fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb

Sharing

Copy URL Twitter E-mail

General

Target
fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb
Size 8.8MB
Sample261102-d4mn9ast6k
SHA256 fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb
MD5 64c941c47d5b03c099bd076b3fd37e27
SHA1 7f6e638cfd3ec08d070eb4fd6e9e9db68585208f
SHA512 3e9903efd519d76890ffaa8a1a80f6565bf98ca320c2a8e90710753f9a759015fdf5616bd4589816dcec60490f8e5268a25b2abcc061638ac4b2b03c4c454a5b
SSDEEP 98304:W+cdPrO+27SVtv4EV+jbVYY8cJ7PCAoCF2t79YZqns:W3rNCSV6EV+jb7XoAmSYs
TLSH
T12096AE1A22AD11C4E1BBC17CCA875A67D7B27C1913709BCF019162AE1F27ED98E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb

File Explorer

fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb

.exe 8.8MB

fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb

IMPHASH bbc1408526286c0c94a5f260862ae4d3
SHA256 fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb
MD5 64c941c47d5b03c099bd076b3fd37e27
SHA1 7f6e638cfd3ec08d070eb4fd6e9e9db68585208f
SHA512 3e9903efd519d76890ffaa8a1a80f6565bf98ca320c2a8e90710753f9a759015fdf5616bd4589816dcec60490f8e5268a25b2abcc061638ac4b2b03c4c454a5b
SSDEEP 98304:W+cdPrO+27SVtv4EV+jbVYY8cJ7PCAoCF2t79YZqns:W3rNCSV6EV+jb7XoAmSYs
TLSH
T12096AE1A22AD11C4E1BBC17CCA875A67D7B27C1913709BCF019162AE1F27ED98E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48721

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\nrd-windows-client-gitlab\work\1131\391013\source\build\x64-windows-static-mt-ninja\RelWithDebInfo\GameViewerLauncher.pdb

advapi32

RegCloseKey CloseServiceHandle OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownW RegCreateKeyExW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW GetNamedSecurityInfoW SetEntriesInAclW RevertToSelf IsValidSid ImpersonateLoggedOnUser GetTokenInformation GetAce FreeSid AllocateAndInitializeSid SystemFunction036 ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RegGetValueA CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource SetNamedSecurityInfoW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

iphlpapi

GetAdaptersInfo

netapi32

NetApiBufferFree NetWkstaGetInfo

oleaut32

SysFreeString VariantClear SysAllocString

ole32

CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeEx CoTaskMemFree CoInitializeSecurity

shell32

SetCurrentProcessExplicitAppUserModelID SHGetKnownFolderPath ShellExecuteW

user32

EnumDisplayDevicesW OpenInputDesktop SetThreadDesktop CloseDesktop GetSystemMetrics GetUserObjectInformationW SendInput GetProcessWindowStation MessageBoxW EnumDisplaySettingsExW PostQuitMessage GetThreadDesktop GetKeyState PostThreadMessageW

kernel32

GetCurrentProcessId CreateProcessW Sleep LoadLibraryExA GetCurrentThreadId WriteFile GetDynamicTimeZoneInformation GetFileAttributesW GetFileAttributesExW GetModuleFileNameW WideCharToMultiByte GetProcessTimes GetCurrentProcess GlobalMemoryStatusEx GetSystemTimeAsFileTime GetSystemDirectoryW FreeLibrary LoadLibraryW GetComputerNameW CloseHandle CreateMutexW CreateFileW ReadFile SetHandleInformation CreatePipe WaitForSingleObject TerminateProcess GetExitCodeProcess ProcessIdToSessionId OpenProcess GetTickCount64 ReadProcessMemory CreateFileMappingW MapViewOfFile UnmapViewOfFile QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcessModules K32GetModuleBaseNameW SetLastError LocalFree FormatMessageW WriteConsoleW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GetUserDefaultLCID GetEnvironmentVariableW GetFileType MultiByteToWideChar RtlVirtualUnwind QueryPerformanceCounter GetModuleHandleExW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW LoadLibraryA FindClose FindFirstFileW FindNextFileW GetProcAddress SystemTimeToFileTime InitializeCriticalSection InitOnceExecuteOnce GetLastError DeleteFileW RemoveDirectoryW QueryPerformanceFrequency VirtualQuery LoadLibraryExW Module32FirstW Module32NextW RtlCaptureStackBackTrace GetCurrentThread RaiseException InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS CreateThread GetThreadId GetModuleHandleA GetModuleFileNameA LockFileEx SetEndOfFile UnlockFileEx SetUnhandledExceptionFilter SetEvent SleepEx CreateEventW GetExitCodeThread FlushInstructionCache GetVersion VirtualAllocEx VirtualProtectEx WriteProcessMemory GetFileSizeEx SetFilePointerEx GetNamedPipeInfo FindFirstFileExW GetFileTime MoveFileExW FormatMessageA DuplicateHandle GetSystemInfo VirtualQueryEx SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW OutputDebugStringW GetLocalTime TryEnterCriticalSection RtlUnwind GetModuleHandleW FlsSetValue FlsFree IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW SetSearchPathMode EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP HeapReAlloc IsValidCodePage GetACP GetOEMCP HeapSize HeapQueryInformation GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionNamesW WTSGetActiveConsoleSessionId GetThreadTimes CreateDirectoryW SetDllDirectoryW CompareStringW LCMapStringW GetLocaleInfoW GetSystemTime IsValidLocale GetStdHandle FlsGetValue FlsAlloc HeapFree HeapAlloc SetConsoleCtrlHandler ExitProcess FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW SetStdHandle InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable GetStringTypeW GetCPInfo CompareStringEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW LCMapStringEx DecodePointer ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW GetDiskFreeSpaceExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileAttributesW SetFileInformationByHandle SetFileTime GetTempPathW AreFileApisANSI DeviceIoControl CreateDirectoryExW CopyFileW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx EncodePointer

crypt32

CryptProtectData CertGetNameStringW CryptHashCertificate CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptUnprotectData

bcrypt

BCryptCloseAlgorithmProvider BCryptGetProperty BCryptGenRandom BCryptCreateHash BCryptDeriveKeyPBKDF2 BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptOpenAlgorithmProvider

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WinVerifyTrust

ws2_32

listen setsockopt bind accept ioctlsocket socket connect getsockname getsockopt ntohs WSASetLastError gethostbyname WSAStartup WSACleanup WSAGetLastError getaddrinfo freeaddrinfo getnameinfo recv send closesocket

rpcrt4

UuidToStringW UuidCreate RpcStringFreeW

Name

.text

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

104KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

292KB

Virtual Size

292KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

323B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

195KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

818KB

Virtual Size

820KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb

advapi32

wtsapi32

iphlpapi

netapi32

oleaut32

ole32

shell32

user32

kernel32

crypt32

bcrypt

wintrust

ws2_32

rpcrt4

generic