ffdda6c4a1e870963079fdce4414688f4236a0cc6fe6887fd2d1ade8fe7623df[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ffdda6c4a1e870963079fdce4414688f4236a0cc6fe6887fd2d1ade8fe7623df.exe
Size 273KB
Sample250127-shavwsvmdk
SHA256 ffdda6c4a1e870963079fdce4414688f4236a0cc6fe6887fd2d1ade8fe7623df
MD5 87239030454d4234745f2de35734c3e5
SHA1 3e9fed71e6cb47c17ef210a604f803dfe713f616
SHA512 c5eaa2f24a753bc91ac3204ce9d986c6f35d6221c9b400e059f432c6cba9dc0dfb3eee40e4710d3b1cce131cf0d7e9fb61e375217404992d834dcc413f6befe6
SSDEEP 6144:5GCocf0Wn8mw2bisZVV3ImwUKyDUbru/S79:c4QmrbLVNIDUKyIvN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffdda6c4a1e870963079fdce4414688f4236a0cc6fe6887fd2d1ade8fe7623df.exe

File Explorer

ffdda6c4a1e870963079fdce4414688f4236a0cc6fe6887fd2d1ade8fe7623df.exe

.dll 273KB

ffdda6c4a1e870963079fdce4414688f4236a0cc6fe6887fd2d1ade8fe7623df.exe

IMPHASH 8d5001d596f5b14c33049c1c26aac41f
SHA256 ffdda6c4a1e870963079fdce4414688f4236a0cc6fe6887fd2d1ade8fe7623df
MD5 87239030454d4234745f2de35734c3e5
SHA1 3e9fed71e6cb47c17ef210a604f803dfe713f616
SHA512 c5eaa2f24a753bc91ac3204ce9d986c6f35d6221c9b400e059f432c6cba9dc0dfb3eee40e4710d3b1cce131cf0d7e9fb61e375217404992d834dcc413f6befe6
SSDEEP 6144:5GCocf0Wn8mw2bisZVV3ImwUKyDUbru/S79:c4QmrbLVNIDUKyIvN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

107352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\DOTC\Desktop\IProtect GameGuard\iProtect DLL - Public\Release\iProtect.pdb

kernel32

CloseHandle GetLastError CreateMutexA Process32First Process32Next CreateToolhelp32Snapshot GetTickCount GetVolumeInformationA GetFileAttributesExA OpenProcess ReadProcessMemory TerminateProcess CompareStringW GetProcessHeap SetEndOfFile CreateFileW SetStdHandle HeapReAlloc GetStringTypeW IsValidLocale EnumSystemLocalesA CreateNamedPipeA GetUserDefaultLCID GetLocaleInfoW GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA LoadLibraryW HeapSize GetTimeZoneInformation FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointer SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc ReadFile WriteFile ConnectNamedPipe CreateFileA GetComputerNameA QueryPerformanceCounter WriteProcessMemory VirtualProtect GetModuleHandleA LoadLibraryA GetProcAddress GetCurrentProcess FreeLibrary CreateThread SetFileAttributesA Sleep IsValidCodePage GetOEMCP GetLocaleInfoA ExitProcess GetACP SetEnvironmentVariableA GetModuleHandleW HeapDestroy HeapCreate IsProcessorFeaturePresent GetStartupInfoW InitializeCriticalSectionAndSpinCount SetHandleCount IsDebuggerPresent InterlockedIncrement InterlockedDecrement WideCharToMultiByte EncodePointer DecodePointer InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar HeapFree GetSystemTimeAsFileTime DeleteFileA HeapAlloc WriteConsoleW GetFileType GetStdHandle GetModuleFileNameW ExitThread ResumeThread GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter

user32

GetClassNameA GetWindowTextA FindWindowA EnumWindows FindWindowExA WindowFromPoint LoadCursorA UpdateWindow SendMessageA BeginPaint GetParent GetWindowThreadProcessId GetWindow EndPaint DestroyWindow RegisterClassExA GetClientRect MessageBoxA SetWindowLongA UnregisterClassA GetWindowLongA CreateWindowExA DefWindowProcA ShowWindow GetSystemMetrics LoadImageA

gdi32

GetStockObject BitBlt DeleteDC DeleteObject SelectObject CreateCompatibleDC GetObjectA

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey GetUserNameA RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

iphlpapi

GetAdaptersInfo

wininet

InternetOpenUrlA InternetReadFile FtpPutFileA InternetOpenA InternetCloseHandle HttpQueryInfoA HttpOpenRequestA HttpSendRequestA FtpGetFileA InternetConnectA