Age-Of-Empires_437975[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Age-Of-Empires_437975.exe
Size

18.6MB
MD5

5baf879590213ef09b9afa5df3c29e59
SHA1

fa492b729167b47288c3b91aa37823945a767df5
SHA256

01dd7963155dc8da22314a0aee7cb937838fb70c099b467abc8d0c946bddaab1
SHA512

b08337117a0b12454a91b878121be1aacfea329489cfe50354934d6f28d045e918124f717c0be9d0eb2cef1976ab32cdbbb72a289523c38124575ab0c355db2f
SSDEEP

393216:a20nzE9EkGbnYl9RX22qd22ak205DCfrm99pDybvCbUvFGGGGtwH3QYDez3QzCQW:aYGbnS9RK5DCQybvCbUvM3ivhdS+9Ixg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Age-Of-Empires_437975.exe

Files

Age-Of-Empires_437975.exe
.exe windows:6 windows x86 arch:x86

86b01d97e18c059cdfbbaa8f932af630

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW

kernel32

TlsSetValue
SystemTimeToTzSpecificLocalTime
FindClose
FindNextFileW
FormatMessageA
LocalFree
CloseHandle
GetLastError
MultiByteToWideChar
SetEvent
InitializeSListHead
HeapReAlloc
FindFirstFileA
RemoveDirectoryW
VirtualAlloc
SetFileAttributesW
VirtualFree
GetModuleFileNameA
RaiseException
GetStartupInfoW
GetEnvironmentStringsW
GetCurrentProcessId
CreateFileW
FreeLibrary
HeapFree
lstrcatA
WriteFile
GetTickCount
GetTimeFormatW
GetLocaleInfoEx
GetModuleHandleExW
EnumSystemLocalesW
ReleaseSemaphore
GetSystemTimeAsFileTime
SetStdHandle
GetProcessHeap
CreateDirectoryW
GetCurrentDirectoryA
PeekNamedPipe
LCMapStringW
GetCurrentDirectoryW
FormatMessageW
GetStringTypeW
FindFirstFileW
RemoveDirectoryA
LCMapStringEx
GetFileAttributesW
SetCurrentDirectoryW
SetFilePointer
ReadConsoleW
GetFinalPathNameByHandleW
GetVersion
ReadFile
RtlUnwind
AcquireSRWLockExclusive
GetFileInformationByHandle
IsDebuggerPresent
GetTempPathW
InitializeCriticalSectionEx
IsProcessorFeaturePresent
FreeLibraryAndExitThread
DeleteCriticalSection
GetFileSizeEx
FindFirstFileExA
GetTimeZoneInformation
SetFilePointerEx
CreateThread
IsValidLocale
ResetEvent
TryAcquireSRWLockExclusive
GetCPInfo
DeleteFileW
DeleteFileA
EnterCriticalSection
GetModuleHandleW
GetSystemInfo
HeapAlloc
GetTickCount64
FileTimeToSystemTime
ExitThread
GetFileType
WaitForSingleObjectEx
TlsGetValue
EncodePointer
GetCurrentThreadId
VerifyVersionInfoW
WaitForSingleObject
GetDateFormatW
GetProcAddress
TlsFree
QueryPerformanceFrequency
IsValidCodePage
GlobalMemoryStatus
LoadLibraryW
CreateFileA
CreateSemaphoreA
HeapSize
SetUnhandledExceptionFilter
SleepEx
GetConsoleCP
WriteConsoleW
LoadLibraryExW
SetEndOfFile
FreeEnvironmentStringsW
GetModuleFileNameW
WaitForMultipleObjects
CreateEventA
LoadLibraryA
ReleaseSRWLockExclusive
CreateDirectoryA
GetProcessAffinityMask
GetFullPathNameW
SetCurrentDirectoryA
lstrlenA
GetConsoleMode
GetModuleHandleA
SetLastError
LeaveCriticalSection
AreFileApisANSI
GetLocaleInfoW
QueryPerformanceCounter
DecodePointer
CompareStringW
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
Sleep
TerminateProcess
GetUserDefaultLCID
GetACP
GetCommandLineA
InitializeCriticalSection
SetFileTime
GetEnvironmentVariableA
VerSetConditionMask
SetEnvironmentVariableA
FindNextFileA
MoveFileExW
GetTempPathA
GetSystemDirectoryW
GetCommandLineW
GetFileAttributesA
GetOEMCP
GetFileSize
GetVersionExA
GetDriveTypeW
GetCurrentProcess
UnhandledExceptionFilter
WakeAllConditionVariable
GetStdHandle
TlsAlloc
SetFileAttributesA
GetFileAttributesExW
ExitProcess
WideCharToMultiByte

user32

wsprintfA
CharUpperW
CharUpperA
SetWindowTextW
ShowWindow
DialogBoxParamA
GetWindowLongA
SetWindowLongA
MessageBoxA
SetWindowTextA
SendMessageA
SetTimer
EndDialog
LoadIconA
LoadStringW
GetDlgItem
DestroyWindow
KillTimer
DialogBoxParamW
MessageBoxW
LoadStringA
PostMessageA

shell32

ShellExecuteExA

oleaut32

VariantClear
SysAllocStringLen
SysStringLen

bcrypt

BCryptGenRandom

advapi32

CryptCreateHash
CryptGetHashParam
CryptDestroyHash
CryptImportKey
CryptAcquireContextW
CryptEncrypt
CryptHashData
CryptDestroyKey
CryptReleaseContext

crypt32

CertOpenStore
CertCreateCertificateChainEngine
CertFreeCertificateChain
CertGetNameStringW
CertEnumCertificatesInStore
CryptQueryObject
CertAddCertificateContextToStore
CryptDecodeObjectEx
CryptStringToBinaryW
CertFindCertificateInStore
CertCloseStore
CertFindExtension
CertGetCertificateChain
CertFreeCertificateContext
CertFreeCertificateChainEngine
PFXImportCertStore

wldap32

ord216
ord301
ord145
ord219
ord46
ord14
ord147
ord73
ord208
ord41
ord117
ord26
ord27
ord127
ord167
ord142
ord79
ord133

ws2_32

gethostname
htons
getsockopt
send
WSAWaitForMultipleEvents
WSAEventSelect
WSAIoctl
WSACreateEvent
WSAResetEvent
freeaddrinfo
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
ioctlsocket
setsockopt
WSAEnumNetworkEvents
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
socket
getaddrinfo
WSACloseEvent
recvfrom
sendto
getpeername

Sections

.text
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

86b01d97e18c059cdfbbaa8f932af630

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

shell32

oleaut32

bcrypt

advapi32

crypt32

wldap32

ws2_32

Sections

.text Size: 6.0MB - Virtual size: 6.0MB

.rdata Size: 200KB - Virtual size: 199KB

.data Size: 7KB - Virtual size: 19KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 72KB - Virtual size: 72KB

.text
Size: 6.0MB - Virtual size: 6.0MB

.rdata
Size: 200KB - Virtual size: 199KB

.data
Size: 7KB - Virtual size: 19KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 72KB - Virtual size: 72KB