war3[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

war3.exe
Size

502KB
MD5

bf41f6a99ff34640dae440ad2a8425b7
SHA1

52087d11918f4cbf693318b377a97bea842f73cf
SHA256

0ea3434d2bdfd9609eda5fce2a68febac2137af72846de52e0008b142297ffbd
SHA512

708bd19aa4cad1d0fc7a7542076fd6cacda555661cc6d96e7a9237f16ee9c3002c7003b5481770c0157f11bbaa5198f554aecdb31550f3d0e8598032f7619f96
SSDEEP

6144:/SKiEVjmXltxLD8bW6sAvT1lcvWqcOp22n1tOsylFdqUNfM/g:qNEVjm1txL4Skv5/qiISlGUNUI

Score

1^/10

Malware Config

Signatures

Files

war3.exe
.exe windows x86

ca57b3f55cb65ff123205d2ba9afca35

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:d9:00:6d:6b:07:5e:81:fc:79:87:59:6b:6b:5e:56
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

14/11/2015, 00:00

Not After

18/01/2018, 12:00

Subject

CN=Blizzard Entertainment\, Inc.,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d3:b6:21:4a:a8:4a:d5:3f:75:f3:47:ca:84:24:a7:7e:e3:e1:a9:e9
Signer

Actual PE Digest

d3:b6:21:4a:a8:4a:d5:3f:75:f3:47:ca:84:24:a7:7e:e3:e1:a9:e9

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Blizzard Entertainment\, Inc.,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

09/12/2016, 06:05
Valid: true

Chain 1

CN=Blizzard Entertainment\, Inc.,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_Create
ImageList_Destroy
ImageList_GetImageCount
ImageList_Replace
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
_TrackMouseEvent
ImageList_Add
InitCommonControlsEx

winmm

timeGetTime

kernel32

CreateIoCompletionPort
PostQueuedCompletionStatus
LocalFree
FormatMessageA
GetACP
InterlockedExchange
InterlockedCompareExchange
TlsAlloc
TlsGetValue
TlsSetValue
GetCommandLineA
GetWindowsDirectoryA
GetFullPathNameA
GetLastError
GetFileSize
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
FindClose
GetFileTime
SetFileTime
CloseHandle
GetModuleHandleA
GetTempPathA
GetDiskFreeSpaceA
CreateDirectoryA
RemoveDirectoryA
CreateFileA
SetFileAttributesA
GetFileAttributesA
DeleteFileA
FindFirstFileA
FindNextFileA
CopyFileA
MoveFileA
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
TlsFree
GetLogicalDriveStringsA
GetDriveTypeA
FreeLibrary
GetProcAddress
LoadLibraryA
Sleep
GetTickCount
GetCurrentProcess
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
WaitForMultipleObjects
DuplicateHandle
GetSystemInfo
CreateMutexA
OpenMutexA
CreateEventA
CreateSemaphoreA
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeaps
HeapLock
HeapUnlock
HeapWalk
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetCurrentThread
SetThreadPriority
GetThreadPriority
GetSystemTime
GetQueuedCompletionStatus
GetModuleFileNameA
SetCurrentDirectoryA
TerminateThread
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
GetVersionExA
GetComputerNameA
GlobalMemoryStatus
ResumeThread
SuspendThread
GetUserDefaultLCID
GetUserDefaultLangID
GetSystemDefaultLangID
GetLocaleInfoA
CreateProcessA
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
QueryPerformanceFrequency
CompareFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetLocalTime

user32

SetFocus
MessageBoxA
ScreenToClient
ClientToScreen
SetCursorPos
GetClientRect
DispatchMessageA
TranslateMessage
EmptyClipboard
SetClipboardData
GetWindowInfo
SystemParametersInfoA
GetScrollInfo
SetScrollInfo
IsDialogMessageA
LoadImageA
DestroyIcon
LoadCursorA
GetWindow
SetParent
GetParent
GetDesktopWindow
SetClassLongA
GetClassLongA
SetWindowLongA
GetWindowLongA
FillRect
DrawFocusRect
GetSysColorBrush
GetSysColor
WindowFromPoint
GetCursorPos
SetCursor
ShowCursor
MessageBeep
GetWindowRect
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
RemovePropA
GetPropA
SetPropA
SetScrollPos
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDCEx
GetDC
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
DrawTextA
SetMenuItemInfoA
GetMenuItemInfoA
InsertMenuItemA
TrackPopupMenu
DeleteMenu
GetMenuItemCount
DestroyMenu
CreatePopupMenu
CreateMenu
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
TranslateAcceleratorA
DestroyAcceleratorTable
CreateAcceleratorTableA
IsWindowEnabled
EnableWindow
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetKeyState
GetFocus
GetActiveWindow
GetClipboardData
CloseClipboard
OpenClipboard
CreateDialogIndirectParamA
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExA
RegisterClassA
CallWindowProcA
DefWindowProcA
PostMessageA
SendMessageA
PeekMessageA
GetMessageA

comdlg32

GetOpenFileNameA
GetSaveFileNameA

storm

ord279
ord570
ord463
ord403
ord401
ord544
ord425
ord421
ord251
ord252
ord253
ord265
ord266
ord268
ord269
ord294
ord575
ord563
ord399
ord548
ord543
ord542
ord541
ord504
ord476
ord479
ord474
ord472
ord280
ord552
ord551
ord595
ord590
ord507
ord581
ord288
ord405
ord503
ord508
ord569
ord302
ord578
ord506
ord501
ord509
ord572
ord571
ord465
ord267
ord271
ord545

msvcr120

__crtGetShowWindowMode
_XcptFilter
_onexit
__dllonexit
_calloc_crt
_unlock
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
_except1
??1type_info@@UAE@XZ
_libm_sse2_pow_precise
_libm_sse2_log10_precise
_libm_sse2_sqrt_precise
memmove
_control87
_clearfp
setvbuf
fprintf
_lock
memset
strrchr
strcpy_s
fopen
fclose
_time64
_ismbblead
_beginthreadex
_purecall
qsort
strtoul
atoi
atof
_vsnprintf
memcpy
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_acmdln
_fmode
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
?terminate@@YAXXZ
_except_handler4_common
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
__CxxFrameHandler3
_commode
_ctime64

advapi32

RegCloseKey
GetUserNameA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

wininet

InternetCanonicalizeUrlA

mss32

_AIL_open_stream@12
_AIL_close_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume@8
_AIL_set_stream_pan@8
_AIL_set_stream_playback_rate@8
_AIL_stream_playback_rate@4
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_stream_position@4
_AIL_register_stream_callback@8
_AIL_set_stream_user_data@12
_AIL_stream_user_data@8
_AIL_set_stream_ms_position@8
_AIL_stream_ms_position@12
_AIL_DLS_load_memory@12
_AIL_DLS_compact@4
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_info@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_playback_rate@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_offset@4
_AIL_3D_sample_playback_rate@4
_AIL_set_3D_sample_distances@12
_AIL_3D_sample_attribute@12
_AIL_set_3D_sample_preference@12
_AIL_set_3D_sample_obstruction@8
_AIL_set_3D_sample_occlusion@8
_AIL_set_3D_sample_cone@16
_AIL_set_3D_sample_effects_level@8
_AIL_register_3D_EOS_callback@8
_AIL_set_3D_velocity@20
_AIL_set_3D_user_data@12
_AIL_set_3D_orientation@28
_AIL_sequence_user_data@8
_AIL_decompress_ADPCM@12
_AIL_extract_DLS@28
_AIL_find_DLS@24
_AIL_set_sequence_user_data@12
_AIL_register_sequence_callback@8
_AIL_sequence_status@4
_AIL_set_sequence_loop_count@8
_AIL_set_sequence_volume@12
_AIL_end_sequence@4
_AIL_resume_sequence@4
_AIL_stop_sequence@4
_AIL_start_sequence@4
_AIL_release_sequence_handle@4
_AIL_allocate_sequence_handle@4
_AIL_set_sample_ms_position@8
_AIL_sample_user_data@8
_AIL_set_sample_user_data@12
_AIL_register_EOS_callback@8
_AIL_sample_position@4
_AIL_sample_playback_rate@4
_AIL_sample_status@4
_AIL_set_sample_loop_count@8
_AIL_set_sample_pan@8
_AIL_set_sample_volume@8
_AIL_set_sample_playback_rate@8
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_open_3D_listener@4
_AIL_set_3D_distance_factor@8
_AIL_set_3D_speaker_type@8
_AIL_set_3D_room_type@8
_AIL_set_3D_provider_preference@12
_AIL_close_3D_provider@4
_AIL_open_3D_provider@4
_AIL_enumerate_3D_providers@12
_AIL_file_type@8
_AIL_MIDI_to_XMI@20
_AIL_WAV_info@8
_AIL_DLS_unload@8
_AIL_DLS_close@8
_AIL_DLS_open@28
_AIL_set_file_callbacks@16
_AIL_sequence_ms_position@12
_AIL_set_XMIDI_master_volume@8
_AIL_init_sequence@12
_AIL_close_XMIDI_driver@4
_AIL_open_XMIDI_driver@4
_AIL_sample_ms_position@12
_AIL_set_named_sample_file@20
_AIL_init_sample@4
_AIL_digital_CPU_percent@4
_AIL_set_redist_directory@4
_AIL_close_digital_driver@4
_AIL_open_digital_driver@16
_AIL_last_error@0
_AIL_shutdown@0
_AIL_startup@0
_AIL_mem_use_free@4
_AIL_mem_use_malloc@4
_AIL_mem_free_lock@4
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_decompress_ASI@24
_AIL_stop_sample@4
_AIL_3D_user_data@8
_AIL_start_sample@4
_AIL_3D_sample_length@4

