UnityPlayer[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

UnityPlayer.dll
Size

21.3MB
MD5

f1aa90b6b27af6db0e6666d4c74eba35
SHA1

9444e6340ecc9209c9be320dc19f7800b96ff1ff
SHA256

3677f08abfed2b098866b368fe28c806654dbf28cee86631b385f42638d6aaf9
SHA512

09c474be06acec73d6ab416d325cd1e196d420f9f7ced9b28be7b438c90dbda05c82c445641b35996ccb8b9ef03e8dd2043ab44abd67a08113e6d71736e51119
SSDEEP

393216:QnM0lSD4++HmbRNH1k3IKk3iKbA7Fze3MUcy+6QlwZP0rwWy:Qn7unOg0

Score

1^/10

Malware Config

Signatures

Files

UnityPlayer.dll
.dll windows x64

ef96b5130c8331f54235176bb35e044d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:57:79:00:b9:b5:a8:e4:48:a6:65:28:c7:76:0d:31
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/06/2015, 00:00

Not After

11/07/2018, 23:59

Subject

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:08:2c:b3:c6:4c:a5:4c:1f:11:f3:e7:17:84:3a:c7:9e:0d:fc:21
Signer

Actual PE Digest

1f:08:2c:b3:c6:4c:a5:4c:1f:11:f3:e7:17:84:3a:c7:9e:0d:fc:21

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

hid

HidD_GetManufacturerString
HidD_GetSerialNumberString
HidD_GetIndexedString
HidD_GetAttributes
HidP_GetCaps
HidP_GetButtonCaps
HidP_GetValueCaps
HidP_MaxDataListLength
HidP_GetData
HidD_GetProductString
HidD_FreePreparsedData
HidD_GetPreparsedData
HidP_InitializeReportForID
HidP_SetUsageValue
HidP_SetUsageValueArray
HidD_GetHidGuid

kernel32

CreateIoCompletionPort
GetQueuedCompletionStatus
GetSystemTimeAsFileTime
GetModuleFileNameW
IsDebuggerPresent
InitializeCriticalSection
ResetEvent
GlobalAlloc
GlobalLock
GlobalUnlock
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
SetLastError
ReadProcessMemory
GetThreadContext
SuspendThread
ResumeThread
WriteFile
ReadFile
SetEndOfFile
SetFilePointer
SetFilePointerEx
FindClose
SetFileTime
GetSystemTime
CreateMutexA
GetModuleFileNameA
GetEnvironmentVariableA
ExpandEnvironmentStringsW
OutputDebugStringA
GetTempFileNameW
GetCurrentDirectoryA
GetDiskFreeSpaceExA
CreateDirectoryW
RemoveDirectoryW
CreateFileW
SetFileAttributesW
GetFileAttributesA
GetFileAttributesW
GetFileAttributesExW
DeleteFileW
FindFirstFileExW
FindFirstFileW
FindNextFileW
CopyFileW
MoveFileExW
ReplaceFileW
GetVersionExA
VerSetConditionMask
GlobalMemoryStatusEx
LocalAlloc
GetTickCount
GetTempPathW
GetComputerNameW
GetVersionExW
VerifyVersionInfoW
GetSystemPowerStatus
GetUserDefaultUILanguage
SetUnhandledExceptionFilter
DebugBreak
GetCommandLineW
GetCurrentDirectoryW
LoadLibraryExW
TerminateProcess
GetStartupInfoA
GetOverlappedResult
WaitForMultipleObjects
CancelIo
GetFileSize
SetThreadPriority
VirtualQuery
SetErrorMode
GetFileTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
lstrcpyA
lstrlenA
GetStdHandle
GetWindowsDirectoryW
GetCurrentProcess
FlushConsoleInputBuffer
GetProcessAffinityMask
ExitThread
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
CreateFileA
OpenEventA
SetWaitableTimer
CreateWaitableTimerA
GetSystemDirectoryA
FindNextFileA
FindFirstFileExA
GetCurrentThreadId
RtlUnwindEx
RtlPcToFileHeader
DecodePointer
EncodePointer
LoadLibraryExA
CreateMutexW
FlushInstructionCache
CreateSemaphoreW
SignalObjectAndWait
ReleaseMutex
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteConsoleW
GetOEMCP
IsValidCodePage
GetCPInfo
FlushFileBuffers
GetProcessHeap
SetStdHandle
GetConsoleCP
ReadConsoleW
GetStringTypeW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStartupInfoW
GetACP
HeapAlloc
HeapFree
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
GetFullPathNameA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
SetConsoleCtrlHandler
DuplicateHandle
HeapQueryInformation
HeapSize
HeapReAlloc
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
IsProcessorFeaturePresent
UnhandledExceptionFilter
VerifyVersionInfoA
ExpandEnvironmentStringsA
InitializeCriticalSectionEx
GetFileType
CreateThread
SleepEx
RaiseException
FormatMessageW
GetCurrentThread
SwitchToThread
GetCurrentProcessId
SetHandleInformation
SetDllDirectoryW
LoadLibraryW
GetFullPathNameW
GetModuleHandleW
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
SetThreadAffinityMask
EnterCriticalSection
WideCharToMultiByte
CreateEventA
MultiByteToWideChar
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryA
FreeLibrary
GetCommandLineA
GetModuleHandleA
GetProcAddress
CreateEventW
WaitForSingleObjectEx
SetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
CreateSemaphoreA
FormatMessageA
SystemTimeToFileTime
GetTimeZoneInformation
GetSystemInfo
GetLocalTime
CloseHandle
Sleep
WaitForSingleObject
ReleaseSemaphore
GetLastError
LocalFree
GlobalMemoryStatus

