e5411eb642adc012de5bec82cd150653f90a78a3dfdccd6c472f60ff96a72570

Sharing

Copy URL

Twitter E-mail

General

Target

e5411eb642adc012de5bec82cd150653f90a78a3dfdccd6c472f60ff96a72570
Size

809KB
MD5

9b2b448e638be0ae3658b3519d0717f2
SHA1

0d5c8a114e22a3e2c06d470e652c46faab02c0fd
SHA256

e5411eb642adc012de5bec82cd150653f90a78a3dfdccd6c472f60ff96a72570
SHA512

689e8ad6a9fbe110a0d0a2c8196f59b513950d9cbb0354e6a81208cf63b993116060406eb557347235274e2c3054bab7abc87f419fd83a4719cbba547bfdb5bb
SSDEEP

12288:oyj67v3h+uANwTOUBXW96qhIxuhOFtLnPMpt2xToBiYeBENyYlczwAPRq0:Rj67h+78W9ixugUp85nwNyYl6Rq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e5411eb642adc012de5bec82cd150653f90a78a3dfdccd6c472f60ff96a72570

Files

e5411eb642adc012de5bec82cd150653f90a78a3dfdccd6c472f60ff96a72570
.exe windows:10 windows x64 arch:x64

a1b5cdfecafbd9738464e9b7984eb725

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

sstext3d.pdb

Imports

advapi32

EventActivityIdControl
RegQueryValueExW
EventUnregister
RegOpenKeyExW
RegSetValueExW
EventSetInformation
RegCreateKeyExW
EventRegister
EventWriteTransfer
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

GlobalUnlock
GlobalLock
MulDiv
GetLastError
ReleaseSRWLockExclusive
OutputDebugStringW
InitOnceComplete
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
GlobalFree
HeapSetInformation
HeapAlloc
GetWindowsDirectoryW
GetProcAddress
CreateMutexExW
GetTimeFormatW
GetCurrentProcessId
GetProcessHeap
GetTickCount
lstrcmpW
IsProcessorFeaturePresent
GetModuleHandleA
LoadLibraryA
OutputDebugStringA
CloseHandle
GetModuleFileNameA
InitOnceBeginInitialize
CreateSemaphoreExW
HeapFree
SetLastError
lstrlenW
ReleaseSemaphore
GetModuleHandleExW
GetPrivateProfileIntW
GetPrivateProfileSectionW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
GetPrivateProfileStringW
FormatMessageW
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryExW

gdi32

GetGlyphOutlineW
GetObjectW
GetCurrentObject
GetOutlineTextMetricsW
DeleteObject
SetTextColor
SetBkColor
CreateFontW
GetDeviceCaps
GetStockObject
ScriptStringFree
ScriptStringAnalyse
ScriptStringGetOrder
CreateFontIndirectW
DeleteDC
CreateDCW
SelectObject
ExcludeClipRect

user32

DialogBoxParamW
GetDlgItem
IntersectRect
GetSystemMetrics
SystemParametersInfoA
SetRectEmpty
PostMessageW
GetMessageW
PostQuitMessage
TranslateMessage
DispatchMessageW
EnumDisplaySettingsW
LoadCursorW
LoadIconW
RegisterClassW
GetClientRect
AdjustWindowRect
CreateWindowExW
SystemParametersInfoW
PeekMessageW
SetTimer
KillTimer
SetCursor
BeginPaint
FillRect
EndPaint
DefWindowProcW
SetWindowPos
UnionRect
ScreenToClient
InvalidateRect
UpdateWindow
SetRect
DrawTextW
MessageBoxW
GetWindowTextW
SendMessageW
CheckDlgButton
SetWindowTextW
CheckRadioButton
EndDialog
LoadStringW
OffsetRect
SetDlgItemTextW
GetDlgItemTextW
IsDlgButtonChecked
SendDlgItemMessageW
EnableWindow

msvcrt

?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_acmdln
__C_specific_handler
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
malloc
free
time
rand
memcpy_s
srand
_vsnwprintf
iswdigit
_atoi64
qsort
calloc
realloc
_finite
_callnewh
acosf
atan2f
cosf
memcpy
memset
sinf
sqrtf

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentProcess
GetStartupInfoW

api-ms-win-core-rtlsupport-l1-2-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

LoadResource
LockResource
SizeofResource
GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetVersionExA

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-com-l1-1-1

CoCreateInstance
CreateStreamOnHGlobal
PropVariantClear
CoUninitialize
CoInitializeEx

api-ms-win-core-processenvironment-l1-2-0

GetCommandLineW

api-ms-win-core-libraryloader-l1-2-2

FindResourceW

api-ms-win-core-heap-l2-1-0

GlobalAlloc

winbrand

BrandingFormatString

comctl32

ord17

comdlg32

ChooseFontW
GetOpenFileNameW
ChooseColorW

d3d9

Direct3DCreate9

glu32

gluTessBeginPolygon
gluTessVertex
gluTessEndContour
gluTessEndPolygon
gluNewTess
gluTessCallback
gluTessNormal
gluTessProperty
gluDeleteTess
gluTessBeginContour

winmm

timeGetTime

Sections

.text
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 584KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a1b5cdfecafbd9738464e9b7984eb725

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-heap-l2-1-0

winbrand

comctl32

comdlg32

d3d9

glu32

winmm

Sections

.text Size: 158KB - Virtual size: 158KB

.rdata Size: 22KB - Virtual size: 22KB

.data Size: 1024B - Virtual size: 22KB

.pdata Size: 5KB - Virtual size: 5KB

.rsrc Size: 37KB - Virtual size: 36KB

.reloc Size: 584KB - Virtual size: 1.9MB

.text
Size: 158KB - Virtual size: 158KB

.rdata
Size: 22KB - Virtual size: 22KB

.data
Size: 1024B - Virtual size: 22KB

.pdata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 37KB - Virtual size: 36KB

.reloc
Size: 584KB - Virtual size: 1.9MB