Twitch[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Twitch.zip
Size

1.8MB
MD5

dd20314add7aa3e99f02b74dff73cca1
SHA1

fdafe1b8a395531e8280c4fbc84630a4ff616ef1
SHA256

b1c165588b9923c27115fb77e366aaff66ab3bbb9d3d57da3dcfe234524c369c
SHA512

c0a5fc724c9cfc499e954aac2b1ce2c3539a7a59317cae108d63e18b7048ca1b657f2beb54df37ad7cf2b168bb819d36fdd1514962b631d10472cdafcba37f47
SSDEEP

24576:DNK8OnfN+40yBfOKAk5vQEiFh1jBk0W6Qs5J3rZMJGabx3X5fUwZfK7robvDNrWA:Du1bBfOKFe/tQqFobx3pfUYfKwbMIt

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Twitch for Windows/32-bit Plugin/twitch.aex
unpack001/Twitch for Windows/64-bit Plugin/twitch.aex

Files

Twitch.zip
.zip
Twitch for Mac/32-bit Plugin/twitch.plugin/Contents/Info.plist
.xml
Twitch for Mac/32-bit Plugin/twitch.plugin/Contents/MacOS/twitch
.dylib macos arch:ppc arch:x86
Twitch for Mac/32-bit Plugin/twitch.plugin/Contents/PkgInfo
Twitch for Mac/32-bit Plugin/twitch.plugin/Contents/Resources/twitch.rsrc
Twitch for Mac/64-bit Plugin/twitch.plugin/Contents/Info.plist
.xml
Twitch for Mac/64-bit Plugin/twitch.plugin/Contents/MacOS/twitch
.dylib macos arch:x64
Twitch for Mac/64-bit Plugin/twitch.plugin/Contents/PkgInfo
Twitch for Mac/64-bit Plugin/twitch.plugin/Contents/Resources/twitch.rsrc
Twitch for Mac/Presets/__-Twitch-__/--RESET--.ffx
Twitch for Mac/Presets/__-Twitch-__/Bad Distortion.ffx
Twitch for Mac/Presets/__-Twitch-__/Bad Film Gate.ffx
Twitch for Mac/Presets/__-Twitch-__/Blinking.ffx
Twitch for Mac/Presets/__-Twitch-__/Blue Glow.ffx
Twitch for Mac/Presets/__-Twitch-__/Chaos Theory.ffx
Twitch for Mac/Presets/__-Twitch-__/Colorless Flash.ffx
Twitch for Mac/Presets/__-Twitch-__/Diagonal Slide.ffx
Twitch for Mac/Presets/__-Twitch-__/Fashion Show.ffx
Twitch for Mac/Presets/__-Twitch-__/Green Street.ffx
Twitch for Mac/Presets/__-Twitch-__/Horizontal Slide.ffx
Twitch for Mac/Presets/__-Twitch-__/Jitter.ffx
Twitch for Mac/Presets/__-Twitch-__/Night Club.ffx
Twitch for Mac/Presets/__-Twitch-__/On the Sun.ffx
Twitch for Mac/Presets/__-Twitch-__/Orange Color Shift.ffx
Twitch for Mac/Presets/__-Twitch-__/Police Lights.ffx
Twitch for Mac/Presets/__-Twitch-__/Random Color Flashes.ffx
Twitch for Mac/Presets/__-Twitch-__/Random Zoom.ffx
Twitch for Mac/Presets/__-Twitch-__/Sharp Flashing.ffx
Twitch for Mac/Presets/__-Twitch-__/Snappy Twitch.ffx
Twitch for Mac/Presets/__-Twitch-__/TRANSITION 360 Spin.ffx
Twitch for Mac/Presets/__-Twitch-__/TRANSITION Bloom.ffx
Twitch for Mac/Presets/__-Twitch-__/TRANSITION Color Tearing.ffx
Twitch for Mac/Presets/__-Twitch-__/TRANSITION Crazy Man.ffx
Twitch for Mac/Presets/__-Twitch-__/TRANSITION Side Swiped.ffx
Twitch for Mac/Presets/__-Twitch-__/Time Jitters.ffx
Twitch for Mac/_DS_Store
Twitch for Mac/twitch_ae.key
Twitch for Windows/32-bit Plugin/twitch.aex
.dll windows:5 windows x86 arch:x86

712da46af641bbc759f56406e23816c4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegCreateKeyA
RegCloseKey
RegQueryValueExA

kernel32

InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetSystemInfo
WaitForMultipleObjects
DeleteCriticalSection
CloseHandle
CreateThread
AllocConsole
SetConsoleScreenBufferSize
FreeConsole
SetConsoleTitleA
GetStdHandle
WriteConsoleA
GetModuleFileNameA
InterlockedIncrement
InterlockedDecrement
Sleep
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetCPInfo
HeapAlloc
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
ExitProcess
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
ReadFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileA
GetLocaleInfoW
SetEndOfFile
GetProcessHeap
GetModuleHandleA

