AngryBirdsStarWars[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

AngryBirdsStarWars.exe
Size

1.6MB
MD5

90209a8f76a118fa3094f08e2e4bff04
SHA1

548073bad5b6b75cb57267780bc0e3db621f0d3e
SHA256

734b1397df50f63737614a7125e9b0097bf019e91d2d59a6a45eae9b66545b85
SHA512

e28a21fc074141fd5ced714961004b7debe6ac5a87855812762a0c1bff5f9b3af10756688d1dfee95a77e2b8118349be138b294ebe7b1d57afb134c5b7c69a75
SSDEEP

24576:vU3r9IWhcSIWZ6D6WD56TSyEP6gt6V9nNR2MSLbUeTBV0EbTwLLUXnJvhC:Ur9IgxIDvmSzER2DUs0EbTx3JvhC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AngryBirdsStarWars.exe

Files

AngryBirdsStarWars.exe
.exe windows x86

316b05e45fe464189a098cd7b789752f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
WaitForSingleObject
GetLastError
CreateProcessW
GetModuleFileNameW
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleFileNameA
LoadLibraryA
GetProcAddress
FormatMessageA
CloseHandle
GetThreadPriority
SetThreadPriority
Sleep
ReleaseMutex
CreateMutexW
LoadLibraryW
GetModuleHandleW
SetErrorMode
OutputDebugStringA
FlushFileBuffers
MoveFileExW
GlobalUnlock
GlobalLock
FreeLibrary
GetFileAttributesA
SetLastError
GetVersionExA
DeleteCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetTickCount
SleepEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection

user32

OpenClipboard
ClientToScreen
DestroyWindow
SetWindowPlacement
SetCursor
MapVirtualKeyW
ScreenToClient
GetWindowRect
GetMessageW
MonitorFromPoint
PostQuitMessage
GetClipboardData
SetCapture
UnregisterClassW
SetForegroundWindow
TrackMouseEvent
LoadCursorW
FindWindowW
GetClientRect
GetDC
TranslateMessage
RegisterClassExW
LoadIconW
GetTopWindow
MessageBoxW
CloseClipboard
LoadImageW
GetWindowPlacement
GetWindowTextA
SetCursorPos
GetWindowLongW
PeekMessageW
ReleaseDC
MonitorFromWindow
SetWindowLongW
SetWindowPos
GetCursorPos
ShowWindow
ClipCursor
CreateWindowExW
AdjustWindowRectEx
ReleaseCapture
SetWindowTextW
GetMonitorInfoW
DefWindowProcW
MoveWindow
DispatchMessageW

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpOpen
WinHttpGetProxyForUrl

ws2_32

recvfrom
sendto
getaddrinfo
freeaddrinfo
WSASetLastError
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
accept
listen
WSAStartup
WSACleanup
getsockname
setsockopt
send
recv
__WSAFDIsSet
select
ioctlsocket
gethostname
WSAGetLastError

wldap32

ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord32
ord35
ord27
ord79
ord200
ord33
ord301
ord46
ord41

msvcr100

??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
memcpy
memmove
??2@YAPAXI@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
__CxxFrameHandler3
_purecall
_CIatan2
_difftime64
_localtime64
_mktime64
_time64
memset
_mkdir
sprintf
free
??_V@YAXPAX@Z
??_U@YAPAXI@Z
ceil
_CIasin
printf
malloc
memchr
_wfopen
_errno
_fileno
ferror
fwrite
_get_osfhandle
fclose
strchr
strrchr
fread
ftell
_getcwd
fseek
rand
exit
isspace
tolower
isdigit
toupper
_read
_beginthreadex
isalpha
isupper
islower
atof
feof
strerror
ungetc
strstr
__iob_func
fopen
fprintf
freopen
realloc
getc
modf
ldexp
srand
frexp
isalnum
ispunct
_CIsqrt
iscntrl
strpbrk
isxdigit
fputs
strtoul
longjmp
fscanf
tmpfile
_pclose
fflush
_popen
fgets
setvbuf
clearerr
rename
_gmtime64
tmpnam
system
remove
clock
strftime
setlocale
getenv
strtod
strncat
strcspn
strcoll
localeconv
calloc
__sys_nerr
sscanf
strtol
_strtoi64
strncmp
qsort
fputc
_fstat64
_lseeki64
atoi
_stat64
_strdup
isprint
isgraph
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_vsnprintf
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_invoke_watson
_controlfp_s
_CIsin
_CIpow
_CIfmod
floor
_CIcos
_open
strncpy
_close
_stricmp
_strnicmp
__argv
vswprintf_s
_chdir
__argc
_lseek
_CItan
_CIlog
_setjmp3
_CIexp
_CIlog10
_CIatan
_CIacos
_CItanh
_CIcosh
_HUGE
_CIsinh

msvcp100

??1_Container_base12@std@@QAE@XZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

dsound

ord11

iphlpapi

GetAdaptersInfo

shell32

ShellExecuteExW
SHGetFolderPathAndSubDirW

winmm

timeGetDevCaps
timeBeginPeriod
timeEndPeriod

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 297KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

316b05e45fe464189a098cd7b789752f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

winhttp

ws2_32

wldap32

msvcr100

msvcp100

dsound

iphlpapi

shell32

winmm

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 147KB - Virtual size: 146KB

.data Size: 7KB - Virtual size: 108KB

.rodata Size: 512B - Virtual size: 272B

.rsrc Size: 297KB - Virtual size: 296KB

.reloc Size: 64KB - Virtual size: 63KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 147KB - Virtual size: 146KB

.data
Size: 7KB - Virtual size: 108KB

.rodata
Size: 512B - Virtual size: 272B

.rsrc
Size: 297KB - Virtual size: 296KB

.reloc
Size: 64KB - Virtual size: 63KB