2ea5561b863f33cf19258c6f97f039425b0530c577c03a6eb4a125f4ed9e0a1f

Sharing

Copy URL Twitter E-mail

General

Target
2ea5561b863f33cf19258c6f97f039425b0530c577c03a6eb4a125f4ed9e0a1f
Size 1.6MB
Sample260710-g1wpjaev9m
SHA256 2ea5561b863f33cf19258c6f97f039425b0530c577c03a6eb4a125f4ed9e0a1f
MD5 9ec2549e1cd57fe445a1aa74f32aef0f
SHA1 5cd402027917537e1de28e26c368bc0f5d61afb2
SHA512 e3871c5b4c789c1b55ed7a9d3f28fb16d729a6ea88f074aa8a5767a86d8ce2f99a39c82729c84322329e0e47f3fe65546aaab89f5e629fa75e9f76c8705b7628
SSDEEP 24576:FUn5YugOHn7adsqjnhMgeiCl7G0nehbGZpbD:FU5dHyDmg27RnWGj
TLSH
T12275E117EA5C00F8E02B917CCAE7C906E672389E03149BCB3A944A591F7BEE45D3D752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ea5561b863f33cf19258c6f97f039425b0530c577c03a6eb4a125f4ed9e0a1f

File Explorer

2ea5561b863f33cf19258c6f97f039425b0530c577c03a6eb4a125f4ed9e0a1f

.exe 1.6MB

2ea5561b863f33cf19258c6f97f039425b0530c577c03a6eb4a125f4ed9e0a1f

IMPHASH 7ca2bd7fb999428959994402c43199ae
SHA256 2ea5561b863f33cf19258c6f97f039425b0530c577c03a6eb4a125f4ed9e0a1f
MD5 9ec2549e1cd57fe445a1aa74f32aef0f
SHA1 5cd402027917537e1de28e26c368bc0f5d61afb2
SHA512 e3871c5b4c789c1b55ed7a9d3f28fb16d729a6ea88f074aa8a5767a86d8ce2f99a39c82729c84322329e0e47f3fe65546aaab89f5e629fa75e9f76c8705b7628
SSDEEP 24576:FUn5YugOHn7adsqjnhMgeiCl7G0nehbGZpbD:FU5dHyDmg27RnWGj
TLSH
T12275E117EA5C00F8E02B917CCAE7C906E672389E03149BCB3A944A591F7BEE45D3D752
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

248884

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\79014\CCCreator\proj\cmake\sln_x64_Release\bin\Release\ttdaemon.pdb

avcodec-61

av_packet_free av_packet_move_ref av_packet_alloc avcodec_get_name avcodec_find_encoder_by_name avcodec_free_context av_packet_unref avcodec_default_get_encode_buffer av_bsf_free av_packet_copy_props av_bsf_alloc av_bsf_receive_packet avcodec_open2 av_bsf_get_by_name av_bsf_init av_new_packet av_bsf_send_packet avcodec_parameters_to_context avcodec_find_decoder_by_name avcodec_alloc_context3

avutil-59

av_hwdevice_ctx_create av_hwframe_ctx_init av_pix_fmt_count_planes av_pix_fmt_desc_get av_frame_free av_frame_ref av_frame_move_ref av_frame_unref av_frame_alloc av_image_copy av_image_fill_pointers av_buffer_create av_frame_copy_props av_rescale av_buffer_unref av_hwframe_ctx_alloc av_buffer_ref av_hwdevice_find_type_by_name av_mallocz av_frame_get_buffer av_freep av_frame_copy av_pix_fmt_get_chroma_sub_sample av_rescale_q

lens

?CreateLensEngine@LensEngineFactory@FRAMEWORK@LENS@@SAPEAVILensEngineInterface@23@XZ ?ReleaseLensEngine@LensEngineFactory@FRAMEWORK@LENS@@SAXPEAVILensEngineInterface@23@@Z

