GameCenter[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

GameCenter.exe
Size

12.0MB
MD5

aeaa4a381974522f178312bbe1cf6bf5
SHA1

cf90639b18685cce9387be3da4319cf3da98ba37
SHA256

2a541cbab918df335b0a86ee2345e513233b30cfa2f9d49bfc44bbabdb047901
SHA512

6e9b99577cd4579ac1b38b608ce389b4f60f68c26a8f727c5582daeba26387a483a158036e9a10c8a094ab3768a025743eb9f8ea18095d12995ca65b9637375f
SSDEEP

196608:P1qGEOF9tJMyVpb+1buVcELSDNfvSvhWh:P1FrF9tJMyVpb0UcEexvihW

Score

1^/10

Malware Config

Signatures

Files

GameCenter.exe
.exe windows:6 windows x86 arch:x86

63216647956fc7e270fba99a44c891b8

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:e2:f0:ad:eb:29:c5:3f:cb:fc:ce:b9
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2023, 06:45

Not After

13/04/2026, 06:45

Subject

CN=VK LLC,O=VK LLC,L=Moscow,ST=Moscow,C=RU,1.2.840.113549.1.9.1=#0c13646f6d61696e40636f72702e6d61696c2e7275

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

be:ae:9f:c2:fa:d5:5d:bc:eb:0e:b9:f7:8d:09:7c:88:e3:73:f3:a5:29:d4:2f:dc:31:3d:1c:04:b6:5a:40:81
Signer

Actual PE Digest

be:ae:9f:c2:fa:d5:5d:bc:eb:0e:b9:f7:8d:09:7c:88:e3:73:f3:a5:29:d4:2f:dc:31:3d:1c:04:b6:5a:40:81

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

d3d9

Direct3DCreate9

shlwapi

PathCreateFromUrlW
PathCombineW
UrlCreateFromPathW

authz

AuthzAccessCheck
AuthzFreeResourceManager
AuthzInitializeResourceManager
AuthzFreeContext
AuthzInitializeContextFromSid

comdlg32

GetSaveFileNameW
GetOpenFileNameW

msimg32

AlphaBlend

shell32

DragFinish
SHGetFolderPathW
SHGetFileInfoW
SHChangeNotify
DragQueryFileW
Shell_NotifyIconW
DragAcceptFiles
SHCreateStdEnumFmtEtc
SHAppBarMessage
ShellExecuteW
ShellExecuteExW

ws2_32

select
setsockopt
WSAAddressToStringW
WSACleanup
gethostbyname
bind
closesocket
WSAGetLastError
connect
inet_addr
getnameinfo
send
WSCEnumProtocols
htons
htonl
accept
freeaddrinfo
WSAStartup
__WSAFDIsSet
WSCGetProviderPath
getsockname
listen
getaddrinfo
recv
socket
inet_ntoa
ioctlsocket
shutdown

psapi

GetModuleInformation
GetProcessImageFileNameW
GetProcessMemoryInfo
EnumProcessModules
GetModuleFileNameExW

user32

MoveWindow
CreateWindowExW
PeekMessageW
MonitorFromWindow
SetTimer
AllowSetForegroundWindow
WindowFromPoint
BeginPaint
FrameRect
RegisterWindowMessageW
FillRect
DispatchMessageW
EnumWindows
GetClassInfoW
SetActiveWindow
GetActiveWindow
GetKeyboardLayoutList
EnumChildWindows
ReleaseCapture
LoadCursorW
SetCapture
GetCapture
GetCursorInfo
CharLowerBuffW
GetSystemMetrics
PostMessageW
SetWindowLongW
CharUpperBuffW
GetClientRect
ShowCursor
SetClipboardData
GetClipboardData
ClientToScreen
IsIconic
GetMonitorInfoW
ShowWindow
CharUpperW
DefWindowProcW
SetForegroundWindow
GetForegroundWindow
GetAsyncKeyState
MapVirtualKeyExW
EnableWindow
GetShellWindow
DestroyWindow
RegisterClassW
CharNextW
GetWindowThreadProcessId
RedrawWindow
GetFocus
GetDC
SetFocus
ReleaseDC
EndPaint
TrackMouseEvent
GetParent
MonitorFromRect
MessageBeep
MessageBoxW
SetClassLongW
RegisterHotKey
UpdateWindow
AttachThreadInput
MsgWaitForMultipleObjects
DestroyIcon
IsWindowVisible
EmptyClipboard
GetAncestor
FlashWindowEx
PtInRect
UnregisterClassW
SendMessageW
GetLastInputInfo
IsWindow
EnumThreadWindows
InvalidateRect
ScreenToClient
GetWindowInfo
SendMessageTimeoutW
BringWindowToTop
SetCursor
LoadStringW
SetWindowPos
OpenClipboard
TranslateMessage
EnumDisplayMonitors
CallWindowProcW
CloseClipboard
UpdateLayeredWindow
DrawIconEx
GetClassNameW
LoadImageW
GetIconInfo
GetKeyNameTextW
GetDesktopWindow
GetCursorPos
DeferWindowPos
EndDeferWindowPos
UnregisterHotKey
GetKeyState
MonitorFromPoint
SystemParametersInfoW
CreateIconFromResourceEx
GetWindow
GetWindowLongW
GetWindowRect
KillTimer
BeginDeferWindowPos
PostThreadMessageW
IsWindowEnabled
CreateIconIndirect
FindWindowW
GetKeyboardLayout

oleaut32

SafeArrayPutElement
SysFreeString
VariantClear
VariantInit
SysReAllocStringLen
SysAllocString
SafeArrayCreate
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayCreateVector
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
VariantChangeType

