General

Malware Config

Signatures

Files

• Minecraft.exe

  .exe windows:5 windows x86 arch:x86

  aea7c997b8cde9d70d1fe280b4324409

  
  

  Code Sign

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0d:ec:8c:87:f8:82:3c:70:00:1a:26:25:d9:67:bc:b9

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  25-09-2020 00:00

  Not After

  13-10-2021 12:00

  Subject

  CN=Mojang AB,O=Mojang AB,L=Stockholm,C=SE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2013 12:00

  Not After

  22-10-2028 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  a4:83:67:35:34:40:a7:32:bc:4c:46:32:ce:e5:81:0f:e7:72:cb:ee

  Signer

  Actual PE Digest

  a4:83:67:35:34:40:a7:32:bc:4c:46:32:ce:e5:81:0f:e7:72:cb:ee

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  winhttp

  WinHttpGetIEProxyConfigForCurrentUser

  comctl32

  ord17

  ws2_32

  getaddrinfo

  select

  __WSAFDIsSet

  ioctlsocket

  listen

  htonl

  accept

  WSACleanup

  WSAStartup

  WSAIoctl

  WSASetLastError

  freeaddrinfo

  setsockopt

  ntohs

  htons

  getsockopt

  getsockname

  getpeername

  connect

  bind

  WSAGetLastError

  send

  recv

  closesocket

  socket

  crypt32

  CertOpenStore

  CertFreeCertificateChain

  CertGetCertificateChain

  CertFreeCertificateChainEngine

  CertCreateCertificateChainEngine

  CryptQueryObject

  CertGetNameStringA

  CertFindExtension

  CertAddCertificateContextToStore

  CryptDecodeObjectEx

  PFXImportCertStore

  CryptStringToBinaryA

  CertFreeCertificateContext

  CertFindCertificateInStore

  CertEnumCertificatesInStore

  CertCloseStore

  sensapi

  IsNetworkAlive

  kernel32

  ReadConsoleW

  GetConsoleCP

  GetDateFormatW

  GetTimeFormatW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  FlushFileBuffers

  SetFilePointerEx

  SetStdHandle

  GetProcessHeap

  GetTimeZoneInformation

  FindFirstFileExA

  GetACP

  WriteFile

  LocalFree

  GetLastError

  SetEvent

  OpenEventW

  GetCommandLineW

  GlobalFree

  LockResource

  LoadResource

  SizeofResource

  FindResourceW

  CloseHandle

  CreateMutexA

  GetExitCodeProcess

  WaitForSingleObject

  CreateProcessW

  GetProcAddress

  GetCurrentProcess

  GetCurrentProcessId

  GetNativeSystemInfo

  GetModuleFileNameW

  GetModuleHandleW

  GetVersionExW

  GetLocaleInfoW

  GetOEMCP

  DeviceIoControl

  FindClose

  GetTempPathW

  SetCurrentDirectoryW

  FindNextFileA

  GetDiskFreeSpaceExW

  CreateDirectoryW

  RemoveDirectoryW

  GetFullPathNameW

  CreateFileW

  GetFileAttributesW

  GetFileAttributesExW

  DeleteFileW

  FindFirstFileW

  FindNextFileW

  MoveFileExW

  FreeLibrary

  LoadLibraryExW

  VirtualAlloc

  VirtualFree

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  SleepEx

  VerSetConditionMask

  QueryPerformanceFrequency

  GetSystemDirectoryA

  GetModuleHandleA

  LoadLibraryA

  VerifyVersionInfoA

  QueryPerformanceCounter

  GetTickCount

  Sleep

  MultiByteToWideChar

  WideCharToMultiByte

  MoveFileExA

  GetEnvironmentVariableA

  SetLastError

  FormatMessageA

  CreateFileA

  ReadFile

  GetStdHandle

  GetModuleFileNameA

  ExitProcess

  HeapReAlloc

  HeapFree

  HeapAlloc

  GetModuleHandleExW

  ExitThread

  FileTimeToSystemTime

  SystemTimeToTzSpecificLocalTime

  PeekNamedPipe

  GetFileType

  GetDriveTypeW

  RtlUnwind

  LoadLibraryW

  UnregisterWaitEx

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  WriteConsoleW

  GetCurrentDirectoryW

  IsValidCodePage

  HeapSize

  GetFileSizeEx

  SetEndOfFile

  FormatMessageW

  TryEnterCriticalSection

  GetCurrentThreadId

  EncodePointer

  DecodePointer

  RaiseException

  QueueUserWorkItem

  IsProcessorFeaturePresent

  DuplicateHandle

  WaitForSingleObjectEx

  GetCurrentThread

  GetExitCodeThread

  InitializeCriticalSectionAndSpinCount

  CreateEventW

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetSystemTimeAsFileTime

  GetStringTypeW

  GetCPInfo

  CompareStringW

  LCMapStringW

  ResetEvent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsDebuggerPresent

  GetStartupInfoW

  InitializeSListHead

  CreateTimerQueue

  SignalObjectAndWait

  SwitchToThread

  CreateThread

  SetThreadPriority

  GetThreadPriority

  GetLogicalProcessorInformation

  CreateTimerQueueTimer

  ChangeTimerQueueTimer

  DeleteTimerQueueTimer

  GetNumaHighestNodeNumber

  GetProcessAffinityMask

  SetThreadAffinityMask

  RegisterWaitForSingleObject

  UnregisterWait

  GetThreadTimes

  FreeLibraryAndExitThread

  VirtualProtect

  ReleaseSemaphore

  InterlockedPopEntrySList

  InterlockedPushEntrySList

  InterlockedFlushSList

  QueryDepthSList

  GetConsoleMode

  user32

  SetWindowLongW

  GetWindowLongW

  SetWindowTextW

  GetDlgItem

  LoadIconW

  ShowWindow

  DestroyWindow

  SendMessageW

  DispatchMessageW

  TranslateMessage

  GetMessageW

  CreateDialogParamW

  MessageBoxW

  EndDialog

  shell32

  SHGetFolderPathW

  CommandLineToArgvW

  advapi32

  CryptDestroyHash

  CryptHashData

  CryptCreateHash

  CryptGenRandom

  CryptGetHashParam

  CryptReleaseContext

  CryptAcquireContextA

  RegQueryValueExW

  RegOpenKeyExW

  RegCloseKey

  SystemFunction036

  Sections

  .text

  Size: 1.2MB - Virtual size: 1.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 468KB - Virtual size: 467KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 58KB - Virtual size: 79KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 85B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1.5MB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 70KB - Virtual size: 69KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