playfabspammerinstallbuild.zip
- SHA256 800466ad1908aeb3152d7cf464195cb184791f6803d40367815cfc1f6630b75c
Password
cjkhk
Overview
overview
3Static
static
3playfabspa...ld.zip
windows7-x64
1playfabspa...ld.zip
windows10-2004-x64
1installer/...rp.dll
windows7-x64
1installer/...rp.dll
windows10-2004-x64
1installer/...on.dll
windows7-x64
1installer/...on.dll
windows10-2004-x64
1installer/...DK.dll
windows7-x64
1installer/...DK.dll
windows10-2004-x64
1installer/...cation
windows7-x64
1installer/...cation
windows10-2004-x64
1installer/...deploy
windows7-x64
3installer/...deploy
windows10-2004-x64
3installer/...or.exe
windows7-x64
3installer/...or.exe
windows10-2004-x64
3installer/...nifest
windows7-x64
3installer/...nifest
windows10-2004-x64
3installer/...ly.dll
windows7-x64
1installer/...ly.dll
windows10-2004-x64
1installer/...cation
windows7-x64
1installer/...cation
windows10-2004-x64
1installer/setup.exe
windows7-x64
3installer/setup.exe
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
playfabspammerinstallbuild.zip
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
playfabspammerinstallbuild.zip
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Microsoft.Playfab.Gaming.GSDK.CSharp.dll
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Microsoft.Playfab.Gaming.GSDK.CSharp.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Newtonsoft.Json.dll
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Newtonsoft.Json.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/PlayFabAllSDK.dll
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/PlayFabAllSDK.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.application
Resource
win7-20240419-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.application
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.exe.config.deploy
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.exe.config.deploy
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.exe.manifest
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral16
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.exe.manifest
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Polly.dll
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Polly.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
installer/Playfab Remote Player Creator.application
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
installer/Playfab Remote Player Creator.application
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
installer/setup.exe
Resource
win7-20240419-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
installer/setup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target playfabspammerinstallbuild.zip
- Size 1.1MB
- Sample240613-zbbbeazblf
- SHA256 800466ad1908aeb3152d7cf464195cb184791f6803d40367815cfc1f6630b75c
- MD5 c7e7527c8129d5bbf54754e8ecc52d83
- SHA1 05563246e785c54c94167bbb83d52db1edf6bc82
- SHA512 c0ddfcac8d32bfa60e38e805b23681ce46e7e59cffe6e82d7ab37afe33460d1addda34e7698efe5ad0dc661783cfe1110fa0d349d9a9a28c03a4d376a96041d7
- SSDEEP 24576:19Mfx+xdZRvAIC2BWc1MYot2vDemH0moVIGjS4D73AWCFpTC/:/qxWZ5AF2Qc1MPQSE0JVIGjSi
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Microsoft.Playfab.Gaming.GSDK.CSharp.dll.deploy unpack001/installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Newtonsoft.Json.dll.deploy unpack001/installer/Application Files/Playfab Remote Player Creator_1_0_0_0/PlayFabAllSDK.dll.deploy unpack001/installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Polly.dll.deploy
File Explorer
-
playfabspammerinstallbuild.zip.zip 1.1MB
-
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Microsoft.Playfab.Gaming.GSDK.CSharp.dll.deploy.dll 26KB
-
