citra-setup-windows[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

citra-setup-windows.exe
Size

18.8MB
MD5

c100ded574f2ee338fc140d6a827d8c7
SHA1

17d9b7ed21aec256a12f3310fed0ccf3dee722ff
SHA256

4d18164a5cd1a739fedb27aac13a9a6a660046234f158dd94685ca3d43a7eb2d
SHA512

e2d474b45554b9c13b994ee7596e13c66c51c592594ddd43deba9feb1b4251f9910e50fd5d146a41fcbca64d39922bf586eddf8b13eb925e7d11083303b786d9
SSDEEP

196608:S3FdHrAsSNesXTx7Hgbn5QZ9HsJsv6tWKFdu9CV/7Uk6:S3FFJsXTx7Hk5QjHsJsv6tWKFdu9ClY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
citra-setup-windows.exe

Files

citra-setup-windows.exe
.exe windows:6 windows x86 arch:x86

c022d1340f73688a398b02b986745e16

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmGetVirtualKey
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmNotifyIME
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmGetDefaultIMEWnd

oleaut32

VariantChangeType
VariantInit
SystemTimeToVariantTime
SysStringLen
SysFreeString
VariantCopy
VariantClear
SysAllocStringLen
SysAllocString

user32

GetFocus
RegisterClassExW
PostMessageW
DrawMenuBar
GetSystemMenu
RemoveMenu
GetClientRect
GetWindowThreadProcessId
SendMessageTimeoutW
CharUpperW
GetDoubleClickTime
IsWindow
MessageBeep
GetCaretBlinkTime
GetDesktopWindow
SystemParametersInfoW
UpdateLayeredWindowIndirect
SendMessageW
AttachThreadInput
ChildWindowFromPointEx
GetSysColorBrush
LoadImageW
GetMonitorInfoW
EnumDisplayMonitors
GetSysColor
LoadIconW
IsHungAppWindow
GetCursorPos
EnumWindows
MonitorFromWindow
UnregisterDeviceNotification
RegisterDeviceNotificationW
CharNextExA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
KillTimer
SetTimer
MsgWaitForMultipleObjectsEx
GetQueueStatus
DispatchMessageW
GetClassInfoW
GetWindowTextW
GetAsyncKeyState
GetMessageExtraInfo
TrackMouseEvent
GetClipboardFormatNameW
GetCursorInfo
GetIconInfo
CreateIconIndirect
CreateCursor
LoadCursorW
GetCursor
SetCursorPos
RegisterClassW
NotifyWinEvent
SetMenuItemInfoW
TrackPopupMenuEx
GetMenu
MapVirtualKeyW
ToUnicode
ToAscii
GetKeyboardState
GetKeyState
IsZoomed
PeekMessageW
SetCaretPos
HideCaret
DestroyCaret
CreateCaret
RegisterWindowMessageW
GetKeyboardLayout
RegisterClipboardFormatW
ChangeClipboardChain
SetClipboardViewer
DefWindowProcW
CreateWindowExW
IsChild
DestroyWindow
ShowWindow
UpdateLayeredWindow
SetLayeredWindowAttributes
FlashWindowEx
MoveWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
IsWindowVisible
IsIconic
SetFocus
GetCapture
SetCapture
ReleaseCapture
GetSystemMetrics
EnableMenuItem
GetForegroundWindow
TranslateMessage
SetForegroundWindow
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
SetWindowRgn
InvalidateRect
SetWindowTextW
GetWindowRect
AdjustWindowRectEx
SetCursor
ClientToScreen
ScreenToClient
GetWindowLongW
SetWindowLongW
GetParent
SetParent
DestroyCursor
DestroyIcon
UnregisterClassW
GetKeyboardLayoutList
RealGetWindowClassW
DrawIconEx
MessageBoxW
WindowFromDC
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
PostThreadMessageW
GetAncestor

uxtheme

OpenThemeData
DrawThemeBackground
GetThemeColor
GetThemeSysFont
IsThemeActive
SetWindowThemeAttribute
DrawThemeTextEx
CloseThemeData
ord47
GetThemeBackgroundRegion
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
GetThemeBool
GetThemeInt
GetThemeEnumValue
GetThemeMargins
GetThemePropertyOrigin
SetWindowTheme
IsAppThemed
GetCurrentThemeName
GetThemeTransitionDuration

ole32

CoInitializeEx
OleSetClipboard
OleUninitialize
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
ReleaseStgMedium
CoGetMalloc
CoTaskMemAlloc
CoCreateGuid
OleInitialize
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
OleGetClipboard
StringFromGUID2

dwmapi

DwmExtendFrameIntoClientArea
DwmDefWindowProc
DwmIsCompositionEnabled
DwmEnableBlurBehindWindow

shell32

SHGetMalloc
SHCreateItemFromParsingName
SHCreateItemFromIDList
ShellExecuteW
ord727
SHGetStockIconInfo
SHGetFileInfoW
SHChangeNotify
SHGetFolderLocation
ShellExecuteExW
SHGetFolderPathW
SHGetPathFromIDListW
SHGetKnownFolderIDList
SHBrowseForFolderW
ord155
SHParseDisplayName
SHGetKnownFolderPath
CommandLineToArgvW

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

advapi32

AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetFileSecurityW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegNotifyChangeKeyValue
AddAccessAllowedAce
DeregisterEventSource
RegisterEventSourceA
ReportEventA
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashA
CryptEnumProvidersA
CopySid
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegQueryInfoKeyW
RegSetValueExW
GetLengthSid
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner

crypt32

CertCreateCertificateContext
CertFreeCertificateContext
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty

gdi32

BitBlt
CombineRgn
CreateRectRgn
DeleteObject
OffsetRgn
SelectClipRgn
GetDeviceCaps
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
DeleteDC
SelectObject
ChoosePixelFormat
SetPixelFormat
GetBitmapBits
GetObjectW
CreateFontIndirectW
EnumFontFamiliesExW
GetFontData
GetStockObject
AddFontResourceExW
RemoveFontResourceExW
AddFontMemResourceEx
RemoveFontMemResourceEx
GetTextMetricsW
GetTextFaceW
CreateDIBSection
GdiFlush
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
GetCharABCWidthsI
SetBkMode
SetGraphicsMode
SetTextColor
SetTextAlign
SetWorldTransform
ExtTextOutW
GetRegionData
CreateBitmap
GetDIBits

mpr

WNetGetUniversalNameA

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

winmm

timeSetEvent
timeKillEvent
PlaySoundW

kernel32

PeekNamedPipe
ReadFileEx
LCMapStringW
GetUserPreferredUILanguages
GetCurrencyFormatW
GetTimeFormatW
GetDateFormatW
GetTickCount64
GetProcessId
GetExitCodeProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
WaitForSingleObjectEx
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
TerminateThread
GetThreadPriority
SetThreadPriority
GetCurrentThread
CreateThread
SwitchToThread
DuplicateHandle
GetFullPathNameW
GetStartupInfoW
GetUserDefaultLCID
CompareStringW
OutputDebugStringW
GetNativeSystemInfo
FlushConsoleInputBuffer
SetHandleInformation
GetOverlappedResult
CreateNamedPipeW
ConnectNamedPipe
GlobalFree
WaitNamedPipeW
DisconnectNamedPipe
CreateFileMappingW
CancelIoEx
GetTimeZoneInformation
SystemTimeToFileTime
GetSystemTime
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
VerifyVersionInfoW
VerSetConditionMask
GetTempFileNameA
GetTempPathA
Sleep
lstrcmpW
GetVolumeInformationW
GetUserDefaultLangID
GlobalSize
LoadLibraryA
GetLocaleInfoW
GlobalUnlock
GlobalLock
GlobalAlloc
CheckRemoteDebuggerPresent
ExpandEnvironmentStringsW
WaitForMultipleObjects
FileTimeToLocalFileTime
GlobalMemoryStatus
GetSystemInfo
VirtualFree
VirtualAlloc
CreateSemaphoreW
CreateEventW
ReleaseSemaphore
ResetEvent
SetEvent
InitializeCriticalSection
GetVersionExW
FileTimeToDosDateTime
GetSystemTimeAsFileTime
LoadLibraryW
LoadLibraryExW
SleepEx
WriteFileEx
VirtualProtect
GetFileAttributesW
GetLogicalDrives
CopyFileW
GetFileInformationByHandleEx
SetFilePointerEx
MoveFileExW
FindFirstFileExW
GetModuleHandleExW
FindNextChangeNotification
GetGeoInfoW
GetUserGeoID
ReleaseMutex
CreateMutexW
EncodePointer
DecodePointer
GetStringTypeW
HeapFree
RaiseException
RtlUnwind
GetCommandLineA
HeapAlloc
ExitThread
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
AreFileApisANSI
SetConsoleCtrlHandler
GetConsoleMode
ReadConsoleInputA
ReadConsoleW
GetConsoleCP
SetStdHandle
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
CreateTimerQueue
SignalObjectAndWait
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
IsValidLocale
EnumSystemLocalesW
HeapSize
GetProcessHeap
GetModuleFileNameA
IsValidCodePage
GetACP
GetOEMCP
SystemTimeToTzSpecificLocalTime
SetEnvironmentVariableA
SetEnvironmentVariableW
WriteConsoleW
GetThreadTimes
FreeLibraryAndExitThread
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateProcessA
GetLocalTime
GetModuleFileNameW
FreeLibrary
WideCharToMultiByte
MultiByteToWideChar
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleA
GetLogicalDriveStringsW
FindNextFileW
GetStdHandle
GetFileType
GetLargestConsoleWindowSize
SetConsoleScreenBufferSize
FreeConsole
AttachConsole
AllocConsole
SetConsoleMode
GetConsoleWindow
GetCommandLineW
CloseHandle
CreateProcessW
LocalFree
FormatMessageW
GetFileAttributesExW
GetLongPathNameW
GetShortPathNameW
GetEnvironmentVariableW
GetCurrentProcess
IsWow64Process
OpenProcess
GetLogicalDriveStringsA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetDiskFreeSpaceExA
GetDriveTypeA
GetDriveTypeW
GetVolumePathNamesForVolumeNameW
SetErrorMode
WaitForSingleObject
TerminateProcess
GetLastError
FileTimeToSystemTime
CreateFileW
DeviceIoControl
FlushFileBuffers
LockFile
UnlockFile
WriteFile
CompareFileTime
GetProcAddress
GetFileSize
ReadFile
SetEndOfFile
SetFilePointer
SetFileTime
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
RemoveDirectoryW
SetFileAttributesW
GetTempPathW
SetLastError
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetSystemDirectoryW
GetModuleHandleW
MoveFileW
GetFileInformationByHandle
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationW
FindFirstFileW

ws2_32

WSAGetLastError
htonl
inet_addr
ntohl
gethostbyaddr
gethostbyname
WSANtohs
WSAAsyncSelect
WSACleanup
WSAStartup
gethostname
WSASetLastError
shutdown
send
recv
WSASocketW
WSASendTo
WSASend
WSARecvFrom
WSARecv
WSANtohl
WSAIoctl
WSAHtonl
WSAConnect
WSAAccept
setsockopt
select
listen
htons
getsockname
getpeername
closesocket
bind
__WSAFDIsSet
getsockopt

d3d9

D3DPERF_BeginEvent
D3DPERF_EndEvent
D3DPERF_SetMarker
D3DPERF_GetStatus
Direct3DCreate9

Sections

.text
Size: 13.0MB - Virtual size: 13.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 166KB - Virtual size: 329KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 484KB - Virtual size: 483KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c022d1340f73688a398b02b986745e16

Headers

DLL Characteristics

File Characteristics

Imports

imm32

oleaut32

user32

uxtheme

ole32

dwmapi

shell32

iphlpapi

advapi32

crypt32

gdi32

mpr

version

winmm

kernel32

ws2_32

d3d9

Sections

.text Size: 13.0MB - Virtual size: 13.0MB

.rdata Size: 5.1MB - Virtual size: 5.1MB

.data Size: 166KB - Virtual size: 329KB

.qtmetad Size: 512B - Virtual size: 272B

_RDATA Size: 512B - Virtual size: 292B

.rsrc Size: 66KB - Virtual size: 65KB

.reloc Size: 484KB - Virtual size: 483KB

.text
Size: 13.0MB - Virtual size: 13.0MB

.rdata
Size: 5.1MB - Virtual size: 5.1MB

.data
Size: 166KB - Virtual size: 329KB

.qtmetad
Size: 512B - Virtual size: 272B

_RDATA
Size: 512B - Virtual size: 292B

.rsrc
Size: 66KB - Virtual size: 65KB

.reloc
Size: 484KB - Virtual size: 483KB