GamePanel[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

GamePanel.exe
Size

578KB
MD5

2afcad90f409a56a6db73ec27da87b26
SHA1

8f78f9483583873ced948996a6254ed6299c2456
SHA256

80e99ef2a949c538e4f1a3016999c0ad0e3e9006d192645e36e1daa2969dde77
SHA512

445e58f223a0cabd3cc8fcd8be98d42124812180ec64dbbc6054aa8bc9af0d2f79754bc9dc232d265f5ae21e035cab377d21b4f271e1b2f0dcbaa956956d7288
SSDEEP

6144:h4l++qt3/d4tgM8jPWICeDeDSs9x4XsTR29YkxUiNTCT1p8eRKjKIann8zVj3sZT:WpqF14tguICGer9d3iRKp8ecjcAuiW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GamePanel.exe

Files

GamePanel.exe
.exe windows:10 windows x86 arch:x86

b0d01f85b50863b19a26a34bf76701b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

GamePanel.pdb

Imports

advapi32

EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
RegGetValueW
CryptAcquireContextW
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
DuplicateToken
FreeSid
OpenProcessToken
AllocateAndInitializeSid
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegDeleteTreeW
GetTokenInformation
CheckTokenMembership

kernel32

FindResourceW
LoadResource
LockResource
SizeofResource
GetEnvironmentVariableW
ResetEvent
CreateThread
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared
GetTickCount
WaitForMultipleObjectsEx
GetLastError
GetFileTime
GetFileSize
FileTimeToSystemTime
GetDateFormatEx
GetTimeFormatEx
CreateDirectoryW
GetVersionExW
OpenProcess
FreeLibrary
QueryFullProcessImageNameW
WaitForMultipleObjects
ResumeThread
GetApplicationUserModelId
DeleteFileW
GetLocaleInfoEx
GetUserDefaultUILanguage
LCIDToLocaleName
WideCharToMultiByte
RaiseException
GetSystemTime
CreateEventExW
SetEvent
SystemTimeToFileTime
Sleep
LocalFree
CreateEventW
CompareStringOrdinal
GetProcessId
ExpandEnvironmentStringsW
FormatMessageW
ReleaseMutex
LocalAlloc
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LoadLibraryExW
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
QueryPerformanceFrequency
WriteFile
GetLocaleInfoW
MulDiv
GetCurrentThreadId
GetProcAddress
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
HeapAlloc
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
LoadLibraryA
OutputDebugStringW
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
CreateFileW

gdi32

GetDIBits
CreateCompatibleDC
GetRgnBox
DeleteDC
CreateRectRgn
DeleteObject
CreateBitmap
BitBlt
SelectObject
CreateCompatibleBitmap
GetObjectW

user32

LoadCursorW
ReleaseDC
GetDC
PostThreadMessageW
ScreenToClient
TrackMouseEvent
SetCapture
ReleaseCapture
RegisterRawInputDevices
MonitorFromPoint
GetMonitorInfoW
SetCursor
RegisterHotKey
UnregisterHotKey
GetWindowTextW
MonitorFromRect
MsgWaitForMultipleObjectsEx
EnableWindow
GetWindowRgn
PeekMessageW
SetWindowRgn
MapWindowPoints
GetWindowThreadProcessId
LoadStringW
GetKeyState
WindowFromPhysicalPoint
CreateWindowExW
GetKeyNameTextW
MapVirtualKeyW
MonitorFromWindow
GetNextDlgTabItem
SetWindowLongW
GetClientRect
mouse_event
GetRawInputData
GetMessageExtraInfo
KillTimer
SetTimer
InvalidateRect
ValidateRect
SystemParametersInfoW
SetWindowTextW
SetParent
DestroyWindow
SendInput
BlockInput
GetWindowLongW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
ShowWindow
GetWindowRect
UnhookWinEvent
SetWinEventHook
GetActiveWindow
SendMessageW
ChangeWindowMessageFilterEx
GetSystemMetrics
GetParent
SetActiveWindow
GetCursorPos
ShowCursor
SetCursorPos
SetFocus
GetAncestor
GetFocus
SetForegroundWindow
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
PostQuitMessage
GetMessageW
PostMessageW
IsWindow
SetProcessDefaultLayout
FindWindowW
GetSysColor
GetIconInfo
CreateWindowInBand
RegisterWindowMessageW
RegisterClassExW
LoadIconW
DefWindowProcW
GetForegroundWindow
ClientToScreen
SetClassLongW
GetClassLongW
MoveWindow
GetCursorInfo
SetWindowPos
PtInRect

api-ms-win-crt-string-l1-1-0

wcsnlen

api-ms-win-crt-time-l1-1-0

_time32

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_initterm
_initterm_e
_c_exit

