deadcells[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

deadcells.exe
Size

14.9MB
MD5

74f7a6d4e627fcbff0efc439d02abfc0
SHA1

e79f1b6788f00e097e7b97739e85feae41ab7a97
SHA256

981ee69ff2f02bf74b2df75808795e463660e24e07fdef85d663ce81ac221ffe
SHA512

459df2cddb5917dd0f51bb0e25befe88235add681ee4962cc68cbf74c2decf1c2384800d87c9edf5281759ffdf9dc938352d714bedb368bcd08711262876dafb
SSDEEP

196608:daeSEMSCHzQftAUiGUCX32+C04ix2ys9JitQe:8zBHzEtAUiGUCX32+CMx9cJit3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
deadcells.exe

Files

deadcells.exe
.exe windows:6 windows x86 arch:x86

dbebd74e11e1acc24bd864324ec74541

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

libhl

hl_alloc_dynbool
hl_dyn_setf
hl_dyn_getp
hl_dyn_setd
hlt_void
hl_same_type
hl_make_dyn
hl_alloc_obj
hl_alloc_strbytes
hl_alloc_closure_ptr
hl_alloc_executable_memory
hl_get_obj_rt
hl_alloc_enum
hl_alloc_dynamic
hl_to_virtual
hl_dyn_castd
hl_alloc_virtual
hl_assert
hl_dyn_call
hl_socket_recv
hl_socket_listen
hl_get_thread
hl_socket_bind
hl_dyn_casti
hl_dyn_seti
hlt_bytes
hl_gc_threads_info
hl_throw
hl_socket_new
hl_thread_start
hl_dyn_setp
hl_sys_sleep
hl_socket_send
hl_dyn_castp
hl_rethrow
hl_dyn_geti
hl_init_virtual
hl_socket_init
hl_free_executable_memory
hl_sys_getpid
hl_gc_set_dump_types
hl_setup_exception
hl_socket_accept
hl_remove_root
hl_fatal_fmt
hl_fatal_error
hl_obj_field_fetch
hl_flush_proto
hl_init_enum
hl_sys_init
hl_exception_stack
hl_to_string
hl_register_thread
hl_global_init
hl_setup_reload_check
hl_add_root
hl_pad_struct
hl_dyn_call_safe
hl_global_free
hl_hash_utf8
hl_is_dynamic
hl_dyn_castf
hl_dyn_getf
hl_alloc_dynobj
hl_dyn_call_obj
hl_dyn_compare
hl_type_size
hl_dyn_getd
hlt_dyn
hl_setup_callbacks
hl_socket_close
hl_alloc_init
hl_from_utf8
hl_zalloc
hl_hash_gen
hl_free
hl_malloc
hl_utf8_length

user32

MessageBoxA

kernel32

GetModuleFileNameW
IsDebuggerPresent
SizeofResource
EndUpdateResourceW
LoadResource
FindResourceW
UpdateResourceW
CopyFileW
BeginUpdateResourceW
LoadLibraryA
GetProcAddress
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess

vcruntime140

memset
_except_handler4_common
__intrinsic_setjmp
strstr
memcpy
wcsrchr

api-ms-win-crt-stdio-l1-1-0

__p__commode
__stdio_common_vswprintf
fread
_wfopen
fseek
__stdio_common_vfwprintf
fclose
ftell
__stdio_common_vsprintf
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

terminate
_controlfp_s
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___wargv
__p___argc
exit
_exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type

api-ms-win-crt-math-l1-1-0

_CIfmod
__setusermatherr
fmod

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
free

api-ms-win-crt-filesystem-l1-1-0

_wstat32

api-ms-win-crt-convert-l1-1-0

wcstol
wcstombs

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14.7MB - Virtual size: 14.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bind
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dbebd74e11e1acc24bd864324ec74541

Headers

DLL Characteristics

File Characteristics

Imports

libhl

user32

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 79KB - Virtual size: 78KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 1KB - Virtual size: 3KB

.gfids Size: 512B - Virtual size: 32B

.rsrc Size: 14.7MB - Virtual size: 14.7MB

.reloc Size: 4KB - Virtual size: 4KB

.bind Size: 138KB - Virtual size: 138KB

.text
Size: 79KB - Virtual size: 78KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 1KB - Virtual size: 3KB

.gfids
Size: 512B - Virtual size: 32B

.rsrc
Size: 14.7MB - Virtual size: 14.7MB

.reloc
Size: 4KB - Virtual size: 4KB

.bind
Size: 138KB - Virtual size: 138KB