Phasmophobia[.]7z

Sharing

Copy URL Twitter E-mail

General

Target

Phasmophobia.7z
Size

10.7MB
MD5

95458b8897cc6ee13e97b8250e9601c5
SHA1

db1c5dfa4b5f4f0a8fc9e773fa0f366db821b801
SHA256

733bb7078e1e26d8de9070aaa6c045071b799413b1615aa97f040cee3ded8872
SHA512

7bf314c4b93a5611ac35f278128e1c6ef5a26a94b54fa65ebc0912e94ed51ed8557c7acbe6b8abd3de984c12aba3c175bd099b9ce7339b48efbe2632d86bec73
SSDEEP

196608:btA2s+57kxamfwrR0HN3vJR6Ni00EMf7VjpaanZnG/kEMQw42LscRE:baH+1SdI07yF0EMjdpbnyrp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/OnlineFix64.dll

Files

Phasmophobia.7z
.7z
Launcher.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

4b:f7:85:d7:f3:b3:b3:b3:e7:a6:92:77:8e:0d:ca:33:3f:6f:f4:4f
Certificate

Issuer

CN=Ascertia Public CA 1,O=Ascertia,C=GB

Not Before

29/10/2020, 16:31

Not After

29/11/2020, 16:31

Subject

CN=OnlineFix,OU=OnlineFix,O=OnlineFix,L=OnlineFix,ST=OnlineFix,C=DE,1.2.840.113549.1.9.1=#0c166f6e6c696e65666978406f6e6c696e656669782e6d65

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

e6
Certificate

Issuer

CN=Ascertia Root CA 2,O=Ascertia,C=GB

Not Before

21/04/2009, 12:15

Not After

14/04/2028, 23:59

Subject

CN=Ascertia Public CA 1,O=Ascertia,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c0:48:bc:7e:cc:b2:b9:d0:c3:4c:02:40:08:f7:e6:b5:7e:7d:b1:70:fe:b6:81:1d:02:29:7b:80:7d:c1:1b:a2
Signer

Actual PE Digest

c0:48:bc:7e:cc:b2:b9:d0:c3:4c:02:40:08:f7:e6:b5:7e:7d:b1:70:fe:b6:81:1d:02:29:7b:80:7d:c1:1b:a2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 8.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.of0
Size: - Virtual size: 8.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.of1
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OnlineFix64.dll
.dll windows x64

4b8e5391ed1e2ba024790d409b61ce13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetUserObjectInformationW

shell32

SHGetSpecialFolderPathA

ws2_32

ioctlsocket

wldap32

ord27

advapi32

RegisterEventSourceW

Exports

Exports

Breakpad_SteamMiniDumpInit
Breakpad_SteamSetAppID
Breakpad_SteamSetSteamID
Breakpad_SteamWriteMiniDumpSetComment
Breakpad_SteamWriteMiniDumpUsingExceptionInfoWithBuildId
CreateInterface
OnlineFix
ShellExecuteA
ShellExecuteW
Steam_BConnected
Steam_BGetCallback
Steam_BLoggedOn
Steam_BReleaseSteamPipe
Steam_ConnectToGlobalUser
Steam_CreateGlobalUser
Steam_CreateLocalUser
Steam_CreateSteamPipe
Steam_FreeLastCallback
Steam_GSBLoggedOn
Steam_GSBSecure
Steam_GSGetSteam2GetEncryptionKeyToSendToNewClient
Steam_GSGetSteamID
Steam_GSLogOff
Steam_GSLogOn
Steam_GSRemoveUserConnect
Steam_GSSendSteam2UserConnect
Steam_GSSendSteam3UserConnect
Steam_GSSendUserDisconnect
Steam_GSSendUserStatusResponse
Steam_GSSetServerType
Steam_GSSetSpawnCount
Steam_GSUpdateStatus
Steam_GetAPICallResult
Steam_GetGSHandle
Steam_InitiateGameConnection
Steam_LogOff
Steam_LogOn
Steam_ReleaseThreadLocalMemory
Steam_ReleaseUser
Steam_SetLocalIPBinding
Steam_TerminateGameConnection
hid_close
hid_enumerate
hid_error
hid_exit
hid_free_enumeration
hid_get_feature_report
hid_get_indexed_string
hid_get_manufacturer_string
hid_get_product_string
hid_get_serial_number_string
hid_init
hid_open
hid_open_path
hid_read
hid_read_timeout
hid_send_feature_report
hid_set_nonblocking
hid_write
hid_write_output_report

Sections

.text
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 535KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 307KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.of0
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.of1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.of2
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

4b:f7:85:d7:f3:b3:b3:b3:e7:a6:92:77:8e:0d:ca:33:3f:6f:f4:4fCertificate

Extended Key Usages

Key Usages

e6Certificate

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

c0:48:bc:7e:cc:b2:b9:d0:c3:4c:02:40:08:f7:e6:b5:7e:7d:b1:70:fe:b6:81:1d:02:29:7b:80:7d:c1:1b:a2Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: - Virtual size: 8.6MB

.of0 Size: - Virtual size: 8.8MB

.of1 Size: 6.4MB - Virtual size: 6.4MB

.rsrc Size: 126KB - Virtual size: 125KB

.reloc Size: 512B - Virtual size: 12B

4b8e5391ed1e2ba024790d409b61ce13

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ws2_32

wldap32

advapi32

Exports

Exports

Sections

.text Size: - Virtual size: 1.6MB

.rdata Size: - Virtual size: 535KB

.data Size: - Virtual size: 307KB

.pdata Size: - Virtual size: 78KB

_RDATA Size: - Virtual size: 348B

.of0 Size: - Virtual size: 1.9MB

.of1 Size: 2KB - Virtual size: 2KB

.of2 Size: 4.8MB - Virtual size: 4.8MB

.reloc Size: 512B - Virtual size: 200B

.rsrc Size: 1024B - Virtual size: 664B

4b:f7:85:d7:f3:b3:b3:b3:e7:a6:92:77:8e:0d:ca:33:3f:6f:f4:4f
Certificate

e6
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

c0:48:bc:7e:cc:b2:b9:d0:c3:4c:02:40:08:f7:e6:b5:7e:7d:b1:70:fe:b6:81:1d:02:29:7b:80:7d:c1:1b:a2
Signer

.text
Size: - Virtual size: 8.6MB

.of0
Size: - Virtual size: 8.8MB

.of1
Size: 6.4MB - Virtual size: 6.4MB

.rsrc
Size: 126KB - Virtual size: 125KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: - Virtual size: 1.6MB

.rdata
Size: - Virtual size: 535KB

.data
Size: - Virtual size: 307KB

.pdata
Size: - Virtual size: 78KB

_RDATA
Size: - Virtual size: 348B

.of0
Size: - Virtual size: 1.9MB

.of1
Size: 2KB - Virtual size: 2KB

.of2
Size: 4.8MB - Virtual size: 4.8MB

.reloc
Size: 512B - Virtual size: 200B

.rsrc
Size: 1024B - Virtual size: 664B