Neverwinter_Arc2Setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Neverwinter_Arc2Setup.exe
Size

823KB
MD5

37f52e4fe2c9cc662c02a79b5ff96993
SHA1

165484721a4612c5d0e8896657654e840c293a8c
SHA256

b27e7da0c104be92b0251b74006805e73879bf5bc6885b3936fe802a54a21213
SHA512

46e9a6b7cd7ea05c9f0601eef4e9902605fc5fe2b3860632ccbf8564176d1c6ddadde7b90f9bed77517b3cecbe86096934872468a815d7a2728186b66b23be4e
SSDEEP

24576:gSy90dodZ6DCwbSPUdodZ9umX1NYJb/qcWyx3GBKvsg:toumwbgUdyGmzYJjWyZGK

Score

1^/10

Malware Config

Signatures

Files

Neverwinter_Arc2Setup.exe
.exe windows x86

0e41110de7a0328760a0edaf27d55886

Code Sign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d2:d1:61:f1:bf:22:2e:b8:83:43:e8:03:27:bc:57:61
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16/03/2021, 00:00

Not After

16/03/2023, 23:59

Subject

SERIALNUMBER=C4294399,CN=Perfect World Entertainment\, Inc.,O=Perfect World Entertainment\, Inc.,POSTALCODE=94065,STREET=100 Redwood Shores,L=Redwood City,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f5:5d:8f:c9:fc:cb:db:17:c2:0e:44:cc:3a:4b:0c:03:ef:0a:ac:c5:db:de:2b:1a:76:5d:f1:ca:6c:18:49:20
Signer

Actual PE Digest

f5:5d:8f:c9:fc:cb:db:17:c2:0e:44:cc:3a:4b:0c:03:ef:0a:ac:c5:db:de:2b:1a:76:5d:f1:ca:6c:18:49:20

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

gdiplus

GdipFree

user32

GetDC

gdi32

PatBlt

msimg32

AlphaBlend

winspool.drv

OpenPrinterW

advapi32

RegCloseKey

shell32

DragFinish

comctl32

InitCommonControlsEx

shlwapi

PathIsUNCW

uxtheme

IsAppThemed

ole32

DoDragDrop

oleaut32

SysFreeString

wintrust

WinVerifyTrust

crypt32

CryptMsgClose

winhttp

WinHttpOpen

oleacc

LresultFromObject

imm32

ImmGetContext

winmm

PlaySoundW

Exports

Exports

HttpDownCreateTask
HttpDownDestoryTask
HttpDownGetLimitSpeed
HttpDownGetTotalSpeed
HttpDownInitialize
HttpDownSetLimitSpeed
HttpDownUninitialize

Sections

.MPRESS1
Size: 738KB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0e41110de7a0328760a0edaf27d55886

Code Sign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

Key Usages

d2:d1:61:f1:bf:22:2e:b8:83:43:e8:03:27:bc:57:61Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

f5:5d:8f:c9:fc:cb:db:17:c2:0e:44:cc:3a:4b:0c:03:ef:0a:ac:c5:db:de:2b:1a:76:5d:f1:ca:6c:18:49:20Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdiplus

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

wintrust

crypt32

winhttp

oleacc

imm32

winmm

Exports

Exports

Sections

.MPRESS1 Size: 738KB - Virtual size: 2.3MB

.MPRESS2 Size: 4KB - Virtual size: 4KB

.rsrc Size: 70KB - Virtual size: 69KB

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

d2:d1:61:f1:bf:22:2e:b8:83:43:e8:03:27:bc:57:61
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

f5:5d:8f:c9:fc:cb:db:17:c2:0e:44:cc:3a:4b:0c:03:ef:0a:ac:c5:db:de:2b:1a:76:5d:f1:ca:6c:18:49:20
Signer

.MPRESS1
Size: 738KB - Virtual size: 2.3MB

.MPRESS2
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 70KB - Virtual size: 69KB