Crash Team Racing Nitro Fueled Inst[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

Crash Team Racing Nitro Fueled Inst.rar
Size

38.1MB
MD5

f0493394e68b57e2bac0f0d131b8e1af
SHA1

f3550daa829e62ca78d9b59b635428ee3c562b19
SHA256

89b85b6bb250553e09b756da18e3c0371361411a60da4fd45a5930c7b04c9792
SHA512

56d5c3924034541664277bfd870aa356efd5a29b443556d127965bff53553551457954aa325553cb335d61371244326b6ad8a36f5470671c646d70e978f37474
SSDEEP

786432:U9ih97q5HibvYJs04nmMDW14WD2/i/3o441PnuUdhSimKVRJQhQ:U9O7qqvVRWbPPMPu0mQ3QhQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Crash Team Racing Nitro Fueled Inst/Bin/DS8Sound.dll
unpack001/Crash Team Racing Nitro Fueled Inst/Bin/freeimage.dll
unpack001/Crash Team Racing Nitro Fueled Inst/DevIL.dll
unpack001/Crash Team Racing Nitro Fueled Inst/Direct3D.dll

Files

Crash Team Racing Nitro Fueled Inst.rar
.rar

Password: infected
Crash Team Racing Nitro Fueled Inst/Bin/DS8Sound.dll
.dll windows x86

Password: infected

ad91b5a91dfe9203f3164849b5eae501

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dsound

ord11
ord2

libvorbisfile

ov_time_tell
ov_pcm_total
ov_info
ov_open_callbacks
ov_clear
ov_read
ov_time_seek

engine

?SetSignaled@Event@GAME@@QAEXXZ
?Reset@Event@GAME@@QAEXXZ
?GetSignaled@Event@GAME@@QBE_NXZ
?WaitForAny@Event@GAME@@SAXQAPAV12@I@Z
??1Event@GAME@@UAE@XZ
??0Event@GAME@@QAE@_N@Z
?Resume@SoundStream@GAME@@UAEXXZ
?SetFinished@Sound@GAME@@UAEXXZ
?IsPlaying@Sound@GAME@@UAE_NXZ
?SetPlaybackRate@Sound@GAME@@UAEXH@Z
?Set3dPosition@Sound@GAME@@UAEXMMM@Z
?SetFalloffDistances@Sound@GAME@@UAEXMM@Z
?GetTime@Sound@GAME@@UAEXPAH0@Z
??0SoundSample@GAME@@QAE@_N@Z
??1SoundSample@GAME@@UAE@XZ
?Update@Sound@GAME@@UAEXXZ
?RIFFGetChunk@GAME@@YA_NPBXIIAAI1@Z
?StreamReadCallback@SoundSystem@GAME@@SAHPAX0I@Z
?StreamSeekCallback@SoundSystem@GAME@@SAHPAXHH@Z
?StreamTellCallback@SoundSystem@GAME@@SAJPAX@Z
?StreamCloseCallback@SoundSystem@GAME@@SAXPAX@Z
?StreamOpenCallback@SoundSystem@GAME@@SAIPBDPAPAX@Z
?DecLoopCount@Sound@GAME@@QAEHXZ
?Update@SoundStream@GAME@@UAEXXZ
?StreamData@SoundStream@GAME@@UAE_NPBMHHH@Z
?GetStreamTime@SoundStream@GAME@@UBEMXZ
?Enter@CriticalSection@GAME@@QAEXPBD@Z
?Exit@CriticalSection@GAME@@QAEXXZ
??0SoundSystem@GAME@@QAE@XZ
??1SoundSystem@GAME@@UAE@XZ
??0CriticalSection@GAME@@QAE@XZ
??1CriticalSection@GAME@@UAE@XZ
?GetType@Sound@GAME@@QBE?AW4Type@12@XZ
??0SoundStream@GAME@@QAE@_N@Z
??1SoundStream@GAME@@UAE@XZ
?Play@SoundStream@GAME@@UAEXXZ
?Stop@SoundStream@GAME@@UAEXXZ
?Pause@SoundStream@GAME@@UAEXXZ

msvcp140

?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

vcruntime140

__std_exception_copy
_CxxThrowException
_purecall
__std_terminate
_except_handler4_common
memset
memmove
__std_exception_destroy
memcpy
_except_handler3
__CxxFrameHandler3
__std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
terminate
_cexit
_invalid_parameter_noinfo_noreturn
_crt_atexit

