GamePanel[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

GamePanel.exe
Size

943KB
MD5

d576df927c74a3a6d3404a931becc44f
SHA1

79a4699d14e28c79b49ffc514a8893cbd761b937
SHA256

95c6221116b6befb37b3c5d171bec3b683eeaebac35ff3b51ca12a8aa1ec7d54
SHA512

7c68a59d9cbc5750e79fa07cdee6ab8473399ed3b47104599c099b1a4423023dfb852c375c676a9ccc9a3db059383b82707b69b3367968d1e84a6dae0fea8c10
SSDEEP

24576:hH3EmVT2czvvRfnEKZlGOjfAJzEu+vF8Ey:hXEm/ZfEKZlGOSAucFNy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GamePanel.exe

Files

GamePanel.exe
.exe windows x86

2b87ca102cf5340391ffe3620f5a5f23

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegGetValueW
EventWriteTransfer
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExW
EventSetInformation
EventRegister
EventUnregister
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextW
CryptCreateHash
CryptGetHashParam
CryptHashData
OpenProcessToken
DuplicateToken
CheckTokenMembership
FreeSid
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegDeleteTreeW
GetTokenInformation
AllocateAndInitializeSid

kernel32

SetThreadpoolWait
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateThreadpoolWait
CreateEventExW
SetEvent
IsWow64Process2
GetCurrentProcess
CreateEventW
LocalFree
OpenProcess
FreeLibrary
QueryFullProcessImageNameW
ResetEvent
SystemTimeToFileTime
AcquireSRWLockShared
ReleaseSRWLockShared
FormatMessageW
CreateThreadpoolTimer
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
GetSystemTime
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
FindResourceW
LoadResource
WaitForThreadpoolWaitCallbacks
SizeofResource
DeleteFileW
GetFileAttributesW
QueryPerformanceCounter
GetTempFileNameW
GetDateFormatEx
GetTimeFormatEx
GetApplicationUserModelId
GetEnvironmentVariableW
WriteFile
CreateFileW
CreateThread
LoadLibraryExA
CloseThreadpoolWait
GetUserDefaultLocaleName
GetLocaleInfoEx
GetUserDefaultUILanguage
LCIDToLocaleName
WideCharToMultiByte
RaiseException
Sleep
ResolveLocaleName
GetCurrentThread
SetThreadDescription
CompareStringOrdinal
GetProcessId
ExpandEnvironmentStringsW
ReleaseMutex
GetCurrentThreadId
VirtualProtect
LocalAlloc
GetLocalTime
GetLocaleInfoW
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
MulDiv
GetCurrentProcessId
CreateMutexExW
GetProcAddress
FindPackagesByPackageFamily
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
HeapAlloc
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
OutputDebugStringW
LockResource
GetLastError
SetThreadpoolTimer
GetSystemInfo

gdi32

DeleteDC
GetDIBits
GetObjectW
CreateRectRgn
CreateCompatibleDC
GetRgnBox
DeleteObject
BitBlt
CreateCompatibleBitmap
SelectObject

user32

ReleaseDC
GetDC
UnregisterClassW
GetSysColor
LoadStringW
SetWindowPos
GetClassLongW
SetClassLongW
ClientToScreen
TrackMouseEvent
SetCapture
ReleaseCapture
SetTimer
InvalidateRect
ValidateRect
MoveWindow
SetWindowTextW
SetParent
DestroyWindow
SetActiveWindow
ShowCursor
SetCursorPos
SetForegroundWindow
GetDesktopWindow
MonitorFromRect
SendInput
BlockInput
SetFocus
GetWindowLongW
GetActiveWindow
GetFocus
GetCursorPos
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetKeyState
SetCursor
GetWindowThreadProcessId
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
PostQuitMessage
GetMessageW
IsWindow
SetProcessDefaultLayout
FindWindowW
RegisterWindowMessageW
ChangeWindowMessageFilterEx
RegisterClassExW
GetMessageExtraInfo
GetRawInputData
MonitorFromWindow
mouse_event
CreateWindowInBand
GetWindowTextW
GetClientRect
LoadIconW
DefWindowProcW
ShowWindow
WindowFromPhysicalPoint
GetMonitorInfoW
PtInRect
LoadCursorW
SetWindowLongW
GetNextDlgTabItem
RegisterRawInputDevices
GetSystemMetrics
CreateWindowExW
EnableWindow
GetParent
SystemParametersInfoW
GetWindowRgn
SetWindowRgn
GetAncestor
MapWindowPoints
GetWindowRect
UnhookWinEvent
SetWinEventHook
GetForegroundWindow
GetIconInfo
GetCursorInfo
PostMessageW
SendMessageW
ScreenToClient
SetWindowCompositionAttribute
MonitorFromPoint
KillTimer

