LEGONINJAGO_DX11[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

LEGONINJAGO_DX11.exe
Size

38.3MB
MD5

4830987383d0f01e37feedfa1cf324b2
SHA1

0f4b495f5e75d1e7fbf8b6e813f79b7e06db0ef9
SHA256

671f6a6e66acc2ef28094277a2d91ae881df58297c29415c8a9e4b9db6367233
SHA512

5c8f0fd44127b3bf51d476ec167e0825332ad9bd2f58c6fbc0feacebc6e2976c7f756447e67a62ef1a64ca5a575f95b99c3f51952ea1181a1a6e7c40a5a56964
SSDEEP

393216:v3R2k/1AsQAP4WrKeOSPZGLtLUN/SoKEtSbDNy+d305WYTpE6TCrmWqXy6/b1j34:owYeHlbfBvm28

Score

1^/10

Malware Config

Signatures

Files

LEGONINJAGO_DX11.exe
.exe windows x64

7c1e5f040153240a88eaf16c45cea1ec

Code Sign

Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

01-09-2009 00:00

Not After

31-12-2037 23:59

Subject

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03-05-2011 07:00

Not After

03-05-2031 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:e6:11:0c:fc:cf:af:76
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

20-09-2017 13:06

Not After

20-09-2020 13:06

Subject

CN=Travellers Tales (UK) Limited,O=Travellers Tales (UK) Limited,L=Knutsford,ST=Cheshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d6:ec:9d:2d:c8:7e:e0:13:28:e2:65:27:f2:e0:52:92:28:fc:ed:e2
Signer

Actual PE Digest

d6:ec:9d:2d:c8:7e:e0:13:28:e2:65:27:f2:e0:52:92:28:fc:ed:e2

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Travellers Tales (UK) Limited,O=Travellers Tales (UK) Limited,L=Knutsford,ST=Cheshire,C=GB

16-11-2017 14:44
Valid: true

Chain 1

CN=Travellers Tales (UK) Limited,O=Travellers Tales (UK) Limited,L=Knutsford,ST=Cheshire,C=GB

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

steam_api64

SteamApps
SteamAPI_Shutdown
SteamRemoteStorage
SteamAPI_RestartAppIfNecessary
SteamAPI_Init
SteamAPI_RunCallbacks
SteamUserStats
SteamFriends
SteamUser
SteamAPI_UnregisterCallback
SteamAPI_RegisterCallback
SteamUtils

advapi32

GetUserNameA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA

dbghelp

StackWalk64
SymCleanup
SymFunctionTableAccess64
SymGetModuleBase64
SymInitialize
MiniDumpWriteDump
SymFromAddr
SymGetLineFromAddr64
SymSetOptions

gdi32

BitBlt
CreateICA
DeleteDC
SelectObject
DeleteObject
CreateCompatibleDC
CreateDIBSection

ole32

CoCreateInstance
CoCreateGuid
CoInitialize
CoSetProxyBlanket
CoUninitialize
CreateStreamOnHGlobal
CoTaskMemFree
CoInitializeEx

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString

shell32

SHGetFolderPathA
SHCreateDirectoryExA

user32

ScreenToClient
GetKeyboardLayoutNameA
GetWindowThreadProcessId
GetMonitorInfoA
EnumDisplayMonitors
GetRawInputDeviceInfoA
MessageBoxA
ShowWindow
SetWindowPos
SetFocus
SetForegroundWindow
AdjustWindowRect
GetWindowLongA
SetWindowLongA
EnumDisplaySettingsA
PostMessageA
GetRawInputDeviceList
GetSystemMetrics
EnumDisplayDevicesA
DispatchMessageA
IsWindowVisible
GetForegroundWindow
GetDC
ReleaseDC
GetClientRect
ClientToScreen
WindowFromPoint
GetDesktopWindow
EnumWindows
SystemParametersInfoA
MonitorFromWindow
GetWindowRect
ToUnicodeEx
GetKeyboardLayout
TrackMouseEvent
TranslateMessage
PeekMessageA
SendMessageA
DefWindowProcA
PostQuitMessage
RegisterClassExA
GetRegisteredRawInputDevices
RegisterRawInputDevices
GetRawInputData
LoadIconA
LoadCursorA
SetWindowLongPtrA
GetWindowLongPtrA
ClipCursor
SetCursor
ShowCursor
SetWindowTextA
UpdateWindow
MapVirtualKeyExA
IsIconic
DestroyWindow
CreateWindowExA

ws2_32

recv
send
setsockopt
socket
WSAStartup
WSAGetLastError
inet_addr
htons
ioctlsocket
connect
closesocket
gethostbyname
shutdown

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces

hid

HidP_GetCaps
HidD_GetAttributes
HidD_GetHidGuid
HidD_GetManufacturerString
HidD_GetProductString
HidD_GetPreparsedData

d3dcompiler_46

D3DReflect
D3DPreprocess
D3DCompile

xinput1_3

ord4
ord3
ord2

xapofx1_5

CreateFX

dinput8

DirectInput8Create

wininet

InternetConnectA
InternetWriteFile
InternetReadFile
InternetCloseHandle
InternetOpenA
InternetQueryOptionA
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestExA
HttpEndRequestA
HttpQueryInfoA
InternetQueryDataAvailable

iphlpapi

GetAdaptersInfo

gdiplus

GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipSaveImageToStream
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders
GdipFree

kernel32

GetStringTypeW
OutputDebugStringW
LoadLibraryW
SetFilePointer
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount64
GetSystemTimeAsFileTime
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
GetFileType
GetModuleHandleW
GetStartupInfoW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
UnhandledExceptionFilter
RtlVirtualUnwind
SetLastError
HeapSize
GetModuleFileNameW
RtlPcToFileHeader
GetModuleHandleExW
ExitProcess
RtlUnwindEx
RtlLookupFunctionEntry
DecodePointer
EncodePointer
VerifyVersionInfoA
SetThreadExecutionState
SetThreadAffinityMask
TerminateProcess
CreateMutexA
ReleaseMutex
VerSetConditionMask
LCMapStringEx
ExpandEnvironmentStringsA
LoadLibraryA
FreeLibrary
WideCharToMultiByte
MultiByteToWideChar
MoveFileW
MoveFileA
SetFileTime
SetFilePointerEx
SetFileAttributesA
RemoveDirectoryW
RemoveDirectoryA
GetLongPathNameA
GetFileSizeEx
GetFileInformationByHandle
GetFileAttributesW
FindNextFileW
FindNextFileA
FindFirstFileW
FindFirstFileA
FindClose
DeleteFileW
DeleteFileA
CreateFileW
CreateDirectoryW
GetStdHandle
K32GetProcessMemoryInfo
K32GetModuleFileNameExA
K32EnumProcessModules
GetUserDefaultLangID
GetUserGeoID
GetLogicalDriveStringsA
IsWow64Process
GetNativeSystemInfo
GetLogicalProcessorInformation
GetVersionExA
GlobalMemoryStatusEx
IsProcessorFeaturePresent
GetLogicalDrives
GetDriveTypeA
GetDiskFreeSpaceExA
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetProcAddress
K32GetModuleBaseNameA
GetTempPathA
LocalFree
GetModuleHandleA
HeapReAlloc
SetStdHandle
WriteConsoleW
GetModuleFileNameA
GetCurrentProcessId
GetFileAttributesA
CreateDirectoryA
GetCurrentDirectoryA
RtlCaptureContext
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetCurrentThreadId
CancelIo
WriteFile
ReadFile
CreateFileA
CreateSemaphoreA
ResumeThread
GetExitCodeThread
TerminateThread
ExitThread
EnterCriticalSection
SetThreadPriority
GetCurrentThread
CreateThread
Sleep
CreateEventA
WaitForSingleObject
ReleaseSemaphore
ResetEvent
SetEvent
HeapUnlock
HeapLock
InitializeCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetLastError
FormatMessageA
CopyFileA
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentProcess
GetProcessAffinityMask
SetProcessAffinityMask
GetSystemInfo
GetSystemTime
GetLocalTime
RtlCaptureStackBackTrace
OutputDebugStringA
HeapAlloc
HeapFree
GetProcessHeap
VirtualAlloc
VirtualFree
CloseHandle
RaiseException

d3dx9_43

D3DXGetShaderConstantTableEx

Sections

.text
Size: 21.6MB - Virtual size: 21.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9.3MB - Virtual size: 9.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.0MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shr
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 869KB - Virtual size: 869KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7c1e5f040153240a88eaf16c45cea1ec

Code Sign

Certificate

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

05:e6:11:0c:fc:cf:af:76Certificate

Extended Key Usages

Key Usages

d6:ec:9d:2d:c8:7e:e0:13:28:e2:65:27:f2:e0:52:92:28:fc:ed:e2Signer

Signature Validations

Verification

16-11-2017 14:44 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

steam_api64

advapi32

dbghelp

gdi32

ole32

oleaut32

shell32

user32

ws2_32

setupapi

hid

d3dcompiler_46

xinput1_3

xapofx1_5

dinput8

wininet

iphlpapi

gdiplus

kernel32

d3dx9_43

Sections

.text Size: 21.6MB - Virtual size: 21.6MB

.rdata Size: 9.3MB - Virtual size: 9.3MB

.data Size: 4.0MB - Virtual size: 6.6MB

.pdata Size: 1.1MB - Virtual size: 1.1MB

.tls Size: 320KB - Virtual size: 320KB

.shr Size: 512B - Virtual size: 16B

.rsrc Size: 869KB - Virtual size: 869KB

.reloc Size: 1.1MB - Virtual size: 1.1MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07
Certificate

05:e6:11:0c:fc:cf:af:76
Certificate

d6:ec:9d:2d:c8:7e:e0:13:28:e2:65:27:f2:e0:52:92:28:fc:ed:e2
Signer

16-11-2017 14:44
Valid: true

.text
Size: 21.6MB - Virtual size: 21.6MB

.rdata
Size: 9.3MB - Virtual size: 9.3MB

.data
Size: 4.0MB - Virtual size: 6.6MB

.pdata
Size: 1.1MB - Virtual size: 1.1MB

.tls
Size: 320KB - Virtual size: 320KB

.shr
Size: 512B - Virtual size: 16B

.rsrc
Size: 869KB - Virtual size: 869KB

.reloc
Size: 1.1MB - Virtual size: 1.1MB