wsock32

accept
closesocket
connect
inet_ntoa
getpeername
getsockname
htons
ioctlsocket
inet_addr
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket
gethostbyname
gethostname
WSAStartup
WSACleanup
WSASetLastError
WSAGetLastError
bind

imm32

ImmAssociateContextEx
ImmAssociateContext

gdi32

SetBkColor
SetTextColor
LineTo
GetTextExtentPoint32A
GetStockObject
SelectObject
SetBkMode
MoveToEx
GetBkColor
FillRgn
DeleteObject
CreateSolidBrush
CreateRectRgnIndirect
CombineRgn
CreatePen
CreateDIBitmap

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
FindExecutableA
ShellExecuteA
DragAcceptFiles
DragQueryFileA

Exports

Exports

A1
A2
A3
A4
A5
A6
AA
AB
AG
AL
AM
AN
AQ
AU
Ac
Aj
Ak
Al
Am
Ao
Ap
Aq
Ar
As
At
Au
Av
Aw
Ax
Ay
Az
B0
B1
B2
B3
B4
B5
B6
B7
B9
BA
BB
BC
BD
BE
BF
BG
BH
BI
BJ
BK
BL
BM
BN
BO
BP
BQ
BR
BS
BT
BU
BV
BW
BX
BY
BZ
Ba
Bb
Bc
Bd
Be
Bf
Bg
Bh
Bi
Bj
Bk
Bl
Bm
Bn
Bo
Bp
Bq
Br
Bs
Bt
Bu
Bv
Bw
Bx
By
Bz
C0
C1
C4
C5
C6
C7
C8
C9
CA
CB
CC
CD
CE
CF
CG
CH
CI
CJ
CK
CL
CM
CN
CO
CP
CQ
CR
CS
CT
CU
CV
CW
CX
CY
CZ
Cc
Cd
Ce
Cf
Cg
Ch
Ci
Cj
Ck
Cl
Cm
Cn
Co
Cp
Cq
Cr
Cs
Ct
Cu
Cv
Cw
Cx
Cy
Cz
D0
D1
D2
D3
D4
D5
D6
D7
D8
D9
DA
DB
DC
DD
DE
DF
DG
DH
DI
DJ
DK
DL
DM
DN
DO
DP
DQ
DR
DS
DT
DU
DV
DW
DX
DY
DZ
Da
Db
Dc
Dd
De
Df
Dg
Dh
Di
Dj
Dk
Dl
Dm
Dn
Do
Dq
Dr
Ds
Dt
Du
Dv
Dw
Dx
Dy
Dz
E0
E1
E2
E3
E4
E5
E6
E7
E8
E9
EA
EB
EC
ED
EE
EF
EG
EH
EI
EJ
EK
EL
EM
EN
EO
EP
EQ
ER
ES
ET
EU
EV
EW
EX
EY
EZ
Ea
Eb
Ec
Ed
Ef
Eg
Eh
Ei
Ej
Ek
El
Em
Eo
Ep
Eq
Er
Et
Eu
Ev
Ew
Ex
Ey
Ez
F0
F1
F2
F3
F4
F5
F6
F7
F8
F9
FA
FB
FC
FD
FE
FF
FG
FH
FI
FJ
FK
FL
FM
FN
FO
FP
FQ
FR
FS
FT
FU
FV
FW
FX
FY
FZ
Fa
Fb
Fc
Fd
Fe
Ff
Fg
Fh
Fi
Fj
Fk
Fl
Fm
Fn
Fo
Fp
Fq
Fr
Fs
Ft
Fu
Fv
Fw
Fx
Fy
Fz
G0
G1
G2
G3
G4
G5
G6
G7
G8
G9
GA
GB
GC
GD
GE
GF
GG
GH
GI
GJ
GK
GL
GM
GN
GO
GP
GQ
