1d71884810c23e6245a197f8377134c9f875fa61e322a6fed35ec95c8a8e73e7

Sharing

Copy URL Twitter E-mail

General

Target
1d71884810c23e6245a197f8377134c9f875fa61e322a6fed35ec95c8a8e73e7
Size 4.8MB
Sample260808-e5771sbg44
SHA256 1d71884810c23e6245a197f8377134c9f875fa61e322a6fed35ec95c8a8e73e7
MD5 bedbd2fa255360a1739f1a51d4fc9727
SHA1 e74305bb7cfcd092e91ac613714cc6b1508d4380
SHA512 e7dfd2bb80257d84e5d76d779a426b68eaeb6848acd94ff9692d58b42483d0a485319871b932a0724701e3af25aedb03a6eb13c8dc4f16acf4eb0b4427ee42e9
SSDEEP 49152:ErDzaEKuGzBs6ly37VYo6VWt8TUg202DNFIOPfkPxSVzMJNa2Y2uVqpyhFqdufVE:1EK31s6I3xYon8gg2v19MJYh
TLSH
T18F36AEC0E9D76E71DE0A08B0253FB76A69301B5843584DF7B3D0DCA98DB93813DA7926
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d71884810c23e6245a197f8377134c9f875fa61e322a6fed35ec95c8a8e73e7

File Explorer

1d71884810c23e6245a197f8377134c9f875fa61e322a6fed35ec95c8a8e73e7

.dll 4.8MB

1d71884810c23e6245a197f8377134c9f875fa61e322a6fed35ec95c8a8e73e7

IMPHASH f0498f2b1a73d6ba52341b1ae21fa844
SHA256 1d71884810c23e6245a197f8377134c9f875fa61e322a6fed35ec95c8a8e73e7
MD5 bedbd2fa255360a1739f1a51d4fc9727
SHA1 e74305bb7cfcd092e91ac613714cc6b1508d4380
SHA512 e7dfd2bb80257d84e5d76d779a426b68eaeb6848acd94ff9692d58b42483d0a485319871b932a0724701e3af25aedb03a6eb13c8dc4f16acf4eb0b4427ee42e9
SSDEEP 49152:ErDzaEKuGzBs6ly37VYo6VWt8TUg202DNFIOPfkPxSVzMJNa2Y2uVqpyhFqdufVE:1EK31s6I3xYon8gg2v19MJYh
TLSH
T18F36AEC0E9D76E71DE0A08B0253FB76A69301B5843584DF7B3D0DCA98DB93813DA7926
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2950576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\VS\foobar2000\foo_input_sacd\Release\foo_input_sacd.pdb

shared

_uPrintfV@12 ?scale@audio_math@@YGXPBMIPAMM@Z _GetInfiniteWaitEvent@0 ??0uCallStackTracker@@QAE@PBD@Z ??1uCallStackTracker@@QAE@XZ _stricmp_utf8_ex@16 _uReplaceStringAdd@32 _uFormatSystemErrorMessage@8 _uBugCheck@0 _uExceptFilterProc@4 _stricmp_utf8_partial@12 _stricmp_utf8@8 _uPrintCrashInfo_OnEvent@8

kernel32

ResetEvent WaitForMultipleObjects GetProcAddress GetModuleHandleW GetThreadPriority SetThreadPriority ResumeThread MulDiv LoadLibraryExW lstrlenW VerifyVersionInfoW VerSetConditionMask WaitForSingleObject GetVersionExW GetTickCount GlobalFree GlobalAlloc GlobalSize WakeConditionVariable InitializeConditionVariable SleepConditionVariableCS CreateEventW QueryPerformanceCounter IsProcessorFeaturePresent GlobalUnlock GlobalLock GetSystemTimeAsFileTime GetCurrentProcessId DisableThreadLibraryCalls InitializeSListHead EncodePointer InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache VirtualAlloc VirtualFree IsDebuggerPresent GetCurrentThread OutputDebugStringW InitializeCriticalSection SetEvent MultiByteToWideChar GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize WakeAllConditionVariable GetCurrentThreadId InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SetLastError HeapFree GetDriveTypeW SetFilePointerEx CloseHandle CreateFileW DeviceIoControl GetLogicalDrives ReadFile AcquireSRWLockShared K32GetModuleInformation ReleaseSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockExclusive GetModuleHandleA GetCurrentProcess LoadLibraryExA InitOnceBeginInitialize InitOnceComplete SleepConditionVariableSRW