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

kernel32

InitializeSListHead
IsDebuggerPresent
CreateThread
CloseHandle
WaitForSingleObject
Sleep
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls

api-ms-win-crt-math-l1-1-0

_libm_sse2_log10_precise

Exports

Exports

??0DS8SoundSystem@GAME@@QAE@XZ
??1DS8SoundSystem@GAME@@UAE@XZ
??_7DS8SoundSystem@GAME@@6B@
?AddDevice@DS8SoundSystem@GAME@@QAEXU_GUID@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?CreateSample@DS8SoundSystem@GAME@@UAEPAVSoundSample@2@_N@Z
?CreateStream@DS8SoundSystem@GAME@@UAEPAVSoundStream@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?CreateStream@DS8SoundSystem@GAME@@UAEPAVSoundStream@2@XZ
?DestroySound@DS8SoundSystem@GAME@@UAEXPAVSound@2@@Z
?GetSoundDeviceNames@DS8SoundSystem@GAME@@UBEXAAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@mem@@@Z
?Initialize@DS8SoundSystem@GAME@@UAE_NPAVEWindow@2@IHHH@Z
?RegisterStream@DS8SoundSystem@GAME@@AAEXPAVDS8SoundStream@2@@Z
?ReleaseObject@DS8SoundSystem@GAME@@AAEXPAVSound@2@@Z
?SetListenerOrientation@DS8SoundSystem@GAME@@UAEXMMMMMM@Z
?SetListenerPosition@DS8SoundSystem@GAME@@UAEXMMM@Z
?SetMasterVolume@DS8SoundSystem@GAME@@UAEXM@Z
?SetSpeakerType@DS8SoundSystem@GAME@@UAEXW4SpeakerType3d@2@@Z
?Shutdown@DS8SoundSystem@GAME@@UAEXXZ
?SpeakerType3dToDSConfig@DS8SoundSystem@GAME@@AAEKW4SpeakerType3d@2@@Z
?Supports3d@DS8SoundSystem@GAME@@UAE_NXZ
?UnregisterStream@DS8SoundSystem@GAME@@AAEXPAVDS8SoundStream@2@@Z
?Update@DS8SoundSystem@GAME@@UAEXXZ
?UpdateStreams@DS8SoundSystem@GAME@@AAE_NXZ
CreateSoundSystem
DestroySoundSystem

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Crash Team Racing Nitro Fueled Inst/Bin/freeimage.dll
.dll windows x86

Password: infected

b2c30533d01b5ae7b5337e0921329f5c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

ntohs
ntohl
htons
htonl

kernel32

GetCurrentProcess
SetEndOfFile
SetEnvironmentVariableA
WriteConsoleW
FreeLibrary
GetModuleFileNameW
GetCurrentDirectoryW
GetProcAddress
LoadLibraryA
SetCurrentDirectoryW
IsBadReadPtr
OutputDebugStringA
DeleteFileA
GetTempPathA
GetTempFileNameA
ExitProcess
CreateFileA
GetFileSizeEx
CloseHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
DebugBreak
WideCharToMultiByte
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetStringTypeW
GetLastError
HeapFree
HeapAlloc
ReadFile
HeapReAlloc
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindClose
RtlUnwind
AreFileApisANSI
GetCommandLineA
GetCurrentThreadId
GetModuleHandleExW
IsProcessorFeaturePresent
FindFirstFileExW
GetDriveTypeW
RaiseException
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
GetStdHandle
WriteFile
HeapSize
IsDebuggerPresent
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetFilePointerEx
GetFileType
FindNextFileW
DeleteFileW
MoveFileExW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryExW
FlushFileBuffers
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetFullPathNameW
CreateFileW
GetTimeZoneInformation
OutputDebugStringW
SetStdHandle

Exports

Exports

FreeImage_OutputMessageProc
_FreeImage_AcquireMemory@12
_FreeImage_AdjustBrightness@12
_FreeImage_AdjustColors@32
_FreeImage_AdjustContrast@12
_FreeImage_AdjustCurve@12
_FreeImage_AdjustGamma@12
_FreeImage_Allocate@24
_FreeImage_AllocateEx@36
_FreeImage_AllocateExT@40
_FreeImage_AllocateHeader@28
_FreeImage_AllocateHeaderForBits@36
_FreeImage_AllocateHeaderT@32
_FreeImage_AllocateT@28
_FreeImage_AppendPage@8
_FreeImage_ApplyColorMapping@24
_FreeImage_ApplyPaletteIndexMapping@20
_FreeImage_Clone@4
_FreeImage_CloneMetadata@8
_FreeImage_CloneTag@4
_FreeImage_CloseMemory@4
_FreeImage_CloseMultiBitmap@8
_FreeImage_ColorQuantize@8
_FreeImage_ColorQuantizeEx@20
_FreeImage_Composite@16
_FreeImage_ConvertFromRawBits@36
_FreeImage_ConvertFromRawBitsEx@44
_FreeImage_ConvertLine16To24_555@12
_FreeImage_ConvertLine16To24_565@12
_FreeImage_ConvertLine16To32_555@12
_FreeImage_ConvertLine16To32_565@12
_FreeImage_ConvertLine16To4_555@12
_FreeImage_ConvertLine16To4_565@12
_FreeImage_ConvertLine16To8_555@12
_FreeImage_ConvertLine16To8_565@12
_FreeImage_ConvertLine16_555_To16_565@12
_FreeImage_ConvertLine16_565_To16_555@12
_FreeImage_ConvertLine1To16_555@16
_FreeImage_ConvertLine1To16_565@16
_FreeImage_ConvertLine1To24@16
_FreeImage_ConvertLine1To32@16
_FreeImage_ConvertLine1To4@12
_FreeImage_ConvertLine1To8@12
_FreeImage_ConvertLine24To16_555@12
_FreeImage_ConvertLine24To16_565@12
_FreeImage_ConvertLine24To32@12
_FreeImage_ConvertLine24To4@12
_FreeImage_ConvertLine24To8@12
_FreeImage_ConvertLine32To16_555@12
_FreeImage_ConvertLine32To16_565@12
_FreeImage_ConvertLine32To24@12
_FreeImage_ConvertLine32To4@12
_FreeImage_ConvertLine32To8@12
_FreeImage_ConvertLine4To16_555@16
_FreeImage_ConvertLine4To16_565@16
_FreeImage_ConvertLine4To24@16
_FreeImage_ConvertLine4To32@16
_FreeImage_ConvertLine4To8@12
_FreeImage_ConvertLine8To16_555@16
_FreeImage_ConvertLine8To16_565@16
_FreeImage_ConvertLine8To24@16
_FreeImage_ConvertLine8To32@16
_FreeImage_ConvertLine8To4@16
_FreeImage_ConvertTo16Bits555@4
_FreeImage_ConvertTo16Bits565@4
_FreeImage_ConvertTo24Bits@4
_FreeImage_ConvertTo32Bits@4
_FreeImage_ConvertTo4Bits@4
_FreeImage_ConvertTo8Bits@4
_FreeImage_ConvertToFloat@4
_FreeImage_ConvertToGreyscale@4
_FreeImage_ConvertToRGB16@4
_FreeImage_ConvertToRGBA16@4
_FreeImage_ConvertToRGBAF@4
_FreeImage_ConvertToRGBF@4
_FreeImage_ConvertToRawBits@32
_FreeImage_ConvertToStandardType@8
_FreeImage_ConvertToType@12
_FreeImage_ConvertToUINT16@4
_FreeImage_Copy@20
_FreeImage_CreateICCProfile@12
_FreeImage_CreateTag@0
_FreeImage_CreateView@20
_FreeImage_DeInitialise@0
_FreeImage_DeletePage@8
_FreeImage_DeleteTag@4
_FreeImage_DestroyICCProfile@4
_FreeImage_Dither@8
_FreeImage_EnlargeCanvas@28
_FreeImage_FIFSupportsExportBPP@8
_FreeImage_FIFSupportsExportType@8
_FreeImage_FIFSupportsICCProfiles@4
_FreeImage_FIFSupportsNoPixels@4
_FreeImage_FIFSupportsReading@4
_FreeImage_FIFSupportsWriting@4
_FreeImage_FillBackground@12
_FreeImage_FindCloseMetadata@4
_FreeImage_FindFirstMetadata@12
_FreeImage_FindNextMetadata@8
_FreeImage_FlipHorizontal@4
_FreeImage_FlipVertical@4
_FreeImage_GetAdjustColorsLookupTable@32
_FreeImage_GetBPP@4
_FreeImage_GetBackgroundColor@8
_FreeImage_GetBits@4
_FreeImage_GetBlueMask@4
_FreeImage_GetChannel@8
_FreeImage_GetColorType@4
_FreeImage_GetColorsUsed@4
_FreeImage_GetComplexChannel@8
_FreeImage_GetCopyrightMessage@0
_FreeImage_GetDIBSize@4
_FreeImage_GetDotsPerMeterX@4
_FreeImage_GetDotsPerMeterY@4
_FreeImage_GetFIFCount@0
_FreeImage_GetFIFDescription@4
_FreeImage_GetFIFExtensionList@4
_FreeImage_GetFIFFromFilename@4
_FreeImage_GetFIFFromFilenameU@4
_FreeImage_GetFIFFromFormat@4
_FreeImage_GetFIFFromMime@4
_FreeImage_GetFIFMimeType@4
_FreeImage_GetFIFRegExpr@4
_FreeImage_GetFileType@8
_FreeImage_GetFileTypeFromHandle@12
_FreeImage_GetFileTypeFromMemory@8
_FreeImage_GetFileTypeU@8
_FreeImage_GetFormatFromFIF@4
_FreeImage_GetGreenMask@4
_FreeImage_GetHeight@4
_FreeImage_GetHistogram@12
_FreeImage_GetICCProfile@4
_FreeImage_GetImageType@4
_FreeImage_GetInfo@4
_FreeImage_GetInfoHeader@4
_FreeImage_GetLine@4
_FreeImage_GetLockedPageNumbers@12
_FreeImage_GetMemorySize@4
_FreeImage_GetMetadata@16
_FreeImage_GetMetadataCount@8
_FreeImage_GetPageCount@4
_FreeImage_GetPalette@4
_FreeImage_GetPitch@4
_FreeImage_GetPixelColor@16
_FreeImage_GetPixelIndex@16
_FreeImage_GetRedMask@4
_FreeImage_GetScanLine@8
_FreeImage_GetTagCount@4
_FreeImage_GetTagDescription@4
_FreeImage_GetTagID@4
_FreeImage_GetTagKey@4
_FreeImage_GetTagLength@4
_FreeImage_GetTagType@4
_FreeImage_GetTagValue@4
_FreeImage_GetThumbnail@4
_FreeImage_GetTransparencyCount@4
_FreeImage_GetTransparencyTable@4
_FreeImage_GetTransparentIndex@4
_FreeImage_GetVersion@0
_FreeImage_GetWidth@4
_FreeImage_HasBackgroundColor@4
_FreeImage_HasPixels@4
_FreeImage_HasRGBMasks@4
_FreeImage_Initialise@4
_FreeImage_InsertPage@12
_FreeImage_Invert@4
_FreeImage_IsLittleEndian@0
_FreeImage_IsPluginEnabled@4
_FreeImage_IsTransparent@4
_FreeImage_JPEGCrop@24
_FreeImage_JPEGCropU@24
_FreeImage_JPEGTransform@16
_FreeImage_JPEGTransformCombined@32
_FreeImage_JPEGTransformCombinedFromMemory@32
_FreeImage_JPEGTransformCombinedU@32
_FreeImage_JPEGTransformFromHandle@40
_FreeImage_JPEGTransformU@16
_FreeImage_Load@12
_FreeImage_LoadFromHandle@16
_FreeImage_LoadFromMemory@12
_FreeImage_LoadMultiBitmapFromMemory@12
_FreeImage_LoadU@12
_FreeImage_LockPage@8
_FreeImage_LookupSVGColor@16
_FreeImage_LookupX11Color@16
_FreeImage_MakeThumbnail@12
_FreeImage_MovePage@12
_FreeImage_MultigridPoissonSolver@8
_FreeImage_OpenMemory@8
_FreeImage_OpenMultiBitmap@24
_FreeImage_OpenMultiBitmapFromHandle@16
_FreeImage_Paste@20
_FreeImage_PreMultiplyWithAlpha@4
_FreeImage_ReadMemory@16
_FreeImage_RegisterExternalPlugin@20
_FreeImage_RegisterLocalPlugin@20
_FreeImage_Rescale@16
_FreeImage_RescaleRect@36
_FreeImage_Rotate@16
_FreeImage_RotateClassic@12
_FreeImage_RotateEx@48
_FreeImage_Save@16
_FreeImage_SaveMultiBitmapToHandle@20
_FreeImage_SaveMultiBitmapToMemory@16
_FreeImage_SaveToHandle@20
_FreeImage_SaveToMemory@16
_FreeImage_SaveU@16
_FreeImage_SeekMemory@12
_FreeImage_SetBackgroundColor@8
_FreeImage_SetChannel@12
_FreeImage_SetComplexChannel@12
_FreeImage_SetDotsPerMeterX@8
_FreeImage_SetDotsPerMeterY@8
_FreeImage_SetMetadata@16
_FreeImage_SetMetadataKeyValue@16
_FreeImage_SetOutputMessage@4
_FreeImage_SetOutputMessageStdCall@4
_FreeImage_SetPixelColor@16
_FreeImage_SetPixelIndex@16
_FreeImage_SetPluginEnabled@8
_FreeImage_SetTagCount@8
_FreeImage_SetTagDescription@8
_FreeImage_SetTagID@8
_FreeImage_SetTagKey@8
_FreeImage_SetTagLength@8
_FreeImage_SetTagType@8
_FreeImage_SetTagValue@8
_FreeImage_SetThumbnail@8
_FreeImage_SetTransparencyTable@12
_FreeImage_SetTransparent@8
_FreeImage_SetTransparentIndex@8
_FreeImage_SwapColors@16
_FreeImage_SwapPaletteIndices@12
_FreeImage_TagToString@12
_FreeImage_TellMemory@4
_FreeImage_Threshold@8
_FreeImage_TmoDrago03@20
_FreeImage_TmoFattal02@20
_FreeImage_TmoReinhard05@20
_FreeImage_TmoReinhard05Ex@36
_FreeImage_ToneMapping@24
_FreeImage_Unload@4
_FreeImage_UnlockPage@12
_FreeImage_WriteMemory@16
_FreeImage_ZLibCRC32@12
_FreeImage_ZLibCompress@16
_FreeImage_ZLibGUnzip@16
_FreeImage_ZLibGZip@16
_FreeImage_ZLibUncompress@16