GR
GS
GT
GU
GV
GW
GX
GY
GZ
Ga
Gb
Gc
Gd
Ge
Gf
Gg
Gh
Gi
Gj
Gk
Gl
Gm
Gn
Go
Gp
Gq
Gr
Gs
Gt
Gu
Gv
Gw
Gx
Gy
Gz
H0
H1
H2
H3
H4
H5
H6
H7
H8
H9
HA
HB
HC
HD
HE
HF
HG
HH
HI
HJ
HK
HL
HM
HN
HO
HP
HQ
HR
HS
HT
HU
HV
HW
HX
HY
HZ
Ha
Hb
Hc
Hd
He
Hf
Hg
Hh
Hi
Hj
Hk
Hl
Hm
Hn
Ho
Hp
Hq
Hr
Hs
Ht
Hu
Hv
Hw
Hx
Hy
Hz
I0
I1
I2
I3
I4
I5
I6
I7
I8
I9
IA
IB
IC
ID
IE
IF
IG
IH
II
IJ
IK
IL
IM
IN
IO
IP
IQ
IR
IT
IW
IX
IY
IZ
Ia
Ib
Ic
Id
Ie
If
Ig
Ih
Ii
Ij
Ik

Sections

.text
Size: 362KB - Virtual size: 361KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca57b3f55cb65ff123205d2ba9afca35

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

07:d9:00:6d:6b:07:5e:81:fc:79:87:59:6b:6b:5e:56Certificate

Extended Key Usages

Key Usages

d3:b6:21:4a:a8:4a:d5:3f:75:f3:47:ca:84:24:a7:7e:e3:e1:a9:e9Signer

Signature Validations

Verification

09/12/2016, 06:05 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

winmm

kernel32

user32

comdlg32

storm

msvcr120

advapi32

wininet

mss32

wsock32

imm32

gdi32

shell32

Exports

Exports

Sections

.text Size: 362KB - Virtual size: 361KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 12KB - Virtual size: 55KB

_RDATA Size: 2KB - Virtual size: 2KB

.rsrc Size: 46KB - Virtual size: 46KB

.reloc Size: 20KB - Virtual size: 20KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

07:d9:00:6d:6b:07:5e:81:fc:79:87:59:6b:6b:5e:56
Certificate

d3:b6:21:4a:a8:4a:d5:3f:75:f3:47:ca:84:24:a7:7e:e3:e1:a9:e9
Signer

09/12/2016, 06:05
Valid: true

.text
Size: 362KB - Virtual size: 361KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 12KB - Virtual size: 55KB

_RDATA
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 46KB - Virtual size: 46KB

.reloc
Size: 20KB - Virtual size: 20KB