playit-0[.]9[.]3-signed[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
playit-0.9.3-signed.exe
Size 8.1MB
Sample260716-v3qsysdz4v
SHA256 65352b89c0cb4e7d2d3a19792d53bb325a4455e3121dd6c19ba89b67dda2f841
MD5 aef534752e3bb54d47e24e55072c28bf
SHA1 206689daec270045342c332180781f8ec9840c3e
SHA512 3830fd5c03dba4913a4ef4bfb9c10f839e04bdd2c4e92067c7bace0b7707a964b9c90f26966fc2c5bc86bc09a1bff9e718b5d51bbdd946b4ac42c144c166360b
SSDEEP 98304:BapOovS/Un0PwGpPRzrkEF1u+aVbrE+zQ:qkr7pZk5EgQ
TLSH
T1AF865B07E3AA60BDC2AEC17497466231FA717CC901347E7F1BD4EB312E25B606B1E619
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
playit-0.9.3-signed.exe

File Explorer

playit-0.9.3-signed.exe

.exe 8.1MB

playit-0.9.3-signed.exe

IMPHASH 5617d2ae4986f292c850e0f0e71f97d9
SHA256 65352b89c0cb4e7d2d3a19792d53bb325a4455e3121dd6c19ba89b67dda2f841
MD5 aef534752e3bb54d47e24e55072c28bf
SHA1 206689daec270045342c332180781f8ec9840c3e
SHA512 3830fd5c03dba4913a4ef4bfb9c10f839e04bdd2c4e92067c7bace0b7707a964b9c90f26966fc2c5bc86bc09a1bff9e718b5d51bbdd946b4ac42c144c166360b
SSDEEP 98304:BapOovS/Un0PwGpPRzrkEF1u+aVbrE+zQ:qkr7pZk5EgQ
TLSH
T1AF865B07E3AA60BDC2AEC17497466231FA717CC901347E7F1BD4EB312E25B606B1E619
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

ncrypt

NCryptFreeObject

advapi32

CryptDestroyKey OpenProcessToken SystemFunction036

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSAIoctl WSAPoll WSARecv WSARecvFrom WSASend WSASendTo WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown socket

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CancelIo CancelIoEx CloseHandle CompareStringOrdinal ConnectNamedPipe CopyFileExW CreateConsoleScreenBuffer CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreateIoCompletionPort CreateMutexA CreateNamedPipeW CreateProcessW CreateSemaphoreW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot DeleteFileW DeviceIoControl DisconnectNamedPipe DuplicateHandle ExitProcess FillConsoleOutputAttribute FillConsoleOutputCharacterA FindClose FindFirstFileW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLargestConsoleWindowSize GetLastError GetLogicalProcessorInformation GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNamedPipeInfo GetNumberOfConsoleInputEvents GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MoveFileExW PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleInputW ReadConsoleW ReadFile ReadFileEx RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW SetConsoleActiveScreenBuffer SetConsoleCtrlHandler SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleScreenBufferSize SetConsoleTextAttribute SetConsoleWindowInfo SetCurrentDirectoryW SetEnvironmentVariableW SetFileAttributesW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SwitchToThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryAcquireSRWLockShared UnmapViewOfFile UnregisterWaitEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WriteConsoleW WriteFile WriteFileEx DeleteCriticalSection EnterCriticalSection GetCurrentThreadId GetTickCount InitializeCriticalSection LeaveCriticalSection RaiseException RtlAddFunctionTable RtlUnwindEx UnhandledExceptionFilter VirtualProtect VirtualQuery

user32

GetForegroundWindow GetKeyboardLayout GetWindowThreadProcessId ToUnicodeEx

userenv

GetUserProfileDirectoryW

ole32

CoInitializeEx CoUninitialize

crypt32

CertAddCertificateContextToStore CertAddEncodedCTLToStore CertAddEncodedCertificateToStore CertCloseStore CertCreateCertificateContext CertDeleteCertificateFromStore CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertOpenStore CertSetCertificateContextProperty CertVerifyTimeValidity CryptAcquireCertificatePrivateKey CryptBinaryToStringA CryptEncodeObjectEx CryptHashCertificate CryptStringToBinaryA PFXExportCertStore PFXImportCertStore

secur32

AcquireCredentialsHandleA FreeCredentialsHandle

shell32

ShellExecuteW

bcrypt

BCryptGenRandom

msvcrt

__dllonexit __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _fmode _fpreset _initterm _lock _onexit _unlock abort atexit calloc exit fmod fmodf fprintf free fwrite malloc signal strncmp vfprintf

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile RtlCaptureContext RtlLookupFunctionEntry RtlNtStatusToDosError RtlVirtualUnwind __C_specific_handler floor memcmp memcpy memmove memset strlen

Name

.text

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

215KB

Virtual Size

215KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

570KB

Virtual Size

570KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

playit-0.9.3-signed.exe

ncrypt

advapi32

ws2_32

kernel32

user32

userenv

ole32

crypt32

secur32

shell32

bcrypt

msvcrt

ntdll

generic