Static task
static1
Behavioral task
behavioral1
Sample
76c2960fe331b0e141b7ce99944e700ca3dcff81ac6a8d5e23a6db545960e51d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
76c2960fe331b0e141b7ce99944e700ca3dcff81ac6a8d5e23a6db545960e51d.exe
Resource
win10v2004-20221111-en
General
-
Target
76c2960fe331b0e141b7ce99944e700ca3dcff81ac6a8d5e23a6db545960e51d
-
Size
644KB
-
MD5
29744f10f4bff9580a8cd35b2d636420
-
SHA1
a59ef715a74d2bc6f25d0c13422eb3f42d663f7f
-
SHA256
76c2960fe331b0e141b7ce99944e700ca3dcff81ac6a8d5e23a6db545960e51d
-
SHA512
a30609db322a5859cceb68041f7ec79597987404b2cfade5ef073abb452d030aacee6ef292b5159236252b0d61efc38783f3933f11a436095c511fc819ac88af
-
SSDEEP
12288:ODT7JBSLM7EAbmmLM7EAbmXmCm4JK5OVESsPdL:ATvH7vmL7vmXNm4U5dSop
Malware Config
Signatures
Files
-
76c2960fe331b0e141b7ce99944e700ca3dcff81ac6a8d5e23a6db545960e51d.exe windows x86
8a0549b52f0f5e6781cbb3db548a9d25
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
steam_api
SteamAPI_Init
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
kernel32
GlobalMemoryStatus
QueryPerformanceFrequency
QueryPerformanceCounter
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GetModuleFileNameA
CreateDirectoryA
Sleep
InterlockedExchange
GetVersionExA
OutputDebugStringA
ExitProcess
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
SetCurrentDirectoryA
GetLastError
GetModuleHandleA
CreateMutexA
GetCurrentDirectoryA
lstrlenA
GetDiskFreeSpaceExA
MultiByteToWideChar
WideCharToMultiByte
GetStartupInfoA
SetUnhandledExceptionFilter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentProcessId
user32
DispatchMessageA
LoadImageA
MessageBoxA
PeekMessageA
TranslateMessage
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
shell32
SHGetFolderPathA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
VariantClear
VariantInit
msvcp80
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
msvcr80
??0exception@std@@QAE@ABV01@@Z
_vswprintf
wcsncpy
swscanf
memmove_s
fclose
??0exception@std@@QAE@ABQBD@Z
_stat64i32
strcat_s
fopen_s
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
??0exception@std@@QAE@XZ
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
__CxxFrameHandler3
_invoke_watson
_controlfp_s
_crt_debugger_hook
strrchr
sprintf_s
_splitpath
strstr
_stricmp
vsprintf_s
strchr
strncmp
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
strcpy_s
_invalid_parameter_noinfo
??_V@YAXPAX@Z
memmove
??2@YAPAXI@Z
??3@YAXPAX@Z
sprintf
_configthreadlocale
vsprintf
free
_strlwr
wcscpy_s
strncpy
fwrite
memcpy
memset
_except_handler3
_CxxThrowException
fputs
_except_handler4_common
engine_x86
ShowSplashscreen
?GAME_REGISTRY_SUBKEY@@3PADA
DestroyGame
UninitializeGameScript
InitializeGameScriptFn
?Initialize@IGame@@QAEHPADHPAUHICON__@@KK@Z
?OnPaint@IGame@@QAEXXZ
GetEngineDllVersion
HideSplashscreen
CreateGame
?CD_NAME@@3PADA
InitializeGameScript
filesystem_x86
?length@bfile_stdio@fs@@UAEIXZ
??_7bfile_stdio@fs@@6B@
?close@bfile_stdio@fs@@UAEXXZ
?open@bfile_stdio@fs@@UAE_NPBDW4TYPE@EFSMode@@H@Z
?CrashClose@@YAXXZ
?shutdown@fs@@YAXXZ
?add_source@fs@@YA_NPBDH@Z
?init@fs@@YA_NPBDH0_N1@Z
?read@bfile_stdio@fs@@UAEIPAXI@Z
?load_wide_string@fs@@YAPA_WPBD@Z
?root_path@fs@@YA?BV?$string_base@D@ttl@@PBD@Z
gdi32
DeleteObject
gamedll_x86
InitializeGameScriptDLL
ShutdownGameScriptDLL
Sections
.text Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 560KB - Virtual size: 557KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