h����O��ppt���8�������X�!�<����ps�6���� �yi�ѧ���� �d�|g���1 4d�C���U�hZ���;�6H��< ����)�e��:�u9^v&����|ࣜpvz#�3C�k��2?�ԧ�sS3��A A��B���[D{�� \�e��٦p�ӛظ���r�0/vY�Ƣ��w?7��U�����������3����J�4���j^�]t#W?��E7rw����`���[����r�CY��Mf��E@��/J�������i�m@�;F��nn�``�`^4�+ޔo1a��Tؤ�՟"h711���lH�����sZ���2���,�8��r���?�N�i��l��lȰu)^����1�¡5��$�vu'<�W�=�<�TNE� b�o(Z�� ��4�Z�g��DV�ѳt���T��I�\��"tu����U�%ݱ�"��X役u�s&���(�=`�ß�7*�w9��f�j|8�z�p�|��:�C���F#7�9V��-���2轹��Nv��nP?%���T��:I*(�� ��4��̥�/���x����Y���6���(I��U�#�螔��*f��= E�;����<H�=����7��{�0����J��&�$�r/���M����p�$ګ��1�f[������*W5laL���5�|F���aнr��*ϱ^��3- �-Fv���nN`��3��)���k���Rv������H\�S��T��J_~t|�a]�\}�n��t���drb�4����������;k&d6N��sIϣ-�<d�[ހku��X!�����5�g�>C?f�M)��[=KP�a%y4@�N;2�L���lh�*J 3�� x}좥�Ʒ�ǾѢ����3�m=�=K�&�>2Zdrk�ln��1583�>�srh�Я���P��~\��%�i�� G�ߤ�a�� <�����ۚh���4�c� �(jr���S�R/��&],gz�nz��^��������^З���Ö5�ڃ��[��≳YA]#���>v�\�#2t����$ݝ��4�Ufx�qk�=����c�/0YC�A�P�8ԇ@9�S�+#�A����p�����&it�p��3�K�Kw���$^\��6^U:Iؾ������qקI� ��������9;Wk̙�Uا���9�j�,̋�NsK�{P��������#��ji�q��Ξ�m`L:��erW6O��l�ax��f�l�T�˱D�!f�t�w������G;]�p~���#-��߸h����=/�E�&�!�n�9��������Gquj$>kyg�^n�#���㨤�v5��0�o@ j�����$����8��?��a>��7���s��<��,��9��\��^�z��o4}*b7Ͻ�\dA!l�;l ¤�sEP?M�%1��!KZQ�{��pQ�V����&�rĈ����%�~�|�m����1��"���M���kCG�17S:��3�H�(:�I#V�=��+5�G��I~s-y�`�/W�o}=ԏ��<m����*B�F�o?�� ��P��˒��fL[��:���R��ROs6� M�|S�f%���ӧ���䔅J�,� O�bkXh�?6�����y�kJ)o��o�f�a؏ ��풷uG��O���3���#����(����.��'qG�e���>���Ӭ�����i�3���[f��y�6 �r]^��L)��7ڜꤨx��ϻ��AN�'�~����AXޒ�q�(�G־��������kj��h�@{e�����C �CM|W���q-��gy�����F� ,�6[H!T��k&����C�����|8(����K�ɇS�-���u�?ER��~Xmw����F7E����<���\�`ȇ��d���wI6]��3d�4Kɾ��Rn��S���/4�M[��vX��� ���p(����š�ܒn���t�P0kc�)SC���Ҙ-�?ޒ����s�G�|(!�n=�5Pl�Z�1���}ix�J$�_��������sX 9���$�J)e�ʰ�`b�D<yy�s�u�7�E8��u�������#P��Ν�a7u�Sncf�����g*zH[�D%E9��M����M����'d�v�B��N��~ T��J �H4�J얥��/�N�~T��X��a����ber<$��ȣ[�g\��2j�s39)"39�H>J��K�R��Q#�<� �,%0V���������L�-%w��v3#��6�I4�^�D�{����@���i:۷-#� ���?Ð�'�\�Sn�]��:AW���4�+7|������ZΣ���A��Ʀ�|���X�I�q��~��MƇ��°3���J4����y���Z��(ᔿ�BɶT��ު��Ѐa����}��LY�e�a]+%� �:�J�8���� D�Αn�^i?�k�:2�a$���}ѹq*��CE���٭~<�B�����K���|�b���������I�1&�j�8<�Y���S�1� �T-Ysȫ0M�g�����Ha�c��g�o'!���$(S�U���B[{F���me��$]�u�ؼ�i�ǩt����N�ᬾ�ҩG��O@-Ox����*��˧1)���L��P�rÏϻYQa�:�qƸ�(C__�Q��?1�=IZ \շVIn� w1@h��3Rt��}��Ck�o���.�S y�Щ}�����}�]K=��h�:m�Z��9�n�JIVں�8#�B<eIN��y�5]wܖ��Ǝh/h��buj���3B���+�o3K��R_���A����1�/t���S�*=9�%�צB���H��Ya)n�b-��Zl�x����1$TZR���$yp,�f��R��^w�>7�Z��~g�x ӊ�4<Kq�15=�m.���7 ɧ��U����;���n����!��C��(�xhA�Y��zِTӯ�I&��1jW�b�?+��u�I��˭w�C����O8��z�Ks��*,�������K�x-͡uj�.��1*�@��W=��֨����������رY�S�n�#4�qU��(^��'bLZ4���6胔�=���(w�S7��
Static task
static1
Behavioral task
behavioral1
Sample
warthunder.exe
Resource
win10-20230621-en
General
-
Target
warthunder.exe
-
Size
8.3MB
-
MD5
61b544098fdd35110ea44e2c6d2dac0c
-
SHA1
e05d6819def1a90de4224066cbce5a854ff52f1e
-
SHA256
b9b675902a2e35ee7def99f5bca0d1a86051fce27bfc1112bd1e756ce22016db
-
SHA512
80366ea9bd9ef9752b95454986227c7f5ff47e4d13550b54cbec6a93f62c1c6ff1947cb4f4630581997f1537c6e47e40c07e2ca9550b867c864efdf4a6faaa1e
-
SSDEEP
196608:NoylfYACT/E0dKbsPq//Lb/PrvHsGFu6wQz3/WWLYLz:JgACA0MHrb/4GFeQ7/WE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource warthunder.exe
Files
-
warthunder.exe.exe windows x64
408ae3690a29146ead27accbf1c1d01a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetForegroundWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateSolidBrush
advapi32
CryptHashData
msvcp140
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
dwmapi
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9Ex
d3dx9_43
D3DXCreateFontA
imm32
ImmReleaseContext
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertFreeCertificateChain
ws2_32
ntohl
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
abort
api-ms-win-crt-stdio-l1-1-0
_popen
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
sqrtf
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 695KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 510KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zzz0 Size: - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zzz1 Size: 8.2MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