DotaRevoice-v0[.]3[.]2-windows-x64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
DotaRevoice-v0.3.2-windows-x64.zip
Size 5.6MB
Sample261027-q4644sdf95
SHA256 7a72bc51d230eeaf139521af664050ce5806b88bd9a8954297bf3b80e7b8dae5
MD5 8231e0229dedd30b72287fa2846eec81
SHA1 5bc59e7f76537f421641c6bab284d9460fb36c01
SHA512 ad6a8e5e070f152a675a79f4c0fb4a46cc758b2a622744ae2a76633ce37473028c107907b9e3325406a14a8f16e63b485b9ddc74dcbd4d18df68fe6bfa4d6262
SSDEEP 98304:6idCWYypOIFr/BiCsVPKgP41kVL/PRAirVuqvfR0/ByagdphpP2sjCZp+O6JtoBf:6eCPykI5/Bls1KgP8a/PfrVlVagddOs0
TLSH
T1874633AD63F5FE1F72C00146B8D04B2A84BA7554A17A8722147EF16EEC736A01923DDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DotaRevoice/DotaRevoice.exe

File Explorer

DotaRevoice-v0.3.2-windows-x64.zip

.zip 5.6MB
DotaRevoice/DotaRevoice.exe

.exe 12.5MB
DotaRevoice/LICENSE

34KB
DotaRevoice/README.md

12KB

DotaRevoice-v0.3.2-windows-x64.zip

SHA256 7a72bc51d230eeaf139521af664050ce5806b88bd9a8954297bf3b80e7b8dae5
MD5 8231e0229dedd30b72287fa2846eec81
SHA1 5bc59e7f76537f421641c6bab284d9460fb36c01
SHA512 ad6a8e5e070f152a675a79f4c0fb4a46cc758b2a622744ae2a76633ce37473028c107907b9e3325406a14a8f16e63b485b9ddc74dcbd4d18df68fe6bfa4d6262
SSDEEP 98304:6idCWYypOIFr/BiCsVPKgP41kVL/PRAirVuqvfR0/ByagdphpP2sjCZp+O6JtoBf:6eCPykI5/Bls1KgP8a/PfrVlVagddOs0
TLSH
T1874633AD63F5FE1F72C00146B8D04B2A84BA7554A17A8722147EF16EEC736A01923DDF
MD5 SHA1 SHA512 SSDEEP TLSH

DotaRevoice/DotaRevoice.exe

IMPHASH 5f91209f8418d7bc6be6465d9a6a488e
SHA256 dab900b5af97c51bdc6677718cdcdffb09bb320f5f73b58b630a7c975f436471
MD5 81289a39d2e7a4b6944ee856978d23a3
SHA1 5631a5e73002d52bcdd40e6cc17059bbdd9af1cd
SHA512 4678520bda51b4de69dc51d1a54bd4cf88ff11a0eae12ca779b56b755166872209d68cddf25056e9a54aa7174c66c5955ec5ed580f6981b9e2d2cd4ac8b3749a
SSDEEP 98304:rmRW1yg5oSj+GPf+sZkVUz91zfIfcjMgTlbA+vM9:rmRW1ygv+qGVA9NfIfgTSp
TLSH
T165D66C11B79A99ACC05AC87093468633AA3174CB0B39B9FF45C455382FAABF05F3C759
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7652672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dota_revoice.pdb

kernel32

GetModuleHandleA Sleep GetModuleFileNameW SetThreadErrorMode GetModuleHandleExW GetFinalPathNameByHandleW GlobalUnlock GlobalAlloc FreeLibrary GetLastError CreateWaitableTimerExW SetWaitableTimer LoadLibraryExW SetEvent GetFileSizeEx FindNextFileW QueryPerformanceFrequency WaitForMultipleObjects FlsSetValue IsThreadAFiber GetModuleHandleW FlsAlloc GlobalSize HeapAlloc HeapFree GetProcessHeap WideCharToMultiByte FlsFree GetFileAttributesW GlobalFree GetConsoleOutputCP LoadLibraryA GetCurrentThreadId GetConsoleMode WriteConsoleW GetEnvironmentVariableW DeleteFileW ReleaseMutex CreateMutexA WaitForSingleObjectEx SwitchToThread MultiByteToWideChar GetCurrentThread FormatMessageW ExitProcess LoadLibraryW CreateEventW LoadLibraryExA FindClose FindFirstFileExW RemoveDirectoryW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW GetExitCodeProcess GetEnvironmentStringsW CreateEventA GetProcAddress WaitForSingleObject RtlVirtualUnwind SetLastError GetSystemTimeAsFileTime GetUserPreferredUILanguages InitializeSListHead lstrlenW GlobalLock SetUnhandledExceptionFilter SetThreadPriority WaitForMultipleObjectsEx CloseHandle CreateProcessW CompareStringOrdinal FreeEnvironmentStringsW GetWindowsDirectoryW GetSystemDirectoryW GetFullPathNameW GetFileInformationByHandleEx GetFileInformationByHandle MoveFileExW SetFileInformationByHandle CreateFileW GetStdHandle GetCurrentProcess DuplicateHandle CopyFileExW HeapReAlloc QueryPerformanceCounter SetFileTime CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext CreateThread GetOverlappedResult ReadFile WriteFileEx SleepEx ReadFileEx GetCurrentProcessId SetHandleInformation

