Static task
static1
Behavioral task
behavioral1
Sample
Conquer.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Conquer.exe
Resource
win10v2004-20231222-en
General
-
Target
3f24c650ca314d32a9448b22cbac47fb
-
Size
1.1MB
-
MD5
3f24c650ca314d32a9448b22cbac47fb
-
SHA1
3771d1c11edfafb5d9a5046008b2e55c569a8795
-
SHA256
e5429e480ed1d32888216c957b4819fc6d09525e62a28cd555e44b959ca9beb4
-
SHA512
dc909566dbaff6a490acf48669e77bbc0b33dde57a52b2af50afc6e5a000f0eec029523a1f741d588f3e3d599f333847c1b7a7d7d11e0e5e71cc6973508be2df
-
SSDEEP
24576:/+jN1lXUIV+W+vITZ5FS1TH1ZBAotHZTpWsDQbNTUeF:GjrlEIEWcITJSx1fAYhpWscbpU8
Malware Config
Signatures
Files
-
3f24c650ca314d32a9448b22cbac47fb.rar
-
Conquer.exe.exe windows:4 windows x86 arch:x86
4e98ecba4c931fcbdddec3a711dfb147
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01-08-1996 00:00Not After31-12-2020 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06-08-2003 00:00Not After05-08-2013 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
61:c3:80:3e:4e:7a:9e:4e:71:54:48:f5:1a:97:59:f0Certificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before11-07-2008 08:07Not After11-07-2010 08:07SubjectCN=福建网龙计算机网络信息技术有限公司,OU=Technical Dept.,O=福建网龙计算机网络信息技术有限公司,L=Fu Zhou,ST=Fu Jian,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
2a:48:76:4a:d9:43:bf:72:6b:05:1e:0b:f1:8c:a6:7e:54:a8:c8:6cSigner
Actual PE Digest2a:48:76:4a:d9:43:bf:72:6b:05:1e:0b:f1:8c:a6:7e:54:a8:c8:6cDigest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
timeGetTime
graphic
?GameCameraDestroy@CMyBitmap@@SAXXZ
?GameCameraSet@CMyBitmap@@SAXMMMK@Z
?PrepareSprite@CMyBitmap@@SAXXZ
?PrepareLine@CMyBitmap@@SAXXZ
MultiBmpCreate
?ShowBlock@CMyBitmap@@SAXUCMyPos@@000K@Z
?GetObliqueAngle@CMyBitmap@@SAHXZ
?GetDefaultFontName@CMyBitmap@@SAPBDXZ
?GetScreenSize@CMyBitmap@@SAXAAH0@Z
?Init3DEx@CMyBitmap@@SAHPAUHWND__@@KKHK@Z
?HintGraphicDetail@CMyBitmap@@SAHK@Z
?End3D@CMyBitmap@@SAHXZ
?Flip@CMyBitmap@@SAHPBUtagRECT@@0PAUHWND__@@@Z
?IfDeviceLost@CMyBitmap@@SAHXZ
?ResetDevice@CMyBitmap@@SAHXZ
?Begin3D@CMyBitmap@@SAHXZ
?ShowStringEx@CMyBitmap@@SA?AUCMySize@@HHKPBD0HHW4RENDER_TEXT_STYLE@@KAAUCMyPos@@@Z
?GetStrShowLen@CMyBitmap@@SAHPBDHH@Z
?CalcuCharPosInString@CMyBitmap@@SAHPBDH_N0HPAVIDataIcon@@H@Z
?ShowEmotionStringCommon@CMyBitmap@@SA?AUCMySize@@HHKPBDPAVIDataIcon@@0HHHHHW4RENDER_TEXT_STYLE@@KAAUCMyPos@@@Z
?CheckStringPixels@CMyBitmap@@SA_NPBDK0H@Z
?GetFontSize@CMyBitmap@@SAXAAUCMySize@@@Z
?ShowString@CMyBitmap@@SAXHHKPBD0HHW4RENDER_TEXT_STYLE@@KAAUCMyPos@@@Z
?ShowLine@CMyBitmap@@SAXHHHHK@Z
?CalcuTextExtent@CMyBitmap@@SA?AUCMySize@@PBD0HPAVIDataIcon@@H@Z
?GetFontSize@CMyBitmap@@SAKXZ
?CalcuTextExtentCommon@CMyBitmap@@SA?AUCMySize@@PBD0HPAVIDataIcon@@H@Z
?ShowBlock@CMyBitmap@@SAXHHHHK@Z
?GameFontCreate@CMyBitmap@@SAHXZ
TargetBmpCreate
PuzzelTriangleCreate
?GetFontWidth@CMyBitmap@@SAKPBDH@Z
?GameCameraBuild@CMyBitmap@@SAXUCMySize@@@Z
?ClearBuffer@CMyBitmap@@SAHHHK@Z
?GetScreenHeight@CMyBitmap@@SAHXZ
?ShowStringCommon@CMyBitmap@@SA?AUCMySize@@HHKPBD0HHW4RENDER_TEXT_STYLE@@KAAUCMyPos@@@Z
?GetScreenWidth@CMyBitmap@@SAHXZ
