Static task
static1
General
-
Target
castle.exe
-
Size
2.1MB
-
MD5
609b11e4186768b2bd473061067c61cf
-
SHA1
c3a162f944322b755d163f67b5307e231d978b27
-
SHA256
d71b6479609388d28bc61c46c720ab0272e207004d2e7f0589db3763535e90e6
-
SHA512
1002c7966626a2cc0a4f3293e60e5ec58ba06ce1b1cd72949e6349a8da892836d2262da035a7d005182fc4164af341443d0d3aa6d5d2f1fb29f793f7fc85d2c8
-
SSDEEP
49152:z3wdOg8504QjAHVygumLjZBTnYoKvRAuVR7c+:LwdOg8504QkTBTnaRTVR7c+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource castle.exe
Files
-
castle.exe.exe windows:5 windows x86
fcbdb966fc402d6e85078e68a939ec64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
dinput8
DirectInput8Create
winhttp
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpOpen
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
d3d9
Direct3DCreate9
d3dx9_43
D3DXMatrixOrthoOffCenterLH
D3DXCreateTextureFromFileExA
steam_api
SteamAPI_RegisterCallResult
SteamAPI_UnregisterCallResult
SteamFriends
SteamAPI_RegisterCallback
SteamUser
SteamApps
SteamAPI_UnregisterCallback
SteamNetworking
SteamMatchmaking
SteamClient
SteamAPI_Shutdown
SteamAPI_Init
SteamUtils
SteamRemoteStorage
SteamAPI_RunCallbacks
SteamAPI_SetMiniDumpComment
SteamAPI_WriteMiniDump
SteamUserStats
kernel32
SetEndOfFile
CreateFileW
HeapReAlloc
SetStdHandle
WriteConsoleW
LoadLibraryW
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapCreate
GetStringTypeW
IsProcessorFeaturePresent
GetTimeZoneInformation
ExitProcess
HeapSize
GetFileType
SetHandleCount
RtlUnwind
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetModuleFileNameW
GetStdHandle
WriteFile
LCMapStringW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetModuleHandleA
GetProcAddress
LoadLibraryA
WaitForSingleObject
RaiseException
IsDebuggerPresent
CloseHandle
ResumeThread
GetLastError
GetTickCount
GetProcessHeap
CreateFileA
SetFilePointer
SetEvent
Sleep
CreateEventA
CreateSemaphoreA
ReadFile
GetOverlappedResult
ReleaseSemaphore
GetUserDefaultLCID
OutputDebugStringA
GetFileSize
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocalTime
SetThreadPriority
GetModuleFileNameA
LocalFree
CreateThread
SetLastError
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
HeapSetInformation
GetCommandLineW
HeapAlloc
HeapFree
WideCharToMultiByte
MultiByteToWideChar
SetEnvironmentVariableA
ExitThread
GetSystemTimeAsFileTime
GetDateFormatA
GetTimeFormatA
EncodePointer
DecodePointer
InterlockedDecrement
InterlockedIncrement
CompareStringW
GetCurrentProcess
user32
GetWindowRect
SetCursor
DispatchMessageA
DefWindowProcA
PeekMessageA
TranslateMessage
PostQuitMessage
ScreenToClient
SetRect
ClientToScreen
DestroyWindow
SetForegroundWindow
LoadIconA
GetClientRect
SetFocus
ShowCursor
GetAsyncKeyState
SetWindowLongA
MessageBoxA
SetCursorPos
CreateWindowExA
GetDesktopWindow
SetWindowPos
GetCursorPos
ShowWindow
AdjustWindowRectEx
MessageBoxW
GetSystemMetrics
UpdateWindow
AdjustWindowRect
LoadCursorA
ChangeDisplaySettingsA
RegisterClassA
MoveWindow
UnregisterClassA
gdi32
GetStockObject
shell32
CommandLineToArgvW
ShellExecuteA
ole32
CoUninitialize
CoInitialize
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
oleaut32
SysFreeString
SysAllocString
Sections
.text Size: 813KB - Virtual size: 813KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 363KB - Virtual size: 362KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 124KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 346KB - Virtual size: 345KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.bind Size: 413KB - Virtual size: 413KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