UnityPlayer[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

UnityPlayer.dll
Size

21.3MB
MD5

b5b62b8194006aead019a988c0347d7d
SHA1

a8b948d4e92aeb191ac8da588ddf894c920e7754
SHA256

6e47577a6e3a2c6305d9c9385596185dee1b577c40ce06806a4253f491d4e997
SHA512

c043e7cbfbdad621eadbfffb36876c283f63e0d29ec84483b4c50ef0c05f2413ec1b623f2d1b2c0087089cb822639dc28eac43f91e23dacf44afd833ea644edd
SSDEEP

393216:Mj+8QlzoSWxYs9Z4DT6EofVP5lAiGe2Z4uKFRxG/Zj0B2obB+9:Mj1fnED2K

Score

1^/10

Malware Config

Signatures

Files

UnityPlayer.dll
.dll windows x64

f072f5480351362df4b363632fe36dc0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:88:3b:fb:88:38:ac:27:c4:5b:74:c5:0f:42:b2:5b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

11/07/2018, 00:00

Not After

10/07/2021, 23:59

Subject

CN=Unity Technologies Aps,OU=Core Developer Services,O=Unity Technologies Aps,L=København K,C=DK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

00:42:cf:dd:d4:82:26:9e:27:d2:68:e0:36:83:9d:74:e8:f4:97:c5
Signer

Actual PE Digest

00:42:cf:dd:d4:82:26:9e:27:d2:68:e0:36:83:9d:74:e8:f4:97:c5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Unity Technologies Aps,OU=Core Developer Services,O=Unity Technologies Aps,L=København K,C=DK

03/05/2019, 01:37
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

hid

HidD_GetManufacturerString
HidD_GetSerialNumberString
HidD_GetIndexedString
HidD_GetAttributes
HidP_GetCaps
HidP_GetButtonCaps
HidP_GetValueCaps
HidP_MaxDataListLength
HidP_GetData
HidD_GetProductString
HidD_FreePreparsedData
HidD_GetPreparsedData
HidP_InitializeReportForID
HidP_SetUsageValue
HidP_SetUsageValueArray
HidD_GetHidGuid

kernel32

SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
GetSystemTimeAsFileTime
GetModuleFileNameW
IsDebuggerPresent
InitializeCriticalSection
ResetEvent
GlobalAlloc
GlobalLock
GlobalUnlock
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
ReadProcessMemory
GetThreadContext
SuspendThread
ResumeThread
WriteFile
ReadFile
SetEndOfFile
SetFilePointer
SetFilePointerEx
FindClose
SetFileTime
GetSystemTime
CreateMutexA
GetModuleFileNameA
GetEnvironmentVariableA
ExpandEnvironmentStringsW
OutputDebugStringA
GetTempFileNameW
GetCurrentDirectoryA
GetDiskFreeSpaceExA
CreateDirectoryW
RemoveDirectoryW
CreateFileW
SetFileAttributesW
GetFileAttributesA
GetFileAttributesW
GetFileAttributesExW
DeleteFileW
FindFirstFileExW
FindFirstFileW
FindNextFileW
CopyFileW
MoveFileExW
ReplaceFileW
GetVersionExA
VerSetConditionMask
GlobalMemoryStatusEx
LocalAlloc
GetTickCount
GetTempPathW
GetComputerNameW
GetVersionExW
VerifyVersionInfoW
GetSystemPowerStatus
GetUserDefaultUILanguage
SetUnhandledExceptionFilter
DebugBreak
GetCommandLineW
GetCurrentDirectoryW
LoadLibraryExW
TerminateProcess
GetStartupInfoA
GetOverlappedResult
WaitForMultipleObjects
CancelIo
GetFileSize
SetThreadPriority
VirtualQuery
SetErrorMode
GetFileTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
lstrcpyA
lstrlenA
GetStdHandle
GetWindowsDirectoryW
GetCurrentProcess
FlushConsoleInputBuffer
GetProcessAffinityMask
ExitThread
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
CreateFileA
OpenEventA
SetWaitableTimer
CreateWaitableTimerA
GetSystemDirectoryA
FindNextFileA
FindFirstFileExA
GetCurrentThreadId
RtlUnwindEx
RtlPcToFileHeader
DecodePointer
EncodePointer
LoadLibraryExA
CreateMutexW
FlushInstructionCache
CreateSemaphoreW
SignalObjectAndWait
ReleaseMutex
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteConsoleW
GetOEMCP
IsValidCodePage
GetCPInfo
FlushFileBuffers
GetProcessHeap
SetStdHandle
GetConsoleCP
ReadConsoleW
GetStringTypeW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStartupInfoW
GetACP
HeapAlloc
HeapFree
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
GetFullPathNameA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
SetConsoleCtrlHandler
DuplicateHandle
HeapQueryInformation
HeapSize
HeapReAlloc
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
IsProcessorFeaturePresent
UnhandledExceptionFilter
VerifyVersionInfoA
ExpandEnvironmentStringsA
InitializeCriticalSectionEx
GetFileType
CreateThread
SleepEx
RaiseException
FormatMessageW
GetCurrentThread
SwitchToThread
GetCurrentProcessId
SetHandleInformation
SetDllDirectoryW
LoadLibraryW
GetFullPathNameW
GetModuleHandleW
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
SetThreadAffinityMask
EnterCriticalSection
WideCharToMultiByte
CreateEventA
MultiByteToWideChar
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryA
FreeLibrary
GetCommandLineA
GetModuleHandleA
GetProcAddress
CreateEventW
WaitForSingleObjectEx
SetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
CreateSemaphoreA
FormatMessageA
SystemTimeToFileTime
GetTimeZoneInformation
GetSystemInfo
GetLocalTime
CloseHandle
Sleep
WaitForSingleObject
ReleaseSemaphore
GetLastError
LocalFree
GlobalMemoryStatus

