AssassinsCreed_Launcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

AssassinsCreed_Launcher.exe
Size

604KB
MD5

2044e24566158a72e2d90d6a330d1201
SHA1

99a522dd5bd92cdefdb8e872545ac3e0e9ed1624
SHA256

186aaa7d32ee6586b9bfd7f342fdae95460e329ddde8e6569dedc85f1d234419
SHA512

b6d71e91495e83d652ee97529e5cec7e599c2532a7f49d7ae67be910be7c7848ee8b21018b4f5a637d2f5a6e30e80c897a8bb6f7c85ae16e7af9dd8a85821ba8
SSDEEP

12288:zCm9cF1znWpgnKv2EyOvjkM/SPVyH9ImSyQktlhHZCcpn47nKIWcGwHEgRyqGL+8:zCmogjL5Cc2hPoDvBclPlwnRK0k+S0

Score

1^/10

Malware Config

Signatures

Files

AssassinsCreed_Launcher.exe
.exe windows:4 windows x86 arch:x86

fc0000bc8adbc1e89ee89437dd2dc8e3

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:e7:b9:6e:e2:42:40:1c:23:cc:d7:41:6b:81:ab:d5
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

12/06/2007, 00:00

Not After

13/07/2008, 23:59

Subject

CN=UBISOFT ENTERTAINMENT INC.,OU=UBI.COM,O=UBISOFT ENTERTAINMENT INC.,L=montreal,ST=quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

NdrServerCall
RpcMgmtStopServerListening
RpcServerUnregisterIf
RpcServerUseProtseqEpA
RpcServerRegisterIf
RpcServerListen

wintrust

WinVerifyTrust

kernel32

WritePrivateProfileStringA
GlobalFlags
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetCurrentProcess
FindClose
FindFirstFileA
GetVolumeInformationA
GetCPInfo
GetOEMCP
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesA
GetFileTime
GetTickCount
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetProcessHeap
GetStartupInfoA
ExitThread
CreateThread
GetTimeFormatA
GetDateFormatA
ExitProcess
HeapSize
VirtualFree
HeapDestroy
HeapCreate
GetACP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
SetConsoleMode
ReadConsoleInputA
FileTimeToSystemTime
GetThreadLocale
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
FreeResource
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
GetCurrentProcessId
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
LoadLibraryA
lstrcmpA
FreeLibrary
GetModuleHandleA
GetProcAddress
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
LocalFree
MulDiv
ExpandEnvironmentStringsA
GetStdHandle
WaitForMultipleObjects
GetLocalTime
GetFullPathNameA
DeleteFileA
GetModuleFileNameA
GetTempPathA
GetTempFileNameA
GetDiskFreeSpaceExA
Sleep
OutputDebugStringA
SetEvent
CloseHandle
CreateEventA
WaitForSingleObject
ResetEvent
lstrlenA
CompareStringW
CompareStringA
GetVersion
MultiByteToWideChar
InterlockedExchange
GetCurrentDirectoryA
CreateFileA
GetFileSize
ReadFile
GetLastError
FormatMessageA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetFileInformationByHandle
PeekNamedPipe
GetCommandLineA
CreateFileW

user32

RegisterClipboardFormatA
PostThreadMessageA
CharNextA
DestroyMenu
ReleaseCapture
SetCapture
LoadCursorA
GetSysColorBrush
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetDesktopWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
ReleaseDC
GetDC
SetWindowContextHelpId
MapDialogRect
RegisterWindowMessageA
WinHelpA
IsChild
GetCapture
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
SetActiveWindow
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
SetForegroundWindow
UpdateWindow
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
EqualRect
CopyRect
PtInRect
DefWindowProcA
CallWindowProcA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowTextLengthA
GetWindowTextA
SetWindowPos
SetFocus
ShowWindow
MoveWindow
SetWindowLongA
GetDlgCtrlID
IsWindow
SetWindowTextA
CharUpperA
IsDialogMessageA
SendDlgItemMessageA
GetDlgItem
GetWindow
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
UnregisterClassA
MessageBeep
GetNextDlgGroupItem
IsWindowEnabled
MessageBoxA
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
MapWindowPoints
CopyAcceleratorTableA
DrawIcon
SendMessageA
PostMessageA
IsIconic
GetWindowRect
GetClientRect
EnableWindow
LoadIconA
GetSystemMetrics
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
PostQuitMessage
CheckMenuItem
EnableMenuItem
ModifyMenuA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
SetCursor
SetWindowsHookExA
CallNextHookEx
GetClassLongA

gdi32

ExtSelectClipRgn
DeleteDC
GetStockObject
GetBkColor
GetTextColor
GetRgnBox
GetMapMode
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetTextColor
SetViewportExtEx
OffsetViewportOrgEx
GetClipBox
CreateBitmap
GetDeviceCaps
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
CreateRectRgnIndirect
GetObjectA
SetBkColor
SetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegEnumValueA
RegQueryValueA
RegEnumKeyA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA

shell32

ShellExecuteA
ShellExecuteExA

comctl32

ord17

shlwapi

PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

OleIsCurrentClipboard
CoTaskMemAlloc
CLSIDFromProgID
CoTaskMemFree
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
OleFlushClipboard
CoRegisterMessageFilter
CoRevokeClassObject
CLSIDFromString

oleaut32

SysFreeString
SysAllocStringByteLen
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocString
SysStringLen

ws2_32

WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
bind
listen
gethostbyaddr
getsockname
accept
socket
connect
getsockopt
ioctlsocket
recv
send
__WSAFDIsSet
closesocket
htons
ntohs
select
inet_addr
ntohl
gethostbyname
htonl
inet_ntoa
WSACleanup
WSAStartup

Sections

.text
Size: 460KB - Virtual size: 456KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc0000bc8adbc1e89ee89437dd2dc8e3

Code Sign

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

20:e7:b9:6e:e2:42:40:1c:23:cc:d7:41:6b:81:ab:d5Certificate

Extended Key Usages

Signer

Headers

File Characteristics

Imports

rpcrt4

wintrust

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

Sections

.text Size: 460KB - Virtual size: 456KB

.rdata Size: 92KB - Virtual size: 90KB

.data Size: 20KB - Virtual size: 33KB

.rsrc Size: 24KB - Virtual size: 20KB

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

20:e7:b9:6e:e2:42:40:1c:23:cc:d7:41:6b:81:ab:d5
Certificate

.text
Size: 460KB - Virtual size: 456KB

.rdata
Size: 92KB - Virtual size: 90KB

.data
Size: 20KB - Virtual size: 33KB

.rsrc
Size: 24KB - Virtual size: 20KB