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Crash Team Racing Nitro Fueled Inst/Crash Team Racing Nitro Fueled - Install.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

06:e0:2f:60:34:8e:c8:5d:cc:af:81:aa:69:6c:17:06:87:5b:72:37
Certificate

Issuer

CN=Ascertia Public CA 1,O=Ascertia,C=GB

Not Before

06/08/2019, 20:50

Not After

06/08/2020, 20:50

Subject

CN=Rodger Monroe,C=Poland,1.2.840.113549.1.9.1=#0c116b3230336a676e33387362406f322e706c

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

e5
Certificate

Issuer

CN=Ascertia Root CA 2,O=Ascertia,C=GB

Not Before

17/04/2009, 13:22

Not After

15/03/2029, 12:59

Subject

CN=Ascertia Root CA 2,O=Ascertia,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e6
Certificate

Issuer

CN=Ascertia Root CA 2,O=Ascertia,C=GB

Not Before

21/04/2009, 12:15

Not After

14/04/2028, 23:59

Subject

CN=Ascertia Public CA 1,O=Ascertia,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a9:4d:8f:e2:bd:91:c6:49:50:d5:75:bc:a7:ad:83:a2:25:ef:5d:15
Signer

Actual PE Digest

a9:4d:8f:e2:bd:91:c6:49:50:d5:75:bc:a7:ad:83:a2:25:ef:5d:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 42.8MB - Virtual size: 42.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Crash Team Racing Nitro Fueled Inst/DevIL.dll
.dll windows x86

Password: infected

857e0474583e8b309cab1d7a7412bf3a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

localtime
longjmp
strncmp
atoi
_pctype
_isctype
__mb_cur_max
fputs
sprintf
fprintf
_setjmp3
_tzset
time
strtol
memcpy
memset
exit
sscanf
getenv
_CIpow
calloc
strftime
fputc
malloc
strlen
strcpy
fflush
strtod
memmove
_assert
floor
vfprintf
qsort
exp
rand
log
sqrt
atan2
strstr
__dllonexit
_onexit
_initterm
_adjust_fdiv
_iob
vsprintf
fwrite
fread
ftell
fseek
fopen
fgetc
fclose
free
_ftol
abs
memcmp
fabs
pow
_strnicmp
_stricmp

kernel32

GlobalSize
GlobalFree
CreateFileA
UnmapViewOfFile
GlobalAlloc
MapViewOfFile
GetFileSize
CreateFileMappingA
SetFilePointer
WriteFile
CloseHandle
ReadFile
GetSystemTime

Exports

Exports

_icalloc@8
_ilModAlpha@4
_ilSetAlpha@4
iBindImageTemp
iConvertImage
iConvertPal
iCopyPal
iGetFlipped
ialloc
ifree
ilActiveImage
ilActiveLayer
ilActiveMipmap
ilApplyPal
ilApplyProfile
ilBindImage
ilBlit
ilClearColour
ilClearImage
ilClearImage_
ilCloneCurImage
ilCloseImage
ilClosePal
ilCompressFunc
ilConvertBuffer
ilConvertImage
ilConvertPal
ilCopyImage
ilCopyImageAttr
ilCopyImage_
ilCopyPixels
ilCreateSubImage
ilDefaultImage
ilDeleteImages
ilDetermineType
ilDisable
ilEnable
ilFormatFunc
ilGenImages
ilGetAlpha
ilGetBoolean
ilGetBooleanv
ilGetBppFormat
ilGetBppPal
ilGetBppType
ilGetClear
ilGetCurImage
ilGetCurName
ilGetDXTCData
ilGetData
ilGetError
ilGetInteger
ilGetIntegerv
ilGetLumpPos
ilGetPalBaseType
ilGetPalette
ilGetString
ilGetTypeBpc
ilHint
ilInit
ilIsDisabled
ilIsEnabled
ilIsImage
ilIsValid
ilIsValidF
ilIsValidL
ilIsValidPal
ilKeyColour
ilLoad
ilLoadData
ilLoadDataF
ilLoadDataL
ilLoadF
ilLoadFromJpegStruct
ilLoadImage
ilLoadL
ilLoadPal
ilNewImage
ilNextPower2
ilOriginFunc
ilOverlayImage
ilPopAttrib
ilPushAttrib
ilRegisterFormat
ilRegisterLoad
ilRegisterMipNum
ilRegisterNumImages
ilRegisterOrigin
ilRegisterPal
ilRegisterSave
ilRegisterType
ilRemoveLoad
ilRemoveSave
ilReplaceCurImage
ilResetMemory
ilResetRead
ilResetWrite
ilResizeImage
ilSave
ilSaveData
ilSaveF
ilSaveFromJpegStruct
ilSaveImage
ilSaveL
ilSavePal
ilSetCurImage
ilSetData
ilSetDuration
ilSetError
ilSetInteger
ilSetMemory
ilSetPal
ilSetPixels
ilSetRead
ilSetString
ilSetWrite
ilShutDown
ilTexImage
ilTexImage_
ilTexSubImage_
ilTypeFromExt
ilTypeFunc

