mygame[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
mygame.exe
Size 3.6MB
Sample240724-tp24dsxhmh
SHA256 f95a2befc17647b2f2bbc3e6ada0d57b75d9b04b9476b11294000dfd0787b246
MD5 028dbbbb746e77089c6fe2fbc6481d1a
SHA1 7af2e30544aa0d5b1bd13ec7d029ea9d36c1e58f
SHA512 0cba1356b712961d5b450e1f9911737fd34bb8d858a87f3ef8585f3233218205bbc25214fdb6e907c2a5d3cfc195771594030ef46e4b3a5aedc7e364ddb31aac
SSDEEP 49152:Hn1EriyQCuAlu0z97kwUUaX6Hf9mTgs/a8P1hTIpTAWS/ksd2AF9Z0SbVwKuhS:VEpewUnX6Vj89h0Sbr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mygame.exe

File Explorer

mygame.exe

.exe 3.6MB

mygame.exe

IMPHASH 0979826057c5e8f29caffd6c385878ae
SHA256 f95a2befc17647b2f2bbc3e6ada0d57b75d9b04b9476b11294000dfd0787b246
MD5 028dbbbb746e77089c6fe2fbc6481d1a
SHA1 7af2e30544aa0d5b1bd13ec7d029ea9d36c1e58f
SHA512 0cba1356b712961d5b450e1f9911737fd34bb8d858a87f3ef8585f3233218205bbc25214fdb6e907c2a5d3cfc195771594030ef46e4b3a5aedc7e364ddb31aac
SSDEEP 49152:Hn1EriyQCuAlu0z97kwUUaX6Hf9mTgs/a8P1hTIpTAWS/ksd2AF9Z0SbVwKuhS:VEpewUnX6Vj89h0Sbr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2575953

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetStringTypeW GetStringTypeA GetCPInfo GetOEMCP GetACP IsBadCodePtr SetUnhandledExceptionFilter OutputDebugStringA GetTickCount QueryPerformanceCounter GlobalMemoryStatus Sleep WideCharToMultiByte GetDiskFreeSpaceExA GetFileAttributesA CreateFileA ReadFile GetFileSize WriteFile CloseHandle SetEndOfFile IsBadReadPtr GetLastError QueryPerformanceFrequency InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection SetFilePointer EnterCriticalSection LocalFree FormatMessageA SetPriorityClass SetThreadPriority CreateThread GetCurrentThreadId DuplicateHandle GetCurrentThread GetCurrentProcess ResumeThread GetExitCodeThread TerminateThread GetCurrentDirectoryA GetLocalTime GetVersionExA MultiByteToWideChar lstrcmpiA GetSystemDefaultLangID WritePrivateProfileStringA GetPrivateProfileIntA SetCurrentDirectoryA LoadLibraryA GetProcAddress GetModuleHandleA CreateFileW UnmapViewOfFile IsProcessorFeaturePresent DeleteFileA ExitProcess RtlUnwind GetFileType HeapReAlloc TerminateProcess HeapAlloc HeapFree GetSystemTimeAsFileTime GetStartupInfoA GetCommandLineA TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue GetCurrentProcessId RaiseException HeapSize FlushFileBuffers SetHandleCount GetStdHandle SetStdHandle InterlockedExchange VirtualQuery HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr LCMapStringA LCMapStringW VirtualProtect GetLocaleInfoA GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetPrivateProfileStringA CreateDirectoryA GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetSystemInfo

user32

GetWindowLongA AdjustWindowRect MoveWindow SetWindowsHookExA UpdateWindow SetForegroundWindow UnhookWindowsHookEx DestroyWindow UnregisterClassA LoadIconA LoadCursorA RegisterClassA GetDesktopWindow GetSystemMetrics CreateWindowExA MessageBoxW GetKeyState DialogBoxParamA SetActiveWindow DefWindowProcA EndDialog SendDlgItemMessageA GetDlgItem SetFocus SystemParametersInfoA EnumWindows GetWindowTextA GetClassNameA CallNextHookEx GetAsyncKeyState DispatchMessageA TranslateMessage ShowWindow MessageBoxA ShowCursor PeekMessageA

gdi32

GetStockObject

comdlg32

GetOpenFileNameA

advapi32

RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey RegOpenKeyA

ole32

CoInitialize CoCreateInstance

wsock32

WSAGetLastError send __WSAFDIsSet shutdown connect bind getsockname ntohs htonl recv ntohl gethostname select setsockopt WSACleanup WSAStartup recvfrom closesocket socket sendto htons ioctlsocket gethostbyname inet_addr