Exports

Exports

EntryPointFunc

Sections

.text
Size: 446KB - Virtual size: 446KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 250KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Twitch for Windows/64-bit Plugin/twitch.aex
.dll windows:5 windows x64 arch:x64

a70ee4c7fee6bd6a6f546fa838a63542

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

RegCreateKeyA
RegCloseKey
RegQueryValueExA

kernel32

InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetSystemInfo
WaitForMultipleObjects
DeleteCriticalSection
CloseHandle
CreateThread
AllocConsole
SetConsoleScreenBufferSize
FreeConsole
SetConsoleTitleA
GetStdHandle
WriteConsoleA
GetModuleFileNameA
Sleep
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlUnwindEx
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetCPInfo
HeapAlloc
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
HeapSize
GetModuleHandleW
GetProcAddress
ExitProcess
HeapSetInformation
HeapCreate
HeapDestroy
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
ReadFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
HeapReAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileA
GetLocaleInfoW
SetEndOfFile
GetProcessHeap

Exports

Exports

EntryPointFunc

Sections

.text
Size: 487KB - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 254KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Twitch for Windows/Presets/__-Twitch-__/--RESET--.ffx
Twitch for Windows/Presets/__-Twitch-__/Bad Distortion.ffx
Twitch for Windows/Presets/__-Twitch-__/Bad Film Gate.ffx
Twitch for Windows/Presets/__-Twitch-__/Blinking.ffx
Twitch for Windows/Presets/__-Twitch-__/Blue Glow.ffx
Twitch for Windows/Presets/__-Twitch-__/Chaos Theory.ffx
Twitch for Windows/Presets/__-Twitch-__/Colorless Flash.ffx
Twitch for Windows/Presets/__-Twitch-__/Diagonal Slide.ffx
Twitch for Windows/Presets/__-Twitch-__/Fashion Show.ffx
Twitch for Windows/Presets/__-Twitch-__/Green Street.ffx
Twitch for Windows/Presets/__-Twitch-__/Horizontal Slide.ffx
Twitch for Windows/Presets/__-Twitch-__/Jitter.ffx
Twitch for Windows/Presets/__-Twitch-__/Night Club.ffx
Twitch for Windows/Presets/__-Twitch-__/On the Sun.ffx
Twitch for Windows/Presets/__-Twitch-__/Orange Color Shift.ffx
Twitch for Windows/Presets/__-Twitch-__/Police Lights.ffx
Twitch for Windows/Presets/__-Twitch-__/Random Color Flashes.ffx
Twitch for Windows/Presets/__-Twitch-__/Random Zoom.ffx
Twitch for Windows/Presets/__-Twitch-__/Sharp Flashing.ffx
Twitch for Windows/Presets/__-Twitch-__/Snappy Twitch.ffx
Twitch for Windows/Presets/__-Twitch-__/TRANSITION 360 Spin.ffx
Twitch for Windows/Presets/__-Twitch-__/TRANSITION Bloom.ffx
Twitch for Windows/Presets/__-Twitch-__/TRANSITION Color Tearing.ffx
Twitch for Windows/Presets/__-Twitch-__/TRANSITION Crazy Man.ffx
Twitch for Windows/Presets/__-Twitch-__/TRANSITION Side Swiped.ffx
Twitch for Windows/Presets/__-Twitch-__/Time Jitters.ffx
Twitch for Windows/twitch_ae.key
_DS_Store

Sharing

General

Malware Config

Signatures

Files

712da46af641bbc759f56406e23816c4

Headers

File Characteristics

Imports

advapi32

kernel32

Exports

Exports

Sections

.text Size: 446KB - Virtual size: 446KB

.rdata Size: 70KB - Virtual size: 70KB

.data Size: 250KB - Virtual size: 263KB

.rsrc Size: 512B - Virtual size: 408B

.reloc Size: 20KB - Virtual size: 20KB

a70ee4c7fee6bd6a6f546fa838a63542

Headers

File Characteristics

Imports

advapi32

kernel32

Exports

Exports

Sections

.text Size: 487KB - Virtual size: 487KB

.rdata Size: 79KB - Virtual size: 78KB

.data Size: 254KB - Virtual size: 268KB

.pdata Size: 18KB - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 408B

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 446KB - Virtual size: 446KB

.rdata
Size: 70KB - Virtual size: 70KB

.data
Size: 250KB - Virtual size: 263KB

.rsrc
Size: 512B - Virtual size: 408B

.reloc
Size: 20KB - Virtual size: 20KB

.text
Size: 487KB - Virtual size: 487KB

.rdata
Size: 79KB - Virtual size: 78KB

.data
Size: 254KB - Virtual size: 268KB

.pdata
Size: 18KB - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 408B

.reloc
Size: 4KB - Virtual size: 4KB