8305a3bbddeb100474c90d6bd894fef225c6f4a1060fc09ca5a866b35fa7d052

Sharing

Copy URL Twitter E-mail

General

Target
8305a3bbddeb100474c90d6bd894fef225c6f4a1060fc09ca5a866b35fa7d052
Size 955KB
Sample260714-hdb72sh191
SHA256 8305a3bbddeb100474c90d6bd894fef225c6f4a1060fc09ca5a866b35fa7d052
MD5 6a269c0728cf4b84dd764196c21a7073
SHA1 18fb53eccd5373d5e1555ff6406f84e884a007ed
SHA512 6387284e20b7a14d547383af79390f216f3a5a71af9733d1cd3f636f31565fe6abbcf515b14e10047f1da188e6322de1fe45124ba47b184b2540b3c6ed09f9c6
SSDEEP 24576:6UAPYug2nj7ab2Wh+zkiGiAgNe68OzQytCe:6UY1ni2WgztGGQY
TLSH
T11725D117EA5D00B8E16BE13C89E7CD06E672349A03149BCB3B9446590F3BEE45D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8305a3bbddeb100474c90d6bd894fef225c6f4a1060fc09ca5a866b35fa7d052

File Explorer

8305a3bbddeb100474c90d6bd894fef225c6f4a1060fc09ca5a866b35fa7d052

.exe 955KB

8305a3bbddeb100474c90d6bd894fef225c6f4a1060fc09ca5a866b35fa7d052

IMPHASH 7ca2bd7fb999428959994402c43199ae
SHA256 8305a3bbddeb100474c90d6bd894fef225c6f4a1060fc09ca5a866b35fa7d052
MD5 6a269c0728cf4b84dd764196c21a7073
SHA1 18fb53eccd5373d5e1555ff6406f84e884a007ed
SHA512 6387284e20b7a14d547383af79390f216f3a5a71af9733d1cd3f636f31565fe6abbcf515b14e10047f1da188e6322de1fe45124ba47b184b2540b3c6ed09f9c6
SSDEEP 24576:6UAPYug2nj7ab2Wh+zkiGiAgNe68OzQytCe:6UY1ni2WgztGGQY
TLSH
T11725D117EA5D00B8E16BE13C89E7CD06E672349A03149BCB3B9446590F3BEE45D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

248884

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\79014\CCCreator\proj\cmake\sln_x64_Release\bin\Release\ttdaemon.pdb

avcodec-61

av_packet_free av_packet_move_ref av_packet_alloc avcodec_get_name avcodec_find_encoder_by_name avcodec_free_context av_packet_unref avcodec_default_get_encode_buffer av_bsf_free av_packet_copy_props av_bsf_alloc av_bsf_receive_packet avcodec_open2 av_bsf_get_by_name av_bsf_init av_new_packet av_bsf_send_packet avcodec_parameters_to_context avcodec_find_decoder_by_name avcodec_alloc_context3

avutil-59

av_hwdevice_ctx_create av_hwframe_ctx_init av_pix_fmt_count_planes av_pix_fmt_desc_get av_frame_free av_frame_ref av_frame_move_ref av_frame_unref av_frame_alloc av_image_copy av_image_fill_pointers av_buffer_create av_frame_copy_props av_rescale av_buffer_unref av_hwframe_ctx_alloc av_buffer_ref av_hwdevice_find_type_by_name av_mallocz av_frame_get_buffer av_freep av_frame_copy av_pix_fmt_get_chroma_sub_sample av_rescale_q

lens

?CreateLensEngine@LensEngineFactory@FRAMEWORK@LENS@@SAPEAVILensEngineInterface@23@XZ ?ReleaseLensEngine@LensEngineFactory@FRAMEWORK@LENS@@SAXPEAVILensEngineInterface@23@@Z

