NFS13[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NFS13.exe
Size

13.0MB
MD5

689a568b9fae21f314ec84c038e1ff6b
SHA1

a1a15f3c21edc1e1967634febe7a5b98c9bd88bb
SHA256

9571280bb8868cd254e95442181d7bf1d6eafb2156a95d0c38337c7470762c0f
SHA512

d749d18351d6124964addafd66bacdc201ee6275a381d3ea182c741c2f2a5bf4d4fe0adc10e07f9602136bbf618f91e8ff765a370cedce3287d92b4ec0899575
SSDEEP

196608:URiDvngbPpKFiAcyFu/GjDMztUkQMY8l7o2CCD1LC:URMvngbIIAGGjDMxUkQMY8l7o215G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NFS13.exe

Files

NFS13.exe
.exe windows:5 windows x86 arch:x86

3efa81888192d24b519bfda3c94f5ebf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\P4\HAWAII_FINAL_PC\Hawaii\Runtime\FINAL_PC\Code\GameProjects\Hawaii\Hawaii_PC_External_Unity\Hawaii_PC_External_Unity.pdb

Imports

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice
D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DReflect

dsound

ord1
ord9

dinput8

DirectInput8Create

psapi

EnumProcesses
GetModuleBaseNameW

xinput1_3

ord3
ord2
ord4

ws2_32

getpeername
getsockname
gethostname
gethostbyname
WSAIoctl
recvfrom
sendto
accept
listen
bind
WSAGetOverlappedResult
WSAWaitForMultipleEvents
WSAResetEvent
WSARecvFrom
WSARecv
WSASetEvent
WSACloseEvent
ioctlsocket
setsockopt
WSACreateEvent
WSAGetLastError
send
WSACleanup
closesocket
shutdown
recv
WSAStartup
connect
htons
inet_addr
socket
select
getsockopt

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod
waveInMessage
waveOutMessage
waveOutSetVolume
waveOutGetNumDevs
waveInGetNumDevs
waveOutGetDevCapsA
waveInGetDevCapsA
waveOutOpen
waveInOpen
waveOutClose
waveInClose
waveOutPrepareHeader
waveInPrepareHeader
waveOutUnprepareHeader
waveInUnprepareHeader
waveOutReset
waveInReset
waveInStart
waveInAddBuffer
waveInStop
waveOutWrite