shell32

DragFinish SHCreateItemFromParsingName SHGetKnownFolderPath DragQueryFileW

combase

CoTaskMemFree

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

user32

GetClassNameW GetWindowLongW SetWindowLongW EnableMenuItem GetSystemMenu GetClassInfoExW GetKeyboardState GetMenu ShowWindow AdjustWindowRectEx MsgWaitForMultipleObjectsEx MapVirtualKeyW GetAsyncKeyState GetKeyState GetClipCursor SetCapture RegisterWindowMessageA RegisterRawInputDevices DefWindowProcW RegisterClassExW EnumDisplayMonitors MonitorFromPoint SendMessageW CreateWindowExW GetSystemMetrics SystemParametersInfoA ReleaseCapture GetCursorPos MonitorFromWindow GetMonitorInfoW GetActiveWindow GetWindowPlacement ToUnicodeEx RedrawWindow GetClientRect ClipCursor MapVirtualKeyExW ShowCursor DestroyCursor DestroyIcon GetWindowRect IsProcessDPIAware IsIconic SetWindowDisplayAffinity GetRawInputData SendInput SetForegroundWindow CloseTouchInputHandle GetWindowTextLengthW GetWindowLongPtrW ReleaseDC GetWindowTextW SetWindowTextW DispatchMessageW TranslateMessage PeekMessageW RegisterTouchWindow GetTouchInputInfo TrackMouseEvent CreateIcon RemovePropW CallWindowProcW GetPropW DestroyWindow PostMessageW SetWindowLongPtrW SetPropW CloseClipboard RegisterClipboardFormatW GetDC GetClipboardData SetClipboardData EmptyClipboard IsClipboardFormatAvailable OpenClipboard ValidateRect SetWindowPlacement ChangeDisplaySettingsExW FlashWindowEx SetCursor LoadCursorW GetForegroundWindow SetCursorPos ClientToScreen InvalidateRgn SetWindowPos MonitorFromRect ScreenToClient GetKeyboardLayout CreateIconFromResourceEx

ole32

CoUninitialize CoInitializeEx PropVariantClear OleInitialize RegisterDragDrop RevokeDragDrop CoCreateInstance

opengl32

wglShareLists wglGetProcAddress wglGetCurrentDC wglGetCurrentContext wglMakeCurrent wglCreateContext wglDeleteContext

gdi32

SwapBuffers DescribePixelFormat ChoosePixelFormat CreateRectRgn DeleteObject GetDeviceCaps SetPixelFormat

shlwapi

AssocQueryStringW

advapi32

ImpersonateAnonymousToken RegOpenKeyExW RegCloseKey RevertToSelf RegQueryValueExW SystemFunction036

oleaut32

VariantClear SysAllocStringLen SysFreeString SetErrorInfo GetErrorInfo SafeArrayPutElement SysStringLen SafeArrayCreateVector

uiautomationcore

UiaRaiseAutomationEvent UiaReturnRawElementProvider UiaRaiseAutomationPropertyChangedEvent UiaLookupId UiaHostProviderFromHwnd UiaGetReservedNotSupportedValue

imm32

ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmAssociateContextEx ImmSetCompositionWindow ImmSetCandidateWindow

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

ws2_32

WSAStartup freeaddrinfo WSASocketW listen bind closesocket getaddrinfo WSAGetLastError setsockopt getsockopt ioctlsocket getsockname recv send getpeername WSARecv WSASend connect select WSADuplicateSocketW accept

bcrypt

BCryptGenRandom

ntdll

NtReadFile NtWriteFile NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError

vcruntime140

memset __current_exception __C_specific_handler _CxxThrowException memmove __current_exception_context memcmp __CxxFrameHandler3 memcpy

api-ms-win-crt-math-l1-1-0

round cos sin truncf floor ceil sinf trunc _hypotf log10f pow fmod atan2f cosf __setusermatherr exp2f acosf cbrtf exp2 tan log2 expf floorf ceilf sqrt log exp atan roundf log10 powf

api-ms-win-crt-string-l1-1-0

tolower wcslen strlen

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit strerror __p___argv __p___argc _exit _initterm_e _initterm _wassert terminate _get_initial_narrow_environment _initialize_narrow_environment _crt_atexit _configure_narrow_argv _set_app_type _initialize_onexit_table _seh_filter_exe exit _register_thread_local_exe_atexit_callback _register_onexit_function

api-ms-win-crt-heap-l1-1-0

free _set_new_mode calloc

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode __stdio_common_vfprintf fflush __p__commode __stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale