41c896dca5114424960124d32a026e99
- SHA256 9bbe8b385ff0c9da8db86ef66211c02cc2e7846527d32dd8f1f5b3474f76c9f4
Behavioral task
behavioral1
Sample
Monster Hunter World v20200109-v20200311 Plus 67 Trainer.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Monster Hunter World v20200109-v20200311 Plus 67 Trainer.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 41c896dca5114424960124d32a026e99
- Size 796KB
- Sample240104-ysff1saabr
- SHA256 9bbe8b385ff0c9da8db86ef66211c02cc2e7846527d32dd8f1f5b3474f76c9f4
- MD5 41c896dca5114424960124d32a026e99
- SHA1 3fa8dc5eb1729a50b8eb810836ca45f71392b6df
- SHA512 5f3b85d0ce54b8aa68061ce40d0011facb2854cf7b146e6cc2196964662648e206c5cd64f2edb56e26391929706b2a2872dda98f75aff03fb7c07cf1064fe606
- SSDEEP 24576:Pjz4pvz/2eMA7b5M9gInlgfYXMruLOvtL:7ze2eMA7q95lgfY8Lvh
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- R77 family
- r77 rootkit payload 1 IoCs
Detects the payload of the r77 rootkit.
resource yara_rule static1/unpack001/Monster Hunter World v20200109-v20200311 Plus 67 Trainer.exe r77_payload - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Monster Hunter World v20200109-v20200311 Plus 67 Trainer.exe
File Explorer
-
41c896dca5114424960124d32a026e99.rar 796KB
-
Monster Hunter World v20200109-v20200311 Plus 67 Trainer.exe.exe 1.9MB
Monster Hunter World v20200109-v20200311 Plus 67 Trainer.exe
- IMPHASH 4048d738ded1c82c336c66ca8ccbb888
- SHA256 986dadc5b09df3da82129e55f252e2bc77c8df797c9436fa2c60a2f746ddd017
- MD5 bcb9dae4bdda2912eb45bb07f3745b0c
- SHA1 1b0599c8e7b8b3f0467cf4eaf58eab427316eb5d
- SHA512 f5ae6081e2587e7fb0eb954ca11bf4cb514b5b1ea383bfb4d2036037ef66a41cadf468ba963930ec9539754598ef978ff352fcd00fcaf09fd2bf604237e290fb
- SSDEEP 24576:PmhZTgxM7E85AMujElknYcq6ZwP3r1LaPECkDtGQjnEd6vVfaccDSz:Pm9EjPEaOBK/kwonPvtac
- MD5 SHA1 SHA512 SSDEEP
-
r77 rootkit payload
Detects the payload of the r77 rootkit.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
212164
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
UnmapViewOfFile
Sleep
CloseHandle
LoadLibraryW
GetProcAddress
GetCurrentProcessId
CreateFileMappingW
MapViewOfFile
ReadFile
WritePrivateProfileStringW
WriteFile
CreateFileW
GetModuleHandleA
GetPrivateProfileStringW
GetLastError
LoadLibraryA
WaitNamedPipeW
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleHandleW
GetModuleFileNameW
GetFileAttributesW
MultiByteToWideChar
FreeLibrary
LoadLibraryExW
GetCurrentProcess
IsWow64Process
SetLastError
WaitForSingleObject
ResumeThread
CreateDirectoryW
GetTempPathW
RaiseException
WriteConsoleW
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
DecodePointer
QueryPerformanceCounter
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
LocalFree
CreateTimerQueue
SetEvent
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwindEx
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
GetStdHandle
SetFilePointerEx
HeapAlloc
HeapFree
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsValidLocale
user32
MessageBoxA
MessageBoxW
shell32
SHGetFolderPathW
oleaut32
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayDestroy
mscoree
CLRCreateInstance
CorBindToRuntime
wininet
InternetOpenA
InternetReadFile
InternetOpenUrlA
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
winmm
PlaySoundW
Name
.text
Size
486KB
Virtual Size
485KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
186KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=26715,
count=20, id=260, version=26715,
count=179, id=261, version=26715,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=17, id=260, version=28117,
count=9, id=259, version=28117,
count=147, id=261, version=28117,
count=15, id=257, version=26715,
count=180, id=1, productName=Unmarked objects,
count=16, id=265, version=28314,
count=1, id=255, productName=VS2019 v16.4.0 build 28314, version=28314,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.4.0 build 28314, version=28314,