Ezel2 Patcher2[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Ezel2 Patcher2.exe
Size

2.6MB
MD5

4facdcb25e2910b0f9e182152934f541
SHA1

44f09139e0581a5c723abeba25d91696ad1ae3bb
SHA256

910d8b366e0b059aa59babc15f55cc908215f9e20fa6206d62bcf9a20f0cfc9b
SHA512

3699c5e7ae5370018605ded26a3c27c507329dc1be9208a6c63231b1fb45cf45ee9294b3deb46807c208c6af78a7d01b7c27734707a8ebdfb27f2a39e00ddecb
SSDEEP

49152:UuiHuhn/0NQLo36ZTRTE23g6GZenQFX6ihk6JAZ:d5hn/3o36m6GOiG6+Z

Score

1^/10

Malware Config

Signatures

Files

Ezel2 Patcher2.exe
.exe windows:5 windows x86 arch:x86

ae25595236a5a776976fc8be65d0d576

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:d8:0a:d8:99:8e:76:d5:17:f1:44:e1:17:f5:3b:e1
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

17-01-2017 00:00

Not After

18-03-2019 23:59

Subject

CN=Gameforge 4D GmbH,O=Gameforge 4D GmbH,L=Karlsruhe,ST=Baden-Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:d8:0a:d8:99:8e:76:d5:17:f1:44:e1:17:f5:3b:e1
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

17-01-2017 00:00

Not After

18-03-2019 23:59

Subject

CN=Gameforge 4D GmbH,O=Gameforge 4D GmbH,L=Karlsruhe,ST=Baden-Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:8e:1d:b6:8b:81:e9:7b:87:84:3f:10:2d:60:01:bb:d3:e7:5d:5b:b3:92:69:0b:5f:1b:eb:4a:fd:84:02:a6
Signer

Actual PE Digest

11:8e:1d:b6:8b:81:e9:7b:87:84:3f:10:2d:60:01:bb:d3:e7:5d:5b:b3:92:69:0b:5f:1b:eb:4a:fd:84:02:a6

Digest Algorithm

sha256

PE Digest Matches

false

79:74:ea:90:6e:85:37:ac:e2:67:6b:c9:5c:43:8b:b7:58:2e:f7:8d
Signer

Actual PE Digest

79:74:ea:90:6e:85:37:ac:e2:67:6b:c9:5c:43:8b:b7:58:2e:f7:8d

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

s:\PROJECT\metin2\mainline\Srcs\Tools\TorrentPatch\bin\TorrentPatch_x86_MT_VC90.pdb

Imports

kernel32

GetCurrentProcessId
GetEnvironmentVariableW
GetCPInfo
IsValidCodePage
SetEnvironmentVariableW
GetFileType
GetFileAttributesW
GetWindowsDirectoryW
FindNextFileW
RaiseException
CreateThread
GetThreadLocale
GetCommandLineW
SetErrorMode
SetLastError
LocalAlloc
HeapSize
GetProcessHeap
InterlockedExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
CreateDirectoryW
HeapAlloc
HeapFree
GetFileAttributesA
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
RtlUnwind
HeapReAlloc
ExitThread
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetDriveTypeA
GetFullPathNameA
GetFullPathNameW
MoveFileW
MoveFileA
RemoveDirectoryW
WriteConsoleW
LCMapStringA
LCMapStringW
GetModuleFileNameA
GetCurrentThread
SetHandleCount
VirtualFree
VirtualAlloc
HeapCreate
GetOEMCP
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetTimeFormatA
GetDateFormatA
GetLocaleInfoA
EnumSystemLocalesA
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
GetCurrentDirectoryA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
CompareStringA
CreateFileMappingW
FormatMessageA
lstrcpyA
GetSystemTime
SetThreadAffinityMask
GetTimeZoneInformation
OutputDebugStringW
GetStdHandle
GetTempFileNameW
FindFirstFileW
FindClose
GetTempPathW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
GetACP
ExitProcess
GetExitCodeThread
GetCurrentProcess
GetProcessAffinityMask
TlsAlloc
TlsSetValue
TlsFree
TlsGetValue
ResumeThread
TerminateThread
SetThreadPriority
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
CreateSemaphoreW
LoadLibraryW
GetCurrentThreadId
CreateFileA
ReadFile
SetFilePointer
UnmapViewOfFile
GetSystemInfo
CreateFileMappingA
OutputDebugStringA
MapViewOfFile
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateEventW
WaitForSingleObject
SetEvent
GetModuleHandleW
CopyFileW
DeleteFileW
WriteFile
DeleteFileA
GetTickCount
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
LocalFree
FormatMessageW
CreateProcessW
SetFileTime
TerminateProcess
OpenProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExW
GetFileSize
GetCurrentDirectoryW
GlobalFree
GlobalAlloc
GlobalUnlock
GlobalLock
GetFileTime
GetFileSizeEx
CreateFileW
SetCurrentDirectoryW
GetModuleFileNameW
Sleep
OpenMutexW
ReleaseMutex
CloseHandle
GetLastError
ExpandEnvironmentStringsW
CreateMutexW

