GamingRepairTool[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

GamingRepairTool.exe
Size

697KB
MD5

59e73ccafb7716acd521f905200e99c2
SHA1

f05bfc61c913e8076811fd7e0500db6d4b61382a
SHA256

52ddf1940aa345c326cfbdd5a4b06484cc9c81412ac40c3c62e6ae62fb0806ca
SHA512

05a4e3919573867088adcb01524c3db86d4b01c1b560dbe7748f89328039286afcbdbd9ff32aadb81b77faf4d2d8ea5f38e9ffd88962d6988ff3214fc990312c
SSDEEP

12288:Hg3ImCFI7LEcqzDgOx4y6Pjjcqhzwtho5SlJysV:JmKgLEcwT+wdLysV

Score

1^/10

Malware Config

Signatures

Files

GamingRepairTool.exe
.exe windows:10 windows x64 arch:x64

e426636b026de7ea94467fb58d9b2784

Code Sign

33:00:00:05:57:cf:90:dd:c7:d1:c0:88:8c:00:00:00:00:05:57
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:51

Not After

16/10/2024, 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f2:8f:eb:71:c4:b9:2a:8d:1e:b2:bd:b6:9a:d7:a9:49:93:54:ae:6f:06:5d:2c:ef:c7:e5:47:27:bf:98:b5:e7
Signer

Actual PE Digest

f2:8f:eb:71:c4:b9:2a:8d:1e:b2:bd:b6:9a:d7:a9:49:93:54:ae:6f:06:5d:2c:ef:c7:e5:47:27:bf:98:b5:e7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

GamingRepairTool.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_initterm
terminate
_beginthreadex
_get_initial_wide_environment
_initterm_e
exit
_exit
_crt_atexit
__p___argc
__p___wargv
_register_onexit_function
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_errno
abort

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf
getchar
__stdio_common_vsnprintf_s
fsetpos
_set_fmode
__p__commode
_fseeki64
__stdio_common_vsprintf_s
ungetc
setvbuf
_setmode
_fileno
__acrt_iob_func
fgetpos
fwrite
__stdio_common_vswprintf_s
fgetwc
fgetc
fflush
fclose
fputwc
ungetwc

api-ms-win-crt-string-l1-1-0

wcsncpy_s
_wcsnicmp
wcsnlen
wcscpy_s
wcscmp
__strncnt
islower
strcpy_s
strcspn
_wcsicmp
_wcsdup
isupper
isspace
tolower

ntdll

RtlPcToFileHeader
RtlUnwindEx
NtQueryInformationProcess
NtQueryMutant
DbgPrintEx
RtlLookupFunctionEntry
VerSetConditionMask
NtFsControlFile

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleExW
LoadStringW
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetProcAddress
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

ResetEvent
TryAcquireSRWLockExclusive
CreateMutexW
CreateEventW
SetEvent
LeaveCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
WaitForSingleObject
CreateEventExW
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseMutex
AcquireSRWLockShared
ReleaseSRWLockExclusive
WaitForSingleObjectEx
EnterCriticalSection
OpenSemaphoreW
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockExclusive
CreateMutexExW
SetWaitableTimer

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
HeapReAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

ResumeThread
GetCurrentProcessId
GetCurrentProcess
OpenProcessToken
GetCurrentThreadId
GetCurrentThread
OpenThreadToken
CreateProcessAsUserW
GetExitCodeProcess
CreateThread
ExitProcess
GetExitCodeThread
CreateProcessW

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
GetCPInfo
LCMapStringEx
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

SetHandleInformation
CloseHandle

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo
GetSystemTimePreciseAsFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount64

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoGetActivationFactory
RoUninitialize
RoActivateInstance

api-ms-win-core-fibers-l1-1-0

FlsGetValue
FlsAlloc
FlsSetValue
FlsFree

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

drvstore

DriverStoreEnumW

newdev

DiUninstallDriverW
DiUninstallDevice

setupapi

SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoList
SetupDiDestroyDeviceInfoList

api-ms-win-crt-locale-l1-1-0

_lock_locales
_unlock_locales
_configthreadlocale
setlocale
___lc_locale_name_func
___mb_cur_max_func
localeconv
___lc_collate_cp_func
___lc_codepage_func
__pctype_func

api-ms-win-crt-heap-l1-1-0

_free_base
_malloc_base
_calloc_base
_realloc_base
_set_new_mode
_callnewh
calloc
malloc
free

api-ms-win-crt-convert-l1-1-0

_wtoi
strtof
strtod
wcstoul
_wtof

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-math-l1-1-0

frexp
ldexp
pow
powf

api-ms-win-crt-time-l1-1-0

_W_Getdays
_Getdays
_Strftime
_Getmonths
_Gettnames
_W_Gettnames
_Wcsftime
_W_Getmonths

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects
CreateWaitableTimerW

api-ms-win-core-synch-l1-2-0

WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
WakeAllConditionVariable
Sleep

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsDeleteString
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsConcatString

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegSetValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegDeleteTreeW

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

api-ms-win-core-file-l1-1-0

CreateDirectoryW
RemoveDirectoryW
GetFileAttributesW
FindNextFileW
FindFirstFileW
DeleteFileW
GetFinalPathNameByHandleW
CreateFileW
SetFileTime
GetFileAttributesExW
GetFileTime
SetFileAttributesW
FindClose

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW
K32GetProcessImageFileNameW

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoInitializeEx
CoUninitialize
CoTaskMemFree

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
GlobalFree

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
GetTokenInformation
RevertToSelf
DuplicateTokenEx
AdjustTokenPrivileges

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-namedpipe-l1-1-0

CreatePipe

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-eventing-controller-l1-1-0

StartTraceW
ControlTraceW
EnableTraceEx2

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-service-management-l1-1-0

ControlServiceExW
StartServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW
QueryServiceConfigW
NotifyServiceStatusChangeW
QueryServiceStatusEx

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringEx
GetStringTypeW

winhttp

WinHttpOpen
WinHttpSetOption
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpSendRequest
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpQueryAuthSchemes
WinHttpGetIEProxyConfigForCurrentUser
WinHttpConnect
WinHttpOpenRequest
WinHttpGetDefaultProxyConfiguration
WinHttpGetProxyForUrl
WinHttpSetCredentials

api-ms-win-security-credentials-l1-1-0

CredFree
CredReadW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId

Sections

.text
Size: 384KB - Virtual size: 382KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e426636b026de7ea94467fb58d9b2784

Code Sign

33:00:00:05:57:cf:90:dd:c7:d1:c0:88:8c:00:00:00:00:05:57Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

f2:8f:eb:71:c4:b9:2a:8d:1e:b2:bd:b6:9a:d7:a9:49:93:54:ae:6f:06:5d:2c:ef:c7:e5:47:27:bf:98:b5:e7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-util-l1-1-0

drvstore

newdev

setupapi

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-path-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-string-l1-1-0

winhttp

api-ms-win-security-credentials-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

Sections

.text Size: 384KB - Virtual size: 382KB

33:00:00:05:57:cf:90:dd:c7:d1:c0:88:8c:00:00:00:00:05:57
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

f2:8f:eb:71:c4:b9:2a:8d:1e:b2:bd:b6:9a:d7:a9:49:93:54:ae:6f:06:5d:2c:ef:c7:e5:47:27:bf:98:b5:e7
Signer

.text
Size: 384KB - Virtual size: 382KB

.rdata
Size: 152KB - Virtual size: 149KB

.data
Size: 8KB - Virtual size: 11KB

.pdata
Size: 16KB - Virtual size: 13KB

.didat
Size: 4KB - Virtual size: 144B

.rsrc
Size: 116KB - Virtual size: 113KB

.reloc
Size: 4KB - Virtual size: 2KB