Sections

.text
Size: 659KB - Virtual size: 659KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 753KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Crash Team Racing Nitro Fueled Inst/Direct3D.dll
.dll windows x86

Password: infected

6a1283b2539d99b0c720180596c136bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

d3d9

D3DPERF_BeginEvent
D3DPERF_EndEvent
D3DPERF_SetMarker
Direct3DCreate9

d3dx9_43

D3DXAssembleShader

kernel32

EnterCriticalSection
GetCurrentProcess
Sleep
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
CloseHandle
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryA
GetCurrentThreadId
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
OutputDebugStringW
TerminateProcess

user32

GetDC
GetDesktopWindow

gdi32

SetDeviceGammaRamp

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantInit

engine

??0CriticalSectionLock@GAME@@QAE@PBDAAVCriticalSection@1@_N@Z
??1CriticalSection@GAME@@UAE@XZ
??0CriticalSection@GAME@@QAE@XZ
??0RenderVertexDeclaration@GAME@@QAE@XZ
?GetGraphicsEngine@Engine@GAME@@QBEPAVGraphicsEngine@2@XZ
?UnregisterVertexDeclaration@GraphicsEngine@GAME@@QAEXPAVRenderVertexDeclaration@2@@Z
??0RenderVertexBuffer@GAME@@QAE@XZ
??1CriticalSectionLock@GAME@@QAE@XZ
??0RenderTexture@GAME@@QAE@XZ
??1RenderTexture@GAME@@UAE@XZ
??0RenderSurface@GAME@@QAE@XZ
??1RenderSurface@GAME@@UAE@XZ
??1RenderPixelShader@GAME@@UAE@XZ
??0RenderPixelShader@GAME@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0RenderIndexBuffer@GAME@@QAE@XZ
??1RenderIndexBuffer@GAME@@UAE@XZ
??0RenderDynamicVertexBuffer@GAME@@QAE@XZ
??1RenderDynamicVertexBuffer@GAME@@UAE@XZ
??0RenderVertexShader@GAME@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1RenderVertexShader@GAME@@UAE@XZ
??1RenderVertexBuffer@GAME@@UAE@XZ
??1RenderVertexDeclaration@GAME@@UAE@XZ
??0RenderDynamicIndexBuffer@GAME@@QAE@XZ
??1RenderDynamicIndexBuffer@GAME@@UAE@XZ
?gEngine@GAME@@3PAVEngine@1@A
?CreateLogCategory@Engine@GAME@@QAEIPBD@Z
??1RenderDevice@GAME@@UAE@XZ
??0Viewport@GAME@@QAE@XZ
?GetNameForGeneration@RenderDevice@GAME@@SAPBDW4RenderGenerationId@2@@Z
??0Viewport@GAME@@QAE@HHHH@Z
?PreDeviceReset@Engine@GAME@@QAEXXZ
?PostDeviceReset@Engine@GAME@@QAEXXZ
?SetDeviceLost@Engine@GAME@@QAEXXZ
??0RenderPass@GAME@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1RenderPass@GAME@@UAE@XZ
?AllowAlphaToCoverage@Engine@GAME@@QAE_NXZ
?noName@Name@GAME@@2V12@B
?GetWidth@Viewport@GAME@@QBEHXZ
?GetHeight@Viewport@GAME@@QBEHXZ
?Suspend@RenderDevice@GAME@@UAEXXZ
?Resume@RenderDevice@GAME@@UAEXXZ
??0RenderDevice@GAME@@QAE@XZ