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Newtonsoft.Json.dll.deploy.dll 647KB
-
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/PlayFabAllSDK.dll.deploy.dll 1.9MB
-
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.application5KB
-
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.exe.config.deploy187B
-
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.exe.deploy.exe 8KB
-
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.exe.manifest9KB
-
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Polly.dll.deploy.dll 268KB
-
installer/Playfab Remote Player Creator.application5KB
-
installer/setup.exe.exe 550KB
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Microsoft.Playfab.Gaming.GSDK.CSharp.dll.deploy
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 50842f949db6bf2ec6723a4d4f16bb3592d02baf32e62f1c20c6ea30c1796b69
- MD5 45addffcfcffd441742f1d44a022230e
- SHA1 d2ace309e4f613a5fbbd821dc9a851c1d55d4cff
- SHA512 73fb7a583770a66d2a6071bc887483e5424d3a8fd956d0714c52ecf7cc73810f37ef521860a7a80a05ecee78018e9ac40283dee57f8d80a5d90e2c44878022cc
- SSDEEP 384:rM5KKWMp/jqJH/V/TRkc0yFCXTOAQha2C3yPo3EvrEwMW6iJX+Hdt2ECE/WNMnW:rM5KKJZj2/gc0kQTOi8B5+dsGl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
cjkhk
Minor OS version
0
Major OS version
4
Entry point
32478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\program files\jenkins\workspace\SDK_csharpGSDK\sdks\gsdk\csharp\GSDK_CSharp_Standard\obj\Release\net461\Microsoft.Playfab.Gaming.GSDK.CSharp.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Newtonsoft.Json.dll.deploy
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4
- MD5 5afda7c7d4f7085e744c2e7599279db3
- SHA1 3a833eb7c6be203f16799d7b7ccd8b8c9d439261
- SHA512 7cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944
- SSDEEP 6144:3o4V9ynqKoxhi0gAsfLBhJJzhGIVrdhoHuLFGAJmKApt5psaLGBFahKGRd67XLEm:LyncxQRhJJzhoqgH5sB4dxHG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
cjkhk
Minor OS version
0
Major OS version
4
Entry point
667418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net45\Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
644KB
Virtual Size
644KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/PlayFabAllSDK.dll.deploy
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6e7fb9efb9b65ee95a79fd9023c2c063279666babbfad906c1f2a7ae5048463c
- MD5 2cf2b5012d3a268d649c1f61c48ad583
- SHA1 4a69e26077b4772f60a7153f00d17f8d1a9c0157
- SHA512 7fb3461538691da21e96d11d548c7a2eef90a91c3089f8016da9bd7025d697013cfcc12b83c6cf39a044bd3fcd786f590beaf51c14e68540d1dade69e0c085bb
- SSDEEP 12288:z5OGrnlPWmNa+JDOf77oHqsdtX74hTOaEUckO20x5+1Bb9yviDttm/89HmbbdIxr:1LaAKdhTOaEGOb5+XUviG/80o
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
cjkhk
Minor OS version
0
Major OS version
4
Entry point
1988350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\1\s\sdks\CSharpSDK\PlayFabSDK\source\obj\Release\netstandard2.0\PlayFabAllSDK.pdb
mscoree
_CorDllMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.application
- SHA256 db77f94940734815b2bbd06d1295b99b7763d5e53966a542f355b32275508a25
- MD5 d183381c8d3a83869863e21f318c6b49
- SHA1 a0bcb95cbfdb22a49327b5914bdbb343243ed3a8
- SHA512 1e6345b03449b3f2b22eca2229d1fb033257944bdb3a38f7a3b46d02051f85cf5bb4c91ad3e9dc3d442b3fb2d4f1a00cba58051c7b2dfea8ff38cfa5818dee59
- SSDEEP 96:0WLwO9ZcR5n8pcYb24icPk0J2cNIykmO2d5aiE0kmB5ZKto2GBDA:fu9892Hx0McGyHlDIFQA
- MD5 SHA1 SHA512 SSDEEP
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.exe.config.deploy
- SHA256 f82338e8e9c746b5d95cd2ccc7bf94dd5de2b9b8982fffddf2118e475de50e15
- MD5 15c8c4ba1aa574c0c00fd45bb9cce1ab
- SHA1 0dad65a3d4e9080fa29c42aa485c6102d2fa8bc8
