QuartetKnights[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

QuartetKnights.exe
Size

17.3MB
MD5

64c7c622e4fe1ced179c856a9e88ae23
SHA1

cd2fb8749d54f43b24ff16909c01e7a07fc4e5fa
SHA256

ea5a77cb9f5d2719a1264443409db726a695d83c32b676791b0eb4c0fd453888
SHA512

1db9017120b9ec29bf77759000b02d912d1dd92e63d32a2ce9f8cfb7ecb98e0bb3e0b811a274f22f443a4faff7ae4213dc98203c892ef73ce639958c12e97d1d
SSDEEP

196608:SB4U9tlbrFzWkkEfRDaxw0dr5lj3pfvPF9lqyAES6pjxLVGXhQ3:SB4hEfRDerl1PF9lrxLOhQ3

Score

1^/10

Malware Config

Signatures

Files

QuartetKnights.exe
.exe windows x64

c1787c1187862c609e054cff0d6d3ba6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

steam_api64

SteamAPI_RestartAppIfNecessary
SteamAPI_UnregisterCallResult
SteamAPI_RegisterCallResult
SteamAPI_RunCallbacks
SteamAPI_Shutdown
SteamAPI_RegisterCallback
SteamAPI_UnregisterCallback
SteamInternal_ContextInit
SteamAPI_GetHSteamUser
SteamAPI_GetHSteamPipe
SteamInternal_CreateInterface
SteamAPI_Init

kernel32

GetPrivateProfileIntA
LoadLibraryA
GetProcAddress
FreeLibrary
SetThreadAffinityMask
GetSystemInfo
GetLogicalProcessorInformation
GetModuleHandleA
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
OutputDebugStringA
ReleaseSRWLockShared
AcquireSRWLockShared
FindFirstFileA
FindNextFileA
FindClose
CreateFileA
GetFileSize
CloseHandle
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
ReadFileEx
MoveFileA
CopyFileA
DeleteFileA
CreateDirectoryA
RemoveDirectoryA
GetFileAttributesA
GetCurrentDirectoryA
lstrlenW
GetLocaleInfoA
IsDBCSLeadByteEx
GetVersionExA
CompareStringA
WideCharToMultiByte
VirtualAlloc
VirtualFree
GetFileSizeEx
CreateEventA
GetOverlappedResult
InitializeCriticalSection
DeleteCriticalSection
TryEnterCriticalSection
SetEvent
WaitForSingleObject
SetThreadPriority
ResumeThread
Sleep
SwitchToThread
GetCurrentThread
InitOnceExecuteOnce
SleepEx
GetCurrentProcess
GetCommandLineA
VerSetConditionMask
VerifyVersionInfoA
CreateThread
CreateProcessA
GetExitCodeProcess
LocalAlloc
GetSystemDirectoryW
GetFileAttributesW
CreateFileW
SetLastError
GetModuleHandleW
LoadLibraryExW
IsDebuggerPresent
VerifyVersionInfoW
WaitForSingleObjectEx
GetCurrentThreadId
GetEnvironmentStringsW
SetPriorityClass
GetProcessAffinityMask
SetThreadIdealProcessor
InitializeCriticalSectionAndSpinCount
GetFileTime
SetFilePointerEx
GetFileAttributesExA
SetFileAttributesA
ResetEvent
VirtualProtect
VirtualQuery
GlobalMemoryStatusEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetBinaryTypeA
GetModuleFileNameA
RtlUnwindEx
RaiseException
GetModuleHandleExA
GetTickCount
LoadLibraryExA
CreateDirectoryW
DeleteFileW
SetEndOfFile
MoveFileW
GetExitCodeThread
ReleaseSemaphore
CreateSemaphoreW
ChangeTimerQueueTimer
CreateTimerQueueTimer
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
GetNumaHighestNodeNumber
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
DuplicateHandle
DecodePointer
EncodePointer
RtlPcToFileHeader
GetLastError
ExitProcess
LocalFree
MultiByteToWideChar
GetPrivateProfileStringW
FormatMessageA
GetUserDefaultUILanguage
HeapAlloc
HeapReAlloc
GetDateFormatW
GetTimeFormatW
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
WritePrivateProfileStringA
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
GetConsoleCP
HeapSize
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetFileAttributesExW
CreatePipe
MoveFileExW
GetFullPathNameW
FindFirstFileExA
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetModuleFileNameW
HeapFree
OutputDebugStringW
GetCommandLineW
GetProcessHeap
SetStdHandle
DeleteTimerQueueTimer
GetVersionExW
GetTempPathW
GetACP
WriteConsoleW
GetFileType
GetStdHandle
GetModuleHandleExW
ExitThread
InterlockedPopEntrySList
InterlockedPushEntrySList
GetThreadPriority
InterlockedFlushSList
LoadLibraryW
UnregisterWaitEx
QueryDepthSList

