d69f606dd3a8ce3d3d12d192aa223dee851b27820082f813c3ea2ac1b3ca8b64

Sharing

Copy URL Twitter E-mail

General

Target
d69f606dd3a8ce3d3d12d192aa223dee851b27820082f813c3ea2ac1b3ca8b64
Size 3.2MB
Sample260707-mdds4afx3w
SHA256 d69f606dd3a8ce3d3d12d192aa223dee851b27820082f813c3ea2ac1b3ca8b64
MD5 123264bd000ee4cb4f2fb19ab98b6e98
SHA1 25de7048b25e1b96db0a54e829ec6b0699ac3dd3
SHA512 0f192c8ab4d3e19cd8af3c8e27aadc7d0391d7d621796dbf81215a0dde4b8c95fad7090716e96584fb9abd65aa2f8499740f06d715bb5d64d42a9858797b3976
SSDEEP 49152:EucOLwtmKhS/hZ+wUKylOdnr1dyF+7OzMwi8sui60KfTTRC4H7zKTiw4Qkm4dhFn:3BTNkQRJ0rr0KfTtCZW5dhF1
TLSH
T14AF59C13F29900D8D05DD179879A9632EAB2BC85073076DF0690B7662F7BEE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d69f606dd3a8ce3d3d12d192aa223dee851b27820082f813c3ea2ac1b3ca8b64

File Explorer

d69f606dd3a8ce3d3d12d192aa223dee851b27820082f813c3ea2ac1b3ca8b64

.exe 3.2MB

d69f606dd3a8ce3d3d12d192aa223dee851b27820082f813c3ea2ac1b3ca8b64

IMPHASH 477bee670d93f2f02e497a4906ffdfd9
SHA256 d69f606dd3a8ce3d3d12d192aa223dee851b27820082f813c3ea2ac1b3ca8b64
MD5 123264bd000ee4cb4f2fb19ab98b6e98
SHA1 25de7048b25e1b96db0a54e829ec6b0699ac3dd3
SHA512 0f192c8ab4d3e19cd8af3c8e27aadc7d0391d7d621796dbf81215a0dde4b8c95fad7090716e96584fb9abd65aa2f8499740f06d715bb5d64d42a9858797b3976
SSDEEP 49152:EucOLwtmKhS/hZ+wUKylOdnr1dyF+7OzMwi8sui60KfTTRC4H7zKTiw4Qkm4dhFn:3BTNkQRJ0rr0KfTtCZW5dhF1
TLSH
T14AF59C13F29900D8D05DD179879A9632EAB2BC85073076DF0690B7662F7BEE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1865440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

WxgameDaemon.exe.pdb

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

shell32

CommandLineToArgvW ord680 SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

user32

AllowSetForegroundWindow AttachThreadInput BringWindowToTop CharUpperW CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EnumWindows GetActiveWindow GetForegroundWindow GetQueueStatus GetWindow GetWindowThreadProcessId IsIconic IsWindowVisible KillTimer MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW SetActiveWindow SetFocus SetForegroundWindow SetTimer SetWindowPos ShowWindow TranslateMessage UnregisterClassW

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CancelIo CloseHandle CompareStringW ConnectNamedPipe CreateDirectoryW CreateEventW CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectA CreateNamedPipeW CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNamedPipeServerProcessId GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LocalFree MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA PostQueuedCompletionStatus Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetHandleInformation SetInformationJobObject SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread SystemTimeToTzSpecificLocalTime TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

ntdll

RtlGetLastNtStatus

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

winmm

timeBeginPeriod timeEndPeriod timeGetTime

shlwapi

PathMatchSpecW

ole32

CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoTaskMemFree CoUninitialize

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

238KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

61KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

140B

Characteristics

Name

.tls

Size

1024B

Virtual Size

537B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

d69f606dd3a8ce3d3d12d192aa223dee851b27820082f813c3ea2ac1b3ca8b64

dbghelp

shell32

user32

kernel32

ntdll

userenv

winmm

shlwapi

ole32

generic