GetModuleParentPath
GetProcessIDByName
InjectDLLIntoProcessIdentifier
KillProcessID
LaunchExploit
SMTNP
SendLimitedLuaScript
SendLuaCScript
SendLuaScript
isAPIAttached
Static task
static1
Behavioral task
behavioral1
Sample
Noclip.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Noclip.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
WeAreDevs_API-cpp.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
WeAreDevs_API-cpp.dll
Resource
win10v2004-20231215-en
Target
Noclip.zip
Size
149KB
MD5
1d2f60a950912fc2b3ecf94742f37eae
SHA1
a6f43cacd5a83ebd50af822e8043e3d76b871993
SHA256
f52d0f24bf30ca63247b12ebf2b56f4d96b8add0d7ad6d1b26cd706490d342ed
SHA512
ccb1b69f70e8db6c23bd5ceffd44312620fa0ea8047806502e0cebaa28a52beaa0e5d9ad5f2c3e0d755c4fa843520f5c731fa3b00345324e101a0abde3232b37
SSDEEP
3072:Fe7+/pyzbBQHwn7Y5FQI9UEXFn4Cw8RqfF5KN365GiSJDUVrFSge/KiTDc8JARB0:8S/CNg40f1nG8kfSs5rSJwrFSgtiHc3g
Checks for missing Authenticode signature.
resource |
---|
unpack001/Noclip.exe |
unpack001/WeAreDevs_API-cpp.dll |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
LoadLibraryW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
GetProcAddress
_register_onexit_function
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
terminate
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
abort
__FrameUnwindFilter
_except_handler4_common
__current_exception
__current_exception_context
memset
ShellExecuteA
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleFileNameA
Process32First
WriteProcessMemory
WaitNamedPipeA
WriteFile
TerminateProcess
lstrlenA
WaitForSingleObject
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
GetTempPathA
CreateFileA
Process32Next
CloseHandle
GetProcAddress
VirtualAllocEx
CreateRemoteThread
VirtualFreeEx
SetEndOfFile
WriteConsoleW
HeapSize
CreateFileW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetFileSizeEx
SetFilePointerEx
GetStdHandle
GetFileType
HeapAlloc
HeapFree
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
DeleteFileW
ReadFile
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
MessageBoxA
wsprintfA
InternetOpenUrlA
InternetReadFile
InternetOpenA
InternetCloseHandle
URLDownloadToFileA
GetModuleParentPath
GetProcessIDByName
InjectDLLIntoProcessIdentifier
KillProcessID
LaunchExploit
SMTNP
SendLimitedLuaScript
SendLuaCScript
SendLuaScript
isAPIAttached
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