d3d11

D3D11CreateDevice

libvpl

MFXMemory_GetSurfaceForVPPOut MFXQueryAdapters MFXInitEx MFXQueryVersion MFXClose MFXMemory_GetSurfaceForVPP MFXGetPriority MFXSetPriority MFXDisjoinSession MFXMemory_GetSurfaceForEncode MFXQueryAdaptersNumber MFXJoinSession MFXVideoCORE_QueryPlatform MFXVideoCORE_GetHandle MFXVideoDECODE_Query MFXMemory_GetSurfaceForDecode MFXCloneSession MFXInit MFXQueryIMPL MFXVideoCORE_SetFrameAllocator MFXVideoCORE_SyncOperation MFXVideoCORE_SetHandle MFXVideoVPP_GetVPPStat MFXVideoVPP_GetVideoParam MFXVideoVPP_RunFrameVPPAsync MFXVideoVPP_Close MFXVideoVPP_Query MFXVideoVPP_Reset MFXVideoVPP_ProcessFrameAsync MFXVideoVPP_Init MFXVideoVPP_QueryIOSurf MFXDispReleaseImplDescription MFXVideoENCODE_Close MFXVideoENCODE_QueryIOSurf MFXVideoENCODE_GetVideoParam MFXVideoENCODE_Query MFXLoad MFXCreateSession MFXVideoENCODE_EncodeFrameAsync MFXVideoENCODE_Init MFXSetConfigFilterProperty MFXEnumImplementations MFXCreateConfig MFXUnload

kernel32

Sleep GetModuleHandleW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount LocalFree OutputDebugStringW InitOnceBeginInitialize InitOnceComplete IsDebuggerPresent GetModuleHandleExW GetCurrentProcess GetModuleHandleA CreateEventA LoadLibraryExW QueryPerformanceCounter ResetEvent CloseHandle SetEvent CreateEventW WaitForSingleObject LeaveCriticalSection EnterCriticalSection LoadLibraryW WideCharToMultiByte GetVersionExA MultiByteToWideChar LoadLibraryExA SetUnhandledExceptionFilter FreeLibrary DeleteCriticalSection GetProcAddress LoadLibraryA GetLastError InitializeCriticalSectionEx GetModuleFileNameW

user32

RegisterClassExA GetDesktopWindow GetSystemMetrics GetClientRect CreateWindowExA GetDC DestroyWindow DefWindowProcA

ole32

CoUninitialize CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoTaskMemFree CoCreateGuid CoTaskMemAlloc

oleaut32

SysFreeString SysAllocString VariantClear VariantInit

msvcp140

?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z ??1codecvt_base@std@@UEAA@XZ ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ??1facet@locale@std@@MEAA@XZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z _Wcsxfrm ??_7facet@locale@std@@6B@ ??_7codecvt_base@std@@6B@ ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$collate@_W@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xbad_alloc@std@@YAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z _Wcscoll ??_7_Facet_base@std@@6B@ ??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@ _Mtx_init_in_situ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Facet_base@std@@UEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Xbad_function_call@std@@YAXXZ _Cnd_init_in_situ _Cnd_wait _Thrd_id _Thrd_join _Cnd_broadcast _Cnd_destroy_in_situ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ _Query_perf_frequency _Thrd_sleep _Query_perf_counter _Xtime_get_ticks ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_unlock _Mtx_lock _Mtx_destroy_in_situ ?_Throw_C_error@std@@YAXH@Z ??Bid@locale@std@@QEAA_KXZ ?widen@?$ctype@_W@std@@QEBA_WD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

dxva2

DXVA2CreateDirect3DDeviceManager9

d3d9

Direct3DCreate9 Direct3DCreate9Ex

dxgi

CreateDXGIFactory CreateDXGIFactory1

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler strchr strstr wcsrchr memmove memset _CxxThrowException __current_exception __current_exception_context memcpy __std_exception_copy __std_exception_destroy __std_type_info_compare memchr memcmp _purecall

api-ms-win-crt-heap-l1-1-0

realloc malloc _callnewh free _set_new_mode calloc

api-ms-win-crt-stdio-l1-1-0

feof __p__commode _set_fmode __stdio_common_vsnprintf_s __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _wfopen_s fclose fread_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _invalid_parameter_noinfo_noreturn _beginthreadex terminate abort _initialize_onexit_table _register_onexit_function _crt_atexit _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _set_app_type _seh_filter_exe _cexit