d3d11

D3D11CreateDevice

libvpl

MFXMemory_GetSurfaceForVPPOut MFXQueryAdapters MFXInitEx MFXQueryVersion MFXClose MFXMemory_GetSurfaceForVPP MFXGetPriority MFXSetPriority MFXDisjoinSession MFXMemory_GetSurfaceForEncode MFXQueryAdaptersNumber MFXJoinSession MFXVideoCORE_QueryPlatform MFXVideoCORE_GetHandle MFXVideoDECODE_Query MFXMemory_GetSurfaceForDecode MFXCloneSession MFXInit MFXQueryIMPL MFXVideoCORE_SetFrameAllocator MFXVideoCORE_SyncOperation MFXVideoCORE_SetHandle MFXVideoVPP_GetVPPStat MFXVideoVPP_GetVideoParam MFXVideoVPP_RunFrameVPPAsync MFXVideoVPP_Close MFXVideoVPP_Query MFXVideoVPP_Reset MFXVideoVPP_ProcessFrameAsync MFXVideoVPP_Init MFXVideoVPP_QueryIOSurf MFXDispReleaseImplDescription MFXVideoENCODE_Close MFXVideoENCODE_QueryIOSurf MFXVideoENCODE_GetVideoParam MFXVideoENCODE_Query MFXLoad MFXCreateSession MFXVideoENCODE_EncodeFrameAsync MFXVideoENCODE_Init MFXSetConfigFilterProperty MFXEnumImplementations MFXCreateConfig MFXUnload

kernel32

Sleep GetModuleHandleW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount LocalFree OutputDebugStringW InitOnceBeginInitialize InitOnceComplete IsDebuggerPresent GetModuleHandleExW GetCurrentProcess GetModuleHandleA CreateEventA LoadLibraryExW QueryPerformanceCounter ResetEvent CloseHandle SetEvent CreateEventW WaitForSingleObject LeaveCriticalSection EnterCriticalSection LoadLibraryW WideCharToMultiByte GetVersionExA MultiByteToWideChar LoadLibraryExA SetUnhandledExceptionFilter FreeLibrary DeleteCriticalSection GetProcAddress LoadLibraryA GetLastError InitializeCriticalSectionEx GetModuleFileNameW

user32

RegisterClassExA GetDesktopWindow GetSystemMetrics GetClientRect CreateWindowExA GetDC DestroyWindow DefWindowProcA

ole32

CoUninitialize CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoTaskMemFree CoCreateGuid CoTaskMemAlloc

oleaut32

SysFreeString SysAllocString VariantClear VariantInit

msvcp140

?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z ??1codecvt_base@std@@UEAA@XZ ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ??1facet@locale@std@@MEAA@XZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z _Wcsxfrm ??_7facet@locale@std@@6B@ ??_7codecvt_base@std@@6B@ ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$collate@_W@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xbad_alloc@std@@YAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z _Wcscoll ??_7_Facet_base@std@@6B@ ??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@ _Mtx_init_in_situ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Facet_base@std@@UEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Xbad_function_call@std@@YAXXZ _Cnd_init_in_situ _Cnd_wait _Thrd_id _Thrd_join _Cnd_broadcast _Cnd_destroy_in_situ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ _Query_perf_frequency _Thrd_sleep _Query_perf_counter _Xtime_get_ticks ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_unlock _Mtx_lock _Mtx_destroy_in_situ ?_Throw_C_error@std@@YAXH@Z ??Bid@locale@std@@QEAA_KXZ ?widen@?$ctype@_W@std@@QEBA_WD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

dxva2

DXVA2CreateDirect3DDeviceManager9

d3d9

Direct3DCreate9 Direct3DCreate9Ex

dxgi

CreateDXGIFactory CreateDXGIFactory1

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler strchr strstr wcsrchr memmove memset _CxxThrowException __current_exception __current_exception_context memcpy __std_exception_copy __std_exception_destroy __std_type_info_compare memchr memcmp _purecall

api-ms-win-crt-heap-l1-1-0

realloc malloc _callnewh free _set_new_mode calloc

api-ms-win-crt-stdio-l1-1-0

feof __p__commode _set_fmode __stdio_common_vsnprintf_s __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _wfopen_s fclose fread_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _invalid_parameter_noinfo_noreturn _beginthreadex terminate abort _initialize_onexit_table _register_onexit_function _crt_atexit _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _set_app_type _seh_filter_exe _cexit

