ygopro[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ygopro.exe
Size

5.6MB
MD5

dad065f5e709399b592739998be72d23
SHA1

364c547bc458280b5d7c02ee10f62ebe0215a95a
SHA256

71c8d9b55673c0a7171631416e38e94d7de86e00db8832727faf104546d8ef5a
SHA512

33fb054f25806a5022d79cd309e332ded870aa4143a5c3839de0286e91bfe4258987e4a045dd33c27b2251f37ad4c9f95ccda2ce0f4f982b2fbb7a684abf0eb8
SSDEEP

98304:yy+CdLe4d1qYW6XB3Db3vg10NbnBTRF7mVpX+V3:bxLHu6R3Db3vgyWVd+B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ygopro.exe

Files

ygopro.exe
.exe windows x86

7eacb0d990d006a723904e28e2a8cb74

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

opengl32

glMaterialfv
glVertex3fv
glDisable
glEnable
glLineStipple
glLineWidth
glEnd
glTexGeni
glPointSize
glMaterialf
glPopMatrix
glViewport
glEnableClientState
glStencilOp
glClear
glPolygonOffset
glTexEnvf
glStencilMask
glPopAttrib
glPolygonMode
glGetFloatv
glGetIntegerv
glTexSubImage2D
glGetTexImage
glTexImage2D
glDeleteTextures
glCopyTexSubImage2D
glGenTextures
glPushAttrib
glLightf
glGetError
glDrawBuffer
glLightModeli
glGetString
glDepthFunc
glPixelStorei
glShadeModel
glNormalPointer
wglMakeCurrent
glPushMatrix
glLightfv
glMultMatrixf
glClearDepth
glRectf
glDrawElements
glTexEnvi
glColorMaterial
glColorPointer
glColor4ub
glFlush
glFogi
glIsEnabled
glVertex2f
glTranslatef
glTexParameterf
wglDeleteContext
glDrawArrays
glVertex2i
glLightModelfv
glClearColor
glClipPlane
glTexCoordPointer
glAlphaFunc
glReadBuffer
glHint
glTexParameteri
wglGetProcAddress
glLoadIdentity
glColorMask
wglCreateContext
glReadPixels
glBlendFunc
glStencilFunc
glFrontFace
glMatrixMode
glDisableClientState
glTexCoord2f
glFogfv
glFogf
glScissor
glLoadMatrixf
glDepthMask
glCullFace
glVertex3f
glVertexPointer
glBindTexture
glBegin

ws2_32

bind
closesocket
WSACleanup
WSASend
gethostbyname
inet_addr
socket
gethostname
recvfrom
htonl
WSAStartup
WSARecv
htons
accept
ntohl
listen
WSAIoctl
getprotobynumber
getaddrinfo
getsockname
connect
getsockopt
freeaddrinfo
ioctlsocket
send
recv
sendto
setsockopt
WSASetLastError
WSAGetOverlappedResult
select
WSAGetLastError

winmm

waveOutWrite
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutClose
waveOutOpen
waveOutReset

kernel32

FindClose
GetFileAttributesW
MoveFileW
CreateDirectoryW
DeleteFileW
GetSystemDefaultLangID
GetModuleHandleW
GetCommandLineW
GetModuleFileNameW
SetCurrentDirectoryW
LocalFree
CreateProcessW
WriteFile
CreateFileW
CloseHandle
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetTickCount
GetModuleHandleA
GetProcAddress
LoadLibraryA
SetEvent
SetThreadPriority
ResumeThread
GetVersionExA
InitializeCriticalSection
FindNextFileW
LeaveCriticalSection
DeleteCriticalSection
GetModuleFileNameA
GetFileType
ReadConsoleW
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
GetCurrentDirectoryW
SetEnvironmentVariableW
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
GetTimeFormatW
CompareStringW
LCMapStringW
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
RaiseException
FindFirstFileW
SetFilePointerEx
GetCommandLineA
EnterCriticalSection
GetDateFormatW
GetLocaleInfoW
IsValidLocale
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
GetUserDefaultLCID
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
GetStringTypeW
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
CreateIoCompletionPort
CreateSemaphoreW
PostQueuedCompletionStatus
GetQueuedCompletionStatus
ReleaseSemaphore
ResetEvent
CreateEventW
InitializeCriticalSectionAndSpinCount
GetFileSizeEx
ExitProcess
GlobalUnlock
GlobalMemoryStatusEx
GlobalLock
GlobalAlloc
SetConsoleTitleW
SetConsoleCursorPosition
GetNumberOfConsoleInputEvents
ReadConsoleInputW
GetConsoleMode
SetConsoleMode
GetStdHandle
SetConsoleScreenBufferSize
SetConsoleDisplayMode
SetConsoleCtrlHandler
VerifyVersionInfoW
VerSetConditionMask
GetVersionExW
GetCurrentThread
SetThreadAffinityMask
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
WideCharToMultiByte
FreeLibrary
SystemTimeToFileTime
GetProcessHeap
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
EnumSystemLocalesW
GetConsoleOutputCP
SetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
LoadLibraryExA
DuplicateHandle
GetExitCodeProcess
MoveFileExW
UnhandledExceptionFilter
GetFullPathNameA
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
SetFilePointer
CreatePipe
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
WaitForSingleObjectEx
DeleteFileA
HeapReAlloc

