43b3168804a4357f9c7a75fdcd05c81209b333ba057849a6eb1bfe2a8693db6e

Sharing

Copy URL Twitter E-mail

General

Target
43b3168804a4357f9c7a75fdcd05c81209b333ba057849a6eb1bfe2a8693db6e
Size 4.5MB
Sample261024-d1js7asshs
SHA256 43b3168804a4357f9c7a75fdcd05c81209b333ba057849a6eb1bfe2a8693db6e
MD5 faba4be61297cbda15e44665bbe11e19
SHA1 8aa700342fe1136c4a68c0a673dffbeb6ed0b4cc
SHA512 a2ac8b90e493e3e8f4a24f7bf6822e31e6bba2b8ac14dce3e33da016f7b8b2bc2a4eda16f6c0bb3f10af77f15753f558927f7ba3e932742a889236ea852c90ba
SSDEEP 49152:wmIPVMdoLURI9htgR0+8qstyncYESTY6jTJPcE9W18DgEBIeuh43mNxVDmqJKX5w:wm1d25yn0cY6pPLwGgEB9+JJFmqO
TLSH
T11F26AD207214C1B1E54510F1A87EBFBF5A1D992027758ED3A3E42E6BC9B11C33A7299F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43b3168804a4357f9c7a75fdcd05c81209b333ba057849a6eb1bfe2a8693db6e

File Explorer

43b3168804a4357f9c7a75fdcd05c81209b333ba057849a6eb1bfe2a8693db6e

.exe 4.5MB

43b3168804a4357f9c7a75fdcd05c81209b333ba057849a6eb1bfe2a8693db6e

IMPHASH d1769cc5ebbdfd2b69fa426d78a623d7
SHA256 43b3168804a4357f9c7a75fdcd05c81209b333ba057849a6eb1bfe2a8693db6e
MD5 faba4be61297cbda15e44665bbe11e19
SHA1 8aa700342fe1136c4a68c0a673dffbeb6ed0b4cc
SHA512 a2ac8b90e493e3e8f4a24f7bf6822e31e6bba2b8ac14dce3e33da016f7b8b2bc2a4eda16f6c0bb3f10af77f15753f558927f7ba3e932742a889236ea852c90ba
SSDEEP 49152:wmIPVMdoLURI9htgR0+8qstyncYESTY6jTJPcE9W18DgEBIeuh43mNxVDmqJKX5w:wm1d25yn0cY6pPLwGgEB9+JJFmqO
TLSH
T11F26AD207214C1B1E54510F1A87EBFBF5A1D992027758ED3A3E42E6BC9B11C33A7299F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2397456

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateSemaphoreW ReleaseSemaphore ResetEvent QueryPerformanceFrequency QueryPerformanceCounter WriteFile ReadFile CreateFileW CreateFileA ReadProcessMemory GetCurrentProcessId WriteConsoleW SetEndOfFile HeapQueryInformation HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW SetStdHandle FlushFileBuffers GetTimeZoneInformation HeapReAlloc CreateDirectoryW GetConsoleOutputCP ReadConsoleW GetConsoleMode GetFileAttributesExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle GetModuleFileNameW GetCurrentProcess GetModuleHandleA GetModuleFileNameA FreeLibrary WritePrivateProfileStringA IsProcessorFeaturePresent GetFullPathNameA GetFileAttributesA GetFileType GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RtlUnwind RaiseException SwitchToThread GetProcessHeap GetProcAddress HeapAlloc GetStartupInfoW IsDebuggerPresent InitializeSListHead TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo GetModuleHandleW GetSystemTimeAsFileTime LCMapStringEx DecodePointer EncodePointer LocalFree InitializeCriticalSectionEx GetStringTypeW GetCurrentThreadId TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageA SetFilePointerEx GetFileSizeEx GetLocaleInfoA CompareStringA lstrlenW GlobalLock GlobalUnlock GetSystemDirectoryA MoveFileExA SetFilePointer GetFileSize CreateFileMappingA UnmapViewOfFile MapViewOfFile GlobalAlloc OutputDebugStringA CreateDirectoryA SetLastError GetLastError FindNextFileA FindFirstFileA FindClose MultiByteToWideChar SetFileAttributesA GetTickCount64 GetCommandLineA Module32Next Module32First IsDBCSLeadByteEx CreateToolhelp32Snapshot GetSystemInfo SetThreadPriority Sleep CreateEventA WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CloseHandle CreateThread LoadLibraryA WideCharToMultiByte GetFullPathNameW GetTickCount MoveFileA GetPrivateProfileStringA lstrlenA GlobalFree HeapFree GetCurrentDirectoryA