user32

RegisterRawInputDevices
GetRawInputDeviceInfoW
GetRawInputData
SystemParametersInfoW
PtInRect
ClientToScreen
GetCursorPos
ReleaseCapture
GetKeyNameTextW
GetAsyncKeyState
UnregisterDeviceNotification
RegisterDeviceNotificationW
GetRawInputDeviceList
GetMessageTime
GetMessagePos
UpdateWindow
MonitorFromRect
ValidateRect
DragDetect
GetActiveWindow
PeekMessageA
GetMessageA
GetMonitorInfoA
MonitorFromPoint
IsDialogMessageW
CopyImage
LoadImageW
wvsprintfA
wsprintfA
GetMessageExtraInfo
MessageBoxW
SetClipboardData
CloseClipboard
TrackMouseEvent
OpenClipboard
EnumDisplaySettingsA
GetCaretBlinkTime
IsWindowVisible
MessageBoxA
KillTimer
SetCapture
SetTimer
MonitorFromWindow
EmptyClipboard
IsClipboardFormatAvailable
GetSystemMetrics
SetCursor
LoadCursorA
DestroyCursor
DestroyIcon
CreateIconIndirect
GetThreadDesktop
GetUserObjectInformationA
RegisterWindowMessageA
SendMessageA
SendMessageTimeoutA
ShowWindow
IsIconic
SetForegroundWindow
EnumWindows
SetWindowPos
GetWindowPlacement
CreateDialogParamA
GetDlgItem
GetClientRect
GetWindowRect
AdjustWindowRectEx
ScreenToClient
GetWindowLongA
SetWindowLongA
GetWindowLongPtrA
SetWindowLongPtrA
GetParent
ChangeDisplaySettingsW
EnumDisplaySettingsW
GetMonitorInfoW
EnumDisplayMonitors
UnregisterClassW
RegisterClassExW
DialogBoxParamW
EndDialog
SetDlgItemTextA
SetDlgItemTextW
SendDlgItemMessageW
CopyRect
OffsetRect
LoadIconA
DispatchMessageA
GetAncestor
TranslateMessage
DispatchMessageW
GetUserObjectInformationW
GetProcessWindowStation
PeekMessageW
PostQuitMessage
RegisterClassW
CreateDialogParamW
DialogBoxParamA
CheckDlgButton
IsDlgButtonChecked
SetFocus
GetFocus
GetKeyState
MsgWaitForMultipleObjects
EnableWindow
SetWindowTextW
ShowCursor
SetCursorPos
ClipCursor
GetWindowLongPtrW
SetWindowLongPtrW
EnumDisplayDevicesA
GetDesktopWindow
ReleaseDC
GetDC
DestroyWindow
CreateWindowExW
DefWindowProcW
GetClipboardData

