DevilMayCry4SpecialEdition[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

DevilMayCry4SpecialEdition.exe
Size

15.1MB
MD5

f53b82b332b6b28d79e3e6b600b9507d
SHA1

08d881bae8753f36a1314ec4f7aa91f6269a348e
SHA256

642d11b94fc8226d0a906301c0d42836263fc860c751502272bfacc7fee51efc
SHA512

7058561fcae7eb47353ab0738e20988dd3e531e9afb36b24dcbd871ab56c8c2a328017f7537ddc0a38d983f4b7c90f1ce05b779143f00d484ad3bb0f42d0c961
SSDEEP

98304:jFq8HQs3XAFYkrgBMTAZ32uOfq8K0ptqHcMJMcD+S9KB4CUSDQNy4a92CtGw8:dQGQFmBM0DT8K0ptqblkDDQNyeCtr8

Score

1^/10

Malware Config

Signatures

Files

DevilMayCry4SpecialEdition.exe
.exe windows:5 windows x86

35a042d8576b9c85b47f7c8ff3e8a9c3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:91:d6:a8:a5:b6:48:a7:d0:ec:d7:50:51:de:4a:9e
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

30/04/2015, 00:00

Not After

29/04/2016, 23:59

Subject

CN=CAPCOM Co.\,Ltd.,OU=R&D Asset Management Section,O=CAPCOM Co.\,Ltd.,L=Chuo-ku,ST=Osaka,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b1:6a:5e:c9:fb:d0:73:e9:c1:20:ac:e0:72:5b:ec:d5:da:ff:15:9a
Signer

Actual PE Digest

b1:6a:5e:c9:fb:d0:73:e9:c1:20:ac:e0:72:5b:ec:d5:da:ff:15:9a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SystemTimeToFileTime
CompareFileTime
WriteFile
ReadFile
CreateDirectoryA
QueryPerformanceFrequency
SetThreadExecutionState
GetDateFormatA
SetEnvironmentVariableA
CompareStringW
CreateFileW
WriteConsoleW
GetStringTypeW
FlushFileBuffers
CloseHandle
GetConsoleCP
SetStdHandle
VirtualQuery
RtlUnwind
GetTimeZoneInformation
GetTickCount
GetFileSize
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapCreate
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleFileNameW
HeapSize
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
GetDiskFreeSpaceExA
GetConsoleMode
GetLocalTime
CreateFileA
lstrcpyA
GetSystemTimeAsFileTime
lstrlenA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetFileAttributesA
ExpandEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoW
InitializeCriticalSection
GetUserDefaultLangID
HeapSetInformation
DecodePointer
EncodePointer
IsProcessorFeaturePresent
GetProcessHeap
HeapAlloc
HeapFree
GetStdHandle
CreateProcessA
TerminateProcess
GlobalFree
GetModuleHandleA
GetCurrentProcess
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
EnterCriticalSection
QueryPerformanceCounter
LeaveCriticalSection
VirtualAlloc
VirtualFree
Sleep
FileTimeToSystemTime
FileTimeToLocalFileTime
GetLastError
FindClose
RemoveDirectoryA
DeleteFileA
MoveFileA
GetModuleFileNameA
CopyFileA
SetEndOfFile
GetDiskFreeSpaceA
SleepEx
ReadFileEx
SetFilePointer
FindNextFileA
FindFirstFileA
InterlockedExchangeAdd
InterlockedCompareExchange
GetCurrentThreadId
GetPrivateProfileStringA
WritePrivateProfileStringA
GlobalLock
GlobalAlloc
GlobalUnlock
TryEnterCriticalSection
GetProcAddress
LoadLibraryA
FreeLibrary
WaitForSingleObject
SetEvent
ResetEvent
WideCharToMultiByte
ResumeThread
CreateThread
CreateEventA
CreateSemaphoreA
GetCurrentProcessId
ReleaseSemaphore
GetExitCodeThread
WaitForMultipleObjects
DebugBreak
SetThreadIdealProcessor
ReleaseMutex
GetCommandLineA
CreateMutexA
GetSystemInfo
RaiseException
ExitProcess
SetThreadPriority
VerifyVersionInfoA
VerSetConditionMask
InterlockedExchange
LoadLibraryW

user32

MessageBoxW
GetSystemMetrics
GetPropA
DefWindowProcA
GetCursorPos
ScreenToClient
ClientToScreen
GetAsyncKeyState
UnregisterHotKey
RegisterHotKey
SendMessageA
FindWindowW
LoadAcceleratorsA
LoadIconW
RegisterClassExW
PeekMessageA
TranslateMessage
DispatchMessageW
RemovePropA
DestroyWindow
SetCursor
ShowCursor
DefWindowProcW
IsIconic
BeginPaint
EndPaint
PostQuitMessage
ClipCursor
CreateWindowExW
GetSystemMenu
DeleteMenu
EnableMenuItem
LoadIconA
LoadCursorA
RegisterClassExA
GetWindowThreadProcessId
CloseClipboard
SetClipboardData
EmptyClipboard
ShowWindow
SetForegroundWindow
GetClientRect
SetWindowPos
AdjustWindowRect
SetWindowLongA
GetWindowRect
MessageBoxA
SystemParametersInfoA
SendMessageW
UpdateWindow
SetPropA
CreateWindowExA

shell32

SHGetFolderPathA
ShellExecuteA
DragAcceptFiles

psapi

GetModuleFileNameExA

imm32

ImmGetContext
ImmGetCompositionStringA
ImmGetDefaultIMEWnd
ImmReleaseContext

d3d10

D3D10CreateDeviceAndSwapChain
D3D10ReflectShader
D3D10DisassembleShader

dinput8

DirectInput8Create

xinput1_3

ord3
ord5
ord4
ord2

steam_api

SteamMatchmaking
SteamUserStats
SteamUser
SteamFriends
SteamAPI_RegisterCallResult
SteamAPI_UnregisterCallResult
SteamClient
SteamUtils
SteamAPI_UnregisterCallback
SteamApps
SteamAPI_IsSteamRunning
SteamAPI_RegisterCallback
SteamRemoteStorage
SteamAPI_Shutdown
SteamAPI_RunCallbacks
SteamAPI_Init
SteamAPI_RestartAppIfNecessary

ws2_32

WSAStartup
WSACleanup

iphlpapi

GetIfEntry
GetAdaptersAddresses

avifil32

AVIMakeCompressedStream
AVIFileCreateStreamA
AVIStreamRelease
AVIFileRelease
AVIFileExit
AVIStreamWrite
AVIFileOpenA
AVIFileInit
AVIStreamSetFormat

msvfw32

ICCompressorChoose
ICCompressorFree

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

wmvcore

WMCreateSyncReader
WMCreateProfileManager
WMCreateWriter

gdiplus

GdipGetImageEncodersSize
GdipSaveImageToFile
GdipDisposeImage
GdipGetImageEncoders
GdipFree
GdipLoadImageFromFile
GdiplusShutdown
GdiplusStartup
GdipCloneImage
GdipAlloc

gdi32

GetStockObject

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

ole32

CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket
CoInitialize

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 11.4MB - Virtual size: 11.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.2MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 297KB - Virtual size: 297KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

35a042d8576b9c85b47f7c8ff3e8a9c3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

0a:91:d6:a8:a5:b6:48:a7:d0:ec:d7:50:51:de:4a:9eCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

b1:6a:5e:c9:fb:d0:73:e9:c1:20:ac:e0:72:5b:ec:d5:da:ff:15:9aSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

psapi

imm32

d3d10

dinput8

xinput1_3

steam_api

ws2_32

iphlpapi

avifil32

msvfw32

winmm

wmvcore

gdiplus

gdi32

advapi32

ole32

oleaut32

Sections

.text Size: 11.4MB - Virtual size: 11.4MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 2.2MB - Virtual size: 2.8MB

.rsrc Size: 297KB - Virtual size: 297KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

0a:91:d6:a8:a5:b6:48:a7:d0:ec:d7:50:51:de:4a:9e
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

b1:6a:5e:c9:fb:d0:73:e9:c1:20:ac:e0:72:5b:ec:d5:da:ff:15:9a
Signer

.text
Size: 11.4MB - Virtual size: 11.4MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 2.2MB - Virtual size: 2.8MB

.rsrc
Size: 297KB - Virtual size: 297KB