c798ccf0550a5c4563a1043fc293880fb2aadfc98139b0feadc70214d02920a1[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

c798ccf0550a5c4563a1043fc293880fb2aadfc98139b0feadc70214d02920a1.exe
Size

4.6MB
MD5

c061175d296199aa792e96e631ba674f
SHA1

7e08c49c08f11201539fbc55c54f4f41579597f3
SHA256

c798ccf0550a5c4563a1043fc293880fb2aadfc98139b0feadc70214d02920a1
SHA512

9b86fd9b29a5b2b5e186962b3358ab50ebada1540d448c0565a8a17819e98eb001c499b9891b362642b0bcbab726b731c9bfbb9178ea906c243e8ca8be39be74
SSDEEP

49152:J9FV+oNBxTvOjP+leaI7ROSNM9LItKf+Pm9UMIJe7YHLk9z4OGLuFp7HGG0Gevy1:yqvOjPubI7R5G4m9UMIxQGsAd2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c798ccf0550a5c4563a1043fc293880fb2aadfc98139b0feadc70214d02920a1.exe

Files

c798ccf0550a5c4563a1043fc293880fb2aadfc98139b0feadc70214d02920a1.exe
.dll regsvr32 windows:5 windows x86 arch:x86

455b5c76b19bae6f93e0a1ab906958f1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\flashfarm\depot\main\player\FlashPlayer\platform\win32\obj\external\Release_Debugger\authplay.pdb

Imports

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

winmm

waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveOutGetNumDevs
waveOutGetPosition
waveInStop
waveInReset
waveInUnprepareHeader
waveInClose
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
waveOutClose
waveOutReset
timeGetTime
timeSetEvent
timeKillEvent
waveOutGetDevCapsA
waveInGetNumDevs
waveOutOpen
waveInGetDevCapsA

wininet

HttpQueryInfoA

crypt32

CryptVerifyMessageSignature
CryptGetMessageCertificates
CertCreateCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CertCloseStore

rpcrt4

RpcStringFreeA
UuidToStringA

urlmon

CopyStgMedium

kernel32

lstrlenA
GetModuleFileNameA
InitializeCriticalSection
DeleteCriticalSection
GetProcessTimes
GetCurrentProcess
GlobalLock
GlobalUnlock
GetCurrentProcessId
GlobalSize
GlobalAlloc
FreeLibrary
GetSystemDefaultLangID
MoveFileA
DeleteFileA
GetFileAttributesA
VirtualQuery
GetSystemInfo
GetUserDefaultLangID
WriteFile
FindResourceExW
GetFileAttributesW
SetUnhandledExceptionFilter
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
GetACP
CreateDirectoryA
CreateMutexA
GetCurrentDirectoryA
GetTempFileNameA
RaiseException
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
GetFileAttributesExA
SetCurrentDirectoryA
RemoveDirectoryA
SetFilePointerEx
GetFileSizeEx
UnmapViewOfFile
WaitForSingleObject
ReleaseMutex
MapViewOfFile
CreateFileMappingA
CreateEventA
SetEvent
ResetEvent
SetThreadPriority
TerminateThread
lstrcpyA
IsDBCSLeadByteEx
ReleaseSemaphore
WaitForMultipleObjects
CreateSemaphoreA
GetCPInfo
IsDBCSLeadByte
SetThreadAffinityMask
GetCurrentThread
HeapAlloc
GetProcessHeap
HeapFree
VirtualAlloc
VirtualFree
VirtualProtect
GetModuleHandleW
GetCommandLineA
UnhandledExceptionFilter
GetModuleHandleA
GetStdHandle
TlsGetValue
TlsSetValue
TlsFree
SetLastError
HeapReAlloc
HeapCreate
HeapDestroy
lstrlenW
MultiByteToWideChar
CreateProcessA
LCMapStringW
FlushInstructionCache
LCMapStringA
GetTickCount
GetCurrentThreadId
GetLocaleInfoA
SetErrorMode
SizeofResource
CreateThread
ExitThread
ReadFile
LoadLibraryA
GetProcAddress
GetLastError
CreateFileW
CreateFileA
GetFileSize
SetFilePointer
CloseHandle
GetVersionExA
WideCharToMultiByte
FindResourceExA
FindResourceA
LoadResource
LockResource
GlobalFree
LeaveCriticalSection
EnterCriticalSection
TlsAlloc
InterlockedExchange
InterlockedCompareExchange
Sleep
ExitProcess
RtlUnwind
QueryPerformanceFrequency
QueryPerformanceCounter
VirtualProtectEx
TerminateProcess
IsDebuggerPresent
GetOEMCP
IsValidCodePage
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetSystemDirectoryA

