GameRangerSetup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

GameRangerSetup.exe
Size

111KB
MD5

7f4c3472efcbe0d231dd5c5305fe6db6
SHA1

eb6f1798792b4ceaf3aff9468a7378ec7196676f
SHA256

f4be971e242923dec1e22995eb1907fe45a90a617e738efff001085b1ffb27d6
SHA512

25d4e00b2c0332199227c22f06b51f720ecbc9fee4f8779738530dd653039cbabab0c64af71a85666d12364c28b2c5e734e202424d1c76994a3eaa8effd3f2ac
SSDEEP

1536:YgkNPnEO0brG38GI/cqTzcD6U2qBpjuBrq2qBXWXxXOE8:DNFG8h/cmcBpjuBrq/BmBG

Score

1^/10

Malware Config

Signatures

Files

GameRangerSetup.exe
.exe windows x86

5be8682d7e090ac54ba488569033f3bc

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

17/05/2005, 00:00

Not After

16/05/2010, 23:59

Subject

CN=Comodo Time Stamping Signer,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

b8:f7:6e:d3:56:50:9f:9d:73:0e:58:ca:ea:62:31:84
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/02/2009, 00:00

Not After

09/02/2010, 23:59

Subject

CN=GameRanger Technologies,O=GameRanger Technologies,POSTALCODE=6008,STREET=177 Hay Street,L=Subiaco,ST=Western Australia,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6f:cf:d6:28:27:ad:c0:ef:35:03:f7:1e:33:e4:b0:45:2c:17:49:4a
Signer

Actual PE Digest

6f:cf:d6:28:27:ad:c0:ef:35:03:f7:1e:33:e4:b0:45:2c:17:49:4a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=GameRanger Technologies,O=GameRanger Technologies,POSTALCODE=6008,STREET=177 Hay Street,L=Subiaco,ST=Western Australia,C=AU

08/07/2009, 01:52
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord4080
ord4627
ord2116
ord1768
ord1175
ord567
ord6215
ord3873
ord6199
ord4234
ord5265
ord4376
ord4853
ord4998
ord4710
ord6052
ord1775
ord5280
ord4425
ord3597
ord324
ord2379
ord1146
ord643
ord5982
ord329
ord3957
ord4136
ord5232
ord1567
ord2393
ord6197
ord5718
ord3797
ord2147
ord1180
ord268
ord1568
ord5268
ord1168
ord4275
ord3610
ord656
ord1842
ord4242
ord674
ord366
ord4809
ord5237
ord5252
ord4287
ord3138
ord4457
ord4145
ord2092
ord1233
ord5981
ord4427
ord5282
ord4337
ord3079
ord4396
ord3574
ord609
ord6358
ord2859
ord1929
ord755
ord470
ord2754
ord640
ord1640
ord323
ord5789
ord5875
ord537
ord540
ord2370
ord2302
ord1816
ord2358
ord6334
ord2642
ord3874
ord2645
ord2301
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord815
ord561
ord6117
ord2621
ord1205
ord6438
ord1247
ord1134
ord1105
ord3825
ord3831
ord3830
ord2976
ord1576
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4436
ord4837
ord3798
ord1665
ord2649
ord4353
ord6374
ord5163
ord2385
ord4407
ord1776
ord4077
ord6055
ord4151
ord2878
ord2879
ord3403
ord5472
ord975
ord5012
ord3350
ord4303
ord4467
ord5103
ord5100
ord3059
ord2390
ord2723
ord3721
ord4424
ord3402
ord5261
ord4441
ord5290
ord5241
ord4078
ord800
ord795
ord641
ord860
ord2414
ord3663
ord3626
ord1232
ord2864
ord1641
ord3619
ord823
ord2575
ord825

msvcrt

_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
strstr
sscanf
strncpy
toupper
time
strchr
sprintf
_setmbcp
??1type_info@@UAE@XZ
_controlfp
__CxxFrameHandler
ftell
fseek
_CxxThrowException
fclose
fwrite
fread
memcpy
memmove
strcpy
strcmp
strcat
_purecall
strlen
memset
strrchr
fopen

kernel32

GetSystemTime
GetProcAddress
GetVersionExA
ExitProcess
GetTimeZoneInformation
GetDateFormatA
CreateDirectoryA
GlobalUnlock
GlobalLock
LoadResource
FindResourceA
LockResource
SizeofResource
LoadLibraryA
ResumeThread
GetStartupInfoA
GetLastError
GetModuleFileNameA
GetFileAttributesA
DeleteFileA
MoveFileA
CloseHandle
SetFileTime
CreateFileA
GetDiskFreeSpaceExA
MulDiv
GetModuleHandleA
CreateProcessA
SystemTimeToFileTime
MultiByteToWideChar

user32

GetTopWindow
GetWindowLongA
DestroyIcon
SetWindowLongA
AdjustWindowRectEx
LoadIconA
WindowFromPoint
GetFocus
InvalidateRect
InflateRect
DrawEdge
TrackMouseEvent
KillTimer
GetClientRect
SetTimer
DrawTextW
SetWindowPos
GetWindow
MessageBeep
SetFocus
LoadCursorA
SetCursor
OpenClipboard
GetDesktopWindow
BringWindowToTop
GetSysColor
CloseClipboard
DefWindowProcA
SendMessageA
UpdateWindow
IsWindowVisible
GetClipboardData
PostMessageA
PostThreadMessageA
SetActiveWindow
GetKeyState
FlashWindowEx
EnableWindow
GetMenu
ReleaseDC
GetDC

gdi32

BitBlt
GetDeviceCaps
CreateCompatibleDC
SelectObject
DeleteDC
DeleteObject
CreateDIBSection
CreateFontIndirectA

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA

shell32

SHGetSpecialFolderPathA
ShellExecuteA
SHFileOperationA

ole32

CoCreateInstance

wsock32

select
getpeername
getsockname
connect
closesocket
recv
WSAGetLastError
send
socket
setsockopt
ioctlsocket
gethostbyname
WSASetLastError
ntohs
htons
ntohl
htonl

msimg32

AlphaBlend

winmm

timeBeginPeriod
timeGetTime

shlwapi

PathFileExistsA
PathQuoteSpacesA
PathRemoveArgsA
PathFindFileNameA
PathUnquoteSpacesA
PathIsDirectoryA
PathAddBackslashA
PathRenameExtensionA
PathRemoveFileSpecA

Sections

.text
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5be8682d7e090ac54ba488569033f3bc

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89Certificate

Extended Key Usages

Key Usages

b8:f7:6e:d3:56:50:9f:9d:73:0e:58:ca:ea:62:31:84Certificate

Extended Key Usages

Key Usages

6f:cf:d6:28:27:ad:c0:ef:35:03:f7:1e:33:e4:b0:45:2c:17:49:4aSigner

Signature Validations

Verification

08/07/2009, 01:52 Valid: false

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

wsock32

msimg32

winmm

shlwapi

Sections

.text Size: 44KB - Virtual size: 42KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 36KB - Virtual size: 33KB

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

b8:f7:6e:d3:56:50:9f:9d:73:0e:58:ca:ea:62:31:84
Certificate

6f:cf:d6:28:27:ad:c0:ef:35:03:f7:1e:33:e4:b0:45:2c:17:49:4a
Signer

08/07/2009, 01:52
Valid: false

.text
Size: 44KB - Virtual size: 42KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 36KB - Virtual size: 33KB