- SHA512 52baac63399340427b94bfdeb7a42186d5359ce439c3d775497f347089edfbf72a6637b23bb008ab55b8d4dd3b79a7b2eb7c7ef922ea23d0716d5c3536b359d4
- MD5 SHA1 SHA512
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.exe.deploy
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b1e3617c88a14b921f1d50cd4e01b8880767b65c8a31120e8648ccb34351c623
- MD5 5d4d5c0e4454d54f31bd81b0b7ee30ef
- SHA1 e63bcd5f0cb9044a41880619c176dd8d7f6a6de6
- SHA512 2a26f0e77a2196d82b5aec29e6ccfdc9580db3b9cb20bd8135bbdce94562b48dac8cc2eba7e0bda9fc6a618922414a098c7768feda46ae2c424911f1f33f2219
- SSDEEP 192:erF9n2CvQV1Jk1spJ+SOtQMzS+GQVrtRPpGlh:w2pu1tzVrQlh
- MD5 SHA1 SHA512 SSDEEP
Password
cjkhk
PE Signature issue
Digest
80:b1:da:94:dd:09:fa:ba:b8:c8:6f:2a:d1:8f:a0:4f:d7:5c:cc:3f:ca:87:8e:40:c6:0f:70:eb:cd:ed:a0:73
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=BALLERS\\Ethan
Chains
Jun 12, 2024
Subject
CN=BALLERS\\Ethan
Serial Number
69:06:90:c6:12:64:b0:8d:4a:28:52:16:8e:65:35:e6
Issuer
CN=BALLERS\\Ethan
Timespan
May 26, 2024 - May 27, 2025
Minor OS version
0
Major OS version
4
Entry point
13810
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Ethan\source\repos\Playfab Remote Player Creator\Playfab Remote Player Creator\obj\Debug\Playfab Remote Player Creator.pdb
mscoree
_CorExeMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Playfab Remote Player Creator.exe.manifest
- SHA256 16c99d8e74e496fc80884a14c255a2821de1263e30928e34fb2bf14421b48138
- MD5 9424d22ad455e66f42b6eea532eac7c8
- SHA1 5ba5a6db4e084b9b93fa69dc69fd14cf89c6c426
- SHA512 8fc535c64f49d4d88d12d8215a5bcf35608065a56b3bea762b5cac481c28109f2b35d542c2b108bac83542051e23f909576260b2876075eeb58bcc1a8a205ef7
- SSDEEP 192:fn1SqVyw5tUebzT6SDQoC+WBhxdh+qHRTBk8DIFQA:ceyw5tUebzT6SD6+WBhxdwmT7kFP
- MD5 SHA1 SHA512 SSDEEP
installer/Application Files/Playfab Remote Player Creator_1_0_0_0/Polly.dll.deploy
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a320e0c3639470fdb47d097255a5e1b4fa217e3e03c6e850b72dde19dbb2c37a
- MD5 a59b64eb80ceee01188925f7a8a82f07
- SHA1 d40d09b9bc8b46ebfe63c6b8e605827156146983
- SHA512 102b8bd1da26dc273d888746b2d7d960e714f4c0dc6f73fd843fd0e018c8ea4a6cb53548c21830301b78110df019dd11f5008c67b67116f7e2fad4118d2659b3
- SSDEEP 3072:SZAWDkTmokB1QmoA5XoQAUk27ZGasJMaRtWct14ClZv3YpsPl:SZU0B5jTAUkGwBXbt1Tz3YW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
cjkhk
Minor OS version
0
Major OS version
4
Entry point
280570
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/Polly/obj/Release/net472/Polly.pdb
mscoree
_CorDllMain
Name
.text
Size
266KB
Virtual Size
266KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
installer/Playfab Remote Player Creator.application
- SHA256 db77f94940734815b2bbd06d1295b99b7763d5e53966a542f355b32275508a25
- MD5 d183381c8d3a83869863e21f318c6b49
- SHA1 a0bcb95cbfdb22a49327b5914bdbb343243ed3a8
- SHA512 1e6345b03449b3f2b22eca2229d1fb033257944bdb3a38f7a3b46d02051f85cf5bb4c91ad3e9dc3d442b3fb2d4f1a00cba58051c7b2dfea8ff38cfa5818dee59
- SSDEEP 96:0WLwO9ZcR5n8pcYb24icPk0J2cNIykmO2d5aiE0kmB5ZKto2GBDA:fu9892Hx0McGyHlDIFQA
- MD5 SHA1 SHA512 SSDEEP
installer/setup.exe
- IMPHASH 367254f4e83f62f5437681fde2e55f48
- SHA256 de9c8cee34632b5ba707224a1600253fe409fb16cfe046c7856728e8dfddfdbb
- MD5 b26bef8474c5144a8462590f4fe39dd5
- SHA1 b080311569b8c01023a3b09385571692843cc6f5
- SHA512 376c2ec965681bab3f360669a5b8b2f592be7af818edc2a44608a5a00c32dcc1356e0faa289ce42e3cec97bae6322d6d3b5ddbad20c2552fe4806e31ec8befe9
- SSDEEP 12288:uzJrNX03US0UrNsfHCCImrm+ueMb01JQntLOCFz9Eekf:uBF0kS0ICJuemFze
- MD5 SHA1 SHA512 SSDEEP
Password
cjkhk
PE Signature issue
Digest
ad:27:1f:1f:7d:ca:76:4a:90:bb:17:82:63:1d:9c:33:92:78:d1:10:a3:9c:f9:17:2f:f7:49:f5:92:c6:47:99