user32

LoadCursorA SetWindowTextA GetMenu RegisterClassA CharPrevExA CharNextExA ScreenToClient GetWindowLongA SetWindowLongA FindWindowA LoadIconA SystemParametersInfoA TranslateMessage ShowCursor SetCursor DestroyCursor LoadImageA GetWindowRect SetCursorPos ClientToScreen ChangeDisplaySettingsA MonitorFromWindow GetMonitorInfoA GetAsyncKeyState DefWindowProcW CallWindowProcW IsWindowUnicode SetPropW GetPropW RemovePropW SetWindowTextW GetWindowLongW SetWindowLongW GetCapture SetCapture ReleaseCapture GetSystemMetrics IsIconic PeekMessageA GetDC ReleaseDC InvalidateRect FillRect SetRect OffsetRect LoadStringA MessageBoxA DispatchMessageA GetKeyboardLayoutNameA GetKeyboardLayout OpenClipboard CloseClipboard GetClipboardData CharNextW MonitorFromPoint GetCursorPos AdjustWindowRectEx IsZoomed SetWindowPos FlashWindowEx SendMessageA PostQuitMessage GetClientRect UpdateWindow SetFocus MoveWindow ShowWindow DestroyWindow IsWindow CreateWindowExA RegisterClassExA UnregisterClassA DefWindowProcA GetMessageA GetKeyState

gdi32

DeleteObject CreateSolidBrush EnumFontFamiliesExA GetStockObject CreateFontIndirectA GetCharABCWidthsFloatW GetTextExtentPoint32W SelectObject SetBkColor SetTextColor TextOutW CreateCompatibleDC DeleteDC SetBkMode CreateDIBSection TextOutA GetPixel StretchBlt GetTextExtentPoint32A

advapi32

RegSetValueExA CryptReleaseContext CryptAcquireContextA RegCloseKey RegOpenKeyA RegQueryValueExA RegOpenKeyExA CryptGenRandom

ole32

CoUninitialize CoInitialize CoInitializeEx CoCreateInstance

winmm

timeEndPeriod timeBeginPeriod timeGetDevCaps timeGetTime

d3d9

Direct3DCreate9

d3dx9_43

D3DXVec3Normalize D3DXVec3TransformCoord D3DXMatrixRotationZ D3DXMatrixMultiply D3DXMatrixTranslation D3DXMatrixRotationQuaternion D3DXQuaternionRotationAxis D3DXQuaternionMultiply D3DXVec4Transform D3DXMatrixPerspectiveFovRH D3DXMatrixRotationYawPitchRoll D3DXMatrixInverse D3DXMatrixRotationX D3DXMatrixTransformation D3DXVec3TransformNormal D3DXMatrixRotationAxis D3DXVec3Project D3DXMatrixScaling D3DXVec2Normalize D3DXMatrixDeterminant D3DXMatrixLookAtRH D3DXMatrixOrthoRH D3DXMatrixOrthoOffCenterRH D3DXCreateCylinder D3DXCreateSphere D3DXGetFVFVertexSize D3DXIntersectTri D3DXGetImageInfoFromFileInMemory D3DXLoadSurfaceFromSurface D3DXCreateTexture D3DXCreateTextureFromFileInMemoryEx D3DXPlaneNormalize D3DXQuaternionRotationYawPitchRoll D3DXVec3Transform D3DXMatrixTranspose D3DXCreateMatrixStack

python27

PyEval_EvalCode Py_FlushLine Py_CompileStringFlags Py_SetProgramName PyRun_StringFlags Py_Finalize Py_Initialize PyErr_Fetch PyNumber_Check PyObject_CallObject PyErr_BadArgument Py_BuildValue PyModule_AddIntConstant Py_InitModule4 PyTuple_Size PyLong_AsLong PyTuple_GetItem PyDict_GetItemString PyList_New PyList_Append PyDict_New PyDict_SetItemString PyErr_Format PyExc_ValueError PyInt_FromLong PyTuple_New PyTuple_SetItem PyList_Size PyDict_SetItem PyInt_AsLong PyLong_FromLongLong PyDict_Next PyDict_Size PyErr_Occurred PyArg_ParseTuple _Py_ZeroStruct _Py_TrueStruct PyExc_RuntimeError PyCFunction_NewEx PyModule_GetDict PyErr_SetString PyRun_SimpleStringFlags PyErr_Print PyImport_AddModule _Py_NoneStruct PyBool_FromLong PyString_FromString _PyInt_AsInt PyList_GetItem PyLong_AsUnsignedLongLong PyNumber_Long PyModule_AddStringConstant PyImport_ImportModule PyString_InternFromString PyObject_GetAttrString PyObject_GetAttr PyCallable_Check PyLong_AsLongLong PyFloat_AsDouble PyString_AsString PyErr_Clear

bcrypt

BCryptHashData BCryptCreateHash BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptEncrypt BCryptDecrypt BCryptImportKeyPair BCryptDestroyKey BCryptFinishHash BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptVerifySignature BCryptGetProperty

imm32

ImmGetContext ImmReleaseContext ImmAssociateContext ImmGetCompositionStringW ImmSetCompositionStringW ImmGetCandidateListW ImmGetConversionStatus ImmSetConversionStatus ImmGetOpenStatus ImmNotifyIME ImmIsIME ImmGetIMEFileNameA

