t5sp[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

t5sp.exe
Size

7.7MB
MD5

44cfc97c837cecc74291bcc9a939469c
SHA1

154fdeece89a2fcefd4da13a43f16dd94b709dd9
SHA256

f968ce5b7d53e753ca320499ee21cb9583f8b1d0fa64928e3496b66bd278230a
SHA512

5bcab83d9353b630fd4849d82f0d0e24575ea66fdbab7be5359ffd601d1b1ac01cb832a8ddf114c56ac2605344ad0ea8ba0cf60e2971939ce842f0233703872f
SSDEEP

98304:aaKumMwRVVk8ix/KbZwO+o9O5a/U4dpzfRlFHael9PVPAySQXudEwQ:+VmDbO+o9O8/7dpzf3FHaelDOEL

Score

1^/10

Malware Config

Signatures

Files

t5sp.exe
.exe windows:5 windows x86 arch:x86

d2bad50735bf2d3989d63188c71e34ed

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6c:40:9e:48:c3:2b:0d:11:00:f8:0b:9d:29:bc:1f:b9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

20/04/2009, 00:00

Not After

19/04/2012, 23:59

Subject

CN=Valve Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Steam,O=Valve Corporation,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cf:67:6e:a9:e4:d9:68:78:86:7d:3c:24:23:b4:28:69:a9:7b:41:43
Signer

Actual PE Digest

cf:67:6e:a9:e4:d9:68:78:86:7d:3c:24:23:b4:28:69:a9:7b:41:43

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

steam_api

SteamAPI_RegisterCallResult
SteamAPI_Shutdown
SteamAPI_UnregisterCallback
SteamAPI_UnregisterCallResult
SteamAPI_RunCallbacks
SteamAPI_RestartAppIfNecessary
SteamAPI_Init
SteamApps
SteamGameServer
SteamGameServer_RunCallbacks
SteamMasterServerUpdater
SteamGameServer_Init
SteamGameServer_Shutdown
SteamNetworking
SteamUserStats
SteamAPI_RegisterCallback
SteamUtils
SteamUser
SteamFriends

winmm

mixerSetControlDetails
timeEndPeriod
timeBeginPeriod
mixerGetControlDetailsA
mixerGetLineControlsA
mixerClose
mixerGetLineInfoA
mixerOpen
mixerGetNumDevs
waveInGetNumDevs
timeGetTime

wsock32

recvfrom
select
gethostname
WSAStartup
sendto
closesocket
htons
ioctlsocket
gethostbyname
WSAGetLastError
socket

binkw32

_BinkRegisterFrameBuffers@8
_BinkSetSoundSystem@8
_BinkClose@4
_BinkGetError@0
_BinkOpen@8
_BinkSetSoundTrack@8
_BinkSetIOSize@4
_BinkDoFrame@4
_BinkSetMemory@8
_BinkWait@4
_BinkOpenDirectSound@4
_BinkControlBackgroundIO@8
_BinkSetVolume@12
_BinkPause@8
_BinkShouldSkip@4
_BinkGetFrameBuffersInfo@8
_BinkNextFrame@4
_BinkGetRealtime@12

d3d9

Direct3DCreate9
D3DPERF_BeginEvent
D3DPERF_EndEvent

d3dx9_43

D3DXCompileShader
D3DXSaveSurfaceToFileA
D3DXCreateBuffer
D3DXGetShaderConstantTable
D3DXGetShaderInputSemantics
D3DXGetShaderOutputSemantics