user32

RegisterRawInputDevices
GetRawInputDeviceInfoW
GetRawInputData
SystemParametersInfoW
PtInRect
ClientToScreen
GetCursorPos
ReleaseCapture
GetKeyNameTextW
GetAsyncKeyState
UnregisterDeviceNotification
RegisterDeviceNotificationW
GetRawInputDeviceList
GetMessageTime
GetMessagePos
TrackMouseEvent
UpdateWindow
MonitorFromRect
ValidateRect
DragDetect
GetActiveWindow
PeekMessageA
GetMessageA
GetMonitorInfoA
MonitorFromPoint
IsDialogMessageW
CopyImage
wvsprintfA
wsprintfA
GetMessageExtraInfo
MessageBoxW
GetClipboardData
SetClipboardData
OpenClipboard
CloseClipboard
EnumDisplaySettingsA
GetCaretBlinkTime
IsWindowVisible
MessageBoxA
KillTimer
SetCapture
SetTimer
MonitorFromWindow
IsClipboardFormatAvailable
GetSystemMetrics
SetCursor
LoadCursorA
DestroyCursor
DestroyIcon
CreateIconIndirect
GetThreadDesktop
GetUserObjectInformationA
RegisterWindowMessageA
SendMessageA
SendMessageTimeoutA
ShowWindow
IsIconic
SetForegroundWindow
EnumWindows
SetWindowPos
GetWindowPlacement
CreateDialogParamA
GetDlgItem
GetClientRect
GetWindowRect
AdjustWindowRectEx
ScreenToClient
GetWindowLongA
SetWindowLongA
GetWindowLongPtrA
SetWindowLongPtrA
GetParent
ChangeDisplaySettingsW
EnumDisplaySettingsW
GetMonitorInfoW
EnumDisplayMonitors
UnregisterClassW
RegisterClassExW
DialogBoxParamW
EndDialog
SetDlgItemTextA
SetDlgItemTextW
SendDlgItemMessageW
CopyRect
OffsetRect
LoadIconA
GetAncestor
DispatchMessageA
TranslateMessage
DispatchMessageW
PeekMessageW
GetUserObjectInformationW
GetProcessWindowStation
PostQuitMessage
RegisterClassW
CreateDialogParamW
DialogBoxParamA
CheckDlgButton
IsDlgButtonChecked
SetFocus
GetFocus
GetKeyState
MsgWaitForMultipleObjects
EnableWindow
SetWindowTextW
ShowCursor
SetCursorPos
ClipCursor
GetWindowLongPtrW
SetWindowLongPtrW
LoadImageW
EnumDisplayDevicesA
GetDesktopWindow
ReleaseDC
GetDC
DestroyWindow
CreateWindowExW
DefWindowProcW
EmptyClipboard