user32

DrawFrameControl
DrawIconEx
GetClassNameW
GetWindowTextW
GetWindowTextLengthW
SetMenu
DrawIcon
GetUpdateRect
BringWindowToTop
IsZoomed
IsIconic
GetDesktopWindow
GetSystemMenu
FlashWindow
CreateDialogIndirectParamW
GetForegroundWindow
DrawTextW
CopyRect
DrawFocusRect
OffsetRect
MapWindowPoints
GetMessageW
ValidateRect
DestroyCursor
keybd_event
IsClipboardFormatAvailable
HideCaret
DestroyAcceleratorTable
CreateAcceleratorTableW
TranslateAcceleratorW
DrawEdge
UnionRect
ChildWindowFromPoint
DefFrameProcW
TranslateMDISysAccel
DefMDIChildProcW
GetMenuStringW
GetMessagePos
DrawStateW
DrawStateA
RegisterClipboardFormatW
ChangeDisplaySettingsW
EnumDisplaySettingsW
ShowCursor
KillTimer
SetTimer
DispatchMessageA
PeekMessageA
IsWindow
PtInRect
GetCapture
UnhookWindowsHookEx
UnregisterHotKey
RegisterHotKey
CallNextHookEx
GetActiveWindow
GetMenuItemInfoW
SystemParametersInfoW
GetMessageTime
GetWindow
BeginDeferWindowPos
EndDeferWindowPos
InvalidateRect
SetWindowTextW
GetFocus
IsWindowEnabled
GetDlgItem
CallWindowProcW
LoadImageW
ClientToScreen
ScreenToClient
UpdateWindow
RedrawWindow
SetParent
GetCursorPos
WindowFromPoint
GetParent
ScrollWindow
SetScrollInfo
GetScrollInfo
SetCursorPos
ReleaseCapture
SetCapture
ShowWindow
EnableWindow
SetFocus
SetWindowPos
SetWindowLongW
FillRect
GetWindowRect
GetAsyncKeyState
VkKeyScanW
DispatchMessageW
TranslateMessage
ReleaseDC
GetDC
CheckMenuRadioItem
CheckMenuItem
InsertMenuItemW
EnableMenuItem
GetMenuItemCount
GetSubMenu
CreateMenu
AppendMenuW
DrawMenuBar
GetMenuState
InsertMenuW
RemoveMenu
ModifyMenuW
DestroyMenu
CreatePopupMenu
SetMenuItemInfoW
UnregisterClassW
GetKeyState
RegisterWindowMessageW
DdePostAdvise
DdeConnect
DdeNameService
DdeCreateStringHandleW
DdeDisconnect
DdeInitializeW
DdeGetLastError
DdeCreateDataHandle
DdeGetData
DdeFreeDataHandle
DdeUninitialize
DdeQueryStringW
DdeFreeStringHandle
DestroyWindow
SendMessageW
SetCursor
RegisterClassW
MessageBeep
PeekMessageW
MessageBoxW
PostThreadMessageW
DestroyIcon
LoadBitmapW
IsWindowVisible
CreateDialogParamW
BeginPaint
GetWindowDC
EndPaint
CreateIconIndirect
GetIconInfo
InflateRect
GetUpdateRgn
GetSysColor
SetWindowsHookExW
SetForegroundWindow
RegisterClipboardFormatA
OpenClipboard
SetClipboardData
CloseClipboard
IsDialogMessageW
DeferWindowPos
TrackPopupMenu
MessageBoxA
PostMessageW
GetSystemMetrics
MoveWindow
CreateWindowExW
LoadCursorW
LoadIconW
DefWindowProcW
PostQuitMessage
AdjustWindowRectEx
GetClientRect
GetWindowLongW
SetWindowRgn
DdeClientTransaction

