v2game[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

v2game.exe
Size

11.7MB
MD5

63c5485ff00353f2be8daaa3f0dcf957
SHA1

63159133540f0c1813a5905e6b397c0612abf7d9
SHA256

62d48c204364dd706584777c2e2b3c7ab3c5f1dd0170872554943575d53d6648
SHA512

81516baf5d6e4af53eec1182eb76b2a5f7a0e18a1beaeffaf03dd097887b9a87eb5e18e30c25b3d1e835092083aefbca6f8f7a432b4658511702496c22afed60
SSDEEP

196608:jlDAMxxKr58FFYer7bVKAGimgmNZIl17c62SAE54I1sbPlHixgmiTlHRYAiO1:JAMiOIR3gmNZIXc62SN1sbPlHixgmiTR

Score

1^/10

Malware Config

Signatures

Files

v2game.exe
.exe windows x86

803eb3b61804f32df9572ed541009845

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

d3dx9_41

D3DXMatrixTranspose
D3DXIntersectTri
D3DXBoxBoundProbe
D3DXLoadMeshFromXA
D3DXGetFVFVertexSize
D3DXComputeBoundingSphere
D3DXComputeBoundingBox
D3DXFrameCalculateBoundingSphere
D3DXFrameFind
D3DXCreateSprite
D3DXFrameDestroy
D3DXLoadMeshHierarchyFromXA
D3DXCreateTextureFromFileExA
D3DXMatrixPerspectiveFovLH
D3DXMatrixRotationYawPitchRoll
D3DXMatrixScaling
D3DXCreateEffect
D3DXCreateVolumeTextureFromFileInMemoryEx
D3DXCreateEffectPool
D3DXCreateEffectFromFileA
D3DXSaveTextureToFileA
D3DXMatrixRotationZ
D3DXVec3CatmullRom
D3DXIntersect
D3DXVec3TransformNormal
D3DXMatrixRotationY
D3DXVec3TransformCoord
D3DXMatrixLookAtLH
D3DXMatrixOrthoRH
D3DXSaveTextureToFileInMemory
D3DXCreateTexture
D3DXLoadSurfaceFromSurface
D3DXCreateTextureFromFileInMemoryEx
D3DXCreateRenderToSurface
D3DXMatrixOrthoLH
D3DXVec2Normalize
D3DXVec2CatmullRom
D3DXVec3Normalize
D3DXFloat32To16Array
D3DXFloat16To32Array
D3DXMatrixOrthoOffCenterLH
D3DXCreateFontIndirectA
D3DXSaveSurfaceToFileInMemory
D3DXMatrixMultiply
D3DXMatrixTranslation
D3DXCreateLine
D3DXCreateTextureFromFileInMemory
D3DXSaveSurfaceToFileA
D3DXPlaneFromPoints
D3DXPlaneIntersectLine
D3DXMatrixInverse
D3DXVec3Unproject

lua51

luaL_loadstring
luaL_loadbuffer
lua_isstring
lua_getfield
luaL_openlibs
lua_getinfo
lua_getstack
luaL_newstate
lua_isnumber
lua_equal
lua_next
lua_pushthread
lua_pcall
lua_setfield
lua_settable
lua_insert
lua_toboolean
lua_getfenv
lua_replace
lua_tocfunction
lua_getupvalue
lua_pushfstring
lua_call
lua_setfenv
lua_pushlightuserdata
lua_createtable
lua_rawset
lua_setmetatable
lua_pushboolean
lua_newuserdata
lua_error
lua_concat
lua_pushcclosure
lua_pushnumber
lua_touserdata
lua_pushlstring
lua_rawget
lua_pushnil
lua_pushinteger
luaL_ref
luaL_unref
lua_tointeger
lua_settop
lua_gettop
lua_pushvalue
lua_pushstring
lua_remove
lua_rawgeti
lua_tonumber
lua_objlen
lua_gettable
lua_type
lua_tolstring
lua_getmetatable