?ShowRect@CMyBitmap@@SAXHHHHK@Z
?ScreenShot@CMyBitmap@@SAXPBD@Z
PuzzelBlockCreate
graphicdata
GameDataSetQuery
GameDataSetDestroy
ndsound
_DXPlayMedia@8
_DXClose2DSound@4
_DXCloseMedia@4
_DXDestroy@0
_DXCloseAllMedia@0
_DXCloseSound@12
_DXCloseAllSound@0
_DXSoundinit@4
_DXProcessSound@8
_DXSetMusicVolume@4
_DXSetSoundVolume@4
_DXPlaySound@24
_DXSetVolume@16
_DXSet2DSoundPos@12
role3d
Game3DEffectCreate
Simple3DObjCreate
dinput8
DirectInput8Create
assist
?CreateMonitorManager@@YAXXZ
?QueryMonitorManager@@YAPAVIMonitorManager@@XZ
gamedata
RoleDataQuery
RoleDataDestroy
roleview
RoleViewCreate
mfc42
ord3610
ord3402
ord3721
ord795
ord800
ord641
ord540
ord324
ord656
ord2302
ord4234
ord2645
ord3874
ord4299
ord3092
ord6199
ord4287
ord4284
ord4710
ord3803
ord537
ord5875
ord3706
ord3626
ord2414
ord1641
ord3663
ord2614
ord858
ord922
ord860
ord2818
ord3089
ord3876
ord941
ord5856
ord6874
ord6778
ord2575
ord4396
ord3574
ord3597
ord609
ord4476
ord2860
ord6453
ord1768
ord4538
ord2135
ord1572
ord3631
ord683
ord3226
ord1200
ord6779
ord2764
ord2688
ord4224
ord1105
ord4171
ord6877
ord692
ord665
ord1979
ord5442
ord5186
ord354
ord4125
ord6197
ord6377
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord3571
ord2915
ord2099
ord6605
ord6379
ord5148
ord3698
ord765
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord5307
ord5289
ord4622
ord3738
ord815
ord561
ord2621
ord1134
ord5714
ord2725
ord2859
ord755
ord470
ord4480
ord3398
ord3733
ord810
ord4271
ord3303
ord3296
ord3287
ord6008
ord4000
ord5271
ord2393
ord690
ord5207
ord389
ord1949
ord4034
ord535
ord1643
ord403
ord2454
ord4425
ord5280
ord1775
ord6052
ord2514
ord4998
ord4853
ord4376
ord5265
ord4123
ord2078
ord2642
ord6880
ord3873
ord823
ord2864
ord2379
ord2086
ord6215
ord5981
ord1233
ord6442
ord4275
ord825
ord567
ord1168
ord1146
ord818
ord3742
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord1576
ord3573
msvcrt
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
sin
atan2
feof
atan
??8type_info@@QBEHABV0@@Z
_splitpath
fseek
fread
sqrt
fwrite
fgets
fprintf
isdigit
vsprintf
floor
isprint
isspace
malloc
free
_daylight
exit
atof
fabs
strcpy
strtoul
_mbscmp
strstr
localtime
time
?terminate@@YAXXZ
abs
_findfirst
_findnext
_findclose
strncat
_open
_lseeki64
_close
_read
strrchr
srand
rand
strtok
fopen
fscanf
fclose
strcat
_itoa
_i64toa
pow
memset
_atoi64
ceil
atoi
_ftol
sprintf
_snprintf
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
memcmp
_CxxThrowException
memmove
memcpy
strcmp
strlen
strncpy
sscanf
_purecall
__CxxFrameHandler
_except_handler3
_stricmp
_strupr
??1type_info@@UAE@XZ
_onexit
__dllonexit
fputc
ftell
tolower
strncmp
isalnum
isalpha
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
ctime
mktime
atol
_strdup
_strrev
_mbsnbcat
tmpnam
_rotr
_rotl
_mkdir
wcslen
wcscat
_getch
_strlwr
strchr
gmtime
_filelength
_fileno
_errno
fflush
_setmode
realloc
_pctype
__mb_cur_max
_isctype
abort
wcsstr
_vsnprintf
vfprintf
_iob
memchr
qsort
getenv
fputs
signal
_fdopen
_setmbcp
wcsncat
kernel32
GetCurrentProcessId
GetStdHandle
QueryPerformanceCounter
GetVersionExA