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoA

ole32

CoInitialize
PropVariantClear
CoCreateGuid
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoSetProxyBlanket
StringFromGUID2
CoUninitialize

shlwapi

PathCanonicalizeW
SHDeleteKeyW
PathFileExistsW

setupapi

SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsA

advapi32

CryptAcquireContextA
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegSetValueExA
RegQueryValueExA
RegDeleteValueA
RegCreateKeyW
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
RegSetValueExW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
GetUserNameA
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
SystemFunction036

gdi32

SwapBuffers
GetObjectA
GetDeviceCaps
CreateDIBSection
DeleteObject
ChoosePixelFormat
SetPixelFormat
CreateBitmap

shell32

ShellExecuteW
SHFileOperationW
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExA

opengl32

wglGetProcAddress
wglGetCurrentDC
wglGetCurrentContext
wglDeleteContext
wglCreateContext
wglMakeCurrent

winmm

waveOutGetNumDevs
waveInGetNumDevs
waveOutGetDevCapsA
waveOutGetDevCapsW
timeEndPeriod
waveOutClose
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
waveOutOpen
timeGetTime
waveOutReset
waveOutGetPosition
waveInGetDevCapsA
waveInGetDevCapsW
waveInOpen
waveInClose
waveInPrepareHeader
waveInUnprepareHeader
waveInAddBuffer
waveInStart
waveInReset
timeBeginPeriod

ws2_32

ioctlsocket
accept
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
gethostname
listen
inet_ntoa
inet_addr
htons
getsockname
connect
closesocket
bind
ntohl
htonl
ntohs
recvfrom
select
send
setsockopt
shutdown
WSASetLastError
WSAIoctl
WSASocketA
getaddrinfo
freeaddrinfo
getnameinfo
getpeername
recv
gethostbyname
getprotobyname
WSARecvFrom
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
WSASetEvent
getsockopt
WSAAsyncGetHostByName
WSACancelAsyncRequest
socket
sendto

oleaut32

VariantChangeType
SysFreeString
SysAllocString
VariantClear
VariantInit

imm32

ImmGetContext
ImmAssociateContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetConversionStatus
ImmSetOpenStatus
ImmReleaseContext

dnsapi

DnsQuery_A
DnsFree

iphlpapi

GetIpAddrTable

winhttp

WinHttpGetIEProxyConfigForCurrentUser

Exports

Exports

UnityMain

Sections

.text
Size: 16.9MB - Virtual size: 16.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 605KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 895KB - Virtual size: 894KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.trace
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f072f5480351362df4b363632fe36dc0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

03:88:3b:fb:88:38:ac:27:c4:5b:74:c5:0f:42:b2:5bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

00:42:cf:dd:d4:82:26:9e:27:d2:68:e0:36:83:9d:74:e8:f4:97:c5Signer

Signature Validations

Verification

03/05/2019, 01:37 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

hid

kernel32

user32

version

ole32

shlwapi

setupapi

advapi32

gdi32

shell32

opengl32

winmm

ws2_32

oleaut32

imm32

dnsapi

iphlpapi

winhttp

Exports

Exports

Sections

.text Size: 16.9MB - Virtual size: 16.9MB

.rdata Size: 2.8MB - Virtual size: 2.8MB

.data Size: 605KB - Virtual size: 1.3MB

.pdata Size: 895KB - Virtual size: 894KB

.rodata Size: 3KB - Virtual size: 2KB

.gfids Size: 512B - Virtual size: 492B

.tls Size: 512B - Virtual size: 9B

_RDATA Size: 48KB - Virtual size: 47KB

.trace Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 108KB - Virtual size: 107KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

03:88:3b:fb:88:38:ac:27:c4:5b:74:c5:0f:42:b2:5b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

00:42:cf:dd:d4:82:26:9e:27:d2:68:e0:36:83:9d:74:e8:f4:97:c5
Signer

03/05/2019, 01:37
Valid: false

.text
Size: 16.9MB - Virtual size: 16.9MB

.rdata
Size: 2.8MB - Virtual size: 2.8MB

.data
Size: 605KB - Virtual size: 1.3MB

.pdata
Size: 895KB - Virtual size: 894KB

.rodata
Size: 3KB - Virtual size: 2KB

.gfids
Size: 512B - Virtual size: 492B

.tls
Size: 512B - Virtual size: 9B

_RDATA
Size: 48KB - Virtual size: 47KB

.trace
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 108KB - Virtual size: 107KB