growtopia | Eternity[.]exe | Triage

Sharing

General

Target

Eternity.exe
Size

40.7MB
MD5

dd25c1eb2ee26fae2e4e1514568f08a2
SHA1

4e1c0cc2354510a550f54692449780b8e5613d01
SHA256

feed95481351dc1e993cdb061ae0eb28bfe18bc46409d231ee1ddc5e7c538181
SHA512

53554600d9f45271658a126a33a08ead6f15ac25736cdc85efaa9e9a831564626f3e42fdbb02f5c2891b743b0127b57e41db5b5857a558710619702d147e8e4f
SSDEEP

786432:hzvsyBy7Mu30RZFaG4ZmI1XHMX+XJQripdhr:ayCMr3EG4TVHjZQr+hr

Score

10^/10

growtopia

Malware Config

Signatures

Growtopia family
growtopia
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

Eternity.exe

Files

Eternity.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 19.9MB - Virtual size: 19.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Eternit
Size: 19.7MB - Virtual size: 19.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Eternit
Size: 407KB - Virtual size: 406KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