File-Hearts[.]of[.]Iron[.]IV[.]v1[.]14[.]5[.]Incl[.]ALL[.]DLC[.]zi_704399[.]exe

Resubmissions

27/05/2024, 17:57

240527-wj4fdadd894

27/05/2024, 17:54

240527-wg8bjscc5s4

Sharing

Copy URL Twitter E-mail

General

Target
File-Hearts.of.Iron.IV.v1.14.5.Incl.ALL.DLC.zi_704399.exe
Size 23.3MB
Sample240527-wj4fdadd89
SHA256 b60ce9c107e68a625abaf4cb6a974be35eadebb713dc579534d081159cf7cb7c
MD5 5e2ce9ef393dabb4fd598e4df8892ccb
SHA1 8ba37e3361853de537ea21868cd6e443897b3759
SHA512 652de44d64e28ea1f49707f3ea752f56689ee7b0efdbb6be92dac1d76e6de8768b4a3a77dd413d60493edf3e370eacac952cee4cda1500e093b4e3a96ba87419
SSDEEP 393216:WqNKKjaDXGLWqtBOQvMPp3QWQ/exZlb9yW/dLK9BWlvSlPMoOgwcnmed8+miEy3n:WzXGLWqtBOoMVdWUlbsW1+9BWhSlPMo0
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

File-Hearts.of.Iron.IV.v1.14.5.Incl.ALL.DLC.zi_704399.exe

.exe 23.3MB

File-Hearts.of.Iron.IV.v1.14.5.Incl.ALL.DLC.zi_704399.exe

IMPHASH e8c357369afd28c52af81982176d85ca
SHA256 b60ce9c107e68a625abaf4cb6a974be35eadebb713dc579534d081159cf7cb7c
MD5 5e2ce9ef393dabb4fd598e4df8892ccb
SHA1 8ba37e3361853de537ea21868cd6e443897b3759
SHA512 652de44d64e28ea1f49707f3ea752f56689ee7b0efdbb6be92dac1d76e6de8768b4a3a77dd413d60493edf3e370eacac952cee4cda1500e093b4e3a96ba87419
SSDEEP 393216:WqNKKjaDXGLWqtBOQvMPp3QWQ/exZlb9yW/dLK9BWlvSlPMoOgwcnmed8+miEy3n:WzXGLWqtBOoMVdWUlbsW1+9BWhSlPMo0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

28:31:2f:a9:fc:d8:34:6e:3a:8e:4f:ff:3d:87:0c:f5:ae:5f:99:d0:71:fd:df:f9:89:85:52:ed:fe:fd:e6:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=0450768115,CN=Cyber Holding Partners LLC,O=Cyber Holding Partners LLC,ST=New Jersey,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a4e6577204a6572736579,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Apr 19, 2024