api-ms-win-crt-private-l1-1-0

_o__controlfp_s
_o__crt_atexit
_o__errno
_o__exit
_o__free_base
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__malloc_base
_o__configure_wide_argv
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_errno
_o__set_fmode
_o__set_new_mode
_o__wcsnicmp
_o__wfopen
_o_ceil
_o_exit
_o_fclose
_o_floor
_o_free
_o_malloc
_o_memset
_o_realloc
_o_roundf
_o_strncpy_s
_o_strtol
_o_terminate
_o_towlower
_o_wcscat_s
_o_wcsncpy_s
_o_wcstol
__current_exception
__AdjustPointer
__std_type_info_compare
__processing_throw
__CxxFrameHandler3
_except_handler4_common
_CxxThrowException
_o__configthreadlocale
_o__CIsqrt
_o__cexit
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
strchr
strrchr
wcschr
memmove
__RTDynamicCast
memcmp
memcpy

api-ms-win-core-com-l1-1-1

CoInitializeSecurity
CoGetApartmentType
CoGetMalloc
CoTaskMemFree
CoCreateGuid
CoWaitForMultipleHandles
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoCreateInstance
CLSIDFromProgID
CoGetCallContext

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoGetActivationFactory
RoInitialize
RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsCreateStringReference

api-ms-win-power-base-l1-1-0

PowerDeterminePlatformRoleEx

api-ms-win-core-winrt-error-l1-1-1

SetRestrictedErrorInfo
RoTransformError
RoOriginateError
RoGetMatchingRestrictedErrorInfo

rpcrt4

UuidHash

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

DeleteCriticalSection
InitializeCriticalSectionEx
InitOnceExecuteOnce

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

comctl32

ord411
ord412
ord413
ord410

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor
SetProcessDpiAwareness

d2d1

ord7

d3d11

D3D11CreateDevice

dwrite

DWriteCreateFactory

dcomp

DCompositionCreateDevice2

shell32

SHGetFolderPathAndSubDirW
SHGetKnownFolderPath
ShellExecuteW
SHCreateDirectoryExW
CommandLineToArgvW

shlwapi

PathFileExistsW
SHStrDupA

msdrm

DRMIsWindowProtected

uxtheme

OpenThemeData
CloseThemeData

gdiplus

GdipDisposeImage
GdipAlloc
GdipFree
GdipCreateBitmapFromHICON
GdiplusShutdown
GdiplusStartup
GdipCloneImage
GdipGetImageEncoders
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize

dxgi

CreateDXGIFactory2

ntdll

RtlAllocateHeap
RtlCompareUnicodeString
RtlInitUnicodeString
NtQueryInformationToken
RtlPublishWnfStateData
RtlFreeHeap
RtlNtStatusToDosErrorNoTeb

gamepanelexternalhook

?GetInstance@CGamePanelExternalHook@@SGAAV1@XZ
?Hook@CGamePanelExternalHook@@QAEXPAUHWND__@@@Z
?SetIntercept@CGamePanelExternalHook@@QAEX_NPAUHWND__@@@Z
?Unhook@CGamePanelExternalHook@@QAEXXZ
?GPHHookWindowPointerDown@CGamePanelExternalHook@@SGIXZ

oleaut32

VariantClear
SafeArrayUnaccessData
VariantInit
SysAllocString
SysFreeString
SafeArrayAccessData
SafeArrayGetUBound

dwmapi

DwmSetWindowAttribute

uiautomationcore

UiaReturnRawElementProvider
UiaRaiseAutomationEvent
UiaHostProviderFromHwnd

Sections

.text
Size: 451KB - Virtual size: 450KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 52KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b0d01f85b50863b19a26a34bf76701b0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-power-base-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

rpcrt4

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

comctl32

api-ms-win-shcore-scaling-l1-1-1

d2d1

d3d11

dwrite

dcomp

shell32

shlwapi

msdrm

uxtheme

gdiplus

dxgi

ntdll

gamepanelexternalhook

oleaut32

dwmapi

uiautomationcore

Sections

.text Size: 451KB - Virtual size: 450KB

.imrsiv Size: - Virtual size: 4B

.data Size: 52KB - Virtual size: 60KB

.idata Size: 12KB - Virtual size: 11KB

.rsrc Size: 29KB - Virtual size: 28KB

.reloc Size: 33KB - Virtual size: 33KB

.text
Size: 451KB - Virtual size: 450KB

.imrsiv
Size: - Virtual size: 4B

.data
Size: 52KB - Virtual size: 60KB

.idata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 29KB - Virtual size: 28KB

.reloc
Size: 33KB - Virtual size: 33KB