gdi32

CreatePalette
GetNearestPaletteIndex
StretchDIBits
StretchBlt
MaskBlt
SetBrushOrgEx
GetStockObject
Ellipse
RoundRect
Rectangle
PolyPolygon
SetPolyFillMode
Polygon
Pie
Arc
CreateSolidBrush
SelectClipRgn
GetRegionData
ExtCreateRegion
OffsetRgn
GetTextColor
GetBkColor
SetMapMode
SetViewportExtEx
SetWindowExtEx
SetViewportOrgEx
SetWindowOrgEx
GetTextExtentExPointW
DeleteObject
GetDeviceCaps
GetTextMetricsW
GetCharABCWidthsW
SetROP2
TextOutW
PolyBezier
Polyline
SetPixel
GetPixel
ExtFloodFill
ExtSelectClipRgn
GetClipBox
SetTextColor
SetStretchBltMode
SaveDC
RestoreDC
SetBkMode
SetBkColor
CreateBitmap
CreateCompatibleBitmap
BitBlt
DeleteDC
CreateCompatibleDC
GetPaletteEntries
GetObjectW
ExcludeClipRect
CreateRectRgn
GetTextExtentPoint32W
SelectPalette
RealizePalette
CreateFontIndirectW
CreateHatchBrush
CreatePatternBrush
ExtCreatePen
CreatePen
LineTo
MoveToEx
GetRgnBox
EqualRgn
PtInRegion
RectInRegion
CombineRgn
SelectObject
GetSystemPaletteEntries
CreateRectRgnIndirect
SetTextAlign
CreateDIBSection
GetDIBits
CreateDIBitmap
GetDIBColorTable
PatBlt
CreateICW
EnumFontFamiliesExW
SetAbortProc
EndDoc
StartPage
EndPage
StartDocW
CreateDCW
GetEnhMetaFileW
CopyEnhMetaFileW
DeleteEnhMetaFile
GdiFlush

shell32

ShellExecuteW
ShellExecuteExW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
Shell_NotifyIconW
DragAcceptFiles
DragFinish
DragQueryPoint
DragQueryFileW
ExtractIconW
ExtractIconExW
SHFileOperationW

ole32

OleUninitialize
OleCreate
OleSetContainedObject
CoCreateInstance
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
ReleaseStgMedium
OleGetClipboard
OleInitialize

oleaut32

VariantClear
SysAllocString

comctl32

ord17
ord16
CreateStatusWindowW
ImageList_GetIconSize
ImageList_Draw
ImageList_GetImageCount
ImageList_Create
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Add
ImageList_EndDrag
ImageList_DragMove
ImageList_DragEnter
ImageList_DragLeave
ImageList_SetDragCursorImage
ImageList_BeginDrag

wininet

InternetCloseHandle
InternetReadFile
InternetQueryDataAvailable
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoW

shlwapi

StrCatW

winmm

timeGetTime

comdlg32

PageSetupDlgW
ChooseColorW
PrintDlgW
GetSaveFileNameW
GetOpenFileNameW
ChooseFontW
CommDlgExtendedError

advapi32

FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenThreadToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 456KB - Virtual size: 456KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 257KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 205KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ae25595236a5a776976fc8be65d0d576

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

49:d8:0a:d8:99:8e:76:d5:17:f1:44:e1:17:f5:3b:e1Certificate

Extended Key Usages

Key Usages

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9eCertificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

49:d8:0a:d8:99:8e:76:d5:17:f1:44:e1:17:f5:3b:e1Certificate

Extended Key Usages

Key Usages

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9eCertificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

11:8e:1d:b6:8b:81:e9:7b:87:84:3f:10:2d:60:01:bb:d3:e7:5d:5b:b3:92:69:0b:5f:1b:eb:4a:fd:84:02:a6Signer

79:74:ea:90:6e:85:37:ac:e2:67:6b:c9:5c:43:8b:b7:58:2e:f7:8dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

comctl32

wininet

shlwapi

winmm

comdlg32

advapi32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 456KB - Virtual size: 456KB

.data Size: 72KB - Virtual size: 257KB

.SHARED Size: 512B - Virtual size: 4B

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 205KB - Virtual size: 205KB

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

49:d8:0a:d8:99:8e:76:d5:17:f1:44:e1:17:f5:3b:e1
Certificate

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

49:d8:0a:d8:99:8e:76:d5:17:f1:44:e1:17:f5:3b:e1
Certificate

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

11:8e:1d:b6:8b:81:e9:7b:87:84:3f:10:2d:60:01:bb:d3:e7:5d:5b:b3:92:69:0b:5f:1b:eb:4a:fd:84:02:a6
Signer

79:74:ea:90:6e:85:37:ac:e2:67:6b:c9:5c:43:8b:b7:58:2e:f7:8d
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 456KB - Virtual size: 456KB

.data
Size: 72KB - Virtual size: 257KB

.SHARED
Size: 512B - Virtual size: 4B

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 205KB - Virtual size: 205KB