Static task
static1
Behavioral task
behavioral1
Sample
0.8.2-ALPHA/Alice.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0.8.2-ALPHA/Alice.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
0.8.2-ALPHA/dbg_alice.exe
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
0.8.2-ALPHA/dbg_alice.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
0.8.2-ALPHA/launch_alice.exe
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
0.8.2-ALPHA/launch_alice.exe
Resource
win10v2004-20230915-en
General
-
Target
0.8.2-ALPHA.zip
-
Size
5.3MB
-
MD5
900adc64b55d2571208c6ec1ce987a93
-
SHA1
2ae21ed39fe58c24ed1417095f055023a47fa340
-
SHA256
ba83a42af4f69b4dcaa1af74c0273a971620c188568d9b3a7f12b1e698fd92c0
-
SHA512
88c7e7efd6aaa8a1c1efd11d76e2cf679fae62b0551f7b95d2bd7a90db27bd91e458cca507129ebd233de627b68d80e5bf0792c1ee045e53c19cf273bcdc652c
-
SSDEEP
98304:oGU9wIoyzKeNVSbvn8srrAYaf4UOxd+Z9onFuwDUfbrSjIH/wDQnvLrc6bb/mtqx:xTm+bvnhrMYC6xfFpDgbOjIHoW88KC
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/0.8.2-ALPHA/Alice.exe unpack001/0.8.2-ALPHA/dbg_alice.exe unpack001/0.8.2-ALPHA/launch_alice.exe
Files
-
0.8.2-ALPHA.zip.zip
-
0.8.2-ALPHA/Alice.exe.exe windows:6 windows x64
1faf67c657c1a352d7bdc4f04c154a65
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
opengl32
glBindTexture
glBlendFunc
glClear
glClearColor
glCullFace
glDeleteTextures
glDepthRange
glDisable
glDrawArrays
glEnable
glGenTextures
glGetError
glGetIntegerv
glGetString
glLineWidth
glPixelStorei
glTexImage2D
glTexParameteri
glTexSubImage2D
glViewport
wglCreateContext
wglDeleteContext
wglGetCurrentDC
wglGetProcAddress
wglMakeCurrent
kernel32
AcquireSRWLockExclusive
CloseHandle
CloseThreadpoolTimer
CloseThreadpoolWait
CompareStringW
CreateDirectoryW
CreateEventExW
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateProcessW
CreateSemaphoreExW
CreateThread
CreateThreadpoolTimer
CreateThreadpoolWait
DeleteCriticalSection
DuplicateHandle
EncodePointer
EnterCriticalSection
ExitProcess
ExitThread
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FlushProcessWriteBuffers
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
FreeLibraryWhenCallbackReturns
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumberEx
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetExitCodeThread
GetFileAttributesW
GetFileSizeEx
GetFileType
GetLastError
GetLogicalProcessorInformationEx
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNumaHighestNodeNumber
GetOEMCP
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetThreadGroupAffinity
GetThreadPriority
GetThreadTimes
GetTickCount64
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
InterlockedPopEntrySList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
MultiByteToWideChar
OutputDebugStringA
QueryDepthSList
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReleaseSRWLockExclusive
ReleaseSemaphore
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetThreadGroupAffinity
SetThreadPriority
SetThreadpoolTimer
SetThreadpoolWait
SetUnhandledExceptionFilter
SignalObjectAndWait
Sleep
SleepConditionVariableSRW
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualFree
WaitForSingleObject
WaitForSingleObjectEx
WaitForThreadpoolTimerCallbacks
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
user32
AdjustWindowRectExForDpi
BeginPaint
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
EndPaint
GetClientRect
GetDC
GetDpiForWindow
GetKeyState
GetMonitorInfoW
GetSystemMetrics
GetWindowLongPtrW
GetWindowRect
LoadCursorW
LoadImageW
MessageBoxA
MessageBoxW
MonitorFromWindow
PeekMessageW
PostMessageW
PostQuitMessage
RegisterClassExW
ReleaseCapture
ReleaseDC
SetCapture
SetCursor
SetProcessDpiAwarenessContext
SetUserObjectInformationA
SetWindowLongPtrW
SetWindowLongW
SetWindowPos
SetWindowRgn
ShowWindow
TranslateMessage
UpdateWindow
gdi32
ChoosePixelFormat
SetPixelFormat
SwapBuffers
shell32
CommandLineToArgvW
SHGetKnownFolderPath
ole32
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoUninitialize
Sections
.text Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 99.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 271KB - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
0.8.2-ALPHA/assets/alice.csv
-
0.8.2-ALPHA/assets/alice.gfx
-
0.8.2-ALPHA/assets/alice.gui
-
0.8.2-ALPHA/assets/alice_save_entry.png.png
-
0.8.2-ALPHA/assets/battle_blue.png.png
-
0.8.2-ALPHA/assets/battle_ends.png.png
-
0.8.2-ALPHA/assets/battle_red.png.png
-
0.8.2-ALPHA/assets/diginpips.png.png
-
0.8.2-ALPHA/assets/event_auto.png.png
-
0.8.2-ALPHA/assets/fonts/LibreCaslonText-Italic.ttf
-
0.8.2-ALPHA/assets/fonts/LibreCaslonText-Regular.ttf
-
0.8.2-ALPHA/assets/fonts/OFL-lct.txt
-
0.8.2-ALPHA/assets/fonts/OFL-ssp4.txt
-
0.8.2-ALPHA/assets/fonts/SourceSerif4Subhead-Regular.ttf
-
0.8.2-ALPHA/assets/launcher_bg.png.png
-
0.8.2-ALPHA/assets/launcher_big_button.png.png
-
0.8.2-ALPHA/assets/launcher_check.png.png
-
0.8.2-ALPHA/assets/launcher_close.png.png
-
0.8.2-ALPHA/assets/launcher_down.png.png
-
0.8.2-ALPHA/assets/launcher_left.png.png
-
0.8.2-ALPHA/assets/launcher_line_bg.png.png
-
0.8.2-ALPHA/assets/launcher_no_check.png.png
-
0.8.2-ALPHA/assets/launcher_right.png.png
-
0.8.2-ALPHA/assets/launcher_up.png.png
-
0.8.2-ALPHA/assets/leader_select_replacement.png.png
-
0.8.2-ALPHA/assets/message_disp_options.png.png
-
0.8.2-ALPHA/assets/naval_combat_bg_2.png.png
-
0.8.2-ALPHA/assets/new_panel_bg.png.png
-
0.8.2-ALPHA/assets/odds_icon.dds
-
0.8.2-ALPHA/assets/orgbar_bottom.png.png
-
0.8.2-ALPHA/assets/orgbar_top.png.png
-
0.8.2-ALPHA/assets/port_bars.png.png
-
0.8.2-ALPHA/assets/port_empty.png.png
-
0.8.2-ALPHA/assets/port_ex.png.png
-
0.8.2-ALPHA/assets/retreat.png.png
-
0.8.2-ALPHA/assets/shaders/black_color_f.glsl
-
0.8.2-ALPHA/assets/shaders/line_border_f.glsl
-
0.8.2-ALPHA/assets/shaders/line_border_v.glsl
-
0.8.2-ALPHA/assets/shaders/line_river_f.glsl
-
0.8.2-ALPHA/assets/shaders/line_unit_arrow_f.glsl
-
0.8.2-ALPHA/assets/shaders/line_unit_arrow_v.glsl
-
0.8.2-ALPHA/assets/shaders/map_f.glsl
-
0.8.2-ALPHA/assets/shaders/map_v.glsl
-
0.8.2-ALPHA/assets/shaders/screen_v.glsl
-
0.8.2-ALPHA/assets/shaders/ui_f_shader.glsl
-
0.8.2-ALPHA/assets/shaders/ui_v_shader.glsl
-
0.8.2-ALPHA/assets/siege_bottom.png.png
-
0.8.2-ALPHA/assets/siege_top.png.png
-
0.8.2-ALPHA/assets/siegeframe.png.png
-
0.8.2-ALPHA/assets/small_fort.dds
-
0.8.2-ALPHA/assets/small_port.dds
-
0.8.2-ALPHA/assets/small_rail.dds
-
0.8.2-ALPHA/assets/small_uframes.png.png
-
0.8.2-ALPHA/assets/trigger_not.dds
-
0.8.2-ALPHA/assets/trigger_yes.dds
-
0.8.2-ALPHA/assets/unit_flag_mask.png.png
-
0.8.2-ALPHA/assets/unit_flag_overlay.png.png
-
0.8.2-ALPHA/assets/unitframes.png.png
-
0.8.2-ALPHA/assets/unitleftedges.png.png
-
0.8.2-ALPHA/assets/unitrightedge.png.png
-
0.8.2-ALPHA/assets/unitstatus.png.png
-
0.8.2-ALPHA/dbg_alice.exe.exe windows:6 windows x64
c8a76406b2714db9b744d4e994e5d89d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
dbghelp
MiniDumpWriteDump
kernel32
GetProcAddress
WriteConsoleW
CreateToolhelp32Snapshot
Process32FirstW
GetCurrentProcessId
CloseHandle
Process32NextW
CreateDirectoryW
Thread32First
GetProcessId
OpenThread
Thread32Next
CreateFileW
AttachConsole
GetStdHandle
OpenProcess
HeapReAlloc
HeapSize
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
GetCurrentProcess
TerminateProcess
SetStdHandle
GetFileType
DuplicateHandle
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
WriteFile
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP
user32
MessageBoxW
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
Sections
.text Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
0.8.2-ALPHA/launch_alice.exe.exe windows:6 windows x64
a62dda24842a903a29d821b11b56cd0f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
opengl32
wglMakeCurrent
wglDeleteContext
glBindTexture
glDrawArrays
glEnable
glBlendFunc
glViewport
glClearColor
glDepthRange
glGenTextures
glTexParameteri
glTexSubImage2D
glTexImage2D
glDeleteTextures
wglGetCurrentDC
wglGetProcAddress
glGetString
glGetIntegerv
wglCreateContext
glClear
kernel32
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileType
LCMapStringW
UnmapViewOfFile
CloseHandle
CreateFileW
CreateFileMappingW
MapViewOfFile
GetFileSizeEx
GetModuleFileNameW
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesW
WriteFile
SetEndOfFile
CreateDirectoryW
MultiByteToWideChar
WideCharToMultiByte
CreateProcessW
HeapSetInformation
GetModuleHandleW
ReadFile
HeapFree
SetStdHandle
HeapReAlloc
HeapAlloc
CreateFileMappingA
GetProcessHeap
CompareStringW
GetStdHandle
ExitProcess
GetModuleHandleExW
ExitThread
InitializeCriticalSectionAndSpinCount
RtlUnwind
RtlUnwindEx
RaiseException
RtlPcToFileHeader
TerminateProcess
GetCurrentProcessId
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VerifyVersionInfoW
GetProcessAffinityMask
VirtualFree
VerSetConditionMask
GetCurrentProcess
ReleaseSemaphore
DuplicateHandle
SetThreadGroupAffinity
GetThreadGroupAffinity
GetNumaHighestNodeNumber
GetLogicalProcessorInformationEx
GetStringTypeW
CreateFileA
GetCurrentProcessorNumberEx
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetThreadPriority
SetThreadPriority
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThreadId
GetExitCodeThread
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeCriticalSectionEx
WriteConsoleW
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetSystemTimeAsFileTime
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetLastError
SetLastError
LoadLibraryExW
LoadLibraryW
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
EncodePointer
GetCurrentThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
InitializeSListHead
SetEvent
SignalObjectAndWait
CreateThread
user32
CreateWindowExW
RegisterClassExW
LoadCursorW
GetSystemMetrics
UpdateWindow
SetProcessDpiAwarenessContext
DefWindowProcW
PostQuitMessage
EndPaint
BeginPaint
GetWindowRect
SetWindowPos
GetDC
MessageBoxA
PostMessageW
InvalidateRect
GetDpiForWindow
GetMessageW
MonitorFromWindow
DispatchMessageW
GetMonitorInfoW
MessageBoxW
ShowWindow
LoadImageW
gdi32
SetPixelFormat
ChoosePixelFormat
SwapBuffers
shell32
SHGetKnownFolderPath
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoTaskMemFree
Sections
.text Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 621KB - Virtual size: 621KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 149KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
0.8.2-ALPHA/read me OR ELSE.txt