ca16143adc1d9910db90a57def377afe60c3220c1c1522c37658a2525f6ba191

Sharing

Copy URL Twitter E-mail

General

Target

ca16143adc1d9910db90a57def377afe60c3220c1c1522c37658a2525f6ba191
Size

797KB
MD5

c21b54feb894a6001e700b96ffd40d2f
SHA1

22d6072f17e561149f1eb9c3c749e72b2c1dfe61
SHA256

ca16143adc1d9910db90a57def377afe60c3220c1c1522c37658a2525f6ba191
SHA512

04889004ecdc9419c5bf1d756622f2a456c8bf4be2fcc29ab39263bd0fa9fdc44b258b6e46fcce56e3906208a4fd49960622129dc2f1716f64165127d1a1bde1
SSDEEP

24576:Mlnj2cnXqak8zowTSStSPUwGBxa6ntxOzzRdjnf1Z:MF9nXk8sU/SPUwoxa6nWzzRdjf1Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Game.exe

Files

ca16143adc1d9910db90a57def377afe60c3220c1c1522c37658a2525f6ba191
.zip
Game.exe
.exe windows:5 windows x86

01bf557f4427f3c38117e8cd2a56eebb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

nw_elf

SignalChromeElf
GetInstallDetailsPayload

advapi32

ImpersonateNamedPipeClient
SetEntriesInAclW
GetSecurityInfo
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegDeleteValueW
RegSetValueExW
SystemFunction036
EventRegister
EventUnregister
EventWrite
RevertToSelf
RegDisablePredefinedCache
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
ConvertStringSidToSidW
GetLengthSid
SetTokenInformation
GetKernelObjectSecurity
GetAce
SetKernelObjectSecurity
DuplicateTokenEx
EqualSid
CreateProcessAsUserW
SetThreadToken
CreateRestrictedToken
DuplicateToken
LookupPrivilegeValueW
CopySid
CreateWellKnownSid

kernel32

GetThreadLocale
GetSystemDefaultLCID
GetCurrentThreadId
GetModuleFileNameW
CreateEventW
GetLastError
SetLastError
GetCurrentProcess
DuplicateHandle
GetProcessId
WaitForSingleObject
GetCurrentDirectoryW
SetCurrentDirectoryW
LoadLibraryExW
GetProcAddress
SetProcessShutdownParameters
VirtualAlloc
VirtualFree
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
LocalFree
GetModuleHandleW
GetSystemTimeAsFileTime
ReleaseSRWLockExclusive
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryPerformanceFrequency
QueryPerformanceCounter
QueryThreadCycleTime
GetCurrentThread
GetThreadPriority
SetThreadPriority
Sleep
LoadLibraryW
GetModuleHandleA
ExpandEnvironmentStringsW
CloseHandle
DeleteFileW
OutputDebugStringA
WriteFile
CreateFileW
GetCurrentProcessId
GetLocalTime
GetTickCount
FormatMessageA
OpenProcess
TerminateProcess
GetExitCodeProcess
SetFilePointerEx
ReadFile
GetFileSizeEx
SetEndOfFile
SetFileTime
GetFileInformationByHandle
FlushFileBuffers
HeapCreate
HeapDestroy
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
VirtualQuery
IsDebuggerPresent
RaiseException
CreateThread
GetThreadId
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
GetVersionExW
GetNativeSystemInfo
GetFileAttributesW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
ReplaceFileW
CreateDirectoryW
GetTempPathW
GetLongPathNameW
QueryDosDeviceW
GetSystemDirectoryW
GetWindowsDirectoryW
UnregisterWaitEx
RegisterWaitForSingleObject
SetUnhandledExceptionFilter
RtlCaptureStackBackTrace
TlsGetValue
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessTimes
GetModuleHandleExW
GetUserDefaultLangID
FreeLibrary
FindClose
FindNextFileW
FindFirstFileExW
SetEnvironmentVariableW
GetEnvironmentVariableW
FlushViewOfFile
TlsAlloc
TlsFree
TlsSetValue
IsWow64Process
SwitchToThread
CreateIoCompletionPort
PostQueuedCompletionStatus
SetInformationJobObject
GetQueuedCompletionStatus
VirtualQueryEx
GetSystemInfo
HeapSetInformation
ResetEvent
SetEvent
VirtualProtect
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeCriticalSectionAndSpinCount
DecodePointer
CreateProcessW
GetTimeZoneInformation
CreateSemaphoreW
ReleaseSemaphore
OutputDebugStringW
LockFileEx
UnlockFileEx
GetFileType
GetStdHandle
SetConsoleCtrlHandler
VirtualAllocEx
TerminateJobObject
GetUserDefaultLCID
ProcessIdToSessionId
SetHandleInformation
AssignProcessToJobObject
WriteProcessMemory
GetProcessHandleCount
GetProcessHeaps
SignalObjectAndWait
VirtualProtectEx
ReadProcessMemory
VirtualFreeEx
CreateNamedPipeW
CreateRemoteThread
CreateJobObjectW
CreateMutexW
SearchPathW
lstrlenW
DebugBreak
LoadLibraryExA
GetThreadContext
SuspendThread
TransactNamedPipe
SetNamedPipeHandleState
WaitNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
GetFileInformationByHandleEx
GetVersion
SleepEx
SetFilePointer
GetThreadTimes
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
EnumSystemLocalesW
IsValidLocale
ResumeThread
ReadConsoleW
SetStdHandle
GetFullPathNameW
GetConsoleMode
GetConsoleCP
PeekNamedPipe
GetDriveTypeW
GetACP
RtlUnwind
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
GetStringTypeW
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
WaitForSingleObjectEx
InitOnceExecuteOnce

psapi

GetProcessMemoryInfo
GetPerformanceInfo
QueryWorkingSetEx

shell32

SHGetKnownFolderPath
SHGetFolderPathW
CommandLineToArgvW

shlwapi

PathMatchSpecW

user32

RegisterClassW
PostThreadMessageW
PeekMessageW
SetProcessDPIAware
GetMessageW
GetUserObjectInformationW
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CreateWindowStationW
GetProcessWindowStation
CloseWindowStation
CloseDesktop
wsprintfW
UnregisterClassW
DefWindowProcW
SetWindowLongW
GetWindowLongW
CreateWindowExW
DestroyWindow
RegisterClassExW
DispatchMessageW
TranslateMessage
PostQuitMessage
MsgWaitForMultipleObjectsEx
GetQueueStatus
SetTimer
PostMessageW
KillTimer

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

winhttp

WinHttpSetTimeouts
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpWriteData
WinHttpReadData
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpCrackUrl

Exports

Exports

GetHandleVerifier
IsSandboxedProcess

Sections

.text
Size: 1003KB - Virtual size: 1002KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_text32
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 303KB - Virtual size: 302KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CPADinfo
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 404KB - Virtual size: 403KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

��u�
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

01bf557f4427f3c38117e8cd2a56eebb

Headers

DLL Characteristics

File Characteristics

Imports

nw_elf

advapi32

kernel32

psapi

shell32

shlwapi

user32

version

winmm

winhttp

Exports

Exports

Sections

.text Size: 1003KB - Virtual size: 1002KB

_text32 Size: 66KB - Virtual size: 65KB

.rdata Size: 303KB - Virtual size: 302KB

.data Size: 6KB - Virtual size: 19KB

.didat Size: 512B - Virtual size: 56B

CPADinfo Size: 512B - Virtual size: 40B

.rsrc Size: 404KB - Virtual size: 403KB

.reloc Size: 39KB - Virtual size: 38KB

 ���u� Size: 16KB - Virtual size: 20KB

.text
Size: 1003KB - Virtual size: 1002KB

_text32
Size: 66KB - Virtual size: 65KB

.rdata
Size: 303KB - Virtual size: 302KB

.data
Size: 6KB - Virtual size: 19KB

.didat
Size: 512B - Virtual size: 56B

CPADinfo
Size: 512B - Virtual size: 40B

.rsrc
Size: 404KB - Virtual size: 403KB

.reloc
Size: 39KB - Virtual size: 38KB

��u�
Size: 16KB - Virtual size: 20KB