NFS13[.]exe | Triage

Resubmissions

26/07/2024, 19:25

240726-x48fhazcjl 3

Sharing

Copy URL Twitter E-mail

General

Target

NFS13.exe
Size

13.7MB
MD5

dc6b464b22db0682adeadb14d52ff67f
SHA1

5151fbf81d9a9873d6d116573f27ac580d3cb129
SHA256

172ecf1ef71962fa4d3d75abfa3a38a2f607b4fcce86d616a3a3bbb3c1795e32
SHA512

c6d66b71ff31eb8e78f7bb530feb51246476837f1519d936c1e27fe4857b087b4550e07269e9cd12558815b873b9c0d4557f0cab24020d3f89aea6493f6f797f
SSDEEP

196608:zDaOc7d7M+JQv2it6GVhw09T2HDk8f7kpqbQfV:zDlc7dJsMGVhwUT2HDk8f7kpcS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NFS13.exe

Files

NFS13.exe
.exe windows:5 windows x86 arch:x86

b057a37fb4d07a1b360e146d4ecbcc41

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\P4\HAWAII_FINAL_PC\Hawaii\Runtime\FINAL_PC\Code\GameProjects\Hawaii\Hawaii_PC_External_Unity\Hawaii_PC_External_Unity.pdb

Imports

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice
D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DReflect

dsound

ord1
ord9

dinput8

DirectInput8Create

psapi

EnumProcesses
GetModuleBaseNameW

xinput1_3

ord3
ord2
ord4

ws2_32

getpeername
getsockname
gethostname
gethostbyname
WSAIoctl
recvfrom
sendto
accept
listen
bind
WSAGetOverlappedResult
WSAWaitForMultipleEvents
WSAResetEvent
WSARecvFrom
WSARecv
WSASetEvent
WSACloseEvent
ioctlsocket
setsockopt