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-convert-l1-1-0

wcstombs wcstombs_s

api-ms-win-crt-filesystem-l1-1-0

_wremove

api-ms-win-crt-string-l1-1-0

isspace tolower wcsncpy_s

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

??0ICvAcceleratedOperatorInterface@FRAMEWORK@LENS@@QEAA@AEBV012@@Z ??0ICvAcceleratedOperatorInterface@FRAMEWORK@LENS@@QEAA@XZ ??0ILensAsyncOutputListener@FRAMEWORK@LENS@@QEAA@AEBV012@@Z ??0ILensAsyncOutputListener@FRAMEWORK@LENS@@QEAA@XZ ??0ILensEngineInterface@FRAMEWORK@LENS@@QEAA@AEBV012@@Z ??0ILensEngineInterface@FRAMEWORK@LENS@@QEAA@XZ ??0ILensFlowGraphInterface@FRAMEWORK@LENS@@QEAA@AEBV012@@Z ??0ILensFlowGraphInterface@FRAMEWORK@LENS@@QEAA@XZ ??0IOneKeyGraphInterface@FRAMEWORK@LENS@@QEAA@AEBV012@@Z ??0IOneKeyGraphInterface@FRAMEWORK@LENS@@QEAA@XZ ??0IVendorAlgorithmInterface@FRAMEWORK@LENS@@QEAA@AEBV012@@Z ??0IVendorAlgorithmInterface@FRAMEWORK@LENS@@QEAA@XZ ??1ICvAcceleratedOperatorInterface@FRAMEWORK@LENS@@UEAA@XZ ??1ILensAsyncOutputListener@FRAMEWORK@LENS@@UEAA@XZ ??1ILensEngineInterface@FRAMEWORK@LENS@@UEAA@XZ ??1ILensFlowGraphInterface@FRAMEWORK@LENS@@UEAA@XZ ??1IOneKeyGraphInterface@FRAMEWORK@LENS@@UEAA@XZ ??1IVendorAlgorithmInterface@FRAMEWORK@LENS@@UEAA@XZ ??4ICvAcceleratedOperatorInterface@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??4ILensAsyncOutputListener@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??4ILensEngineInterface@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??4ILensFlowGraphInterface@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??4IOneKeyGraphInterface@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??4IVendorAlgorithmInterface@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??4LensEngineFactory@FRAMEWORK@LENS@@QEAAAEAV012@$$QEAV012@@Z ??4LensEngineFactory@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??4LensUtils@FRAMEWORK@LENS@@QEAAAEAV012@$$QEAV012@@Z ??4LensUtils@FRAMEWORK@LENS@@QEAAAEAV012@AEBV012@@Z ??_7ICvAcceleratedOperatorInterface@FRAMEWORK@LENS@@6B@ ??_7ILensAsyncOutputListener@FRAMEWORK@LENS@@6B@ ??_7ILensEngineInterface@FRAMEWORK@LENS@@6B@ ??_7ILensFlowGraphInterface@FRAMEWORK@LENS@@6B@ ??_7IOneKeyGraphInterface@FRAMEWORK@LENS@@6B@ ??_7IVendorAlgorithmInterface@FRAMEWORK@LENS@@6B@

Name

.text

Size

264KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

8305a3bbddeb100474c90d6bd894fef225c6f4a1060fc09ca5a866b35fa7d052

avcodec-61

avutil-59

lens

d3d11

libvpl

kernel32

user32

ole32

oleaut32

msvcp140

dxva2

d3d9

dxgi

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic