37e97a8ba933101501eaf1a6d624038b4c7a19d137327c1afc596980231a27f9

Sharing

Copy URL Twitter E-mail

General

Target
37e97a8ba933101501eaf1a6d624038b4c7a19d137327c1afc596980231a27f9
Size 421KB
Sample261007-3ma2kaht2p
SHA256 37e97a8ba933101501eaf1a6d624038b4c7a19d137327c1afc596980231a27f9
MD5 b590f0aa29d8c1ee7b51f5d844a8adba
SHA1 efea4ccdb337e1543e2f02f151990b44c31540fe
SHA512 aabf0e085292bf10ba7abd8b606b67c86b304c7ba9086a3b9d540410ce2cc492f0904568517725ea65584fe3c903a3cdab80b61d13237f678ce93f5630622392
SSDEEP 6144:FwMJQ31pyS83caEzjM1pj9BfCBYWysJkJTBAOVr4g:GPiSaca8iBfCBYlsWJTmJ
TLSH
T158946D05FBE405A5E1B7A23CC9F38606E6727C4913618BCF236887991F33BD0A53A765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
37e97a8ba933101501eaf1a6d624038b4c7a19d137327c1afc596980231a27f9

File Explorer

37e97a8ba933101501eaf1a6d624038b4c7a19d137327c1afc596980231a27f9

.dll 421KB

37e97a8ba933101501eaf1a6d624038b4c7a19d137327c1afc596980231a27f9

IMPHASH f79497144af22b654caa5a49a29165d2
SHA256 37e97a8ba933101501eaf1a6d624038b4c7a19d137327c1afc596980231a27f9
MD5 b590f0aa29d8c1ee7b51f5d844a8adba
SHA1 efea4ccdb337e1543e2f02f151990b44c31540fe
SHA512 aabf0e085292bf10ba7abd8b606b67c86b304c7ba9086a3b9d540410ce2cc492f0904568517725ea65584fe3c903a3cdab80b61d13237f678ce93f5630622392
SSDEEP 6144:FwMJQ31pyS83caEzjM1pj9BfCBYWysJkJTBAOVr4g:GPiSaca8iBfCBYlsWJTmJ
TLSH
T158946D05FBE405A5E1B7A23CC9F38606E6727C4913618BCF236887991F33BD0A53A765
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\DragonBallOnline\DragonBallOnlineSource\lib\thirdpartylib\x64\DBOReleaseWithDebugInfo\BugTrapU.pdb

ws2_32

gethostname WSAStartup inet_ntop closesocket shutdown WSAGetOverlappedResult WSASend WSAEnumNetworkEvents connect WSAEventSelect WSASocketW htons inet_pton WSAGetLastError setsockopt WSACleanup freeaddrinfo getaddrinfo

comctl32

ImageList_Destroy InitCommonControlsEx ImageList_LoadImageW

shlwapi

PathRemoveExtensionW PathAddExtensionW PathFindNextComponentW UrlIsW PathCreateFromUrlW PathIsRelativeW PathSkipRootW PathIsRootW StrTrimW PathAppendW PathRemoveBackslashW PathRemoveFileSpecW StrTrimA PathIsURLW PathCombineW PathFindFileNameW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

wininet

InternetWriteFile HttpSendRequestExW HttpOpenRequestW HttpEndRequestW InternetCloseHandle InternetSetStatusCallbackW InternetOpenW InternetCrackUrlW InternetAttemptConnect InternetGetLastResponseInfoW InternetConnectW

kernel32

IsDebuggerPresent LCMapStringW InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapFree HeapAlloc ExitProcess GetModuleFileNameW CreateFileW WriteFile CloseHandle CopyFileW RaiseException FindFirstFileW FindClose FindNextFileW SetEvent WaitForSingleObject MultiByteToWideChar GetStringTypeA SetFilePointer GetFileSize ReadFile MulDiv GetProfileIntW LoadLibraryW GetProcAddress FreeLibrary WideCharToMultiByte GetModuleHandleW GetCurrentProcessId OpenProcess GetLastError DeleteCriticalSection EnterCriticalSection LeaveCriticalSection OutputDebugStringW InitializeCriticalSection QueryPerformanceCounter WriteConsoleW SetEndOfFile GetLocalTime VirtualQuery VirtualProtect GetModuleHandleA FormatMessageW ReadProcessMemory GetCurrentProcess LocalFree GetCurrentThread GetSystemInfo GlobalMemoryStatusEx RtlCaptureContext GetThreadContext GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentThreadId SuspendThread ResumeThread GetDateFormatW GetTimeFormatW SystemTimeToFileTime GetComputerNameW GetCommandLineW GetCurrentDirectoryW GetFileAttributesW DeleteFileW SetUnhandledExceptionFilter CreateProcessW TerminateProcess CreateEventW DisableThreadLibraryCalls GetUserDefaultLangID WaitForMultipleObjects LocalReAlloc ResetEvent GetExitCodeThread GetTempPathW RemoveDirectoryW CreateDirectoryW GetTickCount GetStringTypeW GetWindowsDirectoryW IsDBCSLeadByte IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry ExitThread FreeLibraryAndExitThread GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx InterlockedFlushSList CreateThread SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStartupInfoW EncodePointer RtlPcToFileHeader GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetProcessHeap SetStdHandle FlushFileBuffers HeapSize HeapReAlloc GetStdHandle GetModuleHandleExW

user32

MapWindowPoints BeginDeferWindowPos DeferWindowPos EndDeferWindowPos TabbedTextOutW GetTabbedTextExtentW EnumDisplayDevicesW GetSystemMenu AppendMenuW GetForegroundWindow GetActiveWindow GetWindowThreadProcessId SendMessageTimeoutW GetWindow DrawTextW LoadCursorW CopyIcon GetClassLongPtrW DrawIconEx DestroyIcon GetSysColorBrush IsRectEmpty KillTimer SetTimer PostMessageW DispatchMessageW GetMessageW PostQuitMessage SetWindowPos ScreenToClient IsZoomed CreateDialogParamW LoadIconW MessageBoxW SetForegroundWindow SetWindowLongPtrW GetWindowLongPtrW CheckRadioButton LoadImageW ShowWindow DestroyWindow IsWindowEnabled EnableWindow CreateWindowExW DialogBoxParamW UpdateWindow InvalidateRect LoadStringW GetSystemMetrics GetClientRect GetSysColor SetWindowTextW SendMessageW GetWindowTextLengthW SetCursor SetDlgItemTextW IsWindowVisible SetScrollPos GetDialogBaseUnits IsChild ReleaseCapture GetWindowTextW SetFocus SetCapture GetCapture GetMessagePos GetDlgItem GetParent EndDialog DrawFocusRect DrawEdge GetFocus PtInRect SystemParametersInfoW GetKeyState ReleaseDC GetDC ScrollWindowEx SetScrollInfo GetScrollInfo GetScrollPos DefWindowProcW RedrawWindow EndPaint BeginPaint GetWindowRect FillRect GetDlgCtrlID

gdi32

CreateDCW GetDeviceCaps StretchBlt GetObjectW GetTextExtentPoint32W LineTo MoveToEx CreateFontIndirectW PatBlt GetTextMetricsW TextOutW SetTextColor DeleteDC BitBlt GetClipBox SelectObject SetViewportOrgEx CreateCompatibleDC CreateCompatibleBitmap GetDIBits SetBkColor DeleteObject

comdlg32

GetSaveFileNameW

advapi32

RegEnumKeyExW RegEnumValueW AdjustTokenPrivileges GetTokenInformation OpenProcessToken GetUserNameW RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

ExtractIconExW SHGetSpecialFolderPathW SHGetFileInfoW ShellExecuteW

ole32

StringFromGUID2

oleaut32

SysFreeString GetErrorInfo

BT_AddLogFile BT_AddRegFile BT_AppLogEntry BT_AppLogEntryF BT_AppLogEntryV BT_CallCppFilter BT_CallNetFilter BT_CallSehFilter BT_ClearLog BT_ClearLogFiles BT_CloseLogFile BT_CppFilter BT_DeleteLogFile BT_ExportRegistryKey BT_FlushLogFile BT_GetActivityType BT_GetAppName BT_GetAppVersion BT_GetCustomActivityHandler BT_GetDialogMessage BT_GetDumpType BT_GetExitMode BT_GetFlags BT_GetLogEchoMode BT_GetLogFileEntry BT_GetLogFileName BT_GetLogFilesCount BT_GetLogFlags BT_GetLogLevel BT_GetLogSizeInBytes BT_GetLogSizeInEntries BT_GetMailProfile BT_GetModule BT_GetNotificationEMail BT_GetPostErrHandler BT_GetPreErrHandler BT_GetReportFilePath BT_GetReportFormat BT_GetSupportEMail BT_GetSupportHost BT_GetSupportPort BT_GetSupportURL BT_GetUserMessage BT_InsLogEntry BT_InsLogEntryF BT_InsLogEntryV BT_InstallSehFilter BT_InterceptSUEF BT_MailSnapshot BT_MailSnapshotEx BT_NetFilter BT_OpenLogFile BT_ReadVersionInfo BT_SaveSnapshot BT_SaveSnapshotEx BT_SehFilter BT_SendSnapshot BT_SendSnapshotEx BT_SetActivityType BT_SetAppName BT_SetAppVersion BT_SetCustomActivityHandler BT_SetDialogMessage BT_SetDumpType BT_SetExitMode BT_SetFlags BT_SetLogEchoMode BT_SetLogFlags BT_SetLogLevel BT_SetLogSizeInBytes BT_SetLogSizeInEntries BT_SetMailProfile BT_SetModule BT_SetNotificationEMail BT_SetPostErrHandler BT_SetPreErrHandler BT_SetReportFilePath BT_SetReportFormat BT_SetSupportEMail BT_SetSupportHost BT_SetSupportPort BT_SetSupportServer BT_SetSupportURL BT_SetUserMessage BT_SetUserMessageFromCode BT_UninstallSehFilter

Name

.text

Size

269KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

37e97a8ba933101501eaf1a6d624038b4c7a19d137327c1afc596980231a27f9

ws2_32

comctl32

shlwapi

version

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic