Static task
static1
General
-
Target
Tales of the Moon 0.2.rar
-
Size
81.2MB
-
MD5
b660194cb1f1eaefa11989ec65872fa4
-
SHA1
36667e67f04ff07bd2a2239aed3b31434b32fb11
-
SHA256
122de8927c31a869d5c99099fba33832891c8ee4a2985e7bef216de03972b20c
-
SHA512
df8169f4e616dd9f6eb29da4d02a551909feec811f82fe2b9fdca39e1f2465e06e5c5a61faab2b60b9d4a084869371d1274f5ce9b04312dae2f0b7f75d4b7536
-
SSDEEP
1572864:xiX6E8yLr1MtJZQt+XfjkWldS0JkiGdDItmc3QPVkVBE5SpD1g+5:xiXhX6tJ2tajkWfGamXP2VBAKD1g+5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Tales of the Moon/Tales of the Moon.exe
Files
-
Tales of the Moon 0.2.rar.rar
-
Tales of the Moon/Tales of the Moon.exe.exe windows:6 windows x64 arch:x64
678965afe8e5d6d3443ac0b9808fd2bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
rpcrt4
UuidToStringW
UuidCreate
wininet
InternetWriteFile
InternetOpenA
InternetCloseHandle
InternetCrackUrlA
InternetCanonicalizeUrlA
HttpOpenRequestA
HttpQueryInfoA
HttpEndRequestW
HttpSendRequestA
InternetConnectA
InternetReadFile
InternetGetConnectedState
d3d11
D3D11CreateDevice
dbghelp
SymInitialize
MiniDumpWriteDump
SymFromAddr
winmm
mciGetErrorStringA
joyGetPosEx
joyGetPos
timeGetTime
timeGetDevCaps
timeEndPeriod
timeBeginPeriod
mciSendStringA
ws2_32
WSAAddressToStringA
send
getsockname
connect
inet_ntoa
gethostname
recvfrom
recv
getsockopt
freeaddrinfo
WSAStartup
ioctlsocket
setsockopt
WSAGetLastError
getpeername
__WSAFDIsSet
select
ntohl
ntohs
htonl
htons
inet_addr
getaddrinfo
listen
closesocket
bind
accept
WSACleanup
sendto
inet_ntop
socket
gdiplus
GdiplusShutdown
GdiplusStartup
comctl32
InitCommonControlsEx
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
mfplat
MFStartup
MFCreateSourceResolver
MFCreateMediaType
MFShutdown
mf
MFCreateAudioRendererActivate
MFCreateTopologyNode
MFCreateMediaSession
MFCreateSampleGrabberSinkActivate
MFGetService
MFCreateTopology
kernel32
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTempPathW
SetConsoleCtrlHandler
GetCurrentThread
WriteFile
GetStdHandle
FreeLibraryAndExitThread
ResumeThread
ExitThread
PeekNamedPipe
GetFileType
GetFileInformationByHandle
GetDriveTypeW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
MoveFileExW
SetFileAttributesW
GetFileAttributesExW
GetModuleHandleExW
HeapWalk
HeapValidate
RtlUnwind
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlPcToFileHeader
RtlUnwindEx
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
RaiseException
GetStartupInfoW
IsDebuggerPresent
GetFileSizeEx
SetFilePointerEx
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
ReadConsoleW
SetStdHandle
GetTimeZoneInformation
HeapReAlloc
SetCurrentDirectoryW
GetUserDefaultLCID
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryW
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
GetLastError
LoadLibraryA
CreateEventExW
WaitForSingleObjectEx
CloseHandle
OutputDebugStringA
GetConsoleWindow
SetLastError
GetFullPathNameW
GetExitCodeThread
FormatMessageW
DeleteFileW
CreateThread
GetCurrentDirectoryW
LocalFree
GetModuleHandleW
ReadFile
SetFilePointer
CreateFileW
GetFileAttributesW
GetCurrentDirectoryA
SetCurrentDirectoryA
GetFileSize
SetEnvironmentVariableW
FormatMessageA
CreateDirectoryW
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetModuleFileNameW
GetEnvironmentVariableW
EnumSystemLocalesW
Sleep
CreateProcessW
GetExitCodeProcess
SetWaitableTimer
CreateWaitableTimerW
WaitForSingleObject
GetTickCount64
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcess
K32GetProcessMemoryInfo
GlobalAlloc
GlobalLock
GlobalUnlock
GetLocaleInfoW
GetVersionExW
GetSystemInfo
GlobalMemoryStatusEx
VerSetConditionMask
VerifyVersionInfoW
GlobalFree
GetCurrentProcessId
DebugBreak
GetEnvironmentVariableA
ExitProcess
lstrlenA
GetVersion
MoveFileA
GetCommandLineW
ExpandEnvironmentStringsW
GetFinalPathNameByHandleW
SetErrorMode
GetCurrentThreadId
SetUnhandledExceptionFilter
OutputDebugStringW
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
GetStringTypeW
GetLocaleInfoEx
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
CreateSymbolicLinkW
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFileInformationByHandle
GetNativeSystemInfo
SwitchToThread
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
SetEndOfFile
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
TlsFree
TlsGetValue
TlsAlloc
SetThreadPriority
TlsSetValue
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
RtlCaptureStackBackTrace
IsValidLocale
FlushFileBuffers
GetConsoleOutputCP
FindClose
GetConsoleMode
HeapSize
FreeLibrary
WriteConsoleW
user32
GetForegroundWindow
DispatchMessageW
IsDialogMessageW
PeekMessageW
EnumDisplaySettingsA
UpdateWindow
SetProcessDPIAware
SetDlgItemTextA
MessageBoxA
GetFocus
OpenClipboard
CloseClipboard
GetMonitorInfoW
MonitorFromWindow
TranslateMessage
SetCapture
GetRawInputDeviceList
GetRawInputDeviceInfoA
MessageBoxW
LoadImageW
EmptyClipboard
GetClipboardData
SetClipboardData
IsClipboardFormatAvailable
keybd_event
SetForegroundWindow
ReleaseCapture
FindWindowA
EnumDisplaySettingsW
GetClientRect
GetAsyncKeyState
IsWindowVisible
GetWindowLongPtrW
GetLayeredWindowAttributes
IntersectRect
wsprintfW
GetCursorPos
GetActiveWindow
SetWindowLongPtrW
ClientToScreen
MoveWindow
SetCursorPos
CreateDialogParamW
GetDC
SetWindowTextW
SetDlgItemTextW
GetDlgItemTextW
GetDlgItem
DrawTextW
DialogBoxParamW
ReleaseDC
DefWindowProcW
AdjustWindowRectEx
GetKeyState
PostMessageW
GetWindowRect
DestroyWindow
SetWindowPos
CreateWindowExW
ScreenToClient
SendMessageW
CallNextHookEx
GetSystemMetrics
RegisterClassExW
ShowWindow
FindWindowExA
MapWindowPoints
UnhookWindowsHookEx
EnumWindows
SetFocus
BringWindowToTop
EnumDisplayDevicesW
LoadCursorW
SendMessageA
SetParent
EndDialog
SetWindowsHookExW
SetCursor
gdi32
GetStockObject
DeleteObject
CombineRgn
GetRgnBox
CreateRectRgnIndirect
GetDeviceCaps
SelectObject
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegOpenKeyExW
RegCloseKey
CryptGenRandom
CryptReleaseContext
RegQueryValueExW
CryptAcquireContextA
shell32
ShellExecuteW
SHGetFolderPathW
ole32
CoCreateInstance
CoTaskMemFree
CoInitialize
CoCreateFreeThreadedMarshaler
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
ImmSetCandidateWindow
dwmapi
DwmGetCompositionTimingInfo
DwmGetWindowAttribute
Sections
.text Size: 8.6MB - Virtual size: 8.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 429KB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 406KB - Virtual size: 405KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
minATL Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mydata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 146KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Tales of the Moon/data.win