DuniaModInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

DuniaModInstaller.exe
Size

66.6MB
MD5

e6154a4bc6aeff26a2b554246b2a6993
SHA1

b2a775d66f6a0c51249d6e1d746665ce4b4339a4
SHA256

c7a69556c6129c1176ef1f0433f3d8260304e77cc53be917dc22832ab2d6be43
SHA512

b5656e77d90d61c425e91d668f866450a7d17f2d0bfa606effbbee221f42b3de70f680437b2f67b9c4f34a582d0e4196015a8c1e26497692fc2d1a193aa2768b
SSDEEP

786432:Xfk0Uq198+qR0sb6g/BuMIi3HWwvo6Ca2Q9cQRC+DOGVqLbr0/Rq1/CGY:Xfz31uXuRqWwg6Ca2Q9c8DOGwLcU1/CB

Score

1^/10

Malware Config

Signatures

Files

DuniaModInstaller.exe
.exe windows:6 windows x64 arch:x64

2a586b8a1b950247632078671fe70044

Code Sign

1a:7a:c9:b2:99:04:10:8d:42:0a:7b:22:2d:8d:5a:cc
Certificate

Issuer

CN=Far Cry Modding Community,L=Uherske Hradiste,ST=Zlinsky kraj,C=Czech Republic,1.2.840.113549.1.9.1=#0c14696e666f406a616b75626d61726563656b2e637a

Not Before

30/03/2024, 13:04

Not After

31/05/2024, 23:00

Subject

CN=Jakub Marecek,L=Uherske Hradiste,ST=Zlinsky kraj,C=Czech Republic,1.2.840.113549.1.9.1=#0c14696e666f406a616b75626d61726563656b2e637a

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c5:ae:70:ba:f7:36:60:1f:22:6d:fc:5b:e6:0b:e0:7e:5e:2d:50:b1:4a:49:b4:f7:d7:06:11:ca:67:0c:c7:fc
Signer

Actual PE Digest

c5:ae:70:ba:f7:36:60:1f:22:6d:fc:5b:e6:0b:e0:7e:5e:2d:50:b1:4a:49:b4:f7:d7:06:11:ca:67:0c:c7:fc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumValueW
RevertToSelf
OpenThreadToken
SetThreadToken
DuplicateTokenEx
GetSecurityDescriptorLength
GetTokenInformation
CreateWellKnownSid
GetWindowsAccountDomainSid
ImpersonateLoggedOnUser

bcrypt

BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptDestroyHash
BCryptCreateHash
BCryptEncrypt
BCryptImportKey
BCryptDecrypt
BCryptExportKey
BCryptFinishHash
BCryptGetProperty
BCryptSetProperty
BCryptHashData

crypt32

CertFreeCertificateChainEngine
CertCloseStore
PFXImportCertStore
PFXExportCertStore
CryptFindOIDInfo
CryptQueryObject
CryptMsgGetParam
CryptMsgClose
CryptImportPublicKeyInfoEx2
CryptFormatObject
CryptDecodeObject
CertVerifyTimeValidity
CertSetCertificateContextProperty
CertSerializeCertificateStoreElement
CertSaveStore
CertOpenStore
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertAddCertificateContextToStore
CertAddCertificateLinkToStore
CertControlStore
CertCreateCertificateChainEngine
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertGetCertificateChain
CertGetIntendedKeyUsage
CertGetNameStringW
CertGetValidUsages
CertNameToStrW

iphlpapi

GetAdaptersAddresses
GetPerAdapterInfo
GetExtendedTcpTable
GetTcpTable
GetNetworkParams
if_nametoindex

kernel32

RtlPcToFileHeader
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwindEx
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
RtlLookupFunctionEntry
QueryPerformanceCounter
LocalFree
SetLastError
GetLastError
GetTickCount64
GetProcAddress
LoadLibraryW
GlobalAlloc
GetModuleHandleW
WaitForMultipleObjectsEx
ExitProcess
FormatMessageW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
GetCPInfoExW
GetConsoleMode
GetFileType
ReadFile
ReadConsoleW
WriteFile
WriteConsoleW
GetConsoleOutputCP
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
K32EnumProcessModulesEx
CloseHandle
IsWow64Process
GetExitCodeProcess
CreateProcessW
TerminateProcess
OpenProcess
K32EnumProcesses
K32GetModuleInformation
K32GetModuleBaseNameW
K32GetModuleFileNameExW
GetProcessId
DuplicateHandle
QueryFullProcessImageNameW
CreatePipe
GetCurrentProcess
GetConsoleCP
ReadDirectoryChangesW
CreateFileW
GlobalMemoryStatusEx
CreateFileMappingW
MapViewOfFile
OpenFileMappingW
VirtualAlloc
FlushViewOfFile
UnmapViewOfFile
VirtualQuery
GetSystemInfo
WaitNamedPipeW
CancelIoEx
OpenThread
CancelSynchronousIo
GetCurrentThreadId
LoadLibraryExW
CloseThreadpoolIo
GetCommandLineW
GetCurrentProcessId
RaiseFailFastException
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GetCalendarInfoEx
CompareStringOrdinal
CompareStringEx
FindNLSStringEx
GetLocaleInfoEx
EnumSystemLocalesEx
ResolveLocaleName
LCIDToLocaleName
GetUserPreferredUILanguages
FindStringOrdinal
GetCurrentThread
WaitForSingleObject
Sleep
SleepConditionVariableCS
WakeConditionVariable
InitializeCriticalSection
InitializeConditionVariable
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
IsDebuggerPresent
QueryPerformanceFrequency
GetFullPathNameW
GetLongPathNameW
GetCPInfo
LocalAlloc
LocaleNameToLCID
LCMapStringEx
EnumTimeFormatsEx
EnumCalendarInfoExEx
CreateIoCompletionPort
CopyFileExW
CreateDirectoryW
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
DeleteFileW
DeleteVolumeMountPointW
DeviceIoControl
ExpandEnvironmentStringsW
FindNextFileW
FindClose
FindFirstFileExW
FlushFileBuffers
FreeLibrary
GetCurrentDirectoryW
GetFileAttributesExW
GetFileInformationByHandleEx
GetModuleFileNameW
GetOverlappedResult
GetSystemDirectoryW
MoveFileExW
OutputDebugStringW
QueryUnbiasedInterruptTime
RemoveDirectoryW
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetThreadErrorMode
CreateThread
ResumeThread
GetThreadPriority
SetThreadPriority
GetDynamicTimeZoneInformation
GetTimeZoneInformation
GetCurrentProcessorNumberEx
SetEvent
ResetEvent
CreateEventExW
GetEnvironmentVariableW
CreateMutexExW
SetEnvironmentVariableW
FlushProcessWriteBuffers
WaitForSingleObjectEx
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
GetSystemTimeAsFileTime
DebugBreak
SleepEx
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
EncodePointer
DecodePointer
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
GetProcessHeap

