BlackOps[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

BlackOps.exe
Size

7.6MB
MD5

a22c5f1784516dd53050bc27458e6509
SHA1

1eeb501efbacd066cb63f73d0c6e13cd0450692b
SHA256

8f9bc0f79462b3fbe1452b7591fad22086f858b3a22216a66df05841ecf6a564
SHA512

c58e5d6d263ef66628fae963a1e42a928ed4f8edf0007771f669e59a265dc6720c8645b2dee0a0a0d3e8af9a5e466c118c86434a34bc6c4680fd81c1e28ae8a1
SSDEEP

98304:AC4S/i8pXwcr91+EZeLMu4EOXKQiMmWhaT8iFD+iFlkW5:x/JpXwc3+EZeLt4EOXKPMFha/5

Score

1^/10

Malware Config

Signatures

Files

BlackOps.exe
.exe windows:5 windows x86 arch:x86

5ce0d4812078c1f132e3e9e206c8cfc6

Code Sign

29:fa:b5:3f:04:e3:ef:61:ba:9c:a5:86:e6:c9:90:d2
Certificate

Issuer

CN=OptiJuegos

Not Before

01/01/2013, 03:00

Not After

01/01/2099, 03:00

Subject

CN=OptiJuegos

Extended Key Usages

ExtKeyUsageCodeSigning

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

67:d3:fb:1e:c6:5d:2b:43:54:e4:68:7c:4a:f2:86:a2:c6:92:66:35
Signer

Actual PE Digest

67:d3:fb:1e:c6:5d:2b:43:54:e4:68:7c:4a:f2:86:a2:c6:92:66:35

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\projects_pc\cod\codsrc\src\obj\t5\CoDSteam_CEG_bin\BlackOps.pdb

Imports

steam_api

SteamAPI_RestartAppIfNecessary
SteamAPI_Init
SteamAPI_RunCallbacks
SteamAPI_UnregisterCallback
SteamUserStats
SteamAPI_RegisterCallback
SteamAPI_RegisterCallResult
SteamNetworking
SteamAPI_UnregisterCallResult
SteamAPI_Shutdown
SteamUtils
SteamUser
SteamFriends

winmm

mixerSetControlDetails
timeEndPeriod
timeBeginPeriod
mixerGetControlDetailsA
mixerGetLineControlsA
mixerClose
mixerGetLineInfoA
mixerOpen
mixerGetNumDevs
waveInGetNumDevs
timeGetTime

wsock32

htons
gethostbyname
ioctlsocket
sendto
select
socket
gethostname
WSAStartup
closesocket
WSAGetLastError
recvfrom

binkw32

_BinkRegisterFrameBuffers@8
_BinkSetSoundSystem@8
_BinkClose@4
_BinkGetError@0
_BinkOpenDirectSound@4
_BinkOpen@8
_BinkSetIOSize@4
_BinkDoFrame@4
_BinkSetMemory@8
_BinkWait@4
_BinkGetRealtime@12
_BinkNextFrame@4
_BinkGetFrameBuffersInfo@8
_BinkShouldSkip@4
_BinkPause@8
_BinkSetVolume@12
_BinkControlBackgroundIO@8
_BinkSetSoundTrack@8

d3d9

Direct3DCreate9
D3DPERF_BeginEvent
D3DPERF_EndEvent

d3dx9_43

D3DXCompileShader
D3DXSaveSurfaceToFileA
D3DXCreateBuffer
D3DXGetShaderConstantTable
D3DXGetShaderInputSemantics
D3DXGetShaderOutputSemantics