?Activate@ShellEpisodeScreen@@UAEXPAX@Z ?Activate@ShellMissionScreen@@UAEXPAX@Z ?AwardPoints@GameController@@QAEXHHHPAVObject@@@Z ?CDAPFN0506_GameController__AwardPoints@@3UPFNAPI_DATA_TYPE@@A ?CDAPFN0506_GameController__CalculateEpisodeCompletion@@3UPFNAPI_DATA_TYPE@@A ?CDAPFN0506_GetRandomTrack@@3UPFNAPI_DATA_TYPE@@A ?CDAPFN0506_ShellEpisodeScreen__Activate@@3UPFNAPI_DATA_TYPE@@A ?CDAPFN0506_ShellMissionScreen__Activate@@3UPFNAPI_DATA_TYPE@@A ?CalculateEpisodeCompletion@GameController@@QAEMH@Z CDAPFN0506_CDAPFN0506_X_SECURE_BASE_0Decode CDAPFN0506_CDAPFN0506_X_SECURE_BASE_0Encode CDAPFN0506_CDAPFN0506_X_SECURE_BASE_1Decode CDAPFN0506_CDAPFN0506_X_SECURE_BASE_1Encode CDAPFN0506_CDAPFN0506_X_SECURE_BASE_2Decode CDAPFN0506_CDAPFN0506_X_SECURE_BASE_2Encode CDAPFN0506_CDAPFN0506_X_SECURE_BASE_3Decode CDAPFN0506_CDAPFN0506_X_SECURE_BASE_3Encode CDAPFN0506_CDAPFN0506_X_SECURE_BASE_4Decode CDAPFN0506_CDAPFN0506_X_SECURE_BASE_4Encode CDAPFN0506_CDAPFN0506_X_SECURE_BASE_5Decode CDAPFN0506_CDAPFN0506_X_SECURE_BASE_5Encode CDAPFN0506_CDAPFN0506_X_SECURE_BASE_6Decode CDAPFN0506_CDAPFN0506_X_SECURE_BASE_6Encode CDAPFN0506_CDAPFN0506_X_SECURE_BASE_7Decode CDAPFN0506_CDAPFN0506_X_SECURE_BASE_7Encode CDAPFN0506_SECURE_BASE_0Decode CDAPFN0506_SECURE_BASE_0Encode CDAPFN0506_SECURE_BASE_1Decode CDAPFN0506_SECURE_BASE_1Encode CDAPFN0506_SECURE_BASE_2Decode CDAPFN0506_SECURE_BASE_2Encode CDAPFN0506_SECURE_BASE_3Decode CDAPFN0506_SECURE_BASE_3Encode CDAPFN0506_SECURE_BASE_4Decode CDAPFN0506_SECURE_BASE_4Encode CDAPFN0506_SECURE_BASE_5Decode CDAPFN0506_SECURE_BASE_5Encode CDAPFN0506_SECURE_BASE_6Decode CDAPFN0506_SECURE_BASE_6Encode CDAPFN0506_SECURE_BASE_7Decode CDAPFN0506_SECURE_BASE_7Encode

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

164KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

148KB

Virtual Size

770KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

65B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

740KB

Virtual Size

736KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=6, id=105, version=2067,

count=44, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=95, version=2179,

count=2, id=93, version=2067,

count=14, id=93, version=2179,

count=2, id=93, productName=VS2003 (.NET) build 3077, version=3077,

count=3, id=28, version=9178,

count=1, id=18, version=8444,

count=8, productName=Unmarked objects (old),

count=7, id=25, version=9210,

count=217, id=1, productName=Unmarked objects,

count=68, id=29, version=9178,

count=196, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=151, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,