kernel32

GetFileType
PeekNamedPipe
GetFileInformationByHandle
MoveFileA
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleW
RtlUnwind
RaiseException
GetStartupInfoW
HeapSetInformation
HeapAlloc
FindClose
FindFirstFileExA
FileTimeToLocalFileTime
FileTimeToSystemTime
HeapFree
DecodePointer
EncodePointer
GetStringTypeW
QueryPerformanceCounter
GetLastError
MultiByteToWideChar
CreateDirectoryW
GetFullPathNameW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapCreate
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetFileTime
SystemTimeToTzSpecificLocalTime
GetFileSize
SetErrorMode
GetVolumeInformationA
RemoveDirectoryA
TerminateThread
SetEnvironmentVariableA
CompareStringW
GetProcessHeap
GlobalLock
GlobalAlloc
GlobalUnlock
Sleep
FatalExit
FreeLibrary
GetProcAddress
GetCPInfo
WriteFile
GetCommandLineA
GetExitCodeProcess
CreateProcessA
GetStdHandle
AttachConsole
OutputDebugStringA
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
LoadLibraryW
SetStdHandle
GetTimeZoneInformation
GetFullPathNameA
GetCurrentDirectoryW
InitializeCriticalSection
CreateFileW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LCMapStringW
IsProcessorFeaturePresent
HeapSize
GetModuleFileNameW
GetLocaleInfoW
UnhandledExceptionFilter
HeapReAlloc
WriteConsoleW
GetDriveTypeW
SetEndOfFile
DeleteCriticalSection
GetModuleHandleA
SwitchToThread
GetNativeSystemInfo
FormatMessageA
GetACP
InterlockedExchange
InterlockedCompareExchange
WideCharToMultiByte
IsDebuggerPresent
CreateThread
GetExitCodeThread
SetThreadPriority
ExitThread
WaitForSingleObject
GetDiskFreeSpaceExA
GetDriveTypeA
GlobalMemoryStatus
TerminateProcess
TryEnterCriticalSection
GetSystemTime
DeleteFileA
GetCurrentThreadId
SetFileAttributesA
LocalFileTimeToFileTime
ReadFile
GetFileAttributesA
SetFileTime
SystemTimeToFileTime
GetOEMCP
LoadLibraryA
SetFilePointer
CreateFileA
GetCurrentProcessId
CloseHandle
GetCurrentDirectoryA
FindNextFileA
GetModuleFileNameA
EnterCriticalSection
CopyFileA
SetLastError
FindFirstFileA
LeaveCriticalSection
IsValidCodePage
InterlockedDecrement
InterlockedIncrement
SetUnhandledExceptionFilter
SetThreadAffinityMask
GetProcessAffinityMask
GetCurrentThread
CreateDirectoryA
GetCurrentProcess
GetVersionExA
QueryPerformanceFrequency
GlobalMemoryStatusEx

user32

GetMessageA
SetCursor
GetWindowRect
GetAsyncKeyState
GetCursorPos
GetForegroundWindow
PostQuitMessage
LoadIconA
LoadCursorFromFileA
ShowCursor
MessageBoxA
CloseClipboard
EmptyClipboard
OpenClipboard
SetClipboardData
CharLowerBuffA
CharUpperBuffA
MoveWindow
AdjustWindowRect
GetSystemMetrics
SetRect
GetDesktopWindow
DefWindowProcA
CreateWindowExA
UnregisterClassA
wsprintfA
SendMessageA
PeekMessageA
GetKeyState
TranslateMessage
RegisterClassExA
DestroyWindow
UpdateWindow
DispatchMessageA
ShowWindow
LoadCursorA

shell32

SHCreateDirectoryExW
SHGetFolderPathW
ShellExecuteA

quartz

AMGetErrorTextA

tbb

?terminate@task_scheduler_init@tbb@@QAEXXZ
?note_affinity@task@tbb@@UAEXG@Z
?allocate@allocate_continuation_proxy@internal@tbb@@QBEAAVtask@3@I@Z
?initialize@task_scheduler_init@tbb@@QAEXHI@Z
?free@allocate_root_with_context_proxy@internal@tbb@@QBEXAAVtask@3@@Z
?allocate@allocate_child_proxy@internal@tbb@@QBEAAVtask@3@I@Z
?get_initial_auto_partitioner_divisor@internal@tbb@@YAIXZ
??1task_group_context@tbb@@QAE@XZ
?init@task_group_context@tbb@@IAEXXZ
?NFS_Allocate@internal@tbb@@YAPAXIIPAX@Z
?NFS_Free@internal@tbb@@YAXPAX@Z
?throw_exception_v4@internal@tbb@@YAXW4exception_id@12@@Z
?allocate@allocate_root_with_context_proxy@internal@tbb@@QBEAAVtask@3@I@Z