user32

GetNextDlgTabItem CallNextHookEx SetWindowsHookExW UnhookWindowsHookEx GetMessagePos IsRectEmpty NotifyWinEvent AdjustWindowRect GetClipboardData FrameRect DrawIconEx DrawFocusRect DrawTextW ClientToScreen GetWindow PtInRect DrawFrameControl GetDlgCtrlID OffsetRect CopyRect GetWindowRect GetMenuBarInfo InflateRect IntersectRect SystemParametersInfoW ReleaseDC GetWindowDC SetWindowPos RegisterWindowMessageW IsWindowEnabled RedrawWindow EndPaint BeginPaint GetClientRect SetLayeredWindowAttributes WindowFromPoint CloseClipboard OpenClipboard InvalidateRgn GetWindowTextW GetWindowTextLengthW SetWindowTextW GetClassNameW GetParent CharLowerW PostMessageW GetSysColor ScrollWindowEx SetScrollPos SetScrollInfo SetGestureConfig MessageBeep CreateDialogParamW DestroyWindow SetDlgItemTextW RegisterClassW GetDlgItemTextW SendDlgItemMessageW LoadCursorW InvalidateRect CloseGestureInfoHandle GetGestureInfo GetScrollInfo GetClassInfoExW RegisterClassExW DrawEdge MapWindowPoints GetIconInfo CreateWindowExW SetRectEmpty GetFocus GetDC SetFocus ScreenToClient GetCursorPos TrackMouseEvent UpdateWindow SetCapture SetTimer ShowWindow GetKeyState GetWindowLongW DefWindowProcW CallWindowProcW SendMessageW EndDialog UnregisterClassW SetWindowLongW GetDlgItem KillTimer SetCursor DialogBoxParamW EnableWindow FillRect GetMenuStringW

gdi32

LineTo MoveToEx SetBkMode GetTextColor GetBkColor OffsetRgn CombineRgn CreateRectRgnIndirect CreatePen CreateCompatibleDC GetTextMetricsW SetDCPenColor SetWindowOrgEx IntersectClipRect GetTextExtentPoint32W CreatePolygonRgn FrameRgn FillRgn CreateCompatibleBitmap SetViewportOrgEx BitBlt CreateRectRgn GetCurrentObject SetDCBrushColor ExtTextOutW SetBkColor GetDeviceCaps RestoreDC SaveDC SetTextColor SelectObject GetStockObject DeleteDC GetObjectW LPtoDP OffsetWindowOrgEx CreateFontIndirectW DeleteObject

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegGetValueW

shell32

ord74

ole32

CoCreateInstance DoDragDrop ReleaseStgMedium RevokeDragDrop RegisterDragDrop CreateStreamOnHGlobal

oleaut32

VariantInit SysAllocString VariantClear

msvcp140

?_Xlength_error@std@@YAXPBD@Z ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Cnd_signal _Thrd_id _Thrd_join _Thrd_hardware_concurrency _Cnd_wait _Cnd_broadcast ?__ExceptionPtrRethrow@@YAXPBX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z ?__ExceptionPtrCopy@@YAXPAXPBX@Z ?__ExceptionPtrAssign@@YAXPAXPBX@Z ?__ExceptionPtrToBool@@YA_NPBX@Z ?__ExceptionPtrDestroy@@YAXPAX@Z ?__ExceptionPtrCreate@@YAXPAX@Z ?_Xout_of_range@std@@YAXPBD@Z _Mtx_unlock _Mtx_lock ?_Xbad_function_call@std@@YAXXZ

comctl32

ord410 ImageList_DrawEx ImageList_GetIconSize ord413

uxtheme

IsThemePartDefined CloseThemeData GetThemePartSize OpenThemeData DrawThemeTextEx DrawThemeBackground SetWindowTheme

msimg32

GradientFill

dwmapi

DwmSetWindowAttribute

oleacc

AccessibleObjectFromWindow LresultFromObject

gdiplus

GdiplusShutdown GdiplusStartup GdipCreatePen1 GdipDeletePen GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipDrawLineI

vcruntime140

memmove memcpy _except_handler3 memcmp strstr __std_terminate _purecall __std_exception_copy __std_exception_destroy __CxxFrameHandler3 _CxxThrowException memset __current_exception __current_exception_context __std_type_info_destroy_list _except_handler4_common

api-ms-win-crt-heap-l1-1-0

_callnewh _aligned_realloc realloc _aligned_malloc calloc _recalloc _expand free _aligned_free malloc

api-ms-win-crt-math-l1-1-0

lround llround round _libm_sse2_pow_precise log2

api-ms-win-crt-convert-l1-1-0

strtol atoi _wtol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf feof __stdio_common_vfwprintf __stdio_common_vswprintf_s _wfopen_s fclose __stdio_common_vswscanf fgetws

api-ms-win-crt-string-l1-1-0

strlen wcsnlen strcmp _wcsnicmp _wcsicmp _strdup wcsncpy_s strncmp strcat_s _stricmp strncpy isdigit isalnum

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table _initterm_e _initterm _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll abort _endthreadex terminate _invalid_parameter_noinfo _controlfp_s _errno _beginthreadex

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-environment-l1-1-0

getenv

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

asmcode

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

IPPCODE

Size

594KB

Virtual Size

593KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

35KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.trace

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.movehcs

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=73, id=205, version=50522,

count=11, id=260, version=35721,

count=30, id=261, version=35721,

count=13, id=259, version=35721,

count=4, id=257, version=35721,

count=3, id=260, version=33145,

count=1, id=262, version=33145,

count=30, id=257, version=33145,

count=1, id=259, version=36248,

count=12, id=260, version=36248,

count=4, id=261, version=36248,

count=3, id=257, version=36248,

count=456, id=1, productName=Unmarked objects,

count=1455, productName=Unmarked objects (old),

count=132, id=265, version=36248,

count=1, id=256, version=36248,

count=1, id=255, version=36248,

count=1, id=151,

count=1, id=258, version=36248,