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoA

ole32

CoInitialize
PropVariantClear
CoCreateGuid
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoSetProxyBlanket
StringFromGUID2
CoUninitialize

shlwapi

PathCanonicalizeW
SHDeleteKeyW
PathFileExistsW

setupapi

SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsA

advapi32

CryptAcquireContextA
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegSetValueExA
RegQueryValueExA
RegDeleteValueA
RegCreateKeyW
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
RegSetValueExW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
GetUserNameA
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
SystemFunction036

gdi32

SwapBuffers
GetObjectA
GetDeviceCaps
CreateDIBSection
DeleteObject
ChoosePixelFormat
SetPixelFormat
CreateBitmap

shell32

ShellExecuteW
SHFileOperationW
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExA

opengl32

wglGetProcAddress
wglGetCurrentDC
wglGetCurrentContext
wglDeleteContext
wglCreateContext
wglMakeCurrent

winmm

waveOutGetNumDevs
waveInGetNumDevs
waveOutGetDevCapsA
waveOutGetDevCapsW
timeEndPeriod
waveOutClose
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
waveOutOpen
timeGetTime
waveOutReset
waveOutGetPosition
waveInGetDevCapsA
waveInGetDevCapsW
waveInOpen
waveInClose
waveInPrepareHeader
waveInUnprepareHeader
waveInAddBuffer
waveInStart
waveInReset
timeBeginPeriod

ws2_32

ioctlsocket
accept
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
gethostname
listen
inet_ntoa
inet_addr
htons
getsockname
connect
closesocket
bind
ntohl
htonl
ntohs
recvfrom
select
send
setsockopt
shutdown
WSASetLastError
WSAIoctl
WSASocketA
getaddrinfo
freeaddrinfo
getnameinfo
getpeername
recv
gethostbyname
getprotobyname
WSARecvFrom
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
WSASetEvent
getsockopt
WSAAsyncGetHostByName
WSACancelAsyncRequest
socket
sendto

oleaut32

VariantChangeType
SysFreeString
SysAllocString
VariantClear
VariantInit

imm32

ImmGetContext
ImmAssociateContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetConversionStatus
ImmSetOpenStatus
ImmReleaseContext

dnsapi

DnsQuery_A
DnsFree

iphlpapi

GetIpAddrTable

winhttp

WinHttpGetIEProxyConfigForCurrentUser

Exports

Exports

UnityMain

Sections

.text
Size: 16.8MB - Virtual size: 16.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 605KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 892KB - Virtual size: 891KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.trace
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ef96b5130c8331f54235176bb35e044d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

07:57:79:00:b9:b5:a8:e4:48:a6:65:28:c7:76:0d:31Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

1f:08:2c:b3:c6:4c:a5:4c:1f:11:f3:e7:17:84:3a:c7:9e:0d:fc:21Signer

Headers

DLL Characteristics

File Characteristics

Imports

hid

kernel32

user32

version

ole32

shlwapi

setupapi

advapi32

gdi32

shell32

opengl32

winmm

ws2_32

oleaut32

imm32

dnsapi

iphlpapi

winhttp

Exports

Exports

Sections

.text Size: 16.8MB - Virtual size: 16.8MB

.rdata Size: 2.8MB - Virtual size: 2.8MB

.data Size: 605KB - Virtual size: 1.3MB

.pdata Size: 892KB - Virtual size: 891KB

.rodata Size: 3KB - Virtual size: 2KB

.gfids Size: 512B - Virtual size: 492B

.tls Size: 512B - Virtual size: 9B

_RDATA Size: 48KB - Virtual size: 47KB

.trace Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 108KB - Virtual size: 107KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07:57:79:00:b9:b5:a8:e4:48:a6:65:28:c7:76:0d:31
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

1f:08:2c:b3:c6:4c:a5:4c:1f:11:f3:e7:17:84:3a:c7:9e:0d:fc:21
Signer

.text
Size: 16.8MB - Virtual size: 16.8MB

.rdata
Size: 2.8MB - Virtual size: 2.8MB

.data
Size: 605KB - Virtual size: 1.3MB

.pdata
Size: 892KB - Virtual size: 891KB

.rodata
Size: 3KB - Virtual size: 2KB

.gfids
Size: 512B - Virtual size: 492B

.tls
Size: 512B - Virtual size: 9B

_RDATA
Size: 48KB - Virtual size: 47KB

.trace
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 108KB - Virtual size: 107KB