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-convert-l1-1-0

wcstombs wcstombs_s

api-ms-win-crt-filesystem-l1-1-0

_wremove

api-ms-win-crt-string-l1-1-0

isspace tolower wcsncpy_s

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

??0ICvAcceleratedOperatorInterface@FRAMEWORK@LENS@@QEAA@AEBV012@@Z ??0ICvAcceleratedOperatorInterface@FRAMEWORK@LENS@@QEAA@XZ ??0ILensAsyncOutputListener@FRAMEWORK@LENS@@QEAA@AEBV012@@Z ??0ILensAsyncOutputListener@FRAMEWORK@LENS@@QEAA@XZ ??0ILensEngineInterface@FRAMEWORK@LENS@@QEAA@AEBV012@@Z ??0ILensEngineInterface@FRAMEWORK@LENS@@QEAA@XZ ??0ILensFlowGraphInterface@FRAMEWORK@LENS@@QEAA@AEBV012@@Z ??0ILensFlowGraphInterface@FRAMEWORK@LENS@@QEAA@XZ ??0IOneKeyGraphInterface@FRAMEWORK@LENS@@QEAA@AEBV012@@Z ??0IOneKeyGraphInterface@FRAMEWORK@LENS@@QEAA@XZ ??0IVendorAlgorithmInterface@FRAMEWORK@LENS@@QEAA@AEBV012@@Z ??0IVendorAlgorithmInterface@FRAMEWORK@LENS@@QEAA@XZ ??1ICvAcceleratedOperatorInterface@FRAMEWORK@LENS@@UEAA@XZ ??1ILensAsyncOutputListener@FRAMEWORK@LENS@@UEAA@XZ ??1ILensEngineInterface@FRAMEWORK@LENS@@UEAA@XZ ??1ILensFlowGraphInterface@FRAMEWORK@LENS@@UEAA@XZ ??1IOneKeyGraphInterface@FRAMEWORK@LENS@@UEAA@XZ ??1IVendorAlgorithmInterface@FRAMEWORK@LENS@@UEAA@XZ ??4ICvAcceleratedOperatorInterface@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??4ILensAsyncOutputListener@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??4ILensEngineInterface@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??4ILensFlowGraphInterface@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??4IOneKeyGraphInterface@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??4IVendorAlgorithmInterface@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??4LensEngineFactory@FRAMEWORK@LENS@@QEAAAEAV012@$$QEAV012@@Z ??4LensEngineFactory@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??4LensUtils@FRAMEWORK@LENS@@QEAAAEAV012@$$QEAV012@@Z ??4LensUtils@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??_7ICvAcceleratedOperatorInterface@FRAMEWORK@LENS@@6B@ ??_7ILensAsyncOutputListener@FRAMEWORK@LENS@@6B@ ??_7ILensEngineInterface@FRAMEWORK@LENS@@6B@ ??_7ILensFlowGraphInterface@FRAMEWORK@LENS@@6B@ ??_7IOneKeyGraphInterface@FRAMEWORK@LENS@@6B@ ??_7IVendorAlgorithmInterface@FRAMEWORK@LENS@@6B@

Name

.text

Size

264KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2ea5561b863f33cf19258c6f97f039425b0530c577c03a6eb4a125f4ed9e0a1f

avcodec-61

avutil-59

lens

d3d11

libvpl

kernel32

user32

ole32

oleaut32

msvcp140

dxva2

d3d9

dxgi

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic