xbox[.]png | Triage

Sharing

Copy URL Twitter E-mail

General

Target

xbox.png
Size

1.1MB
MD5

0af961e8339289ee03094a1c600710b4
SHA1

e0e67d1b5a96f03541e9c42e370f813970f80967
SHA256

7dfe6deae059f635ca42ca76d66305cf44ea6dc8db7bcdbf5a8e637145ae3683
SHA512

4811e0b004fe026a6551ce073b29f7f5ffdfe6b96ab39bbd44d3ac71db6eb0779928f99ece24d8af00cb58a92ad098eae691ee5eeb2aeec107a8ab880224c8ea
SSDEEP

24576:0bJWVXcjbL1upJzpRQbmX4pqu7UgHGgHzfQJm:0beIbmX0XlHPHzQ

Score

N/A

Malware Config

Signatures

Files

xbox.png
.exe windows x86

Password: F0rceone

d0d1e3e35e5acdf1aab19fd6c63660c8

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/11/2020, 00:00

Not After

22/02/2024, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/11/2020, 00:00

Not After

22/02/2024, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:3f:f1:ef:0f:14:4f:98:22:bc:38:03:fe:b7:1b:f5:44:88:a8:2d:6f:2d:49:e4:16:08:65:e5:98:f9:85:75
Signer

Actual PE Digest

04:3f:f1:ef:0f:14:4f:98:22:bc:38:03:fe:b7:1b:f5:44:88:a8:2d:6f:2d:49:e4:16:08:65:e5:98:f9:85:75

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

15/04/2021, 18:13
Valid: true

Chain 1

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

f3:74:4c:3a:46:fd:3a:df:73:07:32:13:73:cb:16:fb:0d:01:2d:62
Signer

Actual PE Digest

f3:74:4c:3a:46:fd:3a:df:73:07:32:13:73:cb:16:fb:0d:01:2d:62

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

15/04/2021, 18:13
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

qbcore

cef_string_multimap_append
cef_string_multimap_value
cef_string_multimap_key
cef_string_multimap_size
cef_string_map_append
cef_string_map_value
cef_string_map_key
cef_string_map_size
cef_string_list_append
cef_string_list_value
cef_string_list_size
cef_v8context_get_current_context
cef_v8value_create_function
cef_v8value_create_array
cef_v8value_create_object
cef_v8value_create_string
cef_v8value_create_date
cef_v8value_create_double
cef_v8value_create_uint
cef_v8value_create_int
cef_v8value_create_null
cef_v8value_create_undefined
cef_process_message_create
cef_urlrequest_create
cef_post_data_element_create
cef_post_data_create
cef_request_create
cef_string_multimap_free
cef_string_multimap_alloc
cef_request_context_create_context
cef_cookie_manager_get_global_manager
cef_command_line_get_global
cef_command_line_create
cef_string_map_free
cef_string_map_alloc
cef_stream_reader_create_for_handler
cef_stream_reader_create_for_data
cef_drag_data_create
cef_stream_writer_create_for_handler
cef_log
cef_browser_host_create_browser
cef_api_hash
cef_end_tracing
cef_begin_tracing
cef_string_list_copy
cef_v8value_create_bool
cef_uriencode
cef_base64encode
cef_get_mime_type
cef_enable_highdpi_support
cef_set_osmodal_loop
cef_quit_message_loop
cef_run_message_loop
cef_shutdown
cef_initialize
cef_execute_process
cef_register_scheme_handler_factory
cef_post_delayed_task
cef_post_task
cef_currently_on
cef_visit_web_plugin_info
cef_string_list_alloc
cef_string_userfree_utf16_free
cef_time_delta
cef_time_now
cef_string_utf16_cmp
cef_time_to_timet
cef_string_list_free
cef_string_ascii_to_utf16
cef_get_current_platform_thread_id
cef_string_utf16_to_utf8
cef_string_utf8_clear
cef_string_utf16_set
cef_string_utf8_to_utf16
cef_string_utf16_clear

opengl32

wglDeleteContext
wglMakeCurrent
glBegin
glBindTexture
glBlendFunc
glClear
glClearColor
glColor3f
glColor4f
glDeleteTextures
glDisable
glDrawArrays
glEnable
glEnd
glGenTextures
glHint
glInterleavedArrays
glLineWidth
glLoadIdentity
glMatrixMode
glOrtho
glPixelStorei
glPopAttrib
glPopMatrix
glPushAttrib
glPushMatrix
glRotatef
glTexEnvf
glTexImage2D
glTexParameteri
glTexSubImage2D
glVertex2f
glVertex2i
glViewport
wglCreateContext

winmm

timeGetTime

advapi32

DuplicateToken
GetAce
GetKernelObjectSecurity
GetLengthSid
GetSecurityDescriptorSacl
SetKernelObjectSecurity
SetTokenInformation
SetSecurityInfo
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction036
RevertToSelf
RegCreateKeyExW
GetSecurityInfo
SetEntriesInAclW
ConvertSidToStringSidW
SetThreadToken
CreateProcessAsUserW
LookupPrivilegeValueW
GetTokenInformation
EqualSid
DuplicateTokenEx
CreateRestrictedToken
CreateWellKnownSid
CopySid
RegOpenKeyExW
RegDisablePredefinedCache
RegCloseKey
OpenProcessToken

gdi32

CombineRgn
SetPixelFormat
CreateRectRgn
DeleteObject
PtInRegion
CreateSolidBrush
CreateFontW
SwapBuffers
SetRectRgn
GetDeviceCaps
ChoosePixelFormat

user32

GetCursorPos
SetCursor
GetClientRect
EndPaint
BeginPaint
ReleaseDC
GetDC
GetSystemMetrics
ReleaseCapture
SetCapture
GetCapture
SetFocus
IsWindow
GetDoubleClickTime
GetMessageTime
TrackMouseEvent
ScreenToClient
GetUserObjectInformationW
ClientToScreen
GetWindowLongW
TranslateAcceleratorW
LoadAcceleratorsW
DestroyWindow
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
RegisterWindowMessageW
SetParent
IsWindowVisible
SetWindowPos
ShowWindow
WindowFromPoint
IsDialogMessageW
GetProcessWindowStation
SetProcessWindowStation
CreateWindowStationW
GetThreadDesktop
CreateDesktopW
CloseWindowStation
CloseDesktop
GetAncestor
GetMonitorInfoW
MonitorFromRect
SetWindowPlacement
GetWindowPlacement
GetKeyState
LoadStringW
EnumChildWindows
SetWindowLongW
IsRectEmpty
AdjustWindowRectEx
SetWindowTextW
RemovePropW
GetPropW
SetPropW
UpdateWindow
SetMenu
EnableWindow
EndDialog
DialogBoxParamW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
CallWindowProcW
SendMessageW
LoadIconW
LoadCursorW
RegisterClipboardFormatW
SetClassLongW

kernel32

GetSystemInfo
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
FlushFileBuffers
GetSystemTimeAsFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
SetEndOfFile
ReadFile
TlsFree
HeapAlloc
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
RtlCaptureStackBackTrace
VirtualQuery
SearchPathW
GetCurrentDirectoryW
lstrlenW
DebugBreak
GetModuleHandleExW
ReadProcessMemory
CreateProcessW
CreateRemoteThread
CreateNamedPipeW
CreateJobObjectW
VirtualFreeEx
VirtualProtectEx
QueryDosDeviceW
GetLongPathNameW
GetFileAttributesW
CreateFileW
UnmapViewOfFile
CreateMutexW
SignalObjectAndWait
VirtualFree
GetProcessHandleCount
ProcessIdToSessionId
GetCurrentProcessId
SetHandleInformation
GetFileType
LoadLibraryW
FreeLibrary
AssignProcessToJobObject
MapViewOfFile
CreateFileMappingW
WriteProcessMemory
GetThreadContext
GetExitCodeProcess
CloseHandle
RegisterWaitForSingleObject
UnregisterWaitEx
Sleep
RaiseException
IsDebuggerPresent
GetModuleFileNameW
OutputDebugStringA
DuplicateHandle
GetUserDefaultLCID
GetUserDefaultLangID
GetTickCount
WriteFile
GetNativeSystemInfo
GetVersionExW
HeapReAlloc
HeapFree
VirtualProtect
LoadLibraryExA
MultiByteToWideChar
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
HeapSize
RtlUnwind
LoadLibraryExW
GetDriveTypeW
GetFullPathNameA
GetConsoleCP
GetConsoleMode
ExitProcess
SetStdHandle
GetProcessHeap
GetStdHandle
GetACP
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
WriteConsoleW
ReadConsoleW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
TlsSetValue
TerminateProcess
SetInformationJobObject
TerminateJobObject
GetCurrentThreadId
CreateThread
CreateEventW
WaitForSingleObject
ResetEvent
SetEvent
InitializeCriticalSection
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
LocalFree
GetCurrentProcess
GetProcAddress
GetModuleHandleA
VirtualQueryEx
VirtualAllocEx
HeapSetInformation
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FormatMessageA
GetCommandLineW
SetLastError
GetLastError
FindResourceW
SizeofResource
LockResource
LoadResource
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte

comdlg32

FindTextW

ole32

RevokeDragDrop
RegisterDragDrop
ReleaseStgMedium
DoDragDrop
CoTaskMemFree
CoTaskMemAlloc

Exports

Exports

CLInfo
GetHandleVerifier
IsSandboxedProcess

Sections

.text
Size: 597KB - Virtual size: 597KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 357KB - Virtual size: 357KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: F0rceone

d0d1e3e35e5acdf1aab19fd6c63660c8

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

04:3f:f1:ef:0f:14:4f:98:22:bc:38:03:fe:b7:1b:f5:44:88:a8:2d:6f:2d:49:e4:16:08:65:e5:98:f9:85:75Signer

Signature Validations

Verification

15/04/2021, 18:13 Valid: true

Chain 1

f3:74:4c:3a:46:fd:3a:df:73:07:32:13:73:cb:16:fb:0d:01:2d:62Signer

Signature Validations

Verification

15/04/2021, 18:13 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

qbcore

opengl32

winmm

advapi32

gdi32

user32

kernel32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 597KB - Virtual size: 597KB

.rdata Size: 165KB - Virtual size: 164KB

.data Size: 5KB - Virtual size: 13KB

.gfids Size: 1024B - Virtual size: 860B

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 357KB - Virtual size: 357KB

.reloc Size: 27KB - Virtual size: 26KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

04:3f:f1:ef:0f:14:4f:98:22:bc:38:03:fe:b7:1b:f5:44:88:a8:2d:6f:2d:49:e4:16:08:65:e5:98:f9:85:75
Signer

15/04/2021, 18:13
Valid: true

f3:74:4c:3a:46:fd:3a:df:73:07:32:13:73:cb:16:fb:0d:01:2d:62
Signer

15/04/2021, 18:13
Valid: false

.text
Size: 597KB - Virtual size: 597KB

.rdata
Size: 165KB - Virtual size: 164KB

.data
Size: 5KB - Virtual size: 13KB

.gfids
Size: 1024B - Virtual size: 860B

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 357KB - Virtual size: 357KB

.reloc
Size: 27KB - Virtual size: 26KB