dsound

ord11
ord6

kernel32

GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetEnvironmentVariableW
SetEnvironmentVariableA
InitializeCriticalSectionAndSpinCount
VirtualQuery
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
SetStdHandle
WriteConsoleA
QueryPerformanceCounter
InterlockedDecrement
CreateFileA
ReadFileEx
GetLastError
SleepEx
CloseHandle
GetFileSize
GetFileAttributesA
InterlockedIncrement
DebugBreak
ExitProcess
GetCurrentThreadId
SwitchToThread
InterlockedExchange
RaiseException
Sleep
SetEvent
ResetEvent
CreateEventA
WaitForSingleObject
GetProcessAffinityMask
GetCurrentProcess
DuplicateHandle
GetCurrentThread
CreateThread
SuspendThread
ResumeThread
SetThreadPriority
SetFileAttributesA
VirtualAlloc
VirtualFree
QueryPerformanceFrequency
GetModuleFileNameA
GetModuleHandleA
InitializeCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
GlobalMemoryStatus
GetProcAddress
SetProcessAffinityMask
GetThreadPriority
FormatMessageA
OutputDebugStringA
GetDriveTypeA
GlobalUnlock
GlobalSize
GlobalLock
GetVersionExA
Module32Next
Module32First
CreateToolhelp32Snapshot
GetConsoleOutputCP
WriteFile
ReadFile
GetCurrentProcessId
DeleteFileA
SetErrorMode
SetUnhandledExceptionFilter
DeleteCriticalSection
TerminateProcess
LoadLibraryA
GetTickCount
MulDiv
SetPriorityClass
SetThreadExecutionState
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetCurrentDirectoryA
GetSystemTime
ReleaseMutex
ReleaseSemaphore
CreateMutexA
CreateSemaphoreA
SetFilePointer
PulseEvent
SetLastError
CreateEventW
HeapFree
GetProcessHeap
GetFileInformationByHandle
CreateFileW
lstrcmpiW
lstrlenW
GetFullPathNameW
HeapAlloc
HeapSize
GetProcessTimes
GetModuleHandleExA
GetFileTime
GetTimeZoneInformation
GetComputerNameA
FileTimeToSystemTime
InterlockedCompareExchange
GetSystemDirectoryW
GetWindowsDirectoryW
GetModuleFileNameW
UnmapViewOfFile
LockResource
LoadResource
SizeofResource
FindResourceW
GetConsoleWindow
GetCurrentDirectoryW
GetEnvironmentStringsW
GetCommandLineW
GetStartupInfoW
GetFullPathNameA
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
OpenEventA
GetSystemInfo
IsDebuggerPresent
CreateDirectoryA
FileTimeToLocalFileTime
GetModuleHandleW
ExitThread
MultiByteToWideChar
HeapReAlloc
GetCommandLineA
GetStartupInfoA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
LCMapStringW
GetStdHandle
HeapCreate
GetConsoleCP
WriteConsoleW
CompareStringA
CompareStringW
SetEndOfFile
TerminateThread
GetExitCodeThread
UnhandledExceptionFilter
MoveFileA
RtlUnwind
FindNextFileA
FindClose
RemoveDirectoryA
FindFirstFileA
CompareFileTime
OpenProcess
SystemTimeToFileTime

user32

CloseWindow
CallNextHookEx
GetAsyncKeyState
SetWindowsHookExA
MapVirtualKeyA
MoveWindow
GetMonitorInfoA
MonitorFromWindow
RegisterWindowMessageA
RegisterClassA
LoadImageA
SetWindowTextA
SendMessageA
AdjustWindowRect
SetWindowPos
GetSystemMetrics
DestroyWindow
LoadCursorA
RegisterClassExA
OpenClipboard
GetClipboardData
CloseClipboard
GetMessageA
CallWindowProcA
CreateWindowExA
PostQuitMessage
DispatchMessageA
TranslateMessage
ShowWindow
PostMessageA
ShowCursor
ClientToScreen
GetCursorPos
ScreenToClient
GetForegroundWindow
LoadIconA
SetFocus
GetWindowRect
SetCursorPos
GetActiveWindow
MessageBoxA
ChangeDisplaySettingsA
EnumThreadWindows
GetDesktopWindow
GetDC
ReleaseDC
GetWindowTextA
GetWindowLongA
SetWindowLongA
AdjustWindowRectEx
IsWindow
MonitorFromPoint
EnumDisplayMonitors
PeekMessageA
MessageBoxW
DefWindowProcA

gdi32

DeleteDC
CreateFontA
ExtEscape
SetDeviceGammaRamp
GetDeviceCaps
CreateDCA
CreateSolidBrush

advapi32

CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueA

shell32

SHGetFolderPathA
ShellExecuteA

ole32

CoInitializeEx
CoUninitialize
CLSIDFromString
StringFromGUID2
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree

xinput1_3

ord3
ord4
ord2

psapi

GetProcessMemoryInfo

ws2_32

__WSAFDIsSet
recv
send
ioctlsocket
setsockopt
bind
ntohs
inet_ntoa
connect
getsockname

Sections

.text
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 150KB - Virtual size: 58.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 109B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.version
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ce0d4812078c1f132e3e9e206c8cfc6

Code Sign

29:fa:b5:3f:04:e3:ef:61:ba:9c:a5:86:e6:c9:90:d2Certificate

Extended Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

67:d3:fb:1e:c6:5d:2b:43:54:e4:68:7c:4a:f2:86:a2:c6:92:66:35Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

steam_api

winmm

wsock32

binkw32

d3d9

d3dx9_43

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

xinput1_3

psapi

ws2_32

Sections

.text Size: 5.6MB - Virtual size: 5.6MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 150KB - Virtual size: 58.5MB

.tls Size: 512B - Virtual size: 109B

.rodata Size: 2KB - Virtual size: 1KB

.version Size: 512B - Virtual size: 4B

.rsrc Size: 76KB - Virtual size: 76KB

29:fa:b5:3f:04:e3:ef:61:ba:9c:a5:86:e6:c9:90:d2
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

67:d3:fb:1e:c6:5d:2b:43:54:e4:68:7c:4a:f2:86:a2:c6:92:66:35
Signer

.text
Size: 5.6MB - Virtual size: 5.6MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 150KB - Virtual size: 58.5MB

.tls
Size: 512B - Virtual size: 109B

.rodata
Size: 2KB - Virtual size: 1KB

.version
Size: 512B - Virtual size: 4B

.rsrc
Size: 76KB - Virtual size: 76KB