yfga_game[.]exe | Triage

Sharing

General

Target

yfga_game.exe
Size

46.3MB
MD5

14b51172d4f9f29c2478c8316b4cc5dd
SHA1

fe9f4e65ffd203192859988e232407b62d2dfd61
SHA256

b504f25f7354744305e326bf74567fff4021bcdf54e30d69e4404b3fa4d2eaaf
SHA512

cff063623701d5d0e7f960f08da81731821a8427fa45c88affc6adc46828fabbb526fa41c58d180604b98f0e7d56f6bda6cc1eb30f2224106f44471e18537a16
SSDEEP

786432:G7Ud58tChs1g2uzRL7KPB8NUc3sXEPeEwkHYvgctIKpJZXnfsrQl92Z3tHDUOsj1:yt96576B0HkGUvgcaKpDPBl92HHDdsGy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

yfga_game.exe

Files

yfga_game.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\SerGreen\Source\Repos\Appacker\UnpackerWindowless\obj\Release\UnpackerWindowless.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 266KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