GameMod_widowsoft_1[.]6[.]2[.]1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

GameMod_widowsoft_1.6.2.1.exe
Size

90.4MB
MD5

74ad24621ba1f060eb144c934f53f441
SHA1

7675c5cabb05a23bf3a1ba017ab95df6b03216fc
SHA256

e5cee1c53f2315a5c3e037eea2d803f202fcef2bf6868daf1987f476de410d80
SHA512

3ce821d39e98bdab2db02c301ba07bc282e02d625ca1ee845bc48c9764f582a026f8c3952fb9cf1b70049d72d3764681e4e8d66a4f24a53ded17e939904007e3
SSDEEP

1572864:uK/8TogmsXpJMOcfxegh0JrXvpgJhr4IZZkSU7saqymunXePczLwRBaq5mS34OpQ:u48l3piOshOgJh/ZkSU/zmUXePsEDJod

Score

1^/10

Malware Config

Signatures

Files

GameMod_widowsoft_1.6.2.1.exe
.exe windows:6 windows x86 arch:x86

c44773fbd6f6733d07085085debe0535

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:89:c5:c3:05:9f:ed:53:a7:98:39:f3:60:38:97:b1
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

20/06/2022, 00:00

Not After

20/06/2023, 23:59

Subject

SERIALNUMBER=91420100MABN46X65G,CN=Wuhan Mofangjiasu Technology Co.\, Ltd,O=Wuhan Mofangjiasu Technology Co.\, Ltd,L=wuhan,ST=hubei,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#132945617374204c616b65204e657720546563686e6f6c6f677920446576656c6f706d656e74205a6f6e65,1.3.6.1.4.1.311.60.2.1.2=#13054875626569,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:89:c5:c3:05:9f:ed:53:a7:98:39:f3:60:38:97:b1
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

20/06/2022, 00:00

Not After

20/06/2023, 23:59

Subject

SERIALNUMBER=91420100MABN46X65G,CN=Wuhan Mofangjiasu Technology Co.\, Ltd,O=Wuhan Mofangjiasu Technology Co.\, Ltd,L=wuhan,ST=hubei,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#132945617374204c616b65204e657720546563686e6f6c6f677920446576656c6f706d656e74205a6f6e65,1.3.6.1.4.1.311.60.2.1.2=#13054875626569,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b7:60:59:55:b4:0e:33:73:87:69:d5:d2:6f:94:8b:19:9c:11:41:04:e3:59:34:b0:17:80:57:5f:d4:15:72:05
Signer

Actual PE Digest

b7:60:59:55:b4:0e:33:73:87:69:d5:d2:6f:94:8b:19:9c:11:41:04:e3:59:34:b0:17:80:57:5f:d4:15:72:05

Digest Algorithm

sha256

PE Digest Matches

true

5e:f6:30:d9:c2:85:62:e1:58:76:b9:8c:a8:8d:21:b7:04:fd:3c:bc
Signer

Actual PE Digest

5e:f6:30:d9:c2:85:62:e1:58:76:b9:8c:a8:8d:21:b7:04:fd:3c:bc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathAddBackslashW
PathRemoveExtensionW
PathStripPathW
PathCombineW

kernel32

GetDiskFreeSpaceW
GetDriveTypeW
OutputDebugStringA
CreateEventW
FindClose
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
DeviceIoControl
LocalFree
FormatMessageW
QueryFullProcessImageNameW
K32EnumProcessModules
K32GetModuleFileNameExW
GetCurrentProcess
GetFileTime
DosDateTimeToFileTime
CreateDirectoryExW
DecodePointer
WriteConsoleW
SetEndOfFile
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
FlushFileBuffers
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileType
HeapAlloc
HeapFree
GetStdHandle
ExitProcess
FreeLibraryAndExitThread
ExitThread
CreateThread
SystemTimeToFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
LCMapStringEx
EncodePointer
lstrcpyW
GetStringTypeW
QueryPerformanceFrequency
QueryPerformanceCounter
InitOnceComplete
InitOnceBeginInitialize
GetExitCodeThread
Sleep
WaitForSingleObjectEx
IsProcessorFeaturePresent
GetModuleHandleExW
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
WriteFile
SetFileTime
SetFilePointer
LocalFileTimeToFileTime
GetFileAttributesW
CreateDirectoryW
GlobalLock
GlobalUnlock
GlobalAlloc
GetCurrentProcessId
OutputDebugStringW
MulDiv
GetACP
WideCharToMultiByte
MultiByteToWideChar
FreeLibrary
DeleteTimerQueueTimer
CreateTimerQueueTimer
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrlenW
LoadLibraryW
FreeResource
GetTickCount
ReadFile
GetFileSize
CreateFileW
GetCurrentDirectoryW
InitializeCriticalSectionEx
SetCurrentDirectoryW
CreateEventA
GetCommandLineW
Process32NextW
TerminateProcess
OpenProcess
lstrcmpiW
Process32FirstW
CreateToolhelp32Snapshot
CloseHandle
WaitForSingleObject
CreateProcessW
DeleteFileW
GetProductInfo
lstrcpynW
GetVersionExW
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentThreadId
RaiseException
SizeofResource
LockResource
LoadResource
GetModuleHandleW
FindResourceW
GetModuleFileNameW
GetLastError
InitializeConditionVariable
FormatMessageA
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetLocalTime
LoadLibraryExW

user32

CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
SetTimer
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
GetWindowRect
GetCursorPos
ScreenToClient
MapWindowPoints
IntersectRect
UnionRect
OffsetRect
IsIconic
PtInRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
SetWindowRgn
MessageBoxW
InflateRect
DefWindowProcW
PostQuitMessage
CallWindowProcW
IsWindowVisible
RegisterClassW
RegisterClassExW
GetClassInfoExW
ShowWindow
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
LoadCursorW
LoadImageW
UpdateLayeredWindow
SetWindowPos
DestroyWindow
IsWindow
CreateWindowExW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
PostMessageW
IsZoomed
IsRectEmpty
MoveWindow
MapVirtualKeyExW
GetKeyNameTextW
GetKeyboardLayout
SetForegroundWindow
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
DrawTextA
wsprintfA
EqualRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
IsWindowEnabled
SystemParametersInfoW
wsprintfW
GetSysColor
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
GetCaretBlinkTime
CreateCaret
TrackPopupMenu
AppendMenuW
EnableMenuItem
DestroyMenu
CreatePopupMenu
SetRect
FillRect
DrawTextW
CharPrevW
SetCursor
MonitorFromPoint
GetWindowRgn

gdi32

SetBitmapBits
GetBitmapBits
FillRgn
GetTextExtentPointA
CreatePatternBrush
GdiFlush
TextOutW
MoveToEx
GetObjectA
SetTextColor
SetStretchBltMode
StretchBlt
SetBkMode
SetBkColor
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
CreateCompatibleBitmap
CombineRgn
GetDeviceCaps
CreateDIBSection
PtInRegion
CreateRectRgn
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
SelectObject
SaveDC
RestoreDC
Rectangle
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateCompatibleDC
BitBlt
ExtSelectClipRgn

advapi32

RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyW
RegDeleteValueW

shell32

SHGetSpecialFolderPathW
SHChangeNotify
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW

ole32

CoUninitialize
CoInitialize
CoCreateGuid
CreateStreamOnHGlobal
OleLockRunning
CoCreateInstance
CLSIDFromString
CLSIDFromProgID

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

comctl32

_TrackMouseEvent
ord17

gdiplus

GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipFree
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillRectangleI
GdipDrawRectangleI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

winhttp

WinHttpOpen
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpConnect
WinHttpSetOption
WinHttpSetTimeouts
WinHttpCloseHandle

Sections

.text
Size: 668KB - Virtual size: 668KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 89.5MB - Virtual size: 89.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c44773fbd6f6733d07085085debe0535

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

08:89:c5:c3:05:9f:ed:53:a7:98:39:f3:60:38:97:b1Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

08:89:c5:c3:05:9f:ed:53:a7:98:39:f3:60:38:97:b1Certificate

Extended Key Usages

Key Usages

b7:60:59:55:b4:0e:33:73:87:69:d5:d2:6f:94:8b:19:9c:11:41:04:e3:59:34:b0:17:80:57:5f:d4:15:72:05Signer

5e:f6:30:d9:c2:85:62:e1:58:76:b9:8c:a8:8d:21:b7:04:fd:3c:bcSigner

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

gdiplus

imm32

winhttp

Sections

.text Size: 668KB - Virtual size: 668KB

.rdata Size: 184KB - Virtual size: 183KB

.data Size: 16KB - Virtual size: 22KB

.rsrc Size: 89.5MB - Virtual size: 89.5MB

.reloc Size: 42KB - Virtual size: 41KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:89:c5:c3:05:9f:ed:53:a7:98:39:f3:60:38:97:b1
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:89:c5:c3:05:9f:ed:53:a7:98:39:f3:60:38:97:b1
Certificate

b7:60:59:55:b4:0e:33:73:87:69:d5:d2:6f:94:8b:19:9c:11:41:04:e3:59:34:b0:17:80:57:5f:d4:15:72:05
Signer

5e:f6:30:d9:c2:85:62:e1:58:76:b9:8c:a8:8d:21:b7:04:fd:3c:bc
Signer

.text
Size: 668KB - Virtual size: 668KB

.rdata
Size: 184KB - Virtual size: 183KB

.data
Size: 16KB - Virtual size: 22KB

.rsrc
Size: 89.5MB - Virtual size: 89.5MB

.reloc
Size: 42KB - Virtual size: 41KB