Static task
static1
General
-
Target
SkyrimSELauncher.exe
-
Size
4.2MB
-
MD5
302d27549b1cad8bbb71efbfc54c3358
-
SHA1
7662d5453d5b4666cd23977ad8435cec68d22a73
-
SHA256
a26a67297a308595e97e0637473fdc6ce0c6b53cd6be0c4830b300b19c523338
-
SHA512
026c843d2d7bba40438b44a3be775cd2764558632086c7d9d129006488ee0eda8d6a168026783b82e0c75d3e1026c87a3619232b07d7bd6691fbcdd6650cdb2b
-
SSDEEP
12288:2akr1zxSZ6oev2zAiRrwSHh+qGv5r8a9X4YmAMmQK:2Nr1zxK2vsRrZHQN8IuAMmQK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SkyrimSELauncher.exe
Files
-
SkyrimSELauncher.exe.exe windows x64
Password: 909090
abc27a0ce6b6aab5629e5985f7909fb0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
steam_api64
SteamAPI_Init
SteamApps
SteamAPI_Shutdown
kernel32
CreateDirectoryW
GetCurrentProcess
lstrlenW
GetModuleFileNameW
CreateMutexW
GetLastError
GetCurrentDirectoryW
GetModuleHandleW
CopyFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
OutputDebugStringW
GetPrivateProfileStringW
SetFileAttributesW
GetFileAttributesW
GetSystemTimeAsFileTime
GetPrivateProfileIntW
WritePrivateProfileStringW
CloseHandle
GetCurrentThreadId
CreateFileW
WriteFile
FreeLibrary
GetProcAddress
LoadLibraryW
GetVersionExW
InitializeSListHead
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
GetCurrentProcessId
user32
DestroyWindow
GetDC
LoadStringW
ReleaseDC
CheckDlgButton
EnableWindow
CreateDialogParamW
ChildWindowFromPointEx
ShowWindow
GetSysColor
GetClientRect
GetDesktopWindow
InvalidateRect
LoadImageW
MessageBoxW
GetSystemMetrics
PeekMessageW
EnumDisplayDevicesW
SetProcessDPIAware
GetMessageW
DefWindowProcW
RegisterClassExW
DispatchMessageW
TranslateMessage
LoadIconW
LoadCursorW
PostQuitMessage
GetWindowRect
GetDlgItem
GetWindowInfo
SetWindowTextW
EndDialog
SendMessageW
SetWindowPos
ScreenToClient
UpdateWindow
SetWindowLongW
gdi32
GetTextExtentPoint32W
GetStockObject
SetTextColor
SetBkMode
SetBkColor
advapi32
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
shell32
ShellExecuteExW
SHGetFolderPathW
ShellExecuteW
ole32
CoUninitialize
CoInitialize
msvcp140
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
??Bid@locale@std@@QEAA_KXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@M@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?_BADOFF@std@@3_JB
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
comctl32
PropertySheetW
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
dsound
ord11
vcruntime140
__std_exception_destroy
__std_exception_copy
__CxxFrameHandler3
__C_specific_handler
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
_CxxThrowException
memset
__std_terminate
memmove
memcpy
strstr
api-ms-win-crt-convert-l1-1-0
_wtof
_itow_s
api-ms-win-crt-runtime-l1-1-0
_set_app_type
_get_narrow_winmain_command_line
_initterm
_initterm_e
_exit
_invalid_parameter_noinfo_noreturn
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_cexit
exit
terminate
_configure_narrow_argv
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
api-ms-win-crt-string-l1-1-0
_stricmp
strncmp
tolower
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vswscanf
__stdio_common_vswprintf_s
__p__commode
api-ms-win-crt-filesystem-l1-1-0
_waccess
_wchdir
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-math-l1-1-0
floorf
fmodf
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