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

vcruntime140

__std_exception_copy
__std_exception_destroy
memmove
__std_terminate
_CxxThrowException
memset
_except_handler4_common
__CxxFrameHandler3
__std_type_info_destroy_list
memcpy
__vcrt_InitializeCriticalSectionEx

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswscanf
__stdio_common_vsprintf

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_cexit
_crt_atexit
_seh_filter_dll
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
exit

api-ms-win-crt-string-l1-1-0

strncpy
_wcsicmp

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
_recalloc
calloc
free

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

api-ms-win-crt-math-l1-1-0

_except1
__libm_sse2_powf

Exports

Exports

?CreateTextureFromDDS@GAME@@YA?AW4InitTextureResult@1@PAUIDirect3DDevice9@@W4_D3DPOOL@@PBXIHAAPAUIDirect3DBaseTexture9@@@Z
CreateRenderDevice
DestroyRenderDevice

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

ad91b5a91dfe9203f3164849b5eae501

Headers

DLL Characteristics

File Characteristics

Imports

dsound

libvorbisfile

engine

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 1024B - Virtual size: 1KB

.gfids Size: 512B - Virtual size: 68B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

Password: infected

b2c30533d01b5ae7b5337e0921329f5c

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

Exports

Exports

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 1.6MB - Virtual size: 1.6MB

_RDATA Size: 512B - Virtual size: 32B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 83KB - Virtual size: 83KB

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

06:e0:2f:60:34:8e:c8:5d:cc:af:81:aa:69:6c:17:06:87:5b:72:37Certificate

Extended Key Usages

Key Usages

e5Certificate

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

e6Certificate

Key Usages

a9:4d:8f:e2:bd:91:c6:49:50:d5:75:bc:a7:ad:83:a2:25:ef:5d:15Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 42.8MB - Virtual size: 42.8MB

.sdata Size: 512B - Virtual size: 232B

.rsrc Size: 70KB - Virtual size: 69KB

.reloc Size: 512B - Virtual size: 12B

Password: infected

857e0474583e8b309cab1d7a7412bf3a

Headers

File Characteristics

Imports

msvcrt

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 1024B - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 68B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 1.6MB - Virtual size: 1.6MB

_RDATA
Size: 512B - Virtual size: 32B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 83KB - Virtual size: 83KB

06:e0:2f:60:34:8e:c8:5d:cc:af:81:aa:69:6c:17:06:87:5b:72:37
Certificate

e5
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

e6
Certificate

a9:4d:8f:e2:bd:91:c6:49:50:d5:75:bc:a7:ad:83:a2:25:ef:5d:15
Signer

.text
Size: 42.8MB - Virtual size: 42.8MB

.sdata
Size: 512B - Virtual size: 232B

.rsrc
Size: 70KB - Virtual size: 69KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 659KB - Virtual size: 659KB

.rdata
Size: 116KB - Virtual size: 115KB

.data
Size: 38KB - Virtual size: 753KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 22KB - Virtual size: 22KB

.text
Size: 58KB - Virtual size: 57KB

.rdata
Size: 22KB - Virtual size: 22KB

.data
Size: 512B - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 76B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 3KB - Virtual size: 2KB