user32

ReleaseDC
GetDC
GetClientRect
SetWindowPlacement
SetWindowLongW
RegisterRawInputDevices
SetWindowLongPtrW
CreateWindowExW
RegisterClassExW
GetWindowLongPtrW
LoadIconW
GetRawInputData
MessageBoxA
GetKeyboardType
GetKeyboardState
ScreenToClient
CharNextW
DispatchMessageW
LoadCursorW
PostQuitMessage
PeekMessageW
GetKeyState
GetCaretBlinkTime
GetFocus
PostMessageA
GetAsyncKeyState
SendMessageA
SendMessageW
GetDlgItemTextA
GetDlgItem
SetFocus
SetWindowTextA
SetForegroundWindow
DialogBoxParamA
EndDialog
GetWindowPlacement
SetWindowLongA
SetMenu
UpdateWindow
ShowWindow
SetWindowPos
GetSystemMetrics
AdjustWindowRect
GetWindowLongW
DrawMenuBar
EnumDisplaySettingsA
GetMonitorInfoA
MonitorFromWindow
GetKeyboardLayout
ShowCursor
ClipCursor
GetWindowRect
GetForegroundWindow
MapVirtualKeyExA
GetCursorPos
MessageBoxW
TranslateMessage
DefWindowProcW

gdi32

GetStockObject
GetDeviceCaps

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

shell32

SHGetKnownFolderPath

ole32

CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitialize
CoTaskMemFree
CoInitializeEx

oleaut32

VariantClear
SysFreeString
SysAllocString
VariantInit

winmm

timeBeginPeriod
timeGetDevCaps
timeEndPeriod
timeGetTime

dinput8

DirectInput8Create

xinput9_1_0

XInputSetState
XInputGetState

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DReflect

imm32

ImmSetCompositionStringA
ImmAssociateContext
ImmSetConversionStatus
ImmGetCompositionStringW
ImmGetDefaultIMEWnd
ImmGetOpenStatus
ImmGetConversionStatus
ImmIsIME
ImmReleaseContext
ImmGetContext
ImmNotifyIME
ImmGetCandidateListW
ImmGetIMEFileNameA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList

hid

HidD_GetSerialNumberString
HidD_GetProductString
HidD_GetManufacturerString
HidD_SetFeature
HidD_GetFeature
HidD_FreePreparsedData
HidD_GetPreparsedData
HidD_GetHidGuid
HidD_GetAttributes
HidP_GetValueCaps
HidP_GetCaps

Exports

Exports

msgpack_object_equal
msgpack_object_print
msgpack_object_print_buffer
msgpack_pack_object
msgpack_unpack
msgpack_unpack_next
msgpack_unpacker_data
msgpack_unpacker_destroy
msgpack_unpacker_execute
msgpack_unpacker_expand_buffer
msgpack_unpacker_flush_zone
msgpack_unpacker_free
msgpack_unpacker_init
msgpack_unpacker_new
msgpack_unpacker_next
msgpack_unpacker_next_with_size
msgpack_unpacker_release_zone
msgpack_unpacker_reset
msgpack_unpacker_reset_zone
msgpack_version
msgpack_version_major
msgpack_version_minor
msgpack_version_revision
msgpack_vrefbuffer_append_copy
msgpack_vrefbuffer_append_ref
msgpack_vrefbuffer_clear
msgpack_vrefbuffer_destroy
msgpack_vrefbuffer_init
msgpack_vrefbuffer_migrate
msgpack_zone_clear
msgpack_zone_destroy
msgpack_zone_free
msgpack_zone_init
msgpack_zone_is_empty
msgpack_zone_malloc_expand
msgpack_zone_new

Sections

.text
Size: 12.1MB - Virtual size: 12.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 447KB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 516KB - Virtual size: 516KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bind
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c1787c1187862c609e054cff0d6d3ba6

Headers

DLL Characteristics

File Characteristics

Imports

steam_api64

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

winmm

dinput8

xinput9_1_0

d3d11

d3dcompiler_47

imm32

version

setupapi

hid

Exports

Exports

Sections

.text Size: 12.1MB - Virtual size: 12.1MB

.rdata Size: 4.0MB - Virtual size: 4.0MB

.data Size: 447KB - Virtual size: 4.4MB

.pdata Size: 516KB - Virtual size: 516KB

_RDATA Size: 36KB - Virtual size: 35KB

.rsrc Size: 42KB - Virtual size: 42KB

.bind Size: 174KB - Virtual size: 174KB

.text
Size: 12.1MB - Virtual size: 12.1MB

.rdata
Size: 4.0MB - Virtual size: 4.0MB

.data
Size: 447KB - Virtual size: 4.4MB

.pdata
Size: 516KB - Virtual size: 516KB

_RDATA
Size: 36KB - Virtual size: 35KB

.rsrc
Size: 42KB - Virtual size: 42KB

.bind
Size: 174KB - Virtual size: 174KB