deadcells[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

deadcells.exe
Size

17.4MB
MD5

b04bb8fac3f0ab1fa9b20f63648ac254
SHA1

d8bf20126b6c4ac2eebdfe80e042fecffbc78849
SHA256

092f27acc6da3a80aaeafa29a5fd6678f6004ba2805be9c3eee18eaf65491672
SHA512

634608f9e93b654761d127ca80ecdfdf8a9970f41642f3423d832e190069d9e241c2fbc751e8203094bb3407d9d23c5e614ee061fa51b52d71b4e153b15aff4c
SSDEEP

393216:QqxuLelxWeHjTRxUr9HZQUo7svi2ZRNmmrv3xuj:QqxuLelxWeHjT0r9SUW2Jhu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
deadcells.exe

Files

deadcells.exe
.exe windows:6 windows x86 arch:x86

6f3a01b9e56529b5162f87102fb6271c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Gitlab-Runner\builds\HQ33PpjF\0\motion-twin\deadcells\client\.tools\hashlink\Release\hl.pdb

Imports

libhl

hl_dyn_castd
hl_alloc_dynbool
hl_dyn_setf
hl_dyn_getp
hl_dyn_setd
hlt_void
hl_same_type
hl_make_dyn
hl_alloc_obj
hl_alloc_strbytes
hl_alloc_closure_ptr
hl_alloc_executable_memory
hl_get_obj_rt
hl_alloc_enum
hl_alloc_dynamic
hl_to_virtual
hl_dyn_casti
hl_alloc_virtual
hl_assert
hl_dyn_call
hl_socket_recv
hl_socket_listen
hl_get_thread
hl_socket_bind
hl_dyn_seti
hlt_bytes
hl_throw
hl_gc_threads_info
hl_dyn_setp
hl_socket_new
hl_thread_start
hl_dyn_castp
hl_sys_sleep
hl_socket_send
hl_rethrow
hl_dyn_geti
hl_setup_callbacks
hl_dyn_getd
hl_socket_init
hl_init_virtual
hl_sys_getpid
hl_free_executable_memory
hl_gc_set_dump_types
hl_socket_accept
hl_setup_exception
hl_remove_root
hl_fatal_fmt
hl_fatal_error
hl_obj_field_fetch
hl_flush_proto
hl_init_enum
hl_sys_init
hl_exception_stack
hl_to_string
hl_register_thread
hl_global_init
hl_add_root
hl_pad_struct
hl_setup_reload_check
hl_dyn_call_safe
hl_global_free
hl_hash_utf8
hl_is_dynamic
hl_dyn_castf
hl_dyn_getf
hl_alloc_dynobj
hl_dyn_call_obj
hl_dyn_compare
hlt_dyn
hl_type_size
hl_socket_close
hl_alloc_init
hl_from_utf8
hl_zalloc
hl_hash_gen
hl_free
hl_malloc
hl_utf8_length

user32

MessageBoxA

kernel32

EndUpdateResourceW
TerminateProcess
IsDebuggerPresent
SizeofResource
GetModuleFileNameW
LoadResource
FindResourceW
UpdateResourceW
CopyFileW
BeginUpdateResourceW
LoadLibraryA
GetProcAddress
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess

vcruntime140

strstr
__intrinsic_setjmp
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
memset
_except_handler4_common
memcpy
wcsrchr

api-ms-win-crt-stdio-l1-1-0

__p__commode
__stdio_common_vswprintf
fread
_wfopen
fseek
__stdio_common_vfwprintf
fclose
ftell
__stdio_common_vsprintf
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

terminate
_controlfp_s
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___wargv
__p___argc
_set_app_type
_exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
exit

api-ms-win-crt-math-l1-1-0

__setusermatherr
fmod
_CIfmod

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
free

api-ms-win-crt-filesystem-l1-1-0

_wstat32

api-ms-win-crt-convert-l1-1-0

wcstol
wcstombs

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17.2MB - Virtual size: 17.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bind
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f3a01b9e56529b5162f87102fb6271c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libhl

user32

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 70KB - Virtual size: 70KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 1KB - Virtual size: 3KB

.rsrc Size: 17.2MB - Virtual size: 17.2MB

.reloc Size: 4KB - Virtual size: 3KB

.bind Size: 166KB - Virtual size: 166KB

.text
Size: 70KB - Virtual size: 70KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 17.2MB - Virtual size: 17.2MB

.reloc
Size: 4KB - Virtual size: 3KB

.bind
Size: 166KB - Virtual size: 166KB