LDPlayer9_de_com[.]supercell[.]brawlstars_25567197_ld[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
LDPlayer9_de_com.supercell.brawlstars_25567197_ld.exe
Size 2.5MB
Sample240402-bfwadacb41
SHA256 5717c1e68860552f27d4716b5df35386b6cd926cf86cdb08f4011d567be16d7b
MD5 6722e17e25fffab50fd013c412d06ccb
SHA1 fa82b117399022cb178d63d45d57a00d9769d472
SHA512 ede356a298527373f32e7a05eb686590d718242f8d8aef257e0a68cad8555624d733e81fa349e0f64dc656552b022102ee990bec55a85d2b4422f1f0371c5cda
SSDEEP 24576:SEc0fZhiK8VvnnwBP8I3If2wSj/F+99M1Sv4jZIPL1B926/kvppVUs4mMyYPTxe:SifZsKUI3Xov4j81HkxSmMFPTxe
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

LDPlayer9_de_com.supercell.brawlstars_25567197_ld.exe

.exe 2.5MB

LDPlayer9_de_com.supercell.brawlstars_25567197_ld.exe

IMPHASH a2e26cf546e246e301da616f269492df
SHA256 5717c1e68860552f27d4716b5df35386b6cd926cf86cdb08f4011d567be16d7b
MD5 6722e17e25fffab50fd013c412d06ccb
SHA1 fa82b117399022cb178d63d45d57a00d9769d472
SHA512 ede356a298527373f32e7a05eb686590d718242f8d8aef257e0a68cad8555624d733e81fa349e0f64dc656552b022102ee990bec55a85d2b4422f1f0371c5cda
SSDEEP 24576:SEc0fZhiK8VvnnwBP8I3If2wSj/F+99M1Sv4jZIPL1B926/kvppVUs4mMyYPTxe:SifZsKUI3Xov4j81HkxSmMFPTxe
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

d5:69:86:67:16:09:92:08:3a:33:8b:35:c9:f0:d2:49:fd:4b:e6:87:bd:14:12:36:8c:a9:42:67:db:8b:80:08

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91310114MA1GWA6R46,CN=Shanghai Baizhi Network Technology Co.\, Ltd.,O=Shanghai Baizhi Network Technology Co.\, Ltd.,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e59889e5ae9ae58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Feb 21, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

f9:67:ad:41:3f:01:22:a3:63:1b:63:43:7b:96:b6:be:35:70:71:fa

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Feb 21, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

Serial Number

0e:42:7d:e0:3b:67:1d:c4:64:de:f6:c3:8b:ee:92:16

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 16, 2023 - Aug 15, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:42:7d:e0:3b:67:1d:c4:64:de:f6:c3:8b:ee:92:16

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 16, 2023 - Aug 15, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

919129

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\trunk_download\downloader_en\downloader\bin\ldplayerinst.pdb

ws2_32

bind sendto recvfrom freeaddrinfo getaddrinfo WSAIoctl setsockopt ntohs htons getsockopt getsockname getpeername accept listen ioctlsocket gethostname connect send recv WSASetLastError select __WSAFDIsSet socket WSAGetLastError WSACleanup WSAStartup closesocket htonl ntohl

advapi32

RegCreateKeyW RegQueryValueExW RegCloseKey OpenProcessToken DuplicateTokenEx RegOpenKeyW RegDeleteValueW CryptAcquireContextA CryptReleaseContext CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptGenRandom

crypt32

CertFreeCertificateContext

wldap32

ord32 ord301 ord200 ord30 ord79 ord35 ord33 ord211 ord27 ord26 ord22 ord41 ord143 ord46 ord50 ord45

normaliz

IdnToAscii

kernel32

CreateToolhelp32Snapshot GetLastError Process32FirstW Process32NextW LoadLibraryW GetProcAddress WaitForSingleObject GetExitCodeProcess CreateProcessW Sleep WritePrivateProfileStringW WritePrivateProfileStringA WriteFile CreateFileW DeleteCriticalSection InitializeCriticalSection CreateEventW SetEvent EnterCriticalSection LeaveCriticalSection GlobalAlloc GlobalFree FindResourceW LoadResource FreeResource SizeofResource LockResource RaiseException InitializeCriticalSectionEx FindResourceExW DecodePointer HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap SetLastError GetLogicalDriveStringsW GetDriveTypeW DeviceIoControl GetDiskFreeSpaceExW GetVolumeInformationW GetCurrentProcess DuplicateHandle GetCurrentThreadId GetFileSizeEx GetFileSize GetWindowsDirectoryW K32EnumProcessModules DeleteFileW FindClose FreeLibrary ReadFile GetSystemInfo GetModuleHandleW CreateMutexW GetLocalTime GlobalLock GlobalUnlock CreateSemaphoreW ReleaseSemaphore CreateThread TerminateThread MultiByteToWideChar WideCharToMultiByte GetStdHandle TerminateProcess GetStartupInfoW GetCurrentDirectoryW GetACP ExitProcess GetPrivateProfileStringW MulDiv InitializeCriticalSectionAndSpinCount FormatMessageA GetTickCount64 SleepEx VerSetConditionMask GetSystemDirectoryA GetModuleHandleA LoadLibraryA VerifyVersionInfoA WaitForSingleObjectEx GetFileType PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA UnhandledExceptionFilter GetUserDefaultUILanguage K32GetModuleFileNameExW SetUnhandledExceptionFilter OpenProcess GetVersionExW GetTickCount CompareStringW CloseHandle FindFirstFileW GetModuleFileNameW GetSystemTimeAsFileTime GetCurrentThread EncodePointer GetStringTypeW RtlUnwind CreateTimerQueue IsProcessorFeaturePresent InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority TlsAlloc TlsGetValue TlsSetValue TlsFree GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCPInfo LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetCommandLineW IsDebuggerPresent ExitThread LoadLibraryExW SetFilePointerEx FileTimeToLocalFileTime GetFileInformationByHandle FileTimeToSystemTime GetCurrentProcessId GetModuleHandleExW AreFileApisANSI IsValidCodePage GetOEMCP OutputDebugStringW GetThreadTimes FreeLibraryAndExitThread VirtualAlloc VirtualFree VirtualProtect InitializeSListHead UnregisterWaitEx QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetConsoleCP GetConsoleMode FlushFileBuffers GetTimeZoneInformation ReadConsoleW SetStdHandle FindFirstFileExW SystemTimeToTzSpecificLocalTime WriteConsoleW SetEnvironmentVariableA GetFullPathNameW SetEndOfFile MoveFileExW

user32

GetWindowTextW LoadImageW GetClassInfoExW RegisterClassExW CallWindowProcW SetWindowRgn IsZoomed LoadCursorW OffsetRect SetCursor wvsprintfW GetWindow GetParent IsRectEmpty UnionRect IntersectRect MapWindowPoints GetWindowTextLengthW InvalidateRect GetUpdateRect EndPaint BeginPaint ReleaseCapture SetCapture GetKeyState GetCaretBlinkTime GetCaretPos CharPrevW DrawTextW FillRect SetRect CreateCaret HideCaret ShowCaret SetCaretPos ClientToScreen GetSysColor CreateAcceleratorTableW GetFocus GetActiveWindow SetFocus CharNextW IsWindowVisible DispatchMessageW TranslateMessage GetMessageW GetPropW SetPropW FindWindowExW IsWindow RegisterClassW InvalidateRgn GetGUIThreadInfo ScreenToClient PtInRect GetCursorPos GetClientRect ReleaseDC GetDC SetWindowPos SetForegroundWindow GetWindowLongW IsIconic GetSystemMetrics DestroyWindow SetWindowLongW CreateWindowExW PostMessageW DefWindowProcW GetWindowRect MoveWindow MonitorFromWindow GetMonitorInfoW SendMessageW KillTimer SetWindowTextW PostQuitMessage CloseWindow ShowWindow BringWindowToTop EnableWindow MessageBoxW SetTimer

gdi32

GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo CreatePatternBrush GetObjectA CreateRoundRectRgn CreateRectRgnIndirect SetWindowOrgEx GetTextMetricsW SaveDC CreateSolidBrush RoundRect SelectClipRgn ExtSelectClipRgn SetBkColor StretchBlt SetStretchBltMode CreateDIBSection MoveToEx TextOutW ExtTextOutW GdiFlush CombineRgn SetTextColor RestoreDC SelectObject CreateCompatibleBitmap CreateCompatibleDC DeleteDC Rectangle CreatePen CreateFontIndirectW DeleteObject SetBkMode CreatePenIndirect GetDeviceCaps GetStockObject GetObjectW BitBlt

shell32

SHGetPathFromIDListW SHGetMalloc ShellExecuteW ShellExecuteExW SHBrowseForFolderW SHGetFolderPathW ord165 SHGetSpecialFolderLocation

ole32

CreateStreamOnHGlobal CoInitialize CoUninitialize CoCreateGuid CoCreateInstance CoTaskMemFree CLSIDFromString CLSIDFromProgID OleLockRunning

oleaut32

SysAllocString VariantInit SysFreeString VariantClear

shlwapi

PathFileExistsW PathIsRootW

wininet

InternetReadFile HttpQueryInfoW HttpOpenRequestW InternetConnectW HttpSendRequestW InternetOpenW InternetCloseHandle InternetCrackUrlW

gdiplus

GdipSetInterpolationMode GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipGetImageWidth GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushI GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipDeleteGraphics GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipGetImageHeight GdipGraphicsClear GdipDrawImage GdipDrawImageRectI GdipDeleteFontFamily GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipGetFamily GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatAlign GdipLoadImageFromStream GdipSetStringFormatLineAlign

iphlpapi

GetAdaptersInfo

comctl32

ord17 _TrackMouseEvent

imm32

ImmSetCompositionFontW ImmReleaseContext ImmGetContext ImmGetVirtualKey ImmSetCompositionWindow

Sharing

General

Malware Config

Signatures

File Explorer

LDPlayer9_de_com.supercell.brawlstars_25567197_ld.exe

ws2_32

advapi32

crypt32

wldap32

normaliz

kernel32

user32

gdi32

shell32

ole32

oleaut32

shlwapi

wininet

gdiplus

iphlpapi

comctl32

imm32

generic