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=BALLERS\\Ethan
Chains
Jun 12, 2024
Subject
CN=BALLERS\\Ethan
Serial Number
69:06:90:c6:12:64:b0:8d:4a:28:52:16:8e:65:35:e6
Issuer
CN=BALLERS\\Ethan
Timespan
May 26, 2024 - May 27, 2025
Minor OS version
1
Major OS version
5
Entry point
238368
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\dbs\sh\ddvsm\0727_115535_0\cmd\c\out\binaries\x86ret\bin\i386\Bootstrapper\Engine\setup.pdb
kernel32
OpenProcess
GetNativeSystemInfo
EndUpdateResourceW
VerifyVersionInfoW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetEvent
CreateEventW
LoadResource
LockResource
SizeofResource
FindResourceW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
DeleteFileW
GetFileAttributesW
Sleep
ReadFile
GetTempPathW
GetCurrentProcess
GetSystemInfo
GetSystemDirectoryW
GetWindowsDirectoryW
GetVersionExW
GetModuleFileNameW
GlobalAlloc
GlobalFree
LocalFree
FormatMessageW
CopyFileW
GetDateFormatW
GetTimeFormatW
CompareStringW
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
HeapSetInformation
SetFilePointer
GetDiskFreeSpaceExW
CreateFileW
VerSetConditionMask
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
lstrlenW
GetCurrentProcessId
MulDiv
GetTickCount
GetExitCodeProcess
LoadLibraryW
GetTempFileNameW
SwitchToThread
FindNextFileW
UpdateResourceA
BeginUpdateResourceA
FindResourceA
lstrlenA
DeleteFileA
CreateFileA
UpdateResourceW
BeginUpdateResourceW
GetVersion
GetEnvironmentVariableA
LCMapStringEx
InitializeCriticalSectionEx
HeapReAlloc
HeapSize
WriteConsoleW
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
OutputDebugStringW
SetEndOfFile
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
FindFirstFileW
FindClose
GetProcAddress
FreeLibrary
WaitForSingleObject
GetLastError
CloseHandle
WriteFile
LCMapStringW
HeapFree
HeapAlloc
GetFileType
GetStringTypeW
GetACP
GetModuleHandleExW
ExitProcess
MultiByteToWideChar
RaiseException
VirtualProtect
VirtualQuery
GetModuleHandleW
LoadLibraryExA
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
gdi32
GetStockObject
EnumFontFamiliesExW
DeleteObject
CreateFontIndirectW
GetObjectW
GetTextMetricsW
SelectObject
GetTextExtentPoint32W
GetDeviceCaps
DeleteDC
CreateCompatibleDC
ole32
CoUninitialize
CoInitialize
secur32
GetComputerObjectNameW
shell32
SHGetMalloc
ShellExecuteExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
ShellExecuteA
user32
SystemParametersInfoW
IsDialogMessageW
LoadImageW
LoadIconW
LoadCursorW
SetClassLongW
SetCursor
GetWindowRect
GetClientRect
SetWindowTextW
ShowScrollBar
SetForegroundWindow
EnableWindow
MsgWaitForMultipleObjects
GetFocus
SetFocus
SendDlgItemMessageW
SetDlgItemTextW
GetDlgItem
CreateDialogIndirectParamW
CreateDialogParamW
MoveWindow
ShowWindow
DestroyWindow
SendMessageW
SendMessageA
PeekMessageW
DispatchMessageW
TranslateMessage
ExitWindowsEx
MessageBoxW
ReleaseDC
GetDC
DrawTextW
GetSystemMetrics
GetDialogBaseUnits
MessageBoxA
ScreenToClient
crypt32
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
wininet
InternetCrackUrlW
InternetCombineUrlW
msi
ord92
ord150
ord78
ord8
shlwapi
UrlUnescapeW
_DecodePointerInternal@4
_EncodePointerInternal@4
Name
.text
Size
385KB
Virtual Size
384KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
138KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=158, id=243, version=40116,
count=29, id=242, version=40116,
count=17, id=260, version=31823,
count=22, id=259, version=31823,
count=84, id=261, version=31823,
count=25, id=203, version=65501,
count=355, id=1, productName=Unmarked objects,
count=1, id=259, version=31940,
count=31, id=261, version=31940,
count=1, id=256, version=31940,
count=1, id=255, version=31940,
count=1, id=258, version=31940,