kernel32

WriteConsoleW
SetStdHandle
LCMapStringW
HeapQueryInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
SetConsoleCtrlHandler
FatalAppExitA
SetUnhandledExceptionFilter
GetTickCount
Sleep
ReadFile
WriteFile
SetFilePointerEx
GetFileSizeEx
CloseHandle
CreateFileA
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleA
GetComputerNameA
GetLastError
GetProcAddress
GetSystemInfo
SetThreadExecutionState
GetModuleFileNameA
SetErrorMode
GetCurrentDirectoryA
GetVersionExA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetSystemTime
SystemTimeToFileTime
GetLocalTime
FileTimeToSystemTime
SetFilePointer
MoveFileExA
InitializeCriticalSection
DeleteCriticalSection
GetFileAttributesA
LocalFree
GetCommandLineW
FormatMessageA
WideCharToMultiByte
InterlockedDecrement
lstrlenW
GlobalMemoryStatusEx
GetPrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileStringW
VirtualAlloc
GetFileAttributesW
TryEnterCriticalSection
DeleteFileA
GetCurrentThread
GetCurrentProcess
TlsAlloc
TlsFree
QueryPerformanceCounter
QueryPerformanceFrequency
TlsSetValue
TlsGetValue
FindNextFileA
FindClose
CreateDirectoryA
FindFirstFileA
OutputDebugStringA
lstrcmpiW
OpenProcess
CreateProcessW
LoadLibraryW
GetModuleHandleW
GetTimeZoneInformation
GetGeoInfoA
GetUserGeoID
GetFullPathNameW
SetThreadPriority
CreateThread
InterlockedExchange
CreateEventA
GetCurrentThreadId
GetSystemTimeAsFileTime
GetExitCodeThread
DuplicateHandle
GetThreadPriority
SleepEx
SwitchToThread
CreateMutexA
WaitForSingleObject
ReleaseMutex
InterlockedExchangeAdd
InterlockedCompareExchange
CreateSemaphoreA
ReleaseSemaphore
IsDebuggerPresent
SetThreadIdealProcessor
RaiseException
QueueUserAPC
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
ResumeThread
InitializeCriticalSectionAndSpinCount
VirtualFree
LoadLibraryA
FreeLibrary
VirtualQuery
HeapAlloc
GetProcessHeap
SetEnvironmentVariableA
GetCurrentProcessId
HeapFree
GetEnvironmentVariableA
SetEndOfFile
DeleteFileW
MultiByteToWideChar
MoveFileW
FindFirstFileW
FindNextFileW
CreateDirectoryW
RemoveDirectoryW
GetLogicalDrives
CreateFileW
GetDiskFreeSpaceA
GlobalAlloc
GlobalFree
GetDateFormatA
GetTimeFormatA
GetLocaleInfoA
GetModuleFileNameW
GetEnvironmentVariableW
SetEnvironmentVariableW
SetPriorityClass
GetPriorityClass
WaitForSingleObjectEx
ResetEvent
SetEvent
lstrlenA
DecodePointer
TerminateProcess
ExitProcess
InterlockedIncrement
RtlUnwind
GetCommandLineA
HeapSetInformation
GetStartupInfoW
ExitThread
HeapReAlloc
GetConsoleCP
GetConsoleMode
GetFullPathNameA
CreateProcessA
MoveFileA
IsProcessorFeaturePresent
SetHandleCount
GetStdHandle
GetFileType
HeapCreate
HeapDestroy
GetLocaleInfoW
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlushFileBuffers
CreatePipe
EncodePointer
UnhandledExceptionFilter
GetExitCodeProcess
GetDriveTypeW
GetCurrentDirectoryW
GetUserDefaultLangID
SetLastError
SetCurrentDirectoryW

user32

IsWindow
wsprintfA
RegisterClassW
SetRect
AdjustWindowRect
CreateWindowExW
SystemParametersInfoA
FindWindowW
GetDesktopWindow
GetForegroundWindow
PeekMessageW
DispatchMessageW
TranslateMessage
ShowWindow
SetCursor
PostQuitMessage
GetCursorPos
ScreenToClient
DefWindowProcW
GetClientRect
RegisterDeviceNotificationA
GetAsyncKeyState
PostMessageA
LockSetForegroundWindow
SetForegroundWindow
MessageBoxA

gdi32

GetStockObject

advapi32

RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

CommandLineToArgvW
SHCreateDirectoryExA
SHGetSpecialFolderPathA
ExtractIconA

ole32

CoInitializeEx
CoInitializeSecurity
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize
CoSetProxyBlanket

oleaut32

CreateErrorInfo
SetErrorInfo
VariantInit
VariantChangeType
GetErrorInfo
VarI8FromStr
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
VariantClear
SysFreeString
SysAllocString

dbghelp

SymCleanup
StackWalk64
SymFunctionTableAccess64
SymInitialize
SymGetModuleBase64

iphlpapi

GetAdaptersAddresses

Sections

.text
Size: 11.5MB - Virtual size: 11.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 167KB - Virtual size: 1012KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3efa81888192d24b519bfda3c94f5ebf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dxgi

d3d11

d3dcompiler_43

dsound

dinput8

psapi

xinput1_3

ws2_32

winmm

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

dbghelp

iphlpapi

Sections

.text Size: 11.5MB - Virtual size: 11.5MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 167KB - Virtual size: 1012KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 118KB - Virtual size: 118KB

.text
Size: 11.5MB - Virtual size: 11.5MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 167KB - Virtual size: 1012KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 118KB - Virtual size: 118KB