user32

MessageBoxA
RedrawWindow
DialogBoxParamW
DialogBoxParamA
DialogBoxIndirectParamW
DialogBoxIndirectParamA
EndDialog
GetParent
GetWindowRect
GetDesktopWindow
SetWindowPos
LoadIconA
GetDlgItem
SendMessageA
GetDC
SetWindowTextA
GetMenuItemCount
GetMenuItemInfoA
WaitForInputIdle
InsertMenuItemW
GetClipboardFormatNameA
RegisterClipboardFormatA
SetFocus
GetWindowInfo
CopyRect
DdeInitializeA
DdeCreateStringHandleA
MapVirtualKeyA
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
SendInput
GetKeyboardLayout
SetTimer
PostMessageA
CreateWindowExA
SetWindowLongA
GetWindowLongA
DefWindowProcA
GetFocus
GetCursorPos
ScreenToClient
GetClientRect
GetForegroundWindow
FillRect
ReleaseDC
GetSystemMetrics
GetKeyState
SystemParametersInfoA
GetMenuItemID
DeleteMenu
ClientToScreen
TrackPopupMenu
LoadStringA
GetSubMenu
DestroyMenu
LoadMenuIndirectA
LoadCursorA
SetCursor
IsWindow
DestroyWindow
PeekMessageA
GetWindowThreadProcessId
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
SetClipboardData
EmptyClipboard
GetDoubleClickTime
TranslateMessage
DispatchMessageA
EnableMenuItem
CheckMenuItem
KillTimer
MsgWaitForMultipleObjects
DdeConnect
WindowFromPoint

gdi32

CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
SetBkColor
GetBkColor
CreateFontIndirectW
SetWorldTransform
SetGraphicsMode
GetWorldTransform
SetTextCharacterExtra
LineTo
MoveToEx
CreatePen
GetClipRgn
SetTextColor
ExtTextOutW
ExtTextOutA
SelectClipRgn
IntersectClipRect
SetTextAlign
SetBkMode
DPtoLP
GetDeviceCaps
GetTextExtentPoint32W
GetCurrentObject
GetTextExtentPoint32A
CreatePalette
LPtoDP
StartDocA
EndDoc
CreateSolidBrush
StrokePath
ExtCreatePen
FillPath
RestoreDC
StretchDIBits
SelectClipPath
SaveDC
StartPage
EndPage
BeginPath
EndPath
SetPolyFillMode
PolyBezierTo
GdiFlush
EnumFontFamiliesA
GetTextMetricsA
CreateFontIndirectA
GetStockObject
SelectObject
CreateDCA
DeleteObject
DeleteDC
GetObjectA
CreateDIBSection
CreateCompatibleDC
GetFontData
EnumFontFamiliesExW
GetICMProfileA

comdlg32

GetOpenFileNameA
CommDlgExtendedError
GetSaveFileNameA
PrintDlgA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHAppBarMessage
SHBrowseForFolderA

ole32

ReleaseStgMedium
CoCreateInstance
CoTaskMemAlloc
CoInitialize
CreateBindCtx
OleUninitialize
OleFlushClipboard
OleIsCurrentClipboard
OleGetClipboard
OleSetClipboard
OleInitialize
CoTaskMemFree
CoUninitialize

oleaut32

LoadTypeLi
SysAllocString
UnRegisterTypeLi
RegisterTypeLi
SysFreeString
LoadRegTypeLi
SysStringLen

ws2_32

closesocket
WSAAsyncSelect
WSAGetLastError
WSAIoctl
socket
WSASocketA
WSAStartup
recv
send
ntohl
WSAEnumNetworkEvents
WSAEventSelect
WSACreateEvent
WSACloseEvent
ioctlsocket
select
gethostname
WSAAddressToStringA
sendto
recvfrom
connect
setsockopt
WSASetLastError
getservbyport
gethostbyaddr
htons
getservbyname
htonl
inet_ntoa
gethostbyname
inet_addr
getsockname
ntohs
bind
WSACleanup

Exports

Exports

DllRegisterServer
DllUnregisterServer
ExternalPlayer_Initialize
FPP_SetCrashLoggerEnabled

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 859KB - Virtual size: 859KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 126KB - Virtual size: 982KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 312KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

455b5c76b19bae6f93e0a1ab906958f1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

winmm

wininet

crypt32

rpcrt4

urlmon

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

ws2_32

Exports

Exports

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 859KB - Virtual size: 859KB

.data Size: 126KB - Virtual size: 982KB

.rodata Size: 1KB - Virtual size: 1KB

.rsrc Size: 312KB - Virtual size: 312KB

.reloc Size: 113KB - Virtual size: 113KB

.text Size: 108KB - Virtual size: 112KB

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 859KB - Virtual size: 859KB

.data
Size: 126KB - Virtual size: 982KB

.rodata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 312KB - Virtual size: 312KB

.reloc
Size: 113KB - Virtual size: 113KB

.text
Size: 108KB - Virtual size: 112KB