LegendsOfAriaLegacySetup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

LegendsOfAriaLegacySetup.exe
Size

1.2MB
MD5

45d43e4efb9ae1d0d403c630a9622db9
SHA1

f098c46b40346fc17df71fe301eb804a9517b105
SHA256

ca73d04db953cf1ca72ab7c336198865ebdff598591ccc1f73909e92a88c4198
SHA512

5255a3f4130f10d22c3c0f4bcc4de8a0cc37e1ae3bdbefe591a71ad381a54af47b32fc97a615e53bf5501dd15051bfc5abe0d1edd795bde179d292ffec91374b
SSDEEP

24576:ryIZDdV2r/LpwLkVN+V2E/MBaq9WQwBJ6vKuWEM5WwczRRQcM:ryKr2ZAkVC2Uq9WL6CuWEM5KTa

Score

1^/10

Malware Config

Signatures

Files

LegendsOfAriaLegacySetup.exe
.exe windows x86

Code Sign

65:27:a6:2e:4f:3e:10:b4:9b:c8:f3:b4:be:48:00:1b
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

20/11/2018, 00:00

Not After

20/11/2019, 23:59

Subject

CN=Citadel Studios Inc,O=Citadel Studios Inc,POSTALCODE=20112,STREET=11571 Purse Drive,L=Manassas,ST=Virginia,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:97:bb:53:d8:39:2f:a4:5e:4b:d9:45:c8:9a:89:a1:7b:e3:3a:71
Signer

Actual PE Digest

20:97:bb:53:d8:39:2f:a4:5e:4b:d9:45:c8:9a:89:a1:7b:e3:3a:71

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 179KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

65:27:a6:2e:4f:3e:10:b4:9b:c8:f3:b4:be:48:00:1bCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

20:97:bb:53:d8:39:2f:a4:5e:4b:d9:45:c8:9a:89:a1:7b:e3:3a:71Signer

Headers

DLL Characteristics

File Characteristics

Sections

CODE Size: 41KB - Virtual size: 40KB

DATA Size: 1024B - Virtual size: 592B

BSS Size: - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 2KB

.rsrc Size: 179KB - Virtual size: 178KB

65:27:a6:2e:4f:3e:10:b4:9b:c8:f3:b4:be:48:00:1b
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

20:97:bb:53:d8:39:2f:a4:5e:4b:d9:45:c8:9a:89:a1:7b:e3:3a:71
Signer

CODE
Size: 41KB - Virtual size: 40KB

DATA
Size: 1024B - Virtual size: 592B

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 2KB

.rsrc
Size: 179KB - Virtual size: 178KB