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

devil

ilBindImage ilInit ilTexImage ilSetPixels ilSave ilShutDown ilOriginFunc ilEnable ilCopyPixels ilConvertImage ilLoad ilGetInteger ilGenImages ilDeleteImages

mss32

_AIL_stop_3D_sample@4 _AIL_auto_update_3D_position@8 _AIL_3D_sample_volume@4 _AIL_3D_sample_status@4 _AIL_set_3D_sample_loop_count@8 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_file@8 _AIL_end_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_decompress_ASI@24 _AIL_start_3D_sample@4 _AIL_release_3D_sample_handle@4 _AIL_allocate_3D_sample_handle@4 _AIL_sample_volume_pan@12 _AIL_sample_status@4 _AIL_set_sample_loop_count@8 _AIL_set_sample_volume_pan@12 _AIL_end_sample@4 _AIL_resume_sample@4 _AIL_stop_sample@4 _AIL_start_sample@4 _AIL_set_sample_file@12 _AIL_init_sample@4 _AIL_release_sample_handle@4 _AIL_allocate_sample_handle@4 _AIL_last_error@0 _AIL_mem_free_lock@4 _AIL_file_read@8 _AIL_set_file_callbacks@16 _AIL_WAV_info@8 _AIL_decompress_ADPCM@12 _AIL_file_type@8 _AIL_open_digital_driver@16 _AIL_open_stream@12 _AIL_close_digital_driver@4 _AIL_enumerate_3D_providers@12 _AIL_open_3D_provider@4 _AIL_close_3D_provider@4 _AIL_open_3D_listener@4 _AIL_close_3D_listener@4 _AIL_set_3D_position@16 _AIL_set_3D_velocity@20 _AIL_set_3D_orientation@28 _AIL_startup@0 _AIL_shutdown@0 _AIL_set_redist_directory@4 _AIL_close_stream@4 _AIL_start_stream@4 _AIL_pause_stream@8 _AIL_set_stream_volume_levels@12 _AIL_stream_volume_levels@12 _AIL_set_stream_loop_count@8 _AIL_stream_status@4

speedtreert

?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ??0SGeometry@CSpeedTreeRT@@QAE@XZ ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ??3CSpeedTreeRT@@SAXPAX@Z ??2CSpeedTreeRT@@SAPAXI@Z ??1CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetTime@CSpeedTreeRT@@SAXM@Z ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ

dinput8

DirectInput8Create

ws2_32

select gethostbyname inet_addr htons WSACleanup WSAStartup __WSAFDIsSet WSAGetLastError connect ioctlsocket getsockopt recv closesocket send socket

ddraw

DirectDrawCreate

libcef

cef_string_multimap_append cef_string_multimap_value cef_string_multimap_key cef_string_map_append cef_string_map_value cef_string_map_key cef_string_map_size cef_string_list_append cef_string_list_value cef_string_multimap_size cef_string_utf8_to_utf16 cef_string_multimap_alloc cef_string_multimap_free cef_log cef_string_ascii_to_utf16 cef_string_utf16_to_utf8 cef_string_utf16_cmp cef_string_utf16_clear cef_string_list_size cef_command_line_get_global cef_string_map_free cef_string_map_alloc cef_browser_host_create_browser cef_v8context_get_current_context cef_api_hash cef_run_message_loop cef_shutdown cef_initialize cef_execute_process cef_string_utf8_clear cef_register_extension cef_string_list_free cef_string_list_alloc cef_string_userfree_utf16_free cef_string_utf16_set

crashrpt1500

ord24 ord27 ord16 ord8 ord30

shell32

SHGetSpecialFolderPathA

oleaut32

VariantClear SysFreeString

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

613KB

Virtual Size

612KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

181KB

Virtual Size

464KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

498KB

Virtual Size

497KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

181KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=44, id=264, version=34123,

count=50, id=259, version=33138,

count=3, id=170, productName=VS2010 build 30319, version=30319,

count=1, id=261, productName=VS2019 v16.2.3 build 27905, version=27905,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=2, id=257, productName=VS2017 v15.9.5 build 27026, version=27026,

count=59, id=261, version=30709,

count=120, id=261, productName=VS2019 v16.9.4 build 29914, version=29914,

count=2, productName=Unmarked objects (old),

count=1, id=262, version=33138,

count=2, id=25, version=9210,

count=212, id=261, version=33138,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=58, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=48, version=9044,

count=7, id=206, productName=VS2012 UPD3 build 60610, version=60610,

count=125, id=207, productName=VS2012 UPD3 build 60610, version=60610,

count=2, id=257, productName=VS2015 [14.0] build 23026, version=23026,

count=1, id=253, version=33808,

count=27, id=259, version=33808,

count=19, id=260, version=33808,

count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=99, id=261, version=33808,

count=48, id=260, version=33138,

count=25, id=257, version=33138,

count=679, id=1, productName=Unmarked objects,

count=325, id=261, version=34123,

count=1, id=256, version=34123,

count=1, id=255, version=34123,

count=1, id=151,

count=1, id=258, version=34123,