Static task
static1
Behavioral task
behavioral1
Sample
PES2011.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
PES2011.exe
Resource
win10v2004-20240704-en
General
-
Target
PES2011.exe
-
Size
18.4MB
-
MD5
38c02edb75867dfc21b4d398c3f72752
-
SHA1
63eae1ccdd3d857676869873880b73e0f30dc1d1
-
SHA256
4e93f3ad54495771e83c2153f54add6596e27e5cabedfa00dce48b0ed88b054a
-
SHA512
e727fe1beabc02132468d2d1e194ccf3de95bb2edfe49fd977cade492b4499f84de4599ac5ee773d4b2246b7f301926581061da39ad36c57f463b65f955fff6e
-
SSDEEP
393216:MmRykl+VvxkjW4MGnkn8iLdarEABNPHVnw:98Fxk64ZnkZdarEA/G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PES2011.exe
Files
-
PES2011.exe.exe windows:5 windows x86 arch:x86
0e48aa5a7c0b507cbbf371b014ecfd93
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
d3d9
Direct3DCreate9
ddraw
DirectDrawCreate
dsound
ord2
ord11
ord12
kernel32
CreateDirectoryW
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
GetCommandLineA
GetStartupInfoA
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
ExitProcess
RtlUnwind
GetSystemTimeAsFileTime
RaiseException
LCMapStringA
LCMapStringW
GetCPInfo
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapCreate
VirtualFree
GetTickCount
GetCurrentProcessId
HeapSize
HeapAlloc
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
IsValidCodePage
ReadFile
GetConsoleCP
GetConsoleMode
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetLocaleInfoW
SetFilePointer
CreateFileA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetTimeZoneInformation
SetEndOfFile
GetProcessHeap
CreateDirectoryA
CompareStringW
SetEnvironmentVariableA
GetEnvironmentVariableA
WaitForSingleObject
GetFileSize
CreateMutexA
RemoveDirectoryA
FindClose
MoveFileA
FindNextFileA
DeleteFileA
GetFileAttributesExA
CreateFileW
SetFileAttributesA
GetFileAttributesExW
SetFileAttributesW
TryEnterCriticalSection
InterlockedCompareExchange
InterlockedExchangeAdd
CreateSemaphoreA
ReleaseSemaphore
SetThreadPriority
SetThreadAffinityMask
SuspendThread
ResumeThread
SetFileTime
CreateEventA
GetFullPathNameA
SetEvent
GetThreadPriority
ResetEvent
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
GetSystemInfo
SetCurrentDirectoryW
GetLastError
SignalObjectAndWait
GetDriveTypeA
CreateProcessA
GetExitCodeProcess
GetCurrentDirectoryA
GetFullPathNameW
FindFirstFileW
GetDriveTypeW
FileTimeToLocalFileTime
ExitThread
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetDiskFreeSpaceExA
CreateThread
GetTempFileNameA
MoveFileExA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetModuleFileNameW
GetLocalTime
SetErrorMode
CreateWaitableTimerA
CancelWaitableTimer
SetWaitableTimer
GetFileAttributesA
CloseHandle
GetVersionExA
ReleaseMutex
QueryPerformanceFrequency
CompareStringA
GetProcessAffinityMask
GetFileAttributesW
Sleep
WideCharToMultiByte
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
GlobalMemoryStatus
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
SizeofResource
SetThreadExecutionState
LoadResource
GetLocaleInfoA
FindResourceA
GetCurrentProcess
DeleteCriticalSection
LocalAlloc
FindNextFileW
GetLogicalDriveStringsW
DeleteFileW
CopyFileW
GetTempPathW
GetFileSizeEx
GetDiskFreeSpaceExW
FindFirstFileA
user32
CallWindowProcA
RegisterDeviceNotificationA
GetWindowRect
IsIconic
AttachThreadInput
GetMonitorInfoA
RedrawWindow
DrawMenuBar
SystemParametersInfoA
GetWindowThreadProcessId
MonitorFromRect
EndPaint
SetCursor
GetMessageA
RegisterClassExA
PostQuitMessage
SetForegroundWindow
LoadIconA
GetClientRect
SetFocus
BeginPaint
TranslateMessage
GetForegroundWindow
SetWindowLongA
InvalidateRect
UnregisterClassA
GetWindowLongA
CreateWindowExA
PeekMessageA
TranslateAcceleratorA
GetCursorPos
ShowWindow
DispatchMessageA
AdjustWindowRectEx
UpdateWindow
ScreenToClient
SetWindowPos
EnumDisplaySettingsA
GetDC
ReleaseDC
ShowCursor
GetKeyboardLayout
MessageBoxA
GetDoubleClickTime
DefWindowProcA
GetActiveWindow
PostMessageA
MessageBoxW
GetSystemMetrics
gdi32
GetStockObject
GetDeviceCaps
advapi32
RegOpenKeyExA
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExA
shell32
SHGetSpecialFolderLocation
SHGetFolderPathA
SHFileOperationA
SHGetFileInfoW
SHGetPathFromIDListW
ShellExecuteA
SHGetMalloc
ole32
CoInitializeEx
CoUninitialize
CoCreateGuid
CoCreateInstance
CoTaskMemFree
d3dx9_30
D3DXCreateCubeTextureFromFileInMemoryEx
D3DXCreateTextureFromFileInMemoryEx
D3DXCreateVolumeTextureFromFileInMemoryEx
D3DXAssembleShader
D3DXGetPixelShaderProfile
D3DXCompileShader
D3DXGetShaderConstantTable
D3DXGetVertexShaderProfile
D3DXCreateTexture
D3DXLoadSurfaceFromMemory
D3DXCreateVolumeTexture
D3DXCreateCubeTexture
D3DXLoadVolumeFromMemory
D3DXGetImageInfoFromFileInMemory
winmm
timeKillEvent
timeSetEvent
timeGetSystemTime
timeBeginPeriod
timeGetTime
imm32
ImmAssociateContext
ImmGetContext
dinput8
DirectInput8Create
wininet
InternetCloseHandle
InternetOpenA
HttpSendRequestA
InternetSetStatusCallback
HttpAddRequestHeadersA
HttpQueryInfoA
HttpOpenRequestA
InternetCrackUrlA
InternetReadFileExA
InternetConnectA
iphlpapi
GetIpAddrTable
GetBestRoute
GetIpForwardTable
GetAdaptersInfo
GetNetworkParams
SetIpForwardEntry
secur32
ApplyControlToken
DecryptMessage
EncryptMessage
QueryContextAttributesA
AcquireCredentialsHandleA
FreeCredentialsHandle
DeleteSecurityContext
FreeContextBuffer
InitializeSecurityContextA
crypt32
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertFreeCertificateContext
oleaut32
SysStringLen
SysFreeString
SysAllocString
Sections
.text Size: 14.7MB - Virtual size: 14.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PSFD00 Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.3MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 13B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 349KB - Virtual size: 348KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rld Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE