Windows[.]rar | Triage

Resubmissions

13/03/2024, 19:08

240313-xtncksdc8y 7

13/03/2024, 19:05

240313-xrgf9afb56 7

Sharing

Copy URL Twitter E-mail

General

Target

Windows.rar
Size

13.9MB
MD5

70e7992cfcbdbbff33769bf3ab1b2091
SHA1

6ac693e6c89dad6024a3453ce14c7da966ddfe09
SHA256

bdb8496d349f0d842900128ae6329891f1ccc239180f111a5f89d927c82eb117
SHA512

803388f861b501d31ca751ebf72b68ed138f8e9f195bf45b91c2dad5efd7a1399d05783473eddb07b0ff494ce207c995e2d56f8dac0c4bf4aa45f915def7b203
SSDEEP

393216:Xl/L55CyVTZWiwxRCDVMYP9e9N+accGHRW7Ig59vfLQahHLg:1/tH/r7DZwHGHUpZs

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Windows/GameAssembly.dll
unpack001/Windows/MineXplorer.exe
unpack001/Windows/UnityCrashHandler32.exe
unpack001/Windows/UnityPlayer.dll

Files

Windows.rar
.rar
Windows/GameAssembly.dll
.dll windows:6 windows x86 arch:x86

7bf354a256691fb3e95d3ef6b702cb84

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Unity\minexplorer\MineXplorer\Library\il2cpp_cache\linkresult_D13BBC6FFFE2CE8B4812FFF0A5249A39\GameAssembly.pdb

Imports

kernel32

GetCurrentProcess
GetStdHandle
ReleaseSemaphore
WriteFile
VirtualAlloc
RemoveDirectoryW
WakeAllConditionVariable
GetModuleFileNameW
WakeConditionVariable
GetSystemTimes
GetThreadLocale
SetEnvironmentVariableW
SetThreadPriority
GetDynamicTimeZoneInformation
LeaveCriticalSection
InitializeCriticalSection
InitializeConditionVariable
GetEnvironmentVariableW
SetEndOfFile
CreateMutexW
WaitForMultipleObjectsEx
FindClose
GetLocaleInfoW
CreateFileW
GetCurrentThreadId
GetVersionExW
ReleaseMutex
FreeEnvironmentStringsW
UnmapViewOfFile
DuplicateHandle
GetACP
RtlCaptureStackBackTrace
CreateEventW
Sleep
GetConsoleMode
FormatMessageW
GetTimeZoneInformation
GetLastError
GetFileAttributesExW
ReleaseSRWLockExclusive
SetEvent
GetCurrentThread
AcquireSRWLockExclusive
WaitForSingleObjectEx
TlsAlloc
QueryPerformanceFrequency
GetThreadPriority
GlobalAlloc
DeleteFileW
CloseHandle
ReleaseSRWLockShared
GetNativeSystemInfo
RaiseException
GetSystemInfo
LoadLibraryW
CreateThread
ResetEvent
QueueUserAPC
GetCurrentDirectoryW
GetOverlappedResult
SwitchToThread
GetProcAddress
SetFilePointerEx
FindNextFileW
AcquireSRWLockShared
DeleteCriticalSection
GetCurrentProcessId
GetModuleHandleW
FreeLibrary
CreateSemaphoreW
CopyFileW
WideCharToMultiByte
SleepEx
TlsGetValue
GetSystemTimeAsFileTime
GetFileType
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetEnvironmentStringsW
VirtualQuery
IsDebuggerPresent
FlushFileBuffers
VirtualFree
SetFilePointer
SuspendThread
ResumeThread
GetExitCodeThread
GetThreadContext
GetProcessHeap
GetCommandLineW
GetCommandLineA
GetFullPathNameW
EnterCriticalSection
SetLastError
SleepConditionVariableCS
TlsSetValue
SetStdHandle
GetOEMCP
IsValidCodePage
HeapQueryInformation
HeapSize
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
HeapFree
HeapAlloc
GetConsoleOutputCP
ReadConsoleW
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
FindFirstFileExW
GetFileSizeEx
GetFileInformationByHandleEx
InitializeSRWLock
RtlUnwind
GetCPInfo
GetStringTypeW
LCMapStringEx
MultiByteToWideChar
DecodePointer
EncodePointer
InitializeCriticalSectionEx
TerminateProcess
InitializeSListHead
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
SleepConditionVariableSRW
ReadFile
CreateDirectoryW
WriteConsoleW

user32

MessageBoxA

advapi32

CryptAcquireContextW
GetUserNameW
CryptGenRandom
CryptReleaseContext

ole32

CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoGetContextToken
CoUninitialize
CoTaskMemAlloc
CoInitializeEx

oleaut32

SafeArrayCreate
SafeArrayUnaccessData
SysStringLen
SafeArrayGetVartype
SysFreeString
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayGetDim
SafeArrayAccessData
SafeArrayGetLBound

shell32

SHGetKnownFolderPath
SHGetFolderPathW

ws2_32

gethostbyaddr
WSACleanup
send
socket
ntohs
connect
inet_ntoa
gethostname
__WSAFDIsSet
inet_addr
getsockopt
htonl
inet_ntop
htons
WSAPoll
freeaddrinfo
ioctlsocket
getnameinfo
setsockopt
WSAGetLastError
getsockname
WSARecv
accept
bind
WSAIoctl
closesocket
WSASend
select
ntohl
shutdown
listen
inet_pton
getaddrinfo
recvfrom
WSAStartup

iphlpapi

GetAdaptersAddresses
GetIfEntry
GetNetworkParams

Exports

Exports

CloseZStream
CreateZStream
DllCanUnloadNow
DllGetActivationFactory
Flush
ReadZStream
UnityPalGetLocalTimeZoneData
UnityPalGetTimeZoneDataForID
UnityPalTimeZoneInfoGetTimeZoneIDs
UseUnityPalForTimeZoneInformation
WriteZStream
_DllCanUnloadNow@0
_DllGetActivationFactory@8
il2cpp_add_internal_call
il2cpp_alloc
il2cpp_allocation_granularity
il2cpp_array_class_get
il2cpp_array_element_size
il2cpp_array_get_byte_length
il2cpp_array_length
il2cpp_array_new
il2cpp_array_new_full
il2cpp_array_new_specific
il2cpp_array_object_header_size
il2cpp_assembly_get_image
il2cpp_bounded_array_class_get
il2cpp_capture_memory_snapshot
il2cpp_class_array_element_size
il2cpp_class_enum_basetype
il2cpp_class_for_each
il2cpp_class_from_il2cpp_type
il2cpp_class_from_name
il2cpp_class_from_system_type
il2cpp_class_from_type
il2cpp_class_get_assemblyname
il2cpp_class_get_bitmap
il2cpp_class_get_bitmap_size
il2cpp_class_get_data_size
il2cpp_class_get_declaring_type
il2cpp_class_get_element_class
il2cpp_class_get_events
il2cpp_class_get_field_from_name
il2cpp_class_get_fields
il2cpp_class_get_flags
il2cpp_class_get_image
il2cpp_class_get_interfaces
il2cpp_class_get_method_from_name
il2cpp_class_get_methods
il2cpp_class_get_name
il2cpp_class_get_namespace
il2cpp_class_get_nested_types
il2cpp_class_get_parent
il2cpp_class_get_properties
il2cpp_class_get_property_from_name
il2cpp_class_get_rank
il2cpp_class_get_static_field_data
il2cpp_class_get_type
il2cpp_class_get_type_token
il2cpp_class_get_userdata_offset
il2cpp_class_has_attribute
il2cpp_class_has_parent
il2cpp_class_has_references
il2cpp_class_instance_size
il2cpp_class_is_abstract
il2cpp_class_is_assignable_from
il2cpp_class_is_blittable
il2cpp_class_is_enum
il2cpp_class_is_generic
il2cpp_class_is_inflated
il2cpp_class_is_interface
il2cpp_class_is_subclass_of
il2cpp_class_is_valuetype
il2cpp_class_num_fields
il2cpp_class_set_userdata
il2cpp_class_value_size
il2cpp_current_thread_get_frame_at
il2cpp_current_thread_get_stack_depth
il2cpp_current_thread_get_top_frame
il2cpp_current_thread_walk_frame_stack
il2cpp_custom_attrs_construct
il2cpp_custom_attrs_free
il2cpp_custom_attrs_from_class
il2cpp_custom_attrs_from_method
il2cpp_custom_attrs_get_attr
il2cpp_custom_attrs_has_attr
il2cpp_debug_get_method_info
il2cpp_debugger_set_agent_options
il2cpp_domain_assembly_open
il2cpp_domain_get
il2cpp_domain_get_assemblies
il2cpp_exception_from_name_msg
il2cpp_field_get_flags
il2cpp_field_get_name
il2cpp_field_get_offset
il2cpp_field_get_parent
il2cpp_field_get_type
il2cpp_field_get_value
il2cpp_field_get_value_object
il2cpp_field_has_attribute
il2cpp_field_is_literal
il2cpp_field_set_value
il2cpp_field_set_value_object
il2cpp_field_static_get_value
il2cpp_field_static_set_value
il2cpp_format_exception
il2cpp_format_stack_trace
il2cpp_free
il2cpp_free_captured_memory_snapshot
il2cpp_gc_collect
il2cpp_gc_collect_a_little
il2cpp_gc_disable
il2cpp_gc_enable
il2cpp_gc_foreach_heap
il2cpp_gc_get_heap_size
il2cpp_gc_get_max_time_slice_ns
il2cpp_gc_get_used_size
il2cpp_gc_has_strict_wbarriers
il2cpp_gc_is_disabled
il2cpp_gc_is_incremental
il2cpp_gc_set_external_allocation_tracker
il2cpp_gc_set_external_wbarrier_tracker
il2cpp_gc_set_max_time_slice_ns
il2cpp_gc_wbarrier_set_field
il2cpp_gchandle_foreach_get_target
il2cpp_gchandle_free
il2cpp_gchandle_get_target
il2cpp_gchandle_new
il2cpp_gchandle_new_weakref
il2cpp_get_corlib
il2cpp_get_exception_argument_null
il2cpp_image_get_assembly
il2cpp_image_get_class
il2cpp_image_get_class_count
il2cpp_image_get_entry_point
il2cpp_image_get_filename
il2cpp_image_get_name
il2cpp_init
il2cpp_init_utf16
il2cpp_is_debugger_attached
il2cpp_is_vm_thread
il2cpp_method_get_class
il2cpp_method_get_declaring_type
il2cpp_method_get_flags
il2cpp_method_get_from_reflection
il2cpp_method_get_name
il2cpp_method_get_object
il2cpp_method_get_param
il2cpp_method_get_param_count
il2cpp_method_get_param_name
il2cpp_method_get_return_type
il2cpp_method_get_token
il2cpp_method_has_attribute
il2cpp_method_is_generic
il2cpp_method_is_inflated
il2cpp_method_is_instance
il2cpp_monitor_enter
il2cpp_monitor_exit
il2cpp_monitor_pulse
il2cpp_monitor_pulse_all
il2cpp_monitor_try_enter
il2cpp_monitor_try_wait
il2cpp_monitor_wait
il2cpp_object_get_class
il2cpp_object_get_size
il2cpp_object_get_virtual_method
il2cpp_object_header_size
il2cpp_object_new
il2cpp_object_unbox
il2cpp_offset_of_array_bounds_in_array_object_header
il2cpp_offset_of_array_length_in_array_object_header
il2cpp_override_stack_backtrace
il2cpp_profiler_install
il2cpp_profiler_install_allocation
il2cpp_profiler_install_enter_leave
il2cpp_profiler_install_fileio
il2cpp_profiler_install_gc
il2cpp_profiler_install_thread
il2cpp_profiler_set_events
il2cpp_property_get_flags
il2cpp_property_get_get_method
il2cpp_property_get_name
il2cpp_property_get_parent
il2cpp_property_get_set_method
il2cpp_raise_exception
il2cpp_register_debugger_agent_transport
il2cpp_register_log_callback
il2cpp_resolve_icall
il2cpp_runtime_class_init
il2cpp_runtime_invoke
il2cpp_runtime_invoke_convert_args
il2cpp_runtime_object_init
il2cpp_runtime_object_init_exception
il2cpp_runtime_unhandled_exception_policy_set
il2cpp_set_commandline_arguments
il2cpp_set_commandline_arguments_utf16
il2cpp_set_config
il2cpp_set_config_dir
il2cpp_set_config_utf16
il2cpp_set_data_dir
il2cpp_set_default_thread_affinity
il2cpp_set_find_plugin_callback
il2cpp_set_memory_callbacks
il2cpp_set_temp_dir
il2cpp_shutdown
il2cpp_start_gc_world
il2cpp_stats_dump_to_file
il2cpp_stats_get_value
il2cpp_stop_gc_world
il2cpp_string_chars
il2cpp_string_intern
il2cpp_string_is_interned
il2cpp_string_length
il2cpp_string_new
il2cpp_string_new_len
il2cpp_string_new_utf16
il2cpp_string_new_wrapper
il2cpp_thread_attach
il2cpp_thread_current
il2cpp_thread_detach
il2cpp_thread_get_all_attached_threads
il2cpp_thread_get_frame_at
il2cpp_thread_get_stack_depth
il2cpp_thread_get_top_frame
il2cpp_thread_walk_frame_stack
il2cpp_type_equals
il2cpp_type_get_assembly_qualified_name
il2cpp_type_get_attrs
il2cpp_type_get_class_or_element_class
il2cpp_type_get_name
il2cpp_type_get_name_chunked
il2cpp_type_get_object
il2cpp_type_get_type
il2cpp_type_is_byref
il2cpp_type_is_pointer_type
il2cpp_type_is_static
il2cpp_unhandled_exception
il2cpp_unity_install_unitytls_interface
il2cpp_unity_liveness_calculation_begin
il2cpp_unity_liveness_calculation_end
il2cpp_unity_liveness_calculation_from_root
il2cpp_unity_liveness_calculation_from_statics
il2cpp_value_box

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

il2cpp
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 318KB - Virtual size: 876KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 566KB - Virtual size: 566KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Windows/MineXplorer.exe
.exe windows:6 windows x86 arch:x86

93d7bb032e5b4ede025420a3defb9706

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\buildslave\unity\build\artifacts\WindowsPlayer\Win32_nondev_i_r\WindowsPlayer_Master_il2cpp_x86.pdb

Imports

unityplayer

UnityMain

kernel32

WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
CloseHandle
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
DecodePointer
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CreateFileW

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 552KB - Virtual size: 552KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Windows/MineXplorer_Data/Resources/unity default resources
Windows/MineXplorer_Data/app.info
Windows/MineXplorer_Data/boot.config
Windows/MineXplorer_Data/data.unity3d
Windows/MineXplorer_Data/il2cpp_data/Metadata/global-metadata.dat
Windows/MineXplorer_Data/il2cpp_data/Resources/mscorlib.dll-resources.dat
Windows/MineXplorer_Data/il2cpp_data/etc/mono/2.0/Browsers/Compat.browser
Windows/MineXplorer_Data/il2cpp_data/etc/mono/2.0/DefaultWsdlHelpGenerator.aspx
.js
Windows/MineXplorer_Data/il2cpp_data/etc/mono/2.0/machine.config
.xml
Windows/MineXplorer_Data/il2cpp_data/etc/mono/2.0/settings.map
.xml
Windows/MineXplorer_Data/il2cpp_data/etc/mono/2.0/web.config
.xml
Windows/MineXplorer_Data/il2cpp_data/etc/mono/4.0/Browsers/Compat.browser
Windows/MineXplorer_Data/il2cpp_data/etc/mono/4.0/DefaultWsdlHelpGenerator.aspx
.js
Windows/MineXplorer_Data/il2cpp_data/etc/mono/4.0/machine.config
.xml
Windows/MineXplorer_Data/il2cpp_data/etc/mono/4.0/settings.map
.xml
Windows/MineXplorer_Data/il2cpp_data/etc/mono/4.0/web.config
.xml
Windows/MineXplorer_Data/il2cpp_data/etc/mono/4.5/Browsers/Compat.browser
Windows/MineXplorer_Data/il2cpp_data/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx
.js
Windows/MineXplorer_Data/il2cpp_data/etc/mono/4.5/machine.config
.xml
Windows/MineXplorer_Data/il2cpp_data/etc/mono/4.5/settings.map
.xml
Windows/MineXplorer_Data/il2cpp_data/etc/mono/4.5/web.config
.xml
Windows/MineXplorer_Data/il2cpp_data/etc/mono/browscap.ini
Windows/MineXplorer_Data/il2cpp_data/etc/mono/config
Windows/MineXplorer_Data/il2cpp_data/etc/mono/mconfig/config.xml
.xml
Windows/MineXplorer_Data/sharedassets0.resource
Windows/MineXplorer_Data/sharedassets1.resource
Windows/MineXplorer_Data/sharedassets3.resource
Windows/MineXplorer_Data/sharedassets7.resource
Windows/UnityCrashHandler32.exe
.exe windows:6 windows x86 arch:x86

b2fc07dd04dd5fb8cd58cfcdaa6965fb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\buildslave\unity\build\artifacts\UnityCrashHandler\release_win32\UnityCrashHandler32.pdb

Imports

user32

UnionRect
SetWindowPos
SetWindowTextW
SetForegroundWindow
SendDlgItemMessageA
SendMessageW
DialogBoxParamA
InflateRect
GetDlgItem
OffsetRect
AdjustWindowRect
GetWindowLongA
GetIconInfo
LoadImageA
CreateIconFromResourceEx
LookupIconIdFromDirectoryEx
EndDialog

kernel32

VirtualProtect
GetVersionExW
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapQueryInformation
HeapSize
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapFree
HeapAlloc
FreeLibraryAndExitThread
GetModuleFileNameW
CloseHandle
RaiseException
GetCurrentThread
OpenThread
GetThreadTimes
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
WaitForSingleObjectEx
SwitchToThread
CreateThread
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
VerSetConditionMask
FreeLibrary
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentVariableA
GetCurrentDirectoryA
GetFileAttributesA
OutputDebugStringA
GetLastError
SetLastError
WaitForSingleObject
CreateEventW
GetCurrentProcess
GetCurrentProcessId
InterlockedPopEntrySList
ResumeThread
GetThreadContext
ReadProcessMemory
LocalFree
FormatMessageW
VerifyVersionInfoW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
LoadLibraryW
SetEvent
WaitForMultipleObjectsEx
Sleep
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetProcessId
GetThreadId
OpenProcess
GetStdHandle
CreateFileW
DeleteFileW
GetFileAttributesW
GetFileSize
ReadFile
GetTempPathW
GetSystemTime
GetSystemTimeAsFileTime
CopyFileExW
AllocConsole
SetErrorMode
GetCommandLineW
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
WriteFile
InitializeCriticalSection
CreateEventA
TerminateThread
GetModuleHandleA
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceA
EnumResourceNamesA
IsDebuggerPresent
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
TlsAlloc
TlsFree
VirtualAlloc
VirtualFree
VirtualQuery
SetFilePointerEx
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
GetFileType
SetStdHandle
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
InterlockedPushEntrySList
RtlUnwind
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTickCount
TlsSetValue
TlsGetValue
SuspendThread
GetExitCodeThread
DecodePointer
EncodePointer
GetCPInfo
DuplicateHandle
GetStringTypeW
InitializeSListHead
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
IsProcessorFeaturePresent

shell32

CommandLineToArgvW
SHCreateDirectoryExW

ole32

CoInitializeEx
CoTaskMemFree
CoCreateGuid

psapi

GetModuleFileNameExW

advapi32

GetUserNameA

wininet

InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCrackUrlA
HttpQueryInfoA
InternetCloseHandle

gdi32

GetObjectA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 418KB - Virtual size: 418KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 327KB - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Windows/UnityPlayer.dll
.dll windows:6 windows x86 arch:x86

a8285e1dd94988b21d3ea540f799e2c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\buildslave\unity\build\artifacts\UnityPlayer\Win32_nondev_i_r\UnityPlayer_Win32_il2cpp_x86.pdb

Imports

kernel32

GetFullPathNameW
ReadFile
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetFileTime
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
LocalFree
FormatMessageW
CopyFileW
MoveFileExW
ReplaceFileW
SystemTimeToFileTime
Thread32First
Thread32Next
CreateMutexA
RtlCaptureContext
GetEnvironmentVariableA
GetCurrentDirectoryA
GetCurrentDirectoryW
GetFileAttributesA
DebugBreak
SetUnhandledExceptionFilter
SetLastError
GetErrorMode
TerminateProcess
CreateThread
GetThreadContext
ReadProcessMemory
GetModuleFileNameA
LocalAlloc
GetOverlappedResult
CancelIo
ResetEvent
GetStartupInfoA
SetConsoleCtrlHandler
SetDllDirectoryW
SleepEx
RaiseException
GetThreadTimes
SwitchToThread
SetThreadPriority
GetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
GetWindowsDirectoryW
CreateIoCompletionPort
GetQueuedCompletionStatus
AttachConsole
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
ReleaseSemaphore
GetSystemInfo
GetLocalTime
GetTimeZoneInformation
IsDebuggerPresent
CreateSemaphoreExW
TlsAlloc
TlsFree
GetNativeSystemInfo
VirtualQuery
GetFileSize
HeapSize
GetSystemDirectoryA
GetModuleHandleExW
ExitProcess
RtlUnwind
GetModuleFileNameW
QueryDepthSList
GetVersionExW
FreeLibraryAndExitThread
UnregisterWait
RegisterWaitForSingleObject
GetProcessAffinityMask
FindFirstFileW
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SignalObjectAndWait
GetDiskFreeSpaceExW
GetStartupInfoW
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
DecodePointer
EncodePointer
DuplicateHandle
GetSystemDirectoryW
InitializeCriticalSectionEx
GlobalMemoryStatus
GetTickCount
GetFileType
ExitThread
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
CreateWaitableTimerA
SetWaitableTimer
OpenEventA
ReadConsoleInputW
FlushConsoleInputBuffer
SetThreadAffinityMask
GetStdHandle
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
SetStdHandle
SetConsoleMode
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
GlobalMemoryStatusEx
SetErrorMode
LoadLibraryExW
GetCurrentThread
GetCurrentProcess
GetLastError
GetModuleHandleA
VirtualFree
VirtualProtect
HeapQueryInformation
VirtualAlloc
GetProcessId
CreateProcessW
GetExitCodeProcess
WaitForMultipleObjects
CreateEventW
CreatePipe
SetHandleInformation
OutputDebugStringA
FindClose
CreateFileW
CreateDirectoryW
ExpandEnvironmentStringsW
GetSystemTimeAsFileTime
GetSystemTime
GlobalLock
GlobalUnlock
GlobalAlloc
GetTempFileNameW
GetFileAttributesW
DeleteFileW
CreateToolhelp32Snapshot
GetFileAttributesExW
FindNextFileW
CreateTimerQueue
GetTempPathW
WriteFile
FindFirstFileExW
MultiByteToWideChar
GetUserDefaultLocaleName
GetSystemPowerStatus
GetComputerNameW
LoadLibraryW
GetNumaHighestNodeNumber
GetModuleHandleW
FlushFileBuffers
CreateFileA
GetCommandLineW
UnregisterWaitEx
GetLogicalProcessorInformationEx
WaitForSingleObject
Sleep
CreateEventA
WaitForSingleObjectEx
VerifyVersionInfoW
CloseHandle
CreateEventExW
WaitForMultipleObjectsEx
SetEvent
VerSetConditionMask
WideCharToMultiByte
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentProcessId
TlsSetValue
HeapReAlloc
TlsGetValue

user32

GetCaretBlinkTime
EnumDisplaySettingsA
DestroyWindow
CreateWindowExW
ShowWindow
UpdateWindow
GetDesktopWindow
EnumDisplayDevicesA
MonitorFromWindow
ReleaseDC
AllowSetForegroundWindow
TrackMouseEvent
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
SetCursor
LoadCursorA
DestroyCursor
DestroyIcon
LoadImageW
DefWindowProcW
SetWindowPos
EnumDisplaySettingsW
LoadIconW
AdjustWindowRectEx
GetWindowPlacement
GetDC
MsgWaitForMultipleObjects
EnumDisplayMonitors
GetMonitorInfoW
GetMonitorInfoA
MonitorFromRect
SetWindowLongW
GetWindowLongW
ClipCursor
ShowCursor
GetClientRect
GetWindowRect
ScreenToClient
GetWindowLongA
SetWindowTextW
ValidateRect
KillTimer
SetTimer
GetFocus
RegisterClassW
PostQuitMessage
SendMessageW
PeekMessageA
GetMessageA
GetRawInputDeviceList
RegisterRawInputDevices
GetUserObjectInformationW
GetProcessWindowStation
GetRawInputDeviceInfoW
GetRawInputData
SystemParametersInfoW
PtInRect
ClientToScreen
GetCursorPos
SetCursorPos
GetSystemMetrics
ReleaseCapture
SetCapture
MapVirtualKeyExA
MapVirtualKeyA
GetKeyNameTextW
GetAsyncKeyState
GetKeyState
GetActiveWindow
SetFocus
IsWindowVisible
GetDoubleClickTime
UnregisterDeviceNotification
RegisterDeviceNotificationW
GetMessageExtraInfo
GetMessagePos
DispatchMessageA
TranslateMessage
GetKeyboardLayout
GetKeyboardLayoutNameW
LoadIconA
OffsetRect
CopyRect
MessageBoxA
SendDlgItemMessageW
SetDlgItemTextW
SetDlgItemTextA
EndDialog
DialogBoxParamW
RegisterClassExW
UnregisterClassW
EnumWindows
SetForegroundWindow
IsIconic
SendMessageTimeoutA
RegisterWindowMessageA
GetUserObjectInformationA
GetThreadDesktop
GetParent
SetWindowLongA
DragDetect

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

ole32

CoSetProxyBlanket
PropVariantClear
PropVariantCopy
CoCreateFreeThreadedMarshaler
CoInitialize
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
StringFromGUID2
CoCreateInstance

shlwapi

SHDeleteKeyW
PathCanonicalizeW

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo

advapi32

CryptGenRandom
CryptAcquireContextA
RegSetValueExA
RegQueryValueExA
RegDeleteValueA
RegCreateKeyW
GetUserNameA
GetTokenInformation
GetSidSubAuthority
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
ReportEventA
RegisterEventSourceA
DeregisterEventSource
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptAcquireContextW
CryptReleaseContext

gdi32

ChoosePixelFormat
SetPixelFormat
GetDeviceCaps
SwapBuffers

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW
SHFileOperationW

opengl32

wglCreateContext
wglGetCurrentContext
wglGetProcAddress
wglDeleteContext
wglGetCurrentDC
wglMakeCurrent

winmm

waveOutGetDevCapsA
waveInStart
waveOutClose
waveOutPrepareHeader
waveOutGetDevCapsW
waveOutOpen
waveOutGetNumDevs
waveInAddBuffer
waveInUnprepareHeader
waveInPrepareHeader
waveInClose
waveInOpen
waveInGetDevCapsW
waveInGetDevCapsA
waveInGetNumDevs
waveInReset
waveOutGetPosition
waveOutReset
waveOutWrite
waveOutUnprepareHeader
timeEndPeriod
timeBeginPeriod
timeGetTime

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString
VariantChangeType

imm32

ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContextEx
ImmAssociateContext
ImmReleaseContext
ImmGetConversionStatus
ImmNotifyIME
ImmGetContext

winhttp

WinHttpGetIEProxyConfigForCurrentUser

bcrypt

BCryptGenRandom

hid

HidP_SetUsageValue
HidP_SetUsages
HidP_GetData
HidP_MaxDataListLength
HidP_GetValueCaps
HidP_GetButtonCaps
HidP_GetCaps
HidD_GetHidGuid
HidD_GetPreparsedData
HidD_FreePreparsedData
HidD_GetProductString
HidD_GetManufacturerString
HidD_GetSerialNumberString
HidD_GetAttributes

crypt32

CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
CertAddEncodedCertificateToStore
CertFreeCertificateContext
CertCloseStore
CertOpenStore

ws2_32

getsockopt
WSASendDisconnect
gethostbyaddr
WSACancelAsyncRequest
WSAAsyncGetHostByName
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSASocketW
WSACreateEvent
WSACloseEvent
WSARecvFrom
getprotobyname
gethostbyname
getpeername
ntohl
getnameinfo
freeaddrinfo
getaddrinfo
WSAIoctl
WSACleanup
WSAStartup
gethostname
socket
shutdown
setsockopt
sendto
recvfrom
htonl
__WSAFDIsSet
WSASocketA
WSAGetLastError
WSASetLastError
send
select
recv
ntohs
listen
inet_addr
htons
getsockname
ioctlsocket
connect
closesocket
bind
accept

Exports

Exports

UnityMain

Sections

.text
Size: 16.7MB - Virtual size: 16.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 194KB - Virtual size: 843KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 592KB - Virtual size: 591KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

7bf354a256691fb3e95d3ef6b702cb84

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

shell32

ws2_32

iphlpapi

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

il2cpp Size: 5.0MB - Virtual size: 5.0MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 318KB - Virtual size: 876KB

.reloc Size: 566KB - Virtual size: 566KB

93d7bb032e5b4ede025420a3defb9706

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

unityplayer

kernel32

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 43KB

.rdata Size: 22KB - Virtual size: 22KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 552KB - Virtual size: 552KB

.reloc Size: 3KB - Virtual size: 3KB

b2fc07dd04dd5fb8cd58cfcdaa6965fb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

kernel32

shell32

ole32

psapi

advapi32

wininet

gdi32

version

Sections

.text Size: 418KB - Virtual size: 418KB

.rdata Size: 114KB - Virtual size: 113KB

.data Size: 8KB - Virtual size: 13KB

.rsrc Size: 327KB - Virtual size: 326KB

.reloc Size: 19KB - Virtual size: 19KB

a8285e1dd94988b21d3ea540f799e2c6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

version

ole32

shlwapi

setupapi

advapi32

gdi32

shell32

.text
Size: 1.1MB - Virtual size: 1.1MB

il2cpp
Size: 5.0MB - Virtual size: 5.0MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 318KB - Virtual size: 876KB

.reloc
Size: 566KB - Virtual size: 566KB

.text
Size: 43KB - Virtual size: 43KB

.rdata
Size: 22KB - Virtual size: 22KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 552KB - Virtual size: 552KB

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 418KB - Virtual size: 418KB

.rdata
Size: 114KB - Virtual size: 113KB

.data
Size: 8KB - Virtual size: 13KB

.rsrc
Size: 327KB - Virtual size: 326KB

.reloc
Size: 19KB - Virtual size: 19KB

.text
Size: 16.7MB - Virtual size: 16.7MB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 194KB - Virtual size: 843KB

.rodata
Size: 3KB - Virtual size: 2KB

_RDATA
Size: 39KB - Virtual size: 39KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 592KB - Virtual size: 591KB