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

f1:4c:5e:6a:b9:68:28:42:64:f1:b0:70:b9:9d:3c:70

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2023 - Aug 17, 2024

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

6302368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcessHeap GetACP TlsGetValue Sleep CreateSemaphoreW GetModuleHandleExW GetTimeZoneInformation CompareStringW HeapReAlloc TerminateProcess WriteConsoleW TryEnterCriticalSection GlobalMemoryStatus GetEnvironmentStringsW GetCurrentDirectoryW GetThreadPriority EnterCriticalSection GetCommandLineW SetFileAttributesW FileTimeToSystemTime GetEnvironmentVariableA GetSystemInfo FormatMessageW IsProcessorFeaturePresent CreateTimerQueue SetStdHandle GetLastError GetCurrentProcessId CompareFileTime GlobalFree CreateTimerQueueTimer RemoveDirectoryW IsValidLocale ExitThread GetSystemTimeAsFileTime GetCurrentProcess UnregisterWaitEx GetVersion QueryDepthSList GetFileInformationByHandle QueryPerformanceCounter IsDebuggerPresent PeekNamedPipe GetConsoleMode GetTimeFormatW GetFileType CreateDirectoryW FindClose DecodePointer InitializeSListHead FreeEnvironmentStringsW GetDateFormatW SetEvent MoveFileW LCMapStringW ReleaseSRWLockExclusive GetModuleFileNameW WideCharToMultiByte DuplicateHandle GetTickCount FindNextFileW lstrcatA GetStartupInfoW GetStringTypeW SetFilePointerEx WaitForSingleObject GetFileAttributesW SetPriorityClass LeaveCriticalSection DeleteCriticalSection ExitProcess InterlockedPopEntrySList SetEndOfFile WaitForSingleObjectEx FreeLibrary TlsSetValue LocalFree IsValidCodePage TlsAlloc CreateThread SystemTimeToTzSpecificLocalTime GetModuleHandleW ReadFile UnhandledExceptionFilter CreateFileW GetConsoleOutputCP InterlockedPushEntrySList RaiseException HeapAlloc SetUnhandledExceptionFilter InitializeCriticalSection GetLogicalDriveStringsW GetStdHandle EncodePointer GetProcAddress GetFileAttributesExW GetFileSize SignalObjectAndWait FileTimeToLocalFileTime CloseHandle RtlUnwind WaitForMultipleObjects AcquireSRWLockExclusive InitializeCriticalSectionEx VirtualAlloc UnregisterWait SleepEx GlobalAlloc SetThreadAffinityMask GetOEMCP InterlockedFlushSList LoadLibraryW SetFilePointer SetEnvironmentVariableW ReadConsoleW FindFirstFileW GetFullPathNameW lstrlenA VerifyVersionInfoW VirtualProtect CreateEventW WriteFile VirtualFree GetVersionExW GetLocaleInfoW GlobalUnlock FreeLibraryAndExitThread GetUserDefaultLCID GlobalLock ChangeTimerQueueTimer GetCurrentThread GetCurrentThreadId LoadLibraryExW GetDriveTypeW EnumSystemLocalesW DeleteTimerQueueTimer SetFileTime HeapFree VerSetConditionMask GetModuleHandleA GetThreadTimes GetNumaHighestNodeNumber SetThreadPriority RegisterWaitForSingleObject HeapSize GetFileSizeEx SwitchToThread MoveFileExW ResetEvent GetCPInfo GetProcessAffinityMask DeleteFileW GetTickCount64 QueryPerformanceFrequency GetSystemDirectoryW InitializeCriticalSectionAndSpinCount MultiByteToWideChar FlushFileBuffers GetLogicalProcessorInformation ReleaseSemaphore FindFirstFileExW GetCommandLineA SetLastError TlsFree

user32

PostMessageW GetWindowTextLengthW LoadCursorW LoadIconW MapDialogRect wsprintfA LoadStringW IsDlgButtonChecked GetParent EnableWindow OpenClipboard GetWindowRect GetFocus GetKeyState SetDlgItemTextW DialogBoxParamW CheckDlgButton GetWindowTextW CloseClipboard MoveWindow SendMessageW SetWindowLongW SetFocus GetWindowLongW MonitorFromWindow SetCursor EndDialog KillTimer EmptyClipboard InvalidateRect SetTimer GetMonitorInfoA SetClipboardData GetDlgItem SetWindowTextW CharUpperW ScreenToClient SystemParametersInfoW MessageBoxW ShowWindow MessageBoxA

advapi32

CryptReleaseContext CryptHashData CryptDestroyKey CryptAcquireContextW CloseServiceHandle CryptGetHashParam CryptCreateHash CryptImportKey CryptEncrypt CryptDestroyHash

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHGetSpecialFolderPathW

ole32

CoInitialize CoUninitialize CoCreateInstance OleInitialize CoTaskMemFree

oleaut32

SysAllocString SysFreeString VariantClear SysAllocStringLen SysStringLen

bcrypt

BCryptGenRandom

crypt32

PFXImportCertStore CertFreeCertificateChainEngine CertEnumCertificatesInStore CertFindCertificateInStore CryptStringToBinaryW CertAddCertificateContextToStore CertCreateCertificateChainEngine CertFreeCertificateChain CertCloseStore CertFindExtension CryptQueryObject CertGetCertificateChain CertFreeCertificateContext CertOpenStore CertGetNameStringW CryptDecodeObjectEx

wldap32

ord73 ord301 ord147 ord133 ord79 ord142 ord167 ord127 ord145 ord219 ord46 ord14 ord216 ord208 ord41 ord117 ord26 ord27

ws2_32

recvfrom sendto getpeername ioctlsocket gethostname getaddrinfo WSACloseEvent getsockopt send WSACreateEvent WSAEnumNetworkEvents WSAResetEvent socket WSAEventSelect freeaddrinfo closesocket WSAGetLastError ntohs WSASetLastError WSAStartup WSACleanup htons setsockopt WSAIoctl __WSAFDIsSet select accept bind connect getsockname htonl listen recv WSAWaitForMultipleEvents

Name

.text

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

276KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

File-Hearts.of.Iron.IV.v1.14.5.Incl.ALL.DLC.zi_704399.exe

kernel32

user32

advapi32

shell32

ole32

oleaut32

bcrypt

crypt32

wldap32

ws2_32

generic