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA
CloseServiceHandle
RegSetValueExW
AddAccessDeniedObjectAce
AddAccessAllowedObjectAce
AddAuditAccessAceEx
AddAce
OpenThreadToken
CloseEventLog
RegQueryInfoKeyW
IsValidSid
CreateWellKnownSid
GetLengthSid
AddAccessAllowedAceEx
OpenEventLogW
GetTokenInformation
ReadEventLogW
RegCreateKeyExW
SetSecurityDescriptorDacl
OpenServiceW
InitializeAcl
RegEnumKeyExW
AdjustTokenPrivileges
QueryServiceConfigW
CopySid
SetSecurityInfo
AddAuditAccessObjectAce
RegDeleteKeyW
LookupPrivilegeValueW
OpenSCManagerW
RegOpenKeyExW
OpenProcessToken
RegDeleteValueW
RegNotifyChangeKeyValue
AddAccessDeniedAceEx
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegFlushKey
RegEnumValueW
RegQueryValueExW
ConvertSidToStringSidW
RegCloseKey
InitializeSecurityDescriptor
EnumServicesStatusW

kernel32

ReadFileEx
SetFileTime
GetFileTime
Process32FirstW
GetACP
GetExitCodeProcess
CloseHandle
LocalFree
SizeofResource
GetCurrentProcessId
TerminateThread
SetHandleInformation
GetHandleInformation
GetFullPathNameW
FindNextFileW
WriteProcessMemory
CreateHardLinkW
SetUnhandledExceptionFilter
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
FreeLibrary
SetDllDirectoryW
GetUserDefaultLCID
SetLastError
GetModuleFileNameW
GetLastError
GlobalAlloc
GlobalUnlock
OpenMutexW
CreateThread
CompareStringW
GetGeoInfoW
LoadLibraryA
CreateMutexW
ResetEvent
GetVolumeInformationW
RaiseException
FormatMessageW
OpenJobObjectW
GetCurrentThread
GetLogicalDrives
HeapReAlloc
IsBadReadPtr
ExpandEnvironmentStringsW
LoadLibraryExW
MoveFileWithProgressW
FileTimeToSystemTime
VirtualQuery
VirtualQueryEx
Sleep
SetFilePointer
FlushFileBuffers
LoadResource
SuspendThread
GetTickCount
WritePrivateProfileStringW
GetFileSize
GetStartupInfoW
GetFileAttributesW
SetThreadPriority
VirtualAlloc
GetSystemInfo
GetTempPathW
LeaveCriticalSection
GetLogicalDriveStringsW
GetModuleHandleA
HeapCreate
VerSetConditionMask
GetDiskFreeSpaceW
GetUserDefaultUILanguage
WriteFileEx
GetModuleFileNameA
CompareStringA
WaitForSingleObjectEx
GetCompressedFileSizeW
HeapFree
WideCharToMultiByte
MultiByteToWideChar
FindClose
LoadLibraryW
SetEvent
FreeEnvironmentStringsW
GetLocaleInfoW
ConnectNamedPipe
GetLocalTime
WaitForSingleObject
GetSystemPowerStatus
DeleteCriticalSection
HeapLock
OpenThread
SetErrorMode
GetLogicalProcessorInformation
TzSpecificLocalTimeToSystemTime
SleepEx
IsValidLocale
LocalAlloc
WaitForMultipleObjectsEx
GetVolumePathNameW
SetFileAttributesW
QueryDosDeviceW
VirtualProtect
SetEnvironmentVariableW
ReadProcessMemory
QueryPerformanceFrequency
SetThreadContext
VirtualFree
GetThreadContext
FlushInstructionCache
ExitProcess
HeapAlloc
GetLongPathNameW
RtlUnwind
GetCPInfo
GetStdHandle
DisconnectNamedPipe
GetModuleHandleW
SetInformationJobObject
ReadFile
CompareFileTime
CreateProcessW
CreateRemoteThread
GetNativeSystemInfo
FindResourceW
GetUserGeoID
CheckRemoteDebuggerPresent
MapViewOfFile
MulDiv
GetVersion
GetDriveTypeW
FreeResource
Module32NextW
MoveFileW
GlobalAddAtomW
GetSystemTimeAsFileTime
OpenProcess
SwitchToThread
GetExitCodeThread
OutputDebugStringW
GetFileAttributesExW
GlobalMemoryStatusEx
SetNamedPipeHandleState
IsProcessorFeaturePresent
LockResource
TerminateProcess
QueryInformationJobObject
GetCurrentThreadId
MoveFileExW
UnhandledExceptionFilter
PeekNamedPipe
GlobalFree
HeapWalk
EnterCriticalSection
GetDiskFreeSpaceExW
ReleaseMutex
EnumResourceLanguagesW
GlobalDeleteAtom
SetCurrentDirectoryW
GetCurrentDirectoryW
InitializeCriticalSection
GlobalLock
GetCurrentProcess
GetCommandLineW
HeapSetInformation
ResumeThread
GetProcAddress
VirtualAllocEx
BaseFlushAppcompatCache
FindResourceExW
GetVersionExW
VerifyVersionInfoW
GetEnvironmentStringsW
LCMapStringW
DeviceIoControl
FindFirstFileW
UnmapViewOfFile
Process32NextW
lstrlenW
GetVolumeNameForVolumeMountPointW
SetEndOfFile
QueryPerformanceCounter
CreateToolhelp32Snapshot
SystemTimeToFileTime
CreateFileW
EnumResourceNamesW
GetSystemDirectoryW
DeleteFileW
GetEnvironmentVariableW
Module32FirstW
WriteFile
GetFileInformationByHandle
FindFirstFileExW
ExitThread
CreateNamedPipeW
CreateFileMappingW
CreatePipe
TlsGetValue
HeapUnlock
GetDateFormatW
TlsSetValue
GetSystemDefaultUILanguage
GetOverlappedResult
CreateDirectoryW
EnumCalendarInfoW
IsWow64Process
GetProcessId
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale

dnsapi

DnsQuery_W
DnsRecordListFree

ole32

CoCreateGuid
CoCreateInstance
CoUninitialize
OleInitialize
CoSetProxyBlanket
PropVariantClear
OleUninitialize
CoInitializeEx
CoInitialize
CoInitializeSecurity
CoTaskMemFree
CoTaskMemAlloc
DoDragDrop

iphlpapi

GetAdaptersAddresses
IcmpCloseHandle
IcmpSendEcho
IcmpCreateFile
GetBestInterface

gdi32

GetBitmapBits
SetBkMode
GetObjectW
CreateCompatibleBitmap
CreateDIBSection
SetMapMode
GetStockObject
CreateSolidBrush
SelectObject
DeleteObject
DeleteDC
BitBlt
GetDeviceCaps
CreateCompatibleDC

ntdll

NtQueryInformationProcess
NtQueryInformationThread

Exports

Exports

NoGCLayPipe
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 7.0MB - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 694KB - Virtual size: 693KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 159KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 137B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 56B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 476KB - Virtual size: 476KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63216647956fc7e270fba99a44c891b8

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

0a:e2:f0:ad:eb:29:c5:3f:cb:fc:ce:b9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

be:ae:9f:c2:fa:d5:5d:bc:eb:0e:b9:f7:8d:09:7c:88:e3:73:f3:a5:29:d4:2f:dc:31:3d:1c:04:b6:5a:40:81Signer

Headers

DLL Characteristics

File Characteristics

Imports

d3d9

shlwapi

authz

comdlg32

msimg32

shell32

ws2_32

psapi

user32

oleaut32

advapi32

kernel32

dnsapi

ole32

iphlpapi

gdi32

ntdll

Exports

Exports

Sections

.text Size: 7.0MB - Virtual size: 7.0MB

.itext Size: 11KB - Virtual size: 10KB

.data Size: 694KB - Virtual size: 693KB

.bss Size: - Virtual size: 159KB

.idata Size: 13KB - Virtual size: 12KB

.didata Size: 5KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 137B

.tls Size: - Virtual size: 56B

.rdata Size: 512B - Virtual size: 93B

.reloc Size: 476KB - Virtual size: 476KB

.rsrc Size: 3.8MB - Virtual size: 3.8MB

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

0a:e2:f0:ad:eb:29:c5:3f:cb:fc:ce:b9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

be:ae:9f:c2:fa:d5:5d:bc:eb:0e:b9:f7:8d:09:7c:88:e3:73:f3:a5:29:d4:2f:dc:31:3d:1c:04:b6:5a:40:81
Signer

.text
Size: 7.0MB - Virtual size: 7.0MB

.itext
Size: 11KB - Virtual size: 10KB

.data
Size: 694KB - Virtual size: 693KB

.bss
Size: - Virtual size: 159KB

.idata
Size: 13KB - Virtual size: 12KB

.didata
Size: 5KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 137B

.tls
Size: - Virtual size: 56B

.rdata
Size: 512B - Virtual size: 93B

.reloc
Size: 476KB - Virtual size: 476KB

.rsrc
Size: 3.8MB - Virtual size: 3.8MB