dsound

ord11
ord6

kernel32

GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetEnvironmentVariableW
SetEnvironmentVariableA
InitializeCriticalSectionAndSpinCount
VirtualQuery
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapCreate
GetStdHandle
SetStdHandle
WriteConsoleA
QueryPerformanceCounter
InterlockedDecrement
CreateFileA
ReadFileEx
GetLastError
SleepEx
CloseHandle
GetFileSize
GetFileAttributesA
InterlockedIncrement
DebugBreak
ExitProcess
GetCurrentThreadId
SwitchToThread
InterlockedExchange
GetCurrentProcess
GetProcAddress
GetModuleHandleA
LoadLibraryA
RaiseException
Sleep
SetEvent
ResetEvent
CreateEventA
WaitForSingleObject
GetProcessAffinityMask
DuplicateHandle
GetCurrentThread
CreateThread
SuspendThread
ResumeThread
SetThreadPriority
SetFileAttributesA
VirtualAlloc
VirtualFree
QueryPerformanceFrequency
GetModuleFileNameA
InitializeCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
GetCurrentDirectoryA
GlobalMemoryStatus
SetProcessAffinityMask
GetThreadPriority
FormatMessageA
OutputDebugStringA
GetDriveTypeA
GetConsoleOutputCP
GlobalSize
GlobalLock
GetVersionExA
Module32Next
Module32First
CreateToolhelp32Snapshot
OpenProcess
WriteFile
ReadFile
GetCurrentProcessId
DeleteFileA
SetErrorMode
SetUnhandledExceptionFilter
DeleteCriticalSection
TerminateProcess
GetTickCount
MulDiv
SetPriorityClass
SetThreadExecutionState
FreeLibrary
WideCharToMultiByte
ReleaseMutex
ReleaseSemaphore
CreateMutexA
CreateSemaphoreA
SetFilePointer
PulseEvent
SetLastError
CreateEventW
GetProcessTimes
GetModuleHandleExA
GetFileTime
HeapFree
GetProcessHeap
GetFileInformationByHandle
CreateFileW
lstrcmpiW
lstrlenW
GetFullPathNameW
HeapAlloc
HeapSize
GetTimeZoneInformation
GetComputerNameA
GetSystemTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
InterlockedCompareExchange
GetSystemDirectoryW
GetWindowsDirectoryW
GetModuleFileNameW
UnmapViewOfFile
LockResource
LoadResource
SizeofResource
FindResourceW
GetConsoleWindow
GetCurrentDirectoryW
GetEnvironmentStringsW
GetCommandLineW
GetStartupInfoW
GetFullPathNameA
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
OpenEventA
GetSystemInfo
FindNextFileA
GetModuleHandleW
ExitThread
MultiByteToWideChar
HeapReAlloc
GetCommandLineA
GetStartupInfoA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
LCMapStringW
WriteConsoleW
CompareStringA
CompareStringW
SetEndOfFile
TerminateThread
GetExitCodeThread
FindFirstFileA
FileTimeToLocalFileTime
FindClose
CreateDirectoryA
IsDebuggerPresent
UnhandledExceptionFilter
MoveFileA
GlobalUnlock
RtlUnwind

user32

RegisterClassA
DefWindowProcA
DestroyWindow
PostQuitMessage
CallWindowProcA
SetWindowTextA
CloseWindow
CallNextHookEx
GetAsyncKeyState
SetWindowsHookExA
MapVirtualKeyA
MoveWindow
GetMonitorInfoA
MonitorFromWindow
RegisterWindowMessageA
LoadImageA
LoadIconA
LoadCursorA
RegisterClassExA
AdjustWindowRect
OpenClipboard
GetClipboardData
CloseClipboard
GetMessageA
DispatchMessageA
TranslateMessage
ShowWindow
PostMessageA
ShowCursor
ClientToScreen
GetCursorPos
CreateWindowExA
SendMessageA
ScreenToClient
GetForegroundWindow
SetFocus
SetCursorPos
GetActiveWindow
MessageBoxA
ChangeDisplaySettingsA
EnumThreadWindows
GetDesktopWindow
SetWindowPos
GetDC
ReleaseDC
GetWindowTextA
SetWindowLongA
GetWindowLongA
GetWindowRect
AdjustWindowRectEx
IsWindow
MonitorFromPoint
EnumDisplayMonitors
PeekMessageA
MessageBoxW
GetSystemMetrics

gdi32

DeleteDC
CreateFontA
ExtEscape
SetDeviceGammaRamp
GetDeviceCaps
CreateDCA
CreateSolidBrush

advapi32

CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueA

shell32

SHGetFolderPathA
ShellExecuteA

ole32

StringFromGUID2
CoInitializeEx
CoUninitialize
CLSIDFromString
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance

xinput1_3

ord3
ord4
ord2

psapi

GetProcessMemoryInfo

ws2_32

connect
ioctlsocket
setsockopt
bind
ntohs
send
inet_ntoa
recv
__WSAFDIsSet
getsockname

Sections

.text
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 233KB - Virtual size: 59.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 109B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.version
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2bad50735bf2d3989d63188c71e34ed

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

6c:40:9e:48:c3:2b:0d:11:00:f8:0b:9d:29:bc:1f:b9Certificate

Extended Key Usages

Key Usages

cf:67:6e:a9:e4:d9:68:78:86:7d:3c:24:23:b4:28:69:a9:7b:41:43Signer

Headers

DLL Characteristics

File Characteristics

Imports

steam_api

winmm

wsock32

binkw32

d3d9

d3dx9_43

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

xinput1_3

psapi

ws2_32

Sections

.text Size: 5.6MB - Virtual size: 5.6MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 233KB - Virtual size: 59.0MB

.tls Size: 512B - Virtual size: 109B

.rodata Size: 2KB - Virtual size: 1KB

.version Size: 512B - Virtual size: 4B

.rsrc Size: 76KB - Virtual size: 76KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

6c:40:9e:48:c3:2b:0d:11:00:f8:0b:9d:29:bc:1f:b9
Certificate

cf:67:6e:a9:e4:d9:68:78:86:7d:3c:24:23:b4:28:69:a9:7b:41:43
Signer

.text
Size: 5.6MB - Virtual size: 5.6MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 233KB - Virtual size: 59.0MB

.tls
Size: 512B - Virtual size: 109B

.rodata
Size: 2KB - Virtual size: 1KB

.version
Size: 512B - Virtual size: 4B

.rsrc
Size: 76KB - Virtual size: 76KB