psapi

GetProcessMemoryInfo

d3d9

Direct3DCreate9

dsound

ord11

ws2_32

select
WSAStartup
WSARecvFrom
setsockopt
WSACleanup
WSASendTo
ntohl
ntohs
ioctlsocket
connect
htonl
WSAGetLastError
htons
recv
bind
socket
__WSAFDIsSet
closesocket
send
getsockopt
listen
accept
gethostname
inet_ntoa
inet_addr
gethostbyname

dinput8

DirectInput8Create

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

shlwapi

PathFileExistsW
PathAppendW

steam_api

SteamApps

advapi32

RegOpenKeyExA
OpenProcessToken
GetUserNameA
RegQueryValueExA
RegCloseKey

ole32

StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateInstance

Exports

Exports

PHYSFS_addToSearchPath
PHYSFS_close
PHYSFS_deinit
PHYSFS_delete
PHYSFS_enumerateFiles
PHYSFS_enumerateFilesCallback
PHYSFS_eof
PHYSFS_exists
PHYSFS_fileLength
PHYSFS_flush
PHYSFS_freeList
PHYSFS_getBaseDir
PHYSFS_getCdRomDirs
PHYSFS_getCdRomDirsCallback
PHYSFS_getDirSeparator
PHYSFS_getLastError
PHYSFS_getLastModTime
PHYSFS_getLinkedVersion
PHYSFS_getMountPoint
PHYSFS_getRealDir
PHYSFS_getSearchPath
PHYSFS_getSearchPathCallback
PHYSFS_getUserDir
PHYSFS_getWriteDir
PHYSFS_init
PHYSFS_isDirectory
PHYSFS_isInit
PHYSFS_isSymbolicLink
PHYSFS_mkdir
PHYSFS_mount
PHYSFS_openAppend
PHYSFS_openRead
PHYSFS_openWrite
PHYSFS_permitSymbolicLinks
PHYSFS_read
PHYSFS_readSBE16
PHYSFS_readSBE32
PHYSFS_readSBE64
PHYSFS_readSLE16
PHYSFS_readSLE32
PHYSFS_readSLE64
PHYSFS_readUBE16
PHYSFS_readUBE32
PHYSFS_readUBE64
PHYSFS_readULE16
PHYSFS_readULE32
PHYSFS_readULE64
PHYSFS_removeFromSearchPath
PHYSFS_seek
PHYSFS_setAllocator
PHYSFS_setBuffer
PHYSFS_setSaneConfig
PHYSFS_setWriteDir
PHYSFS_supportedArchiveTypes
PHYSFS_swapSBE16
PHYSFS_swapSBE32
PHYSFS_swapSBE64
PHYSFS_swapSLE16
PHYSFS_swapSLE32
PHYSFS_swapSLE64
PHYSFS_swapUBE16
PHYSFS_swapUBE32
PHYSFS_swapUBE64
PHYSFS_swapULE16
PHYSFS_swapULE32
PHYSFS_swapULE64
PHYSFS_symbolicLinksPermitted
PHYSFS_tell
PHYSFS_utf8FromLatin1
PHYSFS_utf8FromUcs2
PHYSFS_utf8FromUcs4
PHYSFS_utf8ToUcs2
PHYSFS_utf8ToUcs4
PHYSFS_write
PHYSFS_writeSBE16
PHYSFS_writeSBE32
PHYSFS_writeSBE64
PHYSFS_writeSLE16
PHYSFS_writeSLE32
PHYSFS_writeSLE64
PHYSFS_writeUBE16
PHYSFS_writeUBE32
PHYSFS_writeUBE64
PHYSFS_writeULE16
PHYSFS_writeULE32
PHYSFS_writeULE64

Sections

.text
Size: 8.5MB - Virtual size: 8.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 182KB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 613KB - Virtual size: 613KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

803eb3b61804f32df9572ed541009845

Headers

DLL Characteristics

File Characteristics

Imports

d3dx9_41

lua51

kernel32

user32

shell32

quartz

tbb

psapi

d3d9

dsound

ws2_32

dinput8

winmm

shlwapi

steam_api

advapi32

ole32

Exports

Exports

Sections

.text Size: 8.5MB - Virtual size: 8.5MB

.rdata Size: 2.4MB - Virtual size: 2.4MB

.data Size: 182KB - Virtual size: 5.0MB

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 613KB - Virtual size: 613KB

.text
Size: 8.5MB - Virtual size: 8.5MB

.rdata
Size: 2.4MB - Virtual size: 2.4MB

.data
Size: 182KB - Virtual size: 5.0MB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 613KB - Virtual size: 613KB