��R7g7�8��^$��w�b�� �P�r��V]B��ҬPW{lڧ*��/B?���^����.Xm�`���pZ�$4�ڲ�����wE�/prXM�v�����D�����i;/߱��dxM �+�E�c����������bn�����转W�HHiKt ��[ѹ[1�Bd���) Ⱦ��/��ז�E� �d���(y�g��=��4R��,�� �����B��6�)i���2X�x���U��-YY��I��!�}�t9��7����(������%Y�Wi�0w��S�o�VL��Xwݮ�EJ�B�rK���r+�:#lzZ��Ńж=������5�0�"�Ͽ��oJ���/��{��m"��ۓ]��W �d$����V��~�;£m!�}F��Yk�?�Ӛ|�"rx.���WY���='z����+�� �_[ha��g������-.<vIԲXV�������_\#��g���ڱۣRrsc�8�^��F6���C���|�֪�+U��$�^Q��#&��ld sѳ>�|����T�O��|����k�s�X8����gCy�āyj9���=�I���A��)�e/�>���S!�U�.s�2�r�������&��ұ"�_�:(?��+���L(��L˻�\�݀v���bV��Ļ!9�Z��k�9.TӬgM�:�8�ᴥ}��iل���m:t ���R5�����[���t�����$�ߚ�öcEDV����mq���/���:������r6���edKG�x�O�WݖU�R#[s��K�R��/bDI9����i�Js���cQn� ��� `��{ ��j�� '��3[P|zL�xN�}}���쮬вz'�Qf��jRoK�.���cHU����-�qɨȯ�1]Rf���i���dOa|��� �VN��z�� �_�Jw�������Me�_>/R����\WzT��m_Uͯ7۪���Bh���W��1�w ��g�WD�W 0��$����ʤ���@�m�Z�9�$�<i��z��XA攁�E���@��t� ���s��5yǟvx?j4q��_���[�Sc?ɴi�{[qeJ��r��L���v�h��g+_�|i �~�� ����>�A/��,^p&ҿ�.sQ��ڜh[�OJJ�.�}�-ۯk�B�����M�y( �Ð�����~.�Mv�r�0l��Զ�]�К�bHQ"�� ���9�w��N���v�Pt�&��a��+��-V�wl�r>��")�K���h=��kX[/_�nFW6p�G�h4�)�Q*cq�v��S�Q͞ �R�J�%�m� ��ػ?�H5��_��e7Ý5|��P<� ){��e��m��e|�D������;���;�@Z���ގk��Y֩DIMe�V^��p}�u����C7C�5�/���[��o_�:�����݇��8ƳS+Z�ȀY�3��;<ۧ�Æ6�)��6�<.%�mr�0 U5E��11��u��2��f��R$tqh`��9�ظ� =s�f�Ja��Uʺ��_�f3����7�)�s�Y����x�Jwt~]A��ot��2�������M�m�ͮkUE�f_�I�M`��*���`.�D�2hP���ى@��1o�s�YF����p)8��a��Q���v�T��8���K5d�Mu,��Oy8�����Nk����Cs])C��ܪ{�QG4r?�!6I�eG�f�X�{�m�`��a suۿ�$�7H���n��3�g.�Wim{�7gt?���6t��0�E�zw�H�h�4�oh�,k����G�����ɛ�om$�-���Y/ B���b��?�]�#� �$�ۋ�<��.o��r�1JD��ʥF��j����!�oJ�F�ފ}8/o���ѥw>�N�Q�����\d��ֱoC�চ~�o i����R��_D�~-Ƈî?�Yȳ�����N��>����d�rwS� ��:��u��*M��=V����NE���^���y->�G��;I���Ð��L��I�A��X�#!��z���L���eqP�q����2Q�J(�~���jK�4Z���i&&�n���q�� #�q1K����v��6&!~�}���� gƙ�k����q叆j�߀��('/��^���_;�"�{�>Xz%�[�Nw����_��}��<s� ��uL���CiN�b�"1�b���X�1"�y홬|B¤6b����T �)L�]���Ɖ�WTA��z���P-o8�tH��f����xK.���������,8���4�a��9@��r`��^ ���]7����D�mL�KT���J|�+��'Q�]�m���R����ȅ�dLߑ�0R�Q5�Y�^_���Jt�mg���Q����i��,��Vz�Z�s˴��}�io��`x���<�af���W]��mF�A,�l�<�(�^J�����|���Ia'{o�1�a��Bg�p��ֆ��h ������@�B��7�t7Ir�ؑ���7'�뉼A��ګ-V�'�D�3�j+�ڮp�Er�ۥ"���R����}ѵ%{�L�����Ak"e�]Pw��Ҕ{S:�ٿϟ��-���魾w��S|0�U6�/VԔ/(D�aY����s����Ἆ��DZM0l�)����R�`�g<� �>?�vo�$x���f�e���D&Ş�l��K�� Գ"`O�#D�����!ȅ:COB/�[m��oFf����Ch����2ۢM����=���aR��汔��Ⱦ�_���RM��z̘�i� ����������p8���Xg����������̎4�͑[�Z��3No;���R=���$��g<w���@ �P�> ���Gp�⅔�Z߬}�0��I}��.�P��gkAC�ǂ�;&����䛊��ϖ���kl�P�A��DQ���Ԫ3~�f��=�Iv��|�����6�F8��Vs��3�ɱ2w�z�n|s#`a9Ԧ�� ����f]A��Bt��2�v^{�������%�J�^���z��fn���kV��E�Ŷ��|����OҘ�m6���:t!����r�=�K��W�T�
Static task
static1
General
-
Target
game.exe
-
Size
3.1MB
-
MD5
cb954db9c9b875756baa063fda24b660
-
SHA1
3bdc5e0911159d27655116ce3f8725569dcb2087
-
SHA256
5d355ecd4c6f6c194467d9ae38f47fa8edd6567c24a8ae9ebdb547f76767b2ae
-
SHA512
8324785ee3d6168a994bee4a6bc66670b553c0f74b9b1c2139e94a308249276bbb3ca4f625e292f873319209caa6225cc66a6401e3cbfd96f9a006bf4c6e2509
-
SSDEEP
49152:pmMeRWTN9MlH8iLObCyRJ5VgPkQKKfgygMzrKkDDNr0a:qETBYO+uQhYygAukVr
Malware Config
Signatures
Files
-
game.exe.exe windows x86
dae61eb96d1ed68b0f2378b0cfd5bc44
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ijl15
ord5
version
GetFileVersionInfoA
winmm
timeGetTime
ddraw
DirectDrawCreate
kernel32
ExitProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ReleaseDC
gdi32
GetDIBits
advapi32
RegSetValueExA
shell32
SHGetSpecialFolderPathA
ole32
CoUninitialize
oleaut32
VariantClear
d3d9
Direct3DCreate9
imm32
ImmGetOpenStatus
ws2_32
WSAStartup
dinput8
DirectInput8Create
dsound
ord11
Exports
Exports
Sections
.text Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 574KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 27.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 364B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