user32

GetClipboardData
SetClipboardData
DefWindowProcW
GetMessagePos
MapVirtualKeyW
CloseClipboard
GetFocus
GetDC
SetWindowPos
SetActiveWindow
CreateWindowExW
EmptyClipboard
OpenClipboard
SendMessageTimeoutW
ToAsciiEx
DestroyWindow
CreateWindowExA
RegisterClassA
DefWindowProcA
MessageBoxA
GetWindowRect
SendMessageW
GetWindowPlacement
ShowWindow
MoveWindow
FlashWindowEx
GetClientRect
LoadImageW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
DestroyCursor
GetKeyboardState
GetActiveWindow
ChangeDisplaySettingsW
GetCapture
DispatchMessageW
GetCursorInfo
CreateIconIndirect
ClientToScreen
PeekMessageW
SetWindowPlacement
GetDoubleClickTime
GetKeyboardLayout
AdjustWindowRect
TranslateMessage
LoadCursorW
SetCapture
EndPaint
BeginPaint
GetCursorPos
ReleaseDC
SetCursorPos
ShowCursor
SetForegroundWindow
ReleaseCapture
UpdateWindow
EnumDisplaySettingsW
PostQuitMessage
SetWindowLongW
SetCursor

dnsapi

DnsFree
DnsQuery_UTF8

shell32

CommandLineToArgvW
SHFileOperationW

ole32

CoCreateInstance
CoInitialize
CoUninitialize

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmAssociateContextEx
ImmNotifyIME
ImmGetContext

dinput8

DirectInput8Create

gdi32

CreateCompatibleBitmap
SetPixelFormat
SetDeviceGammaRamp
CreateCompatibleDC
SetPixel
StretchDIBits
GetDeviceGammaRamp
DeleteDC
DeleteObject
GetPixelFormat
SwapBuffers
ChoosePixelFormat
SelectObject
DescribePixelFormat

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

Exports

Exports

create_duel
end_duel
get_log_message
get_message
ikpMP3Init
new_card
new_tag_card
preload_script
process
query_card
query_field_card
query_field_count
query_field_info
set_card_reader
set_message_handler
set_player_info
set_responseb
set_responsei
set_script_reader
start_duel

Sections

.text
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 595KB - Virtual size: 594KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 526KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 161KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7eacb0d990d006a723904e28e2a8cb74

Headers

DLL Characteristics

File Characteristics

Imports

opengl32

ws2_32

winmm

kernel32

user32

dnsapi

shell32

ole32

imm32

dinput8

gdi32

advapi32

Exports

Exports

Sections

.text Size: 4.7MB - Virtual size: 4.7MB

.rdata Size: 595KB - Virtual size: 594KB

.data Size: 41KB - Virtual size: 526KB

.rsrc Size: 161KB - Virtual size: 160KB

.reloc Size: 155KB - Virtual size: 154KB

.text
Size: 4.7MB - Virtual size: 4.7MB

.rdata
Size: 595KB - Virtual size: 594KB

.data
Size: 41KB - Virtual size: 526KB

.rsrc
Size: 161KB - Virtual size: 160KB

.reloc
Size: 155KB - Virtual size: 154KB