LDPlayer9_ens_com[.]mojang[.]minecraftpe_3040_ld[.]exe

Resubmissions

20/02/2024, 04:08

240220-eqlqgaaf7v8

20/02/2024, 04:04

240220-em7hrsaf5v6

Sharing

Copy URL Twitter E-mail

General

Target
LDPlayer9_ens_com.mojang.minecraftpe_3040_ld.exe
Size 3.3MB
Sample240220-eqlqgaaf7v
SHA256 c753c236d5e600472ebcea1112d3c9099336a595eb1178532ed8d5ff16555f2a
MD5 b7c64e32d9c820f09cb236618f676313
SHA1 8eee9c50f11ea332d5d2ff875896a8935557ea58
SHA512 74747ee03ec2dda47fad9df4b9266ea908f59cc99049a2ab73be66dbfdb45ddfb49674b9cd0f3984cff28cfeb5352b8b4e9033fc0ae7da7a484d582e5092836a
SSDEEP 49152:7VW9/X7NkfV0OaUAJqiI10HtOUYLPVKA6N+tG0R9sXafgkDFMVR9C1UhPJXMK70V:Bm/pkfVDFAJo1i0hUNfHBiCV2HD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

LDPlayer9_ens_com.mojang.minecraftpe_3040_ld.exe

.exe 3.3MB

LDPlayer9_ens_com.mojang.minecraftpe_3040_ld.exe

IMPHASH 4ede37294ff9eaa1487aa90a65057833
SHA256 c753c236d5e600472ebcea1112d3c9099336a595eb1178532ed8d5ff16555f2a
MD5 b7c64e32d9c820f09cb236618f676313
SHA1 8eee9c50f11ea332d5d2ff875896a8935557ea58
SHA512 74747ee03ec2dda47fad9df4b9266ea908f59cc99049a2ab73be66dbfdb45ddfb49674b9cd0f3984cff28cfeb5352b8b4e9033fc0ae7da7a484d582e5092836a
SSDEEP 49152:7VW9/X7NkfV0OaUAJqiI10HtOUYLPVKA6N+tG0R9sXafgkDFMVR9C1UhPJXMK70V:Bm/pkfVDFAJo1i0hUNfHBiCV2HD
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

2a:d7:b1:af:08:c6:a2:7d:6f:30:67:69:09:de:5a:f1:be:5b:fb:41:ff:ab:68:aa:a2:71:db:76:bf:12:26:d3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91310114MA1GT9FP6N,CN=Shanghai Chang Zhi Network Technology Co\,. Ltd.,O=Shanghai Chang Zhi Network Technology Co\,. Ltd.,ST=上海市,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c09e59889e5ae9ae58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Oct 26, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

b6:f7:39:96:d3:3d:82:d3:38:a6:d0:63:e0:fb:ce:8e:91:34:87:5e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Oct 26, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

Serial Number

0d:65:08:23:68:f9:43:30:12:3c:9a:85:3a:2f:de:bf

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 24, 2021 - Nov 26, 2024

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:65:08:23:68:f9:43:30:12:3c:9a:85:3a:2f:de:bf

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 24, 2021 - Nov 26, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

843476

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\trunk_downloader_package\downloader\bin\ldplayerinst.pdb

advapi32

RegCreateKeyW RegQueryValueExW RegCloseKey CryptGenRandom OpenProcessToken DuplicateTokenEx CryptCreateHash CryptReleaseContext CryptHashData CryptDestroyHash CryptEncrypt CryptDestroyKey CryptGetHashParam CryptImportKey CryptAcquireContextA

ws2_32

sendto recvfrom freeaddrinfo getaddrinfo WSAIoctl setsockopt ntohs htons getsockopt WSAGetLastError WSACleanup accept listen getpeername connect ioctlsocket gethostname WSAStartup htonl ntohl closesocket bind send recv WSASetLastError select socket __WSAFDIsSet getsockname

crypt32

CertFreeCertificateContext

wldap32

ord41 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord50 ord143 ord46 ord211 ord45

normaliz

IdnToAscii

kernel32

GlobalFree GetVersionExW Sleep RaiseException InitializeCriticalSectionEx DeleteCriticalSection LoadResource LockResource SizeofResource FindResourceW FindResourceExW GetProcAddress DecodePointer LoadLibraryW HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap SetLastError GetLogicalDriveStringsW GetDriveTypeW DeviceIoControl GetDiskFreeSpaceExW GetVolumeInformationW GetCurrentProcess OpenProcess DuplicateHandle CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcessModules K32GetModuleFileNameExW GetWindowsDirectoryW GetExitCodeProcess GetModuleHandleW FreeLibrary FindFirstFileW FindNextFileW DeleteFileW FindClose RemoveDirectoryW CreateDirectoryW FreeResource InitializeCriticalSection CreateSemaphoreW EnterCriticalSection GetLastError ReleaseSemaphore CreateThread GetCurrentThreadId CreateMutexW CreateEventW SetEvent GetLocalTime GlobalLock GlobalUnlock ReadFile GlobalAlloc TerminateThread GetFileSizeEx GetFileSize MoveFileExW MultiByteToWideChar WideCharToMultiByte GetStdHandle TerminateProcess GetStartupInfoW GetCurrentDirectoryW GetACP ExitProcess MulDiv InitializeCriticalSectionAndSpinCount FormatMessageA GetTickCount64 SleepEx VerSetConditionMask GetSystemDirectoryA GetModuleHandleA LoadLibraryA VerifyVersionInfoA WaitForSingleObjectEx GetFileType PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA IsDebuggerPresent GetCommandLineW UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation TlsFree TlsSetValue TlsGetValue TlsAlloc GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList IsProcessorFeaturePresent CreateTimerQueue GetStringTypeW EncodePointer AreFileApisANSI GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetCurrentThread GetSystemTimeAsFileTime CreateFileW WriteFile GetUserDefaultUILanguage WaitForSingleObject CloseHandle CreateProcessW GetModuleFileNameW ExitThread LoadLibraryExW GetTickCount RtlUnwind SetFilePointerEx FileTimeToLocalFileTime FileTimeToSystemTime GetCurrentProcessId GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetFullPathNameW SetEnvironmentVariableA CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID SetEndOfFile EnumSystemLocalesW GetModuleHandleExW OutputDebugStringW GetThreadTimes FreeLibraryAndExitThread VirtualAlloc VirtualFree VirtualProtect InitializeSListHead UnregisterWaitEx IsValidCodePage GetOEMCP GetConsoleCP GetConsoleMode FlushFileBuffers QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation ReadConsoleW SetStdHandle SystemTimeToTzSpecificLocalTime WriteConsoleW LeaveCriticalSection

user32

OffsetRect SetCursor wvsprintfW GetWindow IsRectEmpty UnionRect IntersectRect MapWindowPoints InvalidateRect GetUpdateRect ReleaseCapture SetCapture GetKeyState GetFocus GetActiveWindow SetFocus CharNextW IsWindowVisible DispatchMessageW TranslateMessage GetMessageW PtInRect GetCursorPos LoadImageW IsZoomed SetWindowRgn MessageBoxW GetWindowTextW GetWindowTextLengthW GetCaretBlinkTime GetCaretPos CharPrevW FillRect SetRect CreateCaret GetGUIThreadInfo BringWindowToTop EnableWindow ShowWindow CloseWindow PostQuitMessage SetWindowTextW SendMessageW InvalidateRgn CreateAcceleratorTableW GetSysColor ClientToScreen SetCaretPos CallWindowProcW RegisterClassExW GetClassInfoExW GetMonitorInfoW MonitorFromWindow MoveWindow GetWindowRect SetTimer KillTimer GetClientRect DrawTextW DestroyWindow GetParent BeginPaint EndPaint DefWindowProcW GetDC LoadCursorW RegisterClassW CreateWindowExW LoadBitmapW SetWindowLongW GetWindowLongW IsWindow FindWindowExW PostMessageW SetPropW GetPropW GetSystemMetrics IsIconic SetForegroundWindow SetWindowPos ScreenToClient ShowCaret HideCaret ReleaseDC

gdi32

CreateCompatibleBitmap DeleteObject CreateFontIndirectW GetStockObject Rectangle RestoreDC SaveDC GetTextMetricsW SetBkMode SetTextColor CreatePen CreateFontW SetWindowOrgEx CreateRoundRectRgn GetObjectA CreatePatternBrush GetDeviceCaps CreatePenIndirect CreateRectRgnIndirect GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo RoundRect SelectClipRgn ExtSelectClipRgn SetBkColor StretchBlt SetStretchBltMode CreateDIBSection MoveToEx TextOutW ExtTextOutW GdiFlush BitBlt DeleteDC CombineRgn CreateSolidBrush GetObjectW SelectObject CreateCompatibleDC

shell32

SHGetFolderPathW ord165 ShellExecuteW ShellExecuteExW SHGetMalloc SHGetPathFromIDListW SHBrowseForFolderW

ole32

CLSIDFromString CoCreateInstance OleLockRunning CreateStreamOnHGlobal CoUninitialize CLSIDFromProgID CoInitialize

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

shlwapi

PathFileExistsW PathIsRootW

wininet

InternetReadFile InternetCloseHandle InternetCrackUrlW InternetOpenW HttpSendRequestW HttpOpenRequestW HttpQueryInfoW InternetConnectW

gdiplus

GdipLoadImageFromStream GdipSetStringFormatAlign GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipDeleteStringFormat GdipCreateStringFormat GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushI GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipDeleteGraphics GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipSetInterpolationMode GdipGraphicsClear GdipDrawImage GdipDrawImageRectI GdipDeleteFontFamily GdipCreateFontFromLogfontA GdipDeleteFont GdipGetFamily GdipDrawString GdipSetStringFormatLineAlign GdipCreateFontFromDC

iphlpapi

GetAdaptersInfo

comctl32

_TrackMouseEvent ord17

imm32

ImmGetVirtualKey ImmGetContext ImmReleaseContext ImmSetCompositionFontW ImmSetCompositionWindow

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

LDPlayer9_ens_com.mojang.minecraftpe_3040_ld.exe

advapi32

ws2_32

crypt32

wldap32

normaliz

kernel32

user32

gdi32

shell32

ole32

oleaut32

shlwapi

wininet

gdiplus

iphlpapi

comctl32

imm32

generic