Static task
static1
General
-
Target
EasyXnb_2.4.zip
-
Size
1.7MB
-
MD5
ed5e93c44014cb858f4003022f60b1ad
-
SHA1
4ad5cdbb231939a7ba9bcf3205811f5e1532fe1d
-
SHA256
db140e78d33d76f0857a5ffafef85b85f9a0407df053020d8f13a5453b2a0b4c
-
SHA512
269133dc4d156c84ce5e6ec2cfb666391a843f044ac67256ef362a570a64ea9b75d97f3099d2c37f710d2c8963c15ad82bd18e051feb82b5a430f555c7778218
-
SSDEEP
49152:opnun0k0Gn+5NppkTQ3prqV5Jb6vfXYfN4f:6m2NFCbSf5
Malware Config
Signatures
-
Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/EasyXnb.exe unpack001/Microsoft.Xna.Framework.Content.Pipeline.EffectImporter.dll unpack001/Microsoft.Xna.Framework.Content.Pipeline.FBXImporter.dll unpack001/Microsoft.Xna.Framework.Content.Pipeline.TextureImporter.dll unpack001/Microsoft.Xna.Framework.Content.Pipeline.dll unpack001/Microsoft.Xna.Framework.Game.dll unpack001/Microsoft.Xna.Framework.Graphics.dll unpack001/Microsoft.Xna.Framework.dll
Files
-
EasyXnb_2.4.zip.zip
-
EasyXnb.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
EasyXnb.exe.config.xml
-
EasyXnb.pdb
-
Microsoft.Xna.Framework.Content.Pipeline.EffectImporter.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Microsoft.Xna.Framework.Content.Pipeline.FBXImporter.dll.dll windows x86
65b6691bb4ca62c7255550af447d0d11
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcr100
_crt_debugger_hook
__CxxFrameHandler3
_CIsqrt
_CIsin
_CIcos
_CIasin
_CIatan2
strncmp
memset
memmove
sprintf
_HUGE
memcpy
floor
ceil
_stricmp
sscanf
atof
atoi
strtoul
strtol
isspace
isdigit
fclose
tolower
vsprintf
vfprintf
toupper
fopen
malloc
calloc
realloc
_msize
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
_except_handler4_common
??2@YAPAXI@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
_CIfmod
modf
strstr
strtok
strncpy
bsearch
_time64
rand
srand
strpbrk
remove
strcspn
qsort
_mkdir
getenv
strchr
strrchr
wcsrchr
_utime64
_tempnam
_stat64i32
fwrite
fread
rename
_fullpath
_chdir
_chdrive
_getcwd
_access
_makepath
_splitpath
_unlock_file
_ungetc_nolock
_filbuf
_lock_file
wcstok
wcsncpy
wcsncmp
mbstowcs
_CIexp
_CIlog
_CIacos
_CIatan
_CItan
strtod
_CIpow
_snprintf
??_U@YAPAXI@Z
??_V@YAXPAX@Z
fprintf
__iob_func
_strtoi64
_logb
_wfopen
fscanf
_fseeki64
_ftelli64
ferror
clearerr
feof
fputs
_chsize
_fileno
_wremove
atol
isalnum
isupper
_vsnprintf
_finite
_isnan
setlocale
printf
_getpid
_gmtime64
rewind
_wstat64i32
_errno
tmpnam
wcschr
_vsnwprintf
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
??3@YAXPAX@Z
_controlfp_s
memchr
__FrameUnwindFilter
_cexit
_purecall
strnlen
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
advapi32
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
kernel32
GetLastError
FormatMessageW
LocalFree
IsProcessorFeaturePresent
EncodePointer
DecodePointer
InterlockedExchange
Sleep
InterlockedCompareExchange
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
CreateMutexA
CloseHandle
WaitForSingleObjectEx
ReleaseMutex
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
FindFirstFileW
MultiByteToWideChar
SetErrorMode
FindNextFileW
FindClose
WideCharToMultiByte
RemoveDirectoryW
DeleteFileW
SetFileAttributesW
GetTempPathA
FindFirstFileA
RemoveDirectoryA
FindNextFileA
GetCurrentDirectoryA
SetThreadPriority
GetThreadPriority
GetCurrentThread
SetPriorityClass
GetPriorityClass
QueryPerformanceFrequency
GetProcessAffinityMask
GetLocalTime
TlsSetValue
TlsAlloc
DuplicateHandle
GetExitCodeThread
ResumeThread
TerminateThread
TlsGetValue
CreateThread
msvcp100
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??1_Container_base12@std@@QAE@XZ
?_Lockit_ctor@_Lockit@std@@SAXH@Z
?_Lockit_dtor@_Lockit@std@@SAXH@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
mscoree
_CorDllMain
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 378KB - Virtual size: 378KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 45KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Microsoft.Xna.Framework.Content.Pipeline.TextureImporter.dll.dll windows x86
af42357bfaa804f9b5cc8952cda576a7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcr100
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
_malloc_crt
__clean_type_info_names_internal
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
??3@YAXPAX@Z
??2@YAPAXI@Z
_cexit
__FrameUnwindFilter
free
_crt_debugger_hook
kernel32
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
EncodePointer
DecodePointer
InterlockedExchange
d3dx9_41
D3DXGetImageInfoFromFileW
D3DXCreateVolumeTextureFromFileExW
D3DXCreateTextureFromFileExW
D3DXCreateCubeTextureFromFileExW
d3d9
Direct3DCreate9
mscoree
_CorDllMain
Sections
.text Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Microsoft.Xna.Framework.Content.Pipeline.dll.dll windows x86
d5ab6642da2bed9134073f6eba5f920f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcr100
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
??3@YAXPAX@Z
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_crt_debugger_hook
??2@YAPAXI@Z
memcpy_s
_cexit
__FrameUnwindFilter
kernel32
LoadLibraryW
GetProcAddress
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
EncodePointer
DecodePointer
InterlockedExchange
Sleep
InterlockedCompareExchange
DisableThreadLibraryCalls
UnhandledExceptionFilter
gdi32
DeleteDC
GetGlyphIndicesW
GetCharABCWidthsFloatW
CreateCompatibleDC
SelectObject
d3dx9_41
D3DXOptimizeVertices
D3DXCreateEffectCompiler
D3DXCreateMesh
D3DXComputeTangentFrameEx
D3DXLoadSurfaceFromMemory
D3DXCreateBuffer
D3DXOptimizeFaces
d3d9
Direct3DCreate9
user32
CreateWindowExW
DestroyWindow
SetRect
mscoree
_CorDllMain
Sections
.text Size: 190KB - Virtual size: 190KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 327KB - Virtual size: 327KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Microsoft.Xna.Framework.Game.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Microsoft.Xna.Framework.Graphics.dll.dll windows x86
ff527fd3b60f1fc076751d5e97913d5b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedIncrement
InterlockedDecrement
LoadLibraryW
FreeLibrary
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
msvcr100
_unlock
__dllonexit
_lock
_onexit
__FrameUnwindFilter
_cexit
__CxxQueryExceptionSize
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
??2@YAPAXI@Z
?terminate@@YAXXZ
??_V@YAXPAX@Z
??3@YAXPAX@Z
_purecall
__CxxFrameHandler3
memcpy_s
??_U@YAPAXI@Z
__CxxUnregisterExceptionObject
__CxxDetectRethrow
_CxxThrowException
__CxxRegisterExceptionObject
__CxxExceptionFilter
d3dx9_41
D3DXLoadSurfaceFromSurface
D3DXGetShaderVersion
D3DXCreateEffectEx
D3DXGetShaderInputSemantics
user32
GetClientRect
d3d9
D3DPERF_SetOptions
Direct3DCreate9
mscoree
_CorDllMain
Sections
.text Size: 250KB - Virtual size: 250KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 158KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Microsoft.Xna.Framework.dll.dll windows x86
6831dc85fa788cab8f90cf5ca8557af3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcr100
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
??_V@YAXPAX@Z
??2@YAPAXI@Z
memcpy_s
malloc
_finite
wcsnlen
swprintf_s
_cexit
__FrameUnwindFilter
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
__CppXcptFilter
_onexit
_crt_debugger_hook
_except_handler4_common
??3@YAXPAX@Z
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
__CxxFrameHandler3
wcsncmp
_wcsnicmp
memcpy
srand
rand
??_U@YAPAXI@Z
memmove
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_CIlog10
memset
_amsg_exit
_purecall
kernel32
GetVersionExW
CreateThread
SetErrorMode
IsProcessorFeaturePresent
LoadLibraryW
GetProcAddress
WaitForSingleObject
DuplicateHandle
ResetEvent
WaitForMultipleObjects
GetLastError
GlobalAlloc
GlobalLock
GlobalUnlock
EncodePointer
DecodePointer
InterlockedExchange
Sleep
InterlockedCompareExchange
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetProcessHeap
HeapAlloc
CloseHandle
SetEvent
CreateEventW
InterlockedIncrement
InterlockedDecrement
GlobalFree
ole32
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoInitializeEx
CreateStreamOnHGlobal
CoCreateInstance
PropVariantClear
oleaut32
SysAllocString
SysFreeString
user32
GetCursorPos
GetAsyncKeyState
ScreenToClient
RegisterWindowMessageW
RegisterClassW
CreateWindowExW
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
SendMessageW
DispatchMessageW
DestroyWindow
UnregisterClassW
DefWindowProcW
ClientToScreen
SetCursorPos
GetKeyboardState
x3daudio1_7
X3DAudioCalculate
X3DAudioInitialize
msvcp100
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Lockit_dtor@_Lockit@std@@SAXH@Z
?_Lockit_ctor@_Lockit@std@@SAXH@Z
?_Xout_of_range@std@@YAXPBD@Z
windowscodecs
WICConvertBitmapSource
winmm
waveInReset
waveInStart
waveInClose
waveInAddBuffer
waveInUnprepareHeader
waveInPrepareHeader
waveInGetDevCapsW
waveInOpen
waveInMessage
mixerClose
mixerGetLineInfoW
mixerOpen
waveInGetNumDevs
mscoree
_CorDllMain
Sections
.text Size: 286KB - Virtual size: 285KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 366KB - Virtual size: 366KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