api-ms-win-crt-time-l1-1-0

_time32

api-ms-win-crt-string-l1-1-0

strcspn
__strncnt
wcsnlen
memset

api-ms-win-crt-locale-l1-1-0

_lock_locales
_unlock_locales

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__errno
_o__exit
_o__free_base
_o__get_wide_winmain_command_line
_o__Getdays
_o__Getmonths
_o__Gettnames
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__localtime32_s
_o__malloc_base
_o__purecall
_o__realloc_base
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_errno
_o__set_fmode
_o__set_new_mode
_o__Strftime
_o__W_Getdays
_o__W_Getmonths
_o__W_Gettnames
_o__wcsdup
_o__Wcsftime
_o__wcsnicmp
_o__wfopen
_o_abort
_o_calloc
_o_ceil
_o_exit
_o_fclose
_o_floor
_o_free
_o_frexp
_o_islower
_o_isspace
_o_isupper
_o_ldexp
_o_localeconv
_o_malloc
_o_roundf
_o_setlocale
_o_strncpy_s
_o_strtod
_o_strtof
_o_strtol
_o_terminate
_o_tolower
_o_wcstol
_o_wcstoul
__uncaught_exception
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
_o__crt_atexit
_o__controlfp_s
_o__configure_wide_argv
_o__configthreadlocale
_o___std_exception_destroy
_o___std_exception_copy
_o__CIsqrt
_o___pctype_func
_o__CIpow
_o__cexit
_o__calloc_base
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___p__commode
wcsstr
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
wcschr
strchr
strrchr
__CxxFrameHandler3
wcsrchr
__RTDynamicCast
memchr
memcmp
memcpy
memmove

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
StringFromGUID2
CoCreateGuid
CoGetCallContext
CoTaskMemAlloc
CoTaskMemFree
PropVariantClear
CoWaitForMultipleHandles
CoCreateInstance
CoInitializeSecurity

api-ms-win-core-winrt-string-l1-1-0

WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsGetStringLen
WindowsCreateString
WindowsDeleteString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance
RoUninitialize
RoInitialize

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

rpcrt4

UuidCreate
UuidFromStringW

oleaut32

SysAllocStringLen
SysAllocString
VariantInit

api-ms-win-power-base-l1-1-0

PowerDeterminePlatformRoleEx

api-ms-win-core-path-l1-1-0

PathCchCombine

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
TryAcquireSRWLockExclusive
InitializeSRWLock

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
InitializeConditionVariable
WakeAllConditionVariable
WakeConditionVariable

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetStartupInfoW
GetExitCodeThread

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency

api-ms-win-core-localization-l1-2-0

GetCPInfo
LCMapStringEx

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
GetStringTypeW
CompareStringEx

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-memory-l1-1-0

VirtualQuery

comctl32

ord412
ord411
ord410
ord413

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor
SetProcessDpiAwareness

d2d1

ord7

d3d11

D3D11CreateDevice

dwrite

DWriteCreateFactory

dcomp

DCompositionCreateDevice2

shell32

ShellExecuteW
SHCreateDirectoryExW
CommandLineToArgvW
SHGetKnownFolderPath

shlwapi

SHStrDupA
PathFileExistsW

msdrm

DRMIsWindowProtected

uxtheme

OpenThemeData
CloseThemeData

dxgi

CreateDXGIFactory2

ntdll

RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
NtQueryInformationToken
RtlFreeHeap
RtlCompareUnicodeString
RtlPublishWnfStateData
NtQueryLicenseValue
RtlInitUnicodeString

uiautomationcore

UiaRaiseAutomationEvent
UiaHostProviderFromHwnd
UiaReturnRawElementProvider

gamepanelexternalhook

?GetInstance@CGamePanelExternalHook@@SGAAV1@XZ
?Hook@CGamePanelExternalHook@@QAEXPAUHWND__@@@Z
?SetIntercept@CGamePanelExternalHook@@QAEX_NPAUHWND__@@@Z
?GPHHookWindowPointerDown@CGamePanelExternalHook@@SGIXZ
?Unhook@CGamePanelExternalHook@@QAEXXZ

dwmapi

DwmSetWindowAttribute

Sections

.text
Size: 755KB - Virtual size: 754KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 90KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b87ca102cf5340391ffe3620f5a5f23

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

rpcrt4

oleaut32

api-ms-win-power-base-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-memory-l1-1-0

comctl32

api-ms-win-shcore-scaling-l1-1-1

d2d1

d3d11

dwrite

dcomp

shell32

shlwapi

msdrm

uxtheme

dxgi

ntdll

uiautomationcore

gamepanelexternalhook

dwmapi

Sections

.text Size: 755KB - Virtual size: 754KB

.imrsiv Size: - Virtual size: 4B

.data Size: 90KB - Virtual size: 99KB

.idata Size: 13KB - Virtual size: 13KB

.didat Size: 512B - Virtual size: 12B

.rsrc Size: 29KB - Virtual size: 29KB

.reloc Size: 53KB - Virtual size: 53KB

.text
Size: 755KB - Virtual size: 754KB

.imrsiv
Size: - Virtual size: 4B

.data
Size: 90KB - Virtual size: 99KB

.idata
Size: 13KB - Virtual size: 13KB

.didat
Size: 512B - Virtual size: 12B

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 53KB - Virtual size: 53KB