24479301ec2e61da8a8c26fc6945c6edeb44cd41e8179d2cb470493d061d24b1

Sharing

Copy URL Twitter E-mail

General

Target

24479301ec2e61da8a8c26fc6945c6edeb44cd41e8179d2cb470493d061d24b1
Size

250KB
MD5

806f8000eca21790fdb28bffaaee3940
SHA1

e69baf2a488f7e48246b60dea412fb8e65a222fa
SHA256

24479301ec2e61da8a8c26fc6945c6edeb44cd41e8179d2cb470493d061d24b1
SHA512

8ab5a02d352d4ac5c954a9bc57d5f15ce94100f8a87f79a1946717e370f7cd93680cef37432c72e81a302895858a8c8a7fb7bb2293394bc4835ddf18d20e9a60
SSDEEP

3072:qVTEsuGI+sEXuOLqONpP3dLLkXnRqo6CaFyDcrey2SDADeak7dJHB/AdGE:NsuJOLVv/VQnRqESsQLH5Ad5

Score

N/A

Malware Config

Signatures

Files

24479301ec2e61da8a8c26fc6945c6edeb44cd41e8179d2cb470493d061d24b1
.exe windows x86

9132410be16d4e3edfd08f063c5142b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

??3@YAXPAX@Z
wcscpy_s
??_V@YAXPAX@Z
strrchr
_strlwr
vsprintf
strncpy
fwrite
malloc
?_type_info_dtor_internal_method@type_info@@QAEXXZ
memcpy
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
strcat_s
strcpy_s
vsprintf_s
strstr
free
strncmp
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_splitpath
_stricmp
sprintf
sprintf_s
memset

engine_x86_rwdi

?MountDlc@IGame@@QAEXPBD0@Z
GetEngineDllVersion
ShowSplashscreen
InitializeGameScript
?RunTest@Repl@Net@@YAXXZ
?Initialize@IGame@@QAEHPADHPAUHICON__@@KK@Z
?WaitForPipelineThreads@IGame@@QAEXXZ
DestroyGame
CreateGame
HideSplashscreen
UninitializeGameScript
?OnPaint@IGame@@QAEXXZ

filesystem_x86_rwdi

?_CLog@@YAXIIPBDZZ
?CrashShowMessageBox@@YAX_N@Z
?shutdown@fs@@YAXXZ
?add_source@fs@@YA_NPBDH@Z
?init@fs@@YA_NPBDH0_N1@Z
?CrashClose@@YAXXZ
?load_wide_string@fs@@YAPA_WPBD@Z
?root_path@fs@@YA?BV?$string_base@D@ttl@@PBD@Z
?_CLFilter@@YAII@Z

memdump_x86_rwdi

g_StartupValidator

kernel32

GetCurrentThread
DuplicateHandle
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
QueryPerformanceFrequency
GetVersionExA
GetDiskFreeSpaceExA
GetCurrentDirectoryA
CreateMutexA
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetLastError
CreateDirectoryA
GetCommandLineA
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
lstrlenA
WideCharToMultiByte

user32

TranslateMessage
MessageBoxA
PeekMessageA
DispatchMessageA
LoadImageA

gdi32

DeleteObject

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 213KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9132410be16d4e3edfd08f063c5142b5

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

engine_x86_rwdi

filesystem_x86_rwdi

memdump_x86_rwdi

kernel32

user32

gdi32

advapi32

Sections

.text Size: 27KB - Virtual size: 27KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 1024B - Virtual size: 30KB

.rsrc Size: 213KB - Virtual size: 212KB

.text
Size: 27KB - Virtual size: 27KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 1024B - Virtual size: 30KB

.rsrc
Size: 213KB - Virtual size: 212KB