dd9049413cda2d8f92b9ea975236f0d8eebb9cc14a4cbd68a15902bfb8547998

Sharing

Copy URL Twitter E-mail

General

Target
dd9049413cda2d8f92b9ea975236f0d8eebb9cc14a4cbd68a15902bfb8547998
Size 2.7MB
Sample261002-kpgb9atvft
SHA256 dd9049413cda2d8f92b9ea975236f0d8eebb9cc14a4cbd68a15902bfb8547998
MD5 66206a65825e2ddb2c625a2b44c3d725
SHA1 a03c4b4535d170c7bcf23b4d4f6b2a171cadc8b8
SHA512 030c6c4398df20e31eace766bdc06f5622d71722f3fc8d094f359fde84924ffeb620c3570d6e4efe7b10f6141a9f4095241ea7d5305d51a92ec7cbff90b83e8b
SSDEEP 49152:Go1fWr5oZHW+5aM5C0Eg9O9uxuMvA/FnD5fHDZP:h1ea5Al0R9txd0r
TLSH
T15DD5CF52E25642ACDF639538DA829B27E2727CD0073197D727E81E614F979F00FBE281
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dd9049413cda2d8f92b9ea975236f0d8eebb9cc14a4cbd68a15902bfb8547998

File Explorer

dd9049413cda2d8f92b9ea975236f0d8eebb9cc14a4cbd68a15902bfb8547998

.exe 2.7MB

dd9049413cda2d8f92b9ea975236f0d8eebb9cc14a4cbd68a15902bfb8547998

IMPHASH e7e75975a54f7d1e75c5f167e1827b1d
SHA256 dd9049413cda2d8f92b9ea975236f0d8eebb9cc14a4cbd68a15902bfb8547998
MD5 66206a65825e2ddb2c625a2b44c3d725
SHA1 a03c4b4535d170c7bcf23b4d4f6b2a171cadc8b8
SHA512 030c6c4398df20e31eace766bdc06f5622d71722f3fc8d094f359fde84924ffeb620c3570d6e4efe7b10f6141a9f4095241ea7d5305d51a92ec7cbff90b83e8b
SSDEEP 49152:Go1fWr5oZHW+5aM5C0Eg9O9uxuMvA/FnD5fHDZP:h1ea5Al0R9txd0r
TLSH
T15DD5CF52E25642ACDF639538DA829B27E2727CD0073197D727E81E614F979F00FBE281
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

827180

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ridge\Desktop\Nexus\x64\Release\Steam.pdb

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDevice

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

dxgi

CreateDXGIFactory

ntdll

RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RtlCaptureContext RtlInitUnicodeString NtLoadDriver NtUnloadDriver NtQuerySystemInformation RtlAdjustPrivilege RtlVirtualUnwind RtlUnwind

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpQueryOption WinHttpSetTimeouts WinHttpSendRequest WinHttpWriteData WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse

iphlpapi

GetExtendedTcpTable GetAdaptersInfo

ws2_32

inet_ntop ntohs

kernel32

GetFileAttributesA MoveFileExA CreateFileA GetCurrentThread CloseHandle GetNativeSystemInfo GetProcAddress ExitProcess GetCurrentProcessId GlobalMemoryStatusEx CreateProcessA IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent GetUserDefaultUILanguage CreateToolhelp32Snapshot Process32NextW Process32FirstW LocalFree VirtualProtect GetCurrentThreadId QueryPerformanceCounter GetSystemTimePreciseAsFileTime DeviceIoControl CreateFileW LoadLibraryA SetConsoleTitleW VirtualFree VirtualAlloc GetModuleFileNameW GetTempPathW SetWaitableTimer SetPriorityClass CreateWaitableTimerW SetThreadPriority WaitForSingleObject CreateWaitableTimerExW ExpandEnvironmentStringsA Module32FirstW Module32NextW CreateDirectoryW SetErrorMode GetLocalTime SetUnhandledExceptionFilter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency FreeLibrary Sleep SetThreadExecutionState GetModuleHandleW GetTickCount TerminateProcess VirtualQuery GetStartupInfoW GetCommandLineW GetLastError GetModuleHandleExW FreeLibraryAndExitThread GetModuleHandleA GetTimeZoneInformation CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException InitializeSListHead GetSystemTimeAsFileTime GetCPInfo GetStringTypeW WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx GetExitCodeThread WaitForSingleObjectEx SleepConditionVariableSRW ReadConsoleW TryAcquireSRWLockExclusive AcquireSRWLockExclusive GetVolumeInformationA GetEnvironmentVariableA WriteFile ReleaseSRWLockExclusive GetCurrentProcess GetModuleFileNameA DeleteFileW ReadFile IsProcessorFeaturePresent GetTickCount64 GetTempPathA ExitThread GetStdHandle UnhandledExceptionFilter HeapAlloc HeapFree InitializeCriticalSectionAndSpinCount LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW FormatMessageA InitOnceBeginInitialize InitOnceComplete HeapReAlloc IsValidCodePage GetProcessHeap SetStdHandle HeapSize WriteConsoleW EnumSystemLocalesW GetFileType GetACP GetOEMCP GetFileSizeEx SetFilePointerEx MultiByteToWideChar SetEndOfFile FlushFileBuffers GetConsoleOutputCP GetConsoleMode

user32

GetWindowDisplayAffinity EnumDisplayDevicesA SetForegroundWindow GetSystemMetrics GetClientRect TranslateMessage BringWindowToTop GetForegroundWindow AttachThreadInput PeekMessageW DispatchMessageW GetAsyncKeyState ShowWindow SetWindowDisplayAffinity EnumDisplaySettingsW GetWindowLongPtrW SetWindowRgn DefWindowProcW GetWindow IsWindowVisible IsWindow MapWindowPoints MoveWindow EnumWindows SetLayeredWindowAttributes SetFocus FindWindowW GetDesktopWindow CharLowerBuffW IsIconic GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId GetWindowRect GetFocus SetWindowPos SetWindowLongPtrW CreateWindowExW

advapi32

RegCloseKey SetSecurityInfo RegOpenKeyExA GetUserNameA FreeSid SetEntriesInAclW AllocateAndInitializeSid RegQueryValueExW RegOpenKeyExW RegDeleteTreeW RegEnumKeyExW RegOpenKeyW RegCreateKeyW RegSetKeyValueW OpenProcessToken GetTokenInformation RegQueryValueExA

shell32

ShellExecuteA

vmprotectsdk64

VMProtectBeginVirtualization VMProtectBeginMutation VMProtectEnd

crypt32

CertGetCertificateChain CertFreeCertificateContext CryptEncodeObjectEx CertFreeCertificateChain CryptUnprotectData CryptProtectData

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptCreateHash BCryptHashData BCryptCloseAlgorithmProvider

setupapi

SetupDiSetClassInstallParamsW SetupDiGetClassDevsW SetupDiCallClassInstaller SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

winmm

timeEndPeriod timeBeginPeriod

dbghelp

MiniDumpWriteDump

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmAssociateContext ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

Sharing

General

Malware Config

Signatures

File Explorer

dd9049413cda2d8f92b9ea975236f0d8eebb9cc14a4cbd68a15902bfb8547998

dwmapi

d3d11

d3dx11_43

dxgi

ntdll

winhttp

iphlpapi

ws2_32

kernel32

user32

advapi32

shell32

vmprotectsdk64

crypt32

bcrypt

setupapi

winmm

dbghelp

imm32

d3dcompiler_43

generic