0e513c3be8895bbc1e468a116810e629b108b00fdb36a127c40db89774143d8d

Sharing

Copy URL Twitter E-mail

General

Target
0e513c3be8895bbc1e468a116810e629b108b00fdb36a127c40db89774143d8d
Size 10.3MB
Sample260916-km97jsv1bt
SHA256 0e513c3be8895bbc1e468a116810e629b108b00fdb36a127c40db89774143d8d
MD5 199a3e87012b79cb91fc6d712fa51728
SHA1 75b96eca011ecf93910932b0b7376ad631891146
SHA512 c8fc8f9b068c36d88f7050a9b3073135c2dfb7e947734de5c4bec9cfe93b21af45f3438843e249c8b3aa792e60af9ff2dff0a68d1e91380c24cb7952e49edf01
SSDEEP 196608:lOABs97i+4s7BnynZlRYYAsEXvTwKrsGeCpwu8GXUBpI:BBsA+4inyZlHEXkK4ru8QUs
TLSH
T10DB6D0447B63D5E1E08781304FABC3C86363BEF98DBA474BB9C0279E5EF56801D92985
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e513c3be8895bbc1e468a116810e629b108b00fdb36a127c40db89774143d8d

File Explorer

0e513c3be8895bbc1e468a116810e629b108b00fdb36a127c40db89774143d8d

.exe 10.3MB

0e513c3be8895bbc1e468a116810e629b108b00fdb36a127c40db89774143d8d

IMPHASH cb10b1d9ba8981746a4fefda89f5b8c3
SHA256 0e513c3be8895bbc1e468a116810e629b108b00fdb36a127c40db89774143d8d
MD5 199a3e87012b79cb91fc6d712fa51728
SHA1 75b96eca011ecf93910932b0b7376ad631891146
SHA512 c8fc8f9b068c36d88f7050a9b3073135c2dfb7e947734de5c4bec9cfe93b21af45f3438843e249c8b3aa792e60af9ff2dff0a68d1e91380c24cb7952e49edf01
SSDEEP 196608:lOABs97i+4s7BnynZlRYYAsEXvTwKrsGeCpwu8GXUBpI:BBsA+4inyZlHEXkK4ru8QUs
TLSH
T10DB6D0447B63D5E1E08781304FABC3C86363BEF98DBA474BB9C0279E5EF56801D92985
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16373249

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Work\LoveBeat_Steam\Bin\LoveBeat.pdb

kernel32

SetFilePointer FindFirstFileA CloseHandle WriteFile GetTickCount GetSystemTime GetLocalTime ReadFile CreateFileW FindFirstFileW WideCharToMultiByte CreateMutexW WaitForSingleObject CreateEventA CreateProcessA FindClose CreateFileA FindNextFileW CreateProcessW FindNextFileA

user32

KillTimer FindWindowW SendMessageA GetMessageW DefWindowProcA PeekMessageW TranslateMessage SetWindowsHookExW CharNextExA DefWindowProcW DispatchMessageA UnregisterClassA DispatchMessageW GetWindowLongW FindWindowA SetWindowsHookExA EnumWindows RegisterClassA SetTimer RegisterClassW

gdi32

ResetDCW GetStockObject

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

fmodex

?setVolume@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@M@Z ?setVolume@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z ?isPlaying@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z ?getPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z ?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ ?getLength@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z ?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_CHANNELINDEX@@PAVSound@2@_NPAPAVChannel@2@@Z

steam_api

SteamAPI_GetHSteamUser SteamAPI_Init SteamAPI_UnregisterCallResult

sdkencryptedappticket

SteamEncryptedAppTicket_GetTicketSteamID SteamEncryptedAppTicket_GetUserVariableData SteamEncryptedAppTicket_BIsTicketForApp

ws2_32

WSAStartup WSACleanup WSASocketA

dinput8

DirectInput8Create

winmm

timeGetTime mmioInstallIOProcA mmioOpenA mmioClose mmioAscend mmioDescend mmioAdvance

usp10

ScriptStringAnalyse ScriptGetFontProperties ScriptGetProperties ScriptStringFree ScriptShape

devil

ilShutDown ilInit ilHint ilEnable ilSetInteger

ilu

iluInit

dsound

ord11

msacm32

acmStreamOpen acmStreamSize acmStreamConvert acmStreamUnprepareHeader acmStreamPrepareHeader acmFormatSuggest

imm32

ImmGetContext ImmGetConversionStatus ImmSetConversionStatus

d3dx9_43

D3DXMatrixScaling D3DXMatrixTranslation D3DXMatrixRotationQuaternion D3DXMatrixRotationYawPitchRoll D3DXMatrixLookAtLH

comctl32

ord17

wmvcore

WMCreateReader

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

dbghelp

StackWalk SymSetOptions SymCleanup SymFunctionTableAccess

wininet

InternetReadFile InternetQueryDataAvailable HttpQueryInfoA InternetConnectA HttpOpenRequestA

ole32

CoTaskMemAlloc CreateStreamOnHGlobal CoUninitialize

Name

.text

Size

4.1MB

Virtual Size

10.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

922KB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

824KB

Virtual Size

852KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=51, id=241, version=40116,

count=200, id=243, version=40116,

count=39, id=242, version=40116,

count=15, id=199, version=41118,

count=30, id=259, version=26706,

count=22, id=109, productName=VS2005 build 50727, version=50727,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=156, version=21202,

count=4, id=171, productName=VS2010 build 30319, version=30319,

count=39, id=260, version=26706,

count=4, id=257, productName=VS2017 v15.7.1 build 26428, version=26428,

count=8, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=590, id=1, productName=Unmarked objects,

count=131, id=261, version=26706,

count=2818, id=261, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,