Downloader_Diablo2_esES[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Downloader_Diablo2_esES.exe
Size

2.7MB
MD5

f7006cf6c31c0d9a8836535d9d74870d
SHA1

d24cad35f1f3975246a4b1e9293fd3d6bde5632f
SHA256

c13cd7fe0d636b20d0d3b4e166ebae1f69784fd77b7d1c576c7d00ecaa933ec1
SHA512

a8a77bc0ee602de0ab552b56355172c9e6ed17d2e0791b66a430870b4ab23b2a9f850707f3e8149c4591ab2e453dee735375a4bf618339b996186f85c1f5b00b
SSDEEP

49152:b2BYDgYLCnujaMULb2DJT1JRWp1N9RoHxPhLniyOyhIhAMq2hqc:4YDgY2Yef2TXCHoHuyOyhIC9c

Score

1^/10

Malware Config

Signatures

Files

Downloader_Diablo2_esES.exe
.exe windows x86

e02f6df9332fe99ce17da2b92e902068

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:d9:00:6d:6b:07:5e:81:fc:79:87:59:6b:6b:5e:56
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

14/11/2015, 00:00

Not After

18/01/2018, 12:00

Subject

CN=Blizzard Entertainment\, Inc.,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1b:d5:71:fc:77:23:9f:4d:1e:ca:3a:f0:52:25:f5:14:5d:d2:8c:2b
Signer

Actual PE Digest

1b:d5:71:fc:77:23:9f:4d:1e:ca:3a:f0:52:25:f5:14:5d:d2:8c:2b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetReadFileExA
HttpQueryInfoA
InternetSetOptionA
InternetConnectA
InternetSetStatusCallbackA
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetSetCookieW
InternetCrackUrlW
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetReadFile
InternetSetStatusCallbackW
InternetSetOptionW
HttpQueryInfoW
InternetReadFileExW
InternetCloseHandle
InternetGetConnectedState

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

comctl32

InitCommonControlsEx

kernel32

GetModuleHandleW
GetCurrentThreadId
DeleteFileW
GetUserDefaultLangID
CreateThread
LoadLibraryW
GetProcAddress
FreeLibrary
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetDriveTypeA
GetCurrentDirectoryA
CreateFileA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
SetStdHandle
GetConsoleMode
GetConsoleCP
HeapCreate
HeapDestroy
GetEnvironmentStringsW
GetSystemInfo
GetCurrentProcessId
GetCommandLineW
LocalFree
OpenMutexW
CreateMutexW
CreateFileW
GetLastError
CreateEventW
WaitForSingleObject
SetEvent
WriteFile
CloseHandle
GetModuleFileNameW
GetComputerNameA
GetExitCodeProcess
CreateProcessA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsValidCodePage
GetOEMCP
GetACP
GetFileType
SetHandleCount
HeapSize
GetStdHandle
GetCPInfo
LCMapStringW
LCMapStringA
SetConsoleCtrlHandler
ExitThread
GetFullPathNameW
HeapReAlloc
GetStartupInfoA
GetProcessHeap
HeapAlloc
HeapFree
GetCommandLineA
ExitProcess
RtlUnwind
RaiseException
UnhandledExceptionFilter
TerminateProcess
InterlockedExchange
FindResourceW
LoadResource
LockResource
SizeofResource
FreeResource
VirtualFree
VirtualAlloc
LocalAlloc
MulDiv
GlobalAlloc
GlobalFree
SetLastError
GetVersionExA
SetFileTime
SetFileAttributesW
SetEndOfFile
RemoveDirectoryW
SetFilePointer
GetShortPathNameW
GetDiskFreeSpaceExW
FlushFileBuffers
FindFirstFileW
FindNextFileW
FindClose
ReadFile
TlsSetValue
DuplicateHandle
VirtualQuery
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentProcess
LoadLibraryA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetModuleHandleA
GlobalMemoryStatus
Sleep
SetThreadPriority
GetThreadPriority
TlsGetValue
TlsFree
SignalObjectAndWait
QueryPerformanceCounter
GetTickCount
GetCurrentThread
FileTimeToLocalFileTime
FileTimeToSystemTime
TlsAlloc
QueryPerformanceFrequency
GetModuleFileNameA
GetCurrentDirectoryW
GetComputerNameW
GetTempPathW
MultiByteToWideChar
WideCharToMultiByte
GetVersionExW
GetFileAttributesA
GetDiskFreeSpaceW
InterlockedDecrement
InterlockedIncrement
GetFileAttributesExW
GetFileSize
SetCurrentDirectoryW
GetFileAttributesW
CreateDirectoryW
MoveFileW
GetTempFileNameW
GetSystemTimeAsFileTime
SetThreadAffinityMask

user32

EndDialog
InvalidateRect
SetDlgItemTextW
SetWindowLongW
GetDlgItem
SetWindowTextW
ReleaseDC
GetWindowRect
GetDC
GetWindowTextLengthW
IsWindowVisible
SetTimer
ModifyMenuW
GetMenu
MoveWindow
ScreenToClient
SetFocus
LoadImageW
LoadIconW
SendMessageW
BringWindowToTop
KillTimer
GetWindowTextW
ShowWindow
GetDesktopWindow
DialogBoxParamW
MessageBoxW
FindWindowW
IsWindow
FillRect
TrackPopupMenu
PostMessageW
SetForegroundWindow
DefWindowProcW
GetWindowDC
OffsetRect
ClientToScreen
SetRect
DrawTextW
InflateRect
LoadMenuW
LoadAcceleratorsW
SetWindowsHookExW
GetMenuItemCount
GetSubMenu
IsIconic
DrawIcon
DestroyMenu
UnhookWindowsHookEx
TranslateAcceleratorW
CallNextHookEx
GetDlgCtrlID
GetClientRect
GetSystemMetrics
SetWindowPos
GetScrollInfo
CheckDlgButton
IsDlgButtonChecked
DestroyWindow
MsgWaitForMultipleObjects
CopyImage
CallWindowProcW
GetWindowLongW
TrackMouseEvent
SetWindowRgn
IsWindowEnabled
DrawIconEx
CreateWindowExW
PtInRect
IsZoomed
CreateDialogParamW
SetMenuDefaultItem
EnableMenuItem
RemoveMenu
GetSystemMenu
DestroyIcon
EndPaint
BeginPaint
DrawFocusRect
GetParent
GetFocus
SetCapture
ReleaseCapture
GetClassNameW
IsMenu
GetMenuItemID
GetMenuStringW
GetMenuItemInfoW
RemovePropW
GetPropW
SetCursor
LoadCursorW
GetCapture
SetPropW
EnumChildWindows
SystemParametersInfoW
GetWindowPlacement
SetWindowPlacement
EnableWindow
EnumWindows

gdi32

CreateFontIndirectW
GetDeviceCaps
RestoreDC
SaveDC
GetTextColor
SelectClipRgn
CreateRectRgnIndirect
GetObjectW
SetPixel
DeleteDC
CreatePolygonRgn
SelectObject
StretchBlt
CreateCompatibleBitmap
CreateCompatibleDC
SetTextColor
SetBkColor
SetBkMode
GetStockObject
LineTo
MoveToEx
DeleteObject
CreateEllipticRgn
CreatePen
Rectangle
ExcludeClipRect
CreateSolidBrush
CreateRectRgn
GetPixel
BitBlt
GetTextExtentPoint32W

comdlg32

GetSaveFileNameW

shell32

Shell_NotifyIconW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteW

ole32

OleSetContainedObject
OleInitialize
CoInitialize
CoUninitialize
OleCreate
CoCreateInstance
CreateStreamOnHGlobal

msimg32

TransparentBlt

iphlpapi

GetTcpTable
GetAdaptersInfo

rpcrt4

UuidCreate

ws2_32

connect
sendto
inet_addr
ntohl
getpeername
getsockname
ntohs
inet_ntoa
send
WSACleanup
accept
ioctlsocket
select
WSAGetLastError
WSASetLastError
WSAStartup
setsockopt
getsockopt
socket
closesocket
__WSAFDIsSet
listen
bind
recv
gethostname
gethostbyname
htonl
htons

advapi32

RegDeleteKeyA
RegCloseKey
RegEnumKeyExW
GetUserNameW
MapGenericMask
AccessCheck
OpenThreadToken
OpenProcessToken
DuplicateToken
GetFileSecurityW
RegOpenKeyExA
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExA
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW

oleaut32

SysStringLen
SysFreeString
VariantInit
SysAllocString
VariantClear
OleLoadPicture

Sections

.text
Size: 800KB - Virtual size: 799KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 284KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e02f6df9332fe99ce17da2b92e902068

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

07:d9:00:6d:6b:07:5e:81:fc:79:87:59:6b:6b:5e:56Certificate

Extended Key Usages

Key Usages

1b:d5:71:fc:77:23:9f:4d:1e:ca:3a:f0:52:25:f5:14:5d:d2:8c:2bSigner

Headers

DLL Characteristics

File Characteristics

Imports

wininet

version

comctl32

kernel32

user32

gdi32

comdlg32

shell32

ole32

msimg32

iphlpapi

rpcrt4

ws2_32

advapi32

oleaut32

Sections

.text Size: 800KB - Virtual size: 799KB

.rdata Size: 284KB - Virtual size: 280KB

.data Size: 28KB - Virtual size: 80KB

.rsrc Size: 132KB - Virtual size: 131KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

07:d9:00:6d:6b:07:5e:81:fc:79:87:59:6b:6b:5e:56
Certificate

1b:d5:71:fc:77:23:9f:4d:1e:ca:3a:f0:52:25:f5:14:5d:d2:8c:2b
Signer

.text
Size: 800KB - Virtual size: 799KB

.rdata
Size: 284KB - Virtual size: 280KB

.data
Size: 28KB - Virtual size: 80KB

.rsrc
Size: 132KB - Virtual size: 131KB