ncrypt

NCryptDeleteKey
NCryptOpenStorageProvider
NCryptGetProperty
NCryptSetProperty
NCryptFreeObject
NCryptImportKey
NCryptOpenKey

ole32

CoUninitialize
CoTaskMemAlloc
CoInitializeEx
CoGetApartmentType
CoGetContextToken
CoCreateInstance
CoTaskMemFree
CoCreateGuid
CoWaitForMultipleHandles

oleaut32

VariantClear
SysAllocStringLen

user32

LoadStringW

ws2_32

GetAddrInfoW
setsockopt
send
select
recv
listen
ioctlsocket
getsockopt
getsockname
WSASend
WSARecv
WSAGetOverlappedResult
WSAConnect
getpeername
bind
WSAIoctl
WSAEventSelect
FreeAddrInfoExW
closesocket
GetNameInfoW
shutdown
FreeAddrInfoW
WSASocketW
GetAddrInfoExW
WSAStartup
WSACleanup

api-ms-win-crt-math-l1-1-0

__setusermatherr
fmodf
fmod
atan2
pow
sin
nanf
acos
asin
atan
ceil
cos
exp
floor
log
log10
tan
modf
acosf
cosf
sinf
tanf
nan

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free
realloc
_callnewh
_set_new_mode

api-ms-win-crt-string-l1-1-0

_stricmp
strncpy_s
strcmp
strcpy_s
wcsncmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_crt_atexit
terminate
_cexit
_set_app_type
_c_exit
__p___wargv
_initialize_onexit_table
__p___argc
abort
_register_thread_local_exe_atexit_callback
_configure_wide_argv
_initialize_wide_environment
_seh_filter_exe
_get_initial_wide_environment
_exit
_initterm
exit
_initterm_e

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsscanf
_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

DotNetRuntimeDebugHeader

Sections

.text
Size: 665KB - Virtual size: 664KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: 16.9MB - Virtual size: 16.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

hydrated
Size: - Virtual size: 8.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 47.7MB - Virtual size: 47.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 135KB - Virtual size: 592KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2a586b8a1b950247632078671fe70044

Code Sign

1a:7a:c9:b2:99:04:10:8d:42:0a:7b:22:2d:8d:5a:ccCertificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

c5:ae:70:ba:f7:36:60:1f:22:6d:fc:5b:e6:0b:e0:7e:5e:2d:50:b1:4a:49:b4:f7:d7:06:11:ca:67:0c:c7:fcSigner

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

crypt32

iphlpapi

kernel32

ncrypt

ole32

oleaut32

user32

ws2_32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 665KB - Virtual size: 664KB

.managed Size: 16.9MB - Virtual size: 16.9MB

hydrated Size: - Virtual size: 8.2MB

.rdata Size: 47.7MB - Virtual size: 47.7MB

.data Size: 135KB - Virtual size: 592KB

.pdata Size: 1.2MB - Virtual size: 1.2MB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 77KB - Virtual size: 77KB

.reloc Size: 19KB - Virtual size: 19KB

1a:7a:c9:b2:99:04:10:8d:42:0a:7b:22:2d:8d:5a:cc
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

c5:ae:70:ba:f7:36:60:1f:22:6d:fc:5b:e6:0b:e0:7e:5e:2d:50:b1:4a:49:b4:f7:d7:06:11:ca:67:0c:c7:fc
Signer

.text
Size: 665KB - Virtual size: 664KB

.managed
Size: 16.9MB - Virtual size: 16.9MB

hydrated
Size: - Virtual size: 8.2MB

.rdata
Size: 47.7MB - Virtual size: 47.7MB

.data
Size: 135KB - Virtual size: 592KB

.pdata
Size: 1.2MB - Virtual size: 1.2MB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 77KB - Virtual size: 77KB

.reloc
Size: 19KB - Virtual size: 19KB