f71f30b14c401f191f57c5bce458cfb2c8a68cf24c6a99ee10336d5a12096ed1

Sharing

Copy URL Twitter E-mail

General

Target
f71f30b14c401f191f57c5bce458cfb2c8a68cf24c6a99ee10336d5a12096ed1
Size 5.3MB
Sample260816-btgddaxblh
SHA256 f71f30b14c401f191f57c5bce458cfb2c8a68cf24c6a99ee10336d5a12096ed1
MD5 3467b2b4b7b4995a32c1b00e8838b90b
SHA1 14ff3e05b764cd5402a884529428b62a1297368f
SHA512 f218ca43b80ae23f10451acc556cdb787eafa8fd5b25528a93fd2220708ec97ca538937a92c0647a39d5f7802a4fe74c3eaa1d89e134befdb95dccba03b21c76
SSDEEP 98304:wSEQr7Zg4T5ldMYnPXkm0VkmXQ5rs8B6eJUuqs1jhaULtyl1hR:6Qr7Zg4ThyVlXQ5rs8QZuqs+J
TLSH
T1A9469D01B552C0B5E44212B0F92EFBFFD6287E229B2C89DBA3D03D5B79711D12A33656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f71f30b14c401f191f57c5bce458cfb2c8a68cf24c6a99ee10336d5a12096ed1

File Explorer

f71f30b14c401f191f57c5bce458cfb2c8a68cf24c6a99ee10336d5a12096ed1

.exe 5.3MB

f71f30b14c401f191f57c5bce458cfb2c8a68cf24c6a99ee10336d5a12096ed1

IMPHASH e263a982534f95d6ba956bd04140313e
SHA256 f71f30b14c401f191f57c5bce458cfb2c8a68cf24c6a99ee10336d5a12096ed1
MD5 3467b2b4b7b4995a32c1b00e8838b90b
SHA1 14ff3e05b764cd5402a884529428b62a1297368f
SHA512 f218ca43b80ae23f10451acc556cdb787eafa8fd5b25528a93fd2220708ec97ca538937a92c0647a39d5f7802a4fe74c3eaa1d89e134befdb95dccba03b21c76
SSDEEP 98304:wSEQr7Zg4T5ldMYnPXkm0VkmXQ5rs8B6eJUuqs1jhaULtyl1hR:6Qr7Zg4ThyVlXQ5rs8QZuqs+J
TLSH
T1A9469D01B552C0B5E44212B0F92EFBFFD6287E229B2C89DBA3D03D5B79711D12A33656
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3541715

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\projects\client\ClientBase\bin\Win32\gameportablecs.pdb

kernel32

CreateSemaphoreA ReleaseSemaphore OutputDebugStringA MapViewOfFile CreateFileMappingA VerSetConditionMask VerifyVersionInfoW MultiByteToWideChar WideCharToMultiByte SetLastError GlobalAlloc GlobalFree GetProcAddress GlobalLock GetCurrentProcessId GlobalUnlock MulDiv GlobalSize GetModuleHandleA SizeofResource LoadResource FindResourceW GetACP VirtualProtect VirtualFree GetCurrentProcess VirtualAlloc FlushInstructionCache OutputDebugStringW LoadLibraryW FreeLibrary GetVolumeInformationW GetDiskFreeSpaceW GetLogicalDriveStringsW GetDriveTypeW GetLocalTime GetFileSizeEx Sleep LoadLibraryA WriteFile GetTickCount64 ExpandEnvironmentStringsW ReadFile SetFilePointer QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW WaitForSingleObjectEx GetExitCodeThread GetStringTypeW WakeConditionVariable WakeAllConditionVariable GetLocaleInfoEx FindFirstFileExW WaitForSingleObject GetFileAttributesExW UnmapViewOfFile GetFileInformationByHandleEx InitializeCriticalSectionEx GetSystemTimeAsFileTime CompareStringEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle GetFileType GetModuleHandleExW WriteConsoleW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess HeapReAlloc HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW GetTimeZoneInformation IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize SetEndOfFile CopyFileW GetFileAttributesW FindClose RemoveDirectoryW FindNextFileW FindFirstFileW CreateDirectoryW GetModuleHandleW GetModuleFileNameW GetTickCount DeleteFileW CreateFileW GetTempPathW CloseHandle GetLastError ReleaseMutex GetCurrentThreadId CreateMutexW

user32

EndDialog ScreenToClient CreateWindowExW SetWindowRgn MonitorFromWindow MonitorFromRect GetPropW SetWindowPos IsWindowVisible GetDC GetFocus GetWindowRect CreateIconFromResourceEx GetWindow MonitorFromPoint PostMessageW CallWindowProcW UnregisterHotKey GetSystemMenu DefWindowProcW GetWindowLongW IsClipboardFormatAvailable SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard TranslateMessage DispatchMessageW GetMessageW PeekMessageW DestroyWindow GetKeyNameTextW GetKeyboardLayout MapVirtualKeyExW GetKeyState DrawIconEx GetIconInfo RegisterClassExW DestroyCursor GetDesktopWindow SetActiveWindow InflateRect GetSysColor GetClassInfoExW DestroyIcon UpdateLayeredWindow ValidateRect SetLayeredWindowAttributes SetFocus SetPropW GetUpdateRect LoadCursorW SetCapture SetWindowLongW GetClientRect IsZoomed LookupIconIdFromDirectoryEx KillTimer GetParent UpdateWindow ReleaseCapture InvalidateRect ReleaseDC GetCursorPos BeginPaint EndPaint EnableWindow WindowFromPoint IsIconic SetForegroundWindow FindWindowW BringWindowToTop SetWindowTextW GetWindowPlacement TrackPopupMenu GetActiveWindow IsWindow GetCapture SetTimer IsDialogMessageW GetMonitorInfoW ClientToScreen DefDlgProcW SetMenuItemInfoW GetLayeredWindowAttributes SetWindowPlacement GetForegroundWindow AttachThreadInput ShowWindow GetWindowThreadProcessId PostQuitMessage MessageBoxW SetMenuDefaultItem DialogBoxIndirectParamW SetCursor SendMessageW GetSystemMetrics LoadImageW SystemParametersInfoW

shell32

SHBrowseForFolderW SHGetFileInfoW DragFinish DragQueryFileW SHGetKnownFolderPath SHGetPathFromIDListW ord190 SHCreateDirectoryExW SHGetFolderPathW ShellExecuteW SHOpenFolderAndSelectItems ord155

ole32

RegisterDragDrop ReleaseStgMedium OleInitialize CoInitialize RevokeDragDrop CoTaskMemFree CoUninitialize CoCreateInstance CoInitializeEx OleUninitialize

iphlpapi

GetAdaptersAddresses

gdi32

SetViewportOrgEx CreateRoundRectRgn SetWorldTransform BitBlt GetDeviceCaps ExtCreateRegion SelectClipRgn IntersectClipRect SetGraphicsMode GetStockObject CreateFontIndirectW SelectObject CreateDIBSection CreateCompatibleDC DeleteDC GetObjectW DeleteObject

advapi32

RegOpenKeyExW CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW

oleaut32

SysFreeString SysStringLen

imm32

ImmGetOpenStatus ImmAssociateContext ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetOpenStatus

comctl32

ord17 _TrackMouseEvent

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

540KB

Virtual Size

540KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

150KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

814KB

Virtual Size

813KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

167KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f71f30b14c401f191f57c5bce458cfb2c8a68cf24c6a99ee10336d5a12096ed1

kernel32

user32

shell32

ole32

iphlpapi

gdi32

advapi32

oleaut32

imm32

comctl32

generic