FlushConsoleInputBuffer
Sleep
GetFileType
GetVersion
GlobalMemoryStatus
GetStartupInfoA
IsBadReadPtr
InterlockedExchange
GetModuleFileNameA
CloseHandle
ReleaseMutex
GetLastError
CreateMutexA
WritePrivateProfileStringA
GetCurrentDirectoryA
GetPrivateProfileStringA
GetTickCount
GetVolumeInformationA
GetFileAttributesA
WritePrivateProfileSectionA
WritePrivateProfileStructA
GetTimeZoneInformation
DeleteFileA
IsDBCSLeadByte
GlobalFree
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
LockResource
LoadResource
SizeofResource
FindResourceA
lstrcpynA
GetProcAddress
GetModuleHandleA
WriteProcessMemory
ReadProcessMemory
LoadLibraryA
FreeLibrary
_lclose
_lopen
ReadFile
GetFileSize
CreateFileA
CreateThread
IsDebuggerPresent
CreateDirectoryA
GetCurrentThreadId
OpenMutexA
WinExec
CopyFileA
SetCurrentDirectoryA
GetSystemDirectoryA
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapValidate
IsBadCodePtr
MulDiv
MultiByteToWideChar
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileTime
Process32Next
Process32First
CreateToolhelp32Snapshot
OutputDebugStringA
FindClose
FindFirstFileA
CreateFileW
InterlockedIncrement
InterlockedDecrement
GetPrivateProfileIntA
user32
IsWindow
GetClassNameA
MapDialogRect
WindowFromPoint
GetKeyboardState
FindWindowA
mouse_event
EnumChildWindows
RedrawWindow
InvalidateRect
SetCursorPos
FillRect
LoadImageA
SetCursor
IsWindowVisible
UnionRect
GetFocus
keybd_event
GetKeyState
MessageBoxA
ReleaseCapture
SetCapture
EnumWindows
GetParent
BeginPaint
EndPaint
GetCursorPos
ScreenToClient
LoadCursorFromFileA
CallWindowProcA
GetWindowRect
BringWindowToTop
SetWindowPos
SetWindowLongA
SetRect
PostMessageA
ClientToScreen
OffsetRect
EnableWindow
SetTimer
FlashWindow
GetActiveWindow
KillTimer
SendMessageA
LoadCursorA
DestroyIcon
LoadIconA
DestroyCursor
GetWindowTextA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
InflateRect
GetWindow
ChangeDisplaySettingsA
GetWindowRgn
SetWindowsHookExA
CallNextHookEx
GetForegroundWindow
IsIconic
GetSystemMetrics
GetClientRect
UnhookWindowsHookEx
ReleaseDC
GetDC
PtInRect
wsprintfW
DrawIcon
EnumDisplaySettingsA
SetWindowRgn
PostQuitMessage
gdi32
DeleteObject
CreateRectRgnIndirect
CombineRgn
GetStockObject
GetObjectA
CreatePatternBrush
ExtCreateRegion
PtInRegion
DeleteDC
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
CreateRectRgn
CreateSolidBrush
GetTextMetricsA
CreateFontA
CreatePolygonRgn
advapi32
RegCloseKey
RegOpenKeyExA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
shell32
ShellExecuteA
oleaut32
VariantClear
msvcp60
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?clear@ios_base@std@@QAEXH_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
ws2_32
htons
WSACleanup
inet_ntoa
gethostbyname
inet_addr
gethostname
WSAStartup
closesocket
__WSAFDIsSet
select
connect
ioctlsocket
setsockopt
recv
send
socket
WSAGetLastError
netapi32
Netbios
wininet
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 508KB - Virtual size: 507KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 180KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