Static task
static1
General
-
Target
castle.exe
-
Size
1.8MB
-
MD5
f9e916a5489af020cacd8a1989cac009
-
SHA1
2be202736a9e8c2dd28b9a6dcd79d63ce96fc6f4
-
SHA256
307a484501eb9a8a1d1fa4bf2dd7e06d817bd10f25b4d5eb0297bba21bdb8696
-
SHA512
e404af383aa4114e402ca6003efd8b52f6450bc0d0d685afae2029907e2faf3b1d57c8d593ab94cbd9e799fa7695c7f1f8ab97b53ae72715b3fb971bf7669daf
-
SSDEEP
24576:8XZtSNQ5wuEemeGsjzvJJ662CHJexJ2P5y8iFyBTz7PQPYozyt:8GN/DemefnvH6lCExE88VBTPPQPYozyt
Malware Config
Signatures
Files
-
castle.exe.exe windows x86
fcbdb966fc402d6e85078e68a939ec64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
dinput8
DirectInput8Create
winhttp
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpOpen
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
d3d9
Direct3DCreate9
d3dx9_43
D3DXMatrixOrthoOffCenterLH
D3DXCreateTextureFromFileExA
steam_api
SteamAPI_RegisterCallResult
SteamAPI_UnregisterCallResult
SteamFriends
SteamAPI_RegisterCallback
SteamUser
SteamApps
SteamAPI_UnregisterCallback
SteamNetworking
SteamMatchmaking
SteamClient
SteamAPI_Shutdown
SteamAPI_Init
SteamUtils
SteamRemoteStorage
SteamAPI_RunCallbacks
SteamAPI_SetMiniDumpComment
SteamAPI_WriteMiniDump
SteamUserStats
kernel32
SetEndOfFile
CreateFileW
HeapReAlloc
SetStdHandle
WriteConsoleW
LoadLibraryW
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapCreate
GetStringTypeW
IsProcessorFeaturePresent
GetTimeZoneInformation
ExitProcess
HeapSize
GetFileType
SetHandleCount
RtlUnwind
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetModuleFileNameW
GetStdHandle
WriteFile
LCMapStringW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetModuleHandleA
GetProcAddress
LoadLibraryA
WaitForSingleObject
RaiseException
IsDebuggerPresent
CloseHandle
ResumeThread
GetLastError
GetTickCount
GetProcessHeap
CreateFileA
SetFilePointer
SetEvent
Sleep
CreateEventA
CreateSemaphoreA
ReadFile
GetOverlappedResult
ReleaseSemaphore
GetUserDefaultLCID
OutputDebugStringA
GetFileSize
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocalTime
SetThreadPriority
GetModuleFileNameA
LocalFree
CreateThread
SetLastError
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
HeapSetInformation
GetCommandLineW
HeapAlloc
HeapFree
WideCharToMultiByte
MultiByteToWideChar
SetEnvironmentVariableA
ExitThread
GetSystemTimeAsFileTime
GetDateFormatA
GetTimeFormatA
EncodePointer
DecodePointer
InterlockedDecrement
InterlockedIncrement
CompareStringW
GetCurrentProcess
user32
GetWindowRect
SetCursor
DispatchMessageA
DefWindowProcA
PeekMessageA
TranslateMessage
PostQuitMessage
ScreenToClient
SetRect
ClientToScreen
DestroyWindow
SetForegroundWindow
LoadIconA
GetClientRect
SetFocus
ShowCursor
GetAsyncKeyState
SetWindowLongA
MessageBoxA
SetCursorPos
CreateWindowExA
GetDesktopWindow
SetWindowPos
GetCursorPos
ShowWindow
AdjustWindowRectEx
MessageBoxW
GetSystemMetrics
UpdateWindow
AdjustWindowRect
LoadCursorA
ChangeDisplaySettingsA
RegisterClassA
MoveWindow
UnregisterClassA
gdi32
GetStockObject
shell32
CommandLineToArgvW
ShellExecuteA
ole32
CoUninitialize
CoInitialize
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
oleaut32
SysFreeString
SysAllocString
Sections
.text Size: 814KB - Virtual size: 814KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 363KB - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 124KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 346KB - Virtual size: 345KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 109KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.bind Size: 125KB - Virtual size: 125KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