t6zm[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

t6zm.exe
Size

12.5MB
MD5

025c2579b58a9c8c850c4bc0bf278cf9
SHA1

d70a3c41015093618a4b60b85741c3d4ced7a548
SHA256

214ac1666d05c60a7f8ebdd9194fd6ed72c2b55051a9e1601a9106f054654e6f
SHA512

8f6d181cbcbf64a4bc949c4bc5f227d66ff78908d79d848977aae5cd8dd5bc261811ae30ef4baaa8008c0b749d097a88ccdb0f16d1817a6ffaa333b417d8fb26
SSDEEP

393216:3XYCs8QTHxoMo5uEQ5ysQNpLViuZw5kST:GpqwT

Score

1^/10

Malware Config

Signatures

Files

t6zm.exe
.exe windows:5 windows x86

e6231320ba86fcfbc51da9bd2df68ea7

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:5c:80:c6:d0:2d:d5:1e:55:ba:a6:82:10:59:9b:4a
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/06/2014, 00:00

Not After

29/06/2017, 12:00

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:50:9f:f1:ce:9f:76:ea:64:4a:e0:69:f3:8a:8e:79:18:4b:85:e2
Signer

Actual PE Digest

1d:50:9f:f1:ce:9f:76:ea:64:4a:e0:69:f3:8a:8e:79:18:4b:85:e2

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

t6r/t6r

SteamGameServer_Init
SteamGameServer
SteamGameServer_Shutdown
SteamAPI_RegisterCallResult
SteamAPI_RegisterCallback
SteamAPI_Shutdown
SteamAPI_UnregisterCallback
SteamAPI_UnregisterCallResult
SteamAPI_RunCallbacks
SteamAPI_Init
SteamAPI_RestartAppIfNecessary
SteamUtils
SteamUserStats
SteamApps
SteamNetworking
SteamGameServer_RunCallbacks
SteamUser
SteamFriends

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod
mixerClose
mixerGetControlDetailsA
mixerGetLineControlsA
mixerGetLineInfoA
mixerOpen
mixerSetControlDetails
mixerGetDevCapsA
waveInGetNumDevs
mixerGetNumDevs

wsock32

htonl
recvfrom
select
sendto
shutdown
connect
socket
ioctlsocket
htons
recv
__WSAFDIsSet
WSAStartup
WSACleanup
gethostname
ntohl
closesocket
accept
bind
send
WSAGetLastError
setsockopt
gethostbyname
ntohs
inet_ntoa

faultrep

ReportFault

dxgi

CreateDXGIFactory1

dsound

ord6
ord11

kernel32

FormatMessageA
SetEndOfFile
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CompareStringW
HeapQueryInformation
GetExitCodeProcess
CreatePipe
LoadLibraryW
SetConsoleCtrlHandler
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetHandleCount
SetEnvironmentVariableA
SleepEx
GetExitCodeThread
TerminateThread
HeapAlloc
CreateFileW
InterlockedExchange
CloseHandle
GetFileInformationByHandleEx
HeapFree
CreateFileA
GetCurrentThreadId
GetTickCount
lstrlenW
GetStartupInfoW
GetModuleFileNameA
InterlockedIncrement
GetFileInformationByHandle
CreateSemaphoreA
InterlockedCompareExchange
Sleep
GetCurrentProcessId
GetModuleHandleA
GetLastError
ReleaseSemaphore
OpenFileById
GetTimeZoneInformation
GetProcessHeap
lstrcmpiW
FileTimeToSystemTime
GetProcessTimes
GetCurrentProcess
UnmapViewOfFile
HeapSize
SetLastError
InterlockedDecrement
GetFullPathNameW
GetConsoleWindow
SizeofResource
LoadLibraryA
GetSystemTime
WriteFile
QueryPerformanceFrequency
VirtualQuery
GetCommandLineW
GetCurrentDirectoryW
LockResource
CreateEventA
WaitForSingleObject
GetFullPathNameA
GetComputerNameA
SetEvent
CreateFileMappingA
MapViewOfFile
GetModuleHandleExA
DebugBreak
ExpandEnvironmentStringsA
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
GetFileTime
LoadResource
GetProcAddress
ExitProcess
GetSystemTimeAsFileTime
FindResourceW
GetEnvironmentStringsW
lstrlenA
FreeLibrary
QueryPerformanceCounter
SetFilePointer
GetFileSize
ReadFile
RaiseException
ResetEvent
GetProcessAffinityMask
DuplicateHandle
GetCurrentThread
CreateThread
SuspendThread
ResumeThread
SetThreadPriority
OutputDebugStringW
InterlockedExchangeAdd
DeleteFileA
SetFileAttributesA
GetCurrentDirectoryA
VirtualAlloc
VirtualFree
InitializeCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
GlobalMemoryStatus
SetProcessAffinityMask
GetThreadPriority
OutputDebugStringA
GetDriveTypeA
GlobalUnlock
GlobalSize
GlobalLock
GlobalAlloc
GetVersionExA
SetErrorMode
SetUnhandledExceptionFilter
TerminateProcess
WaitForMultipleObjects
MulDiv
SetPriorityClass
SetThreadExecutionState
WideCharToMultiByte
GetSystemInfo
GetSystemDirectoryW
OpenFileMappingA
GetModuleFileNameW
GetWindowsDirectoryW
HeapCreate
HeapDestroy
OpenEventA
CreateSemaphoreW
GetModuleHandleW
OpenProcess
PulseEvent
FindClose
FileTimeToLocalFileTime
FindFirstFileExA
FindNextFileA
GetDriveTypeW
HeapReAlloc
ExitThread
CreateProcessA
GetTimeFormatA
GetDateFormatA
GetCommandLineA
HeapSetInformation
PeekNamedPipe
GetFileType
IsProcessorFeaturePresent
GetStdHandle
GetLocaleInfoW
UnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEnvironmentVariableW
CreateDirectoryA
MoveFileA
RtlUnwind
MultiByteToWideChar
EncodePointer
DecodePointer
ReleaseMutex
CreateMutexA
GetVersion
FlushConsoleInputBuffer
ReadConsoleInputA
SetConsoleMode
GetFileAttributesA

user32

SetWindowTextA
CallWindowProcA
PostQuitMessage
DestroyWindow
DefWindowProcA
CloseWindow
RegisterClassA
LoadImageA
CreateWindowExA
SendMessageA
AdjustWindowRect
SetWindowPos
MapVirtualKeyA
LoadCursorA
GetSystemMetrics
LoadIconA
RegisterClassExA
PeekMessageA
EmptyClipboard
SetClipboardData
OpenClipboard
GetClientRect
MonitorFromWindow
RegisterWindowMessageA
GetClipboardData
CloseClipboard
GetMessageA
DispatchMessageA
TranslateMessage
ShowWindow
ClientToScreen
GetCursorPos
ScreenToClient
GetForegroundWindow
SetFocus
GetWindowRect
SetCursorPos
GetActiveWindow
ChangeDisplaySettingsA
EnumThreadWindows
GetDesktopWindow
GetDC
ReleaseDC
GetWindowTextA
GetWindowLongA
SetWindowLongA
PostMessageA
MessageBoxA
ShowCursor
GetClassLongA
AdjustWindowRectEx
GetMonitorInfoA
SetCursor
IsWindow
GetMenuItemCount
SetClassLongA
EnumDisplaySettingsA
DeleteMenu
GetMenuItemID
GetSystemMenu
GetUserObjectInformationW
GetProcessWindowStation
MoveWindow

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
SetStretchBltMode
GetObjectA
SelectObject
DeleteObject
StretchBlt
DeleteDC
GetBitmapBits
BitBlt
CreateDCA
GetDeviceCaps
SetDeviceGammaRamp
CreateFontA
CreateSolidBrush
GetDIBits

advapi32

InitializeSecurityDescriptor
RegOpenKeyExW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
CryptAcquireContextA
CryptReleaseContext
RegQueryValueExW
RegCloseKey
SetSecurityDescriptorDacl
CryptGenRandom

shell32

ShellExecuteA
SHGetFolderPathA

ole32

CoInitializeEx
CoCreateInstance
CoInitialize
CoUninitialize
StringFromGUID2
CLSIDFromString

oleaut32

VariantInit
VariantClear

wintrust

WinVerifyTrust

wininet

InternetConnectA
InternetReadFile
InternetWriteFile
HttpEndRequestA
HttpQueryInfoA
HttpAddRequestHeadersA
HttpSendRequestExA
HttpOpenRequestA
InternetQueryOptionA
InternetSetOptionA
HttpSendRequestA
InternetCrackUrlA
InternetOpenA
InternetCloseHandle

xinput1_3

ord4
ord2
ord3

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

ws2_32

WSASetLastError
getsockname
getsockopt
inet_ntoa

psapi

GetProcessMemoryInfo

binkw32

_BinkWaitStopAsyncThread@4
_BinkSetMemory@8
_BinkGetRealtime@12
_BinkGetFrameBuffersInfo@8
_BinkPause@8
_BinkControlBackgroundIO@8
_BinkDoFrameAsync@12
_BinkStartAsyncThread@8
_BinkSetSoundTrack@8
_BinkOpen@8
_BinkGetError@0
_BinkDoFrameAsyncWait@8
_BinkClose@4
_BinkGetRects@8
_BinkRequestStopAsyncThread@4
_BinkRegisterFrameBuffers@8
_BinkSetIOSize@4
_BinkDoFrame@4
_BinkNextFrame@4

d3d11

D3D11CreateDeviceAndSwapChain
D3D11CreateDevice

Exports

Exports

NvOptimusEnablement

Sections

.text
Size: 7.3MB - Virtual size: 7.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.conceal
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.interpr
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.0MB - Virtual size: 54.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.version
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 256KB - Virtual size: 255KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6231320ba86fcfbc51da9bd2df68ea7

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:5c:80:c6:d0:2d:d5:1e:55:ba:a6:82:10:59:9b:4aCertificate

Extended Key Usages

Key Usages

1d:50:9f:f1:ce:9f:76:ea:64:4a:e0:69:f3:8a:8e:79:18:4b:85:e2Signer

Headers

DLL Characteristics

File Characteristics

Imports

t6r/t6r

winmm

wsock32

faultrep

dxgi

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wintrust

wininet

xinput1_3

wtsapi32

ws2_32

psapi

binkw32

d3d11

Exports

Exports

Sections

.text Size: 7.3MB - Virtual size: 7.3MB

.conceal Size: 75KB - Virtual size: 75KB

.interpr Size: 26KB - Virtual size: 25KB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 3.0MB - Virtual size: 54.3MB

.tls Size: 7KB - Virtual size: 6KB

.version Size: 512B - Virtual size: 4B

.rodata Size: 3KB - Virtual size: 2KB

.rsrc Size: 256KB - Virtual size: 255KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:5c:80:c6:d0:2d:d5:1e:55:ba:a6:82:10:59:9b:4a
Certificate

1d:50:9f:f1:ce:9f:76:ea:64:4a:e0:69:f3:8a:8e:79:18:4b:85:e2
Signer

.text
Size: 7.3MB - Virtual size: 7.3MB

.conceal
Size: 75KB - Virtual size: 75KB

.interpr
Size: 26KB - Virtual size: 25KB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 3.0MB - Virtual size: 54.3MB

.tls
Size: 7KB - Virtual size: 6KB

.version
Size: 512B - Virtual size: 4B

.rodata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 256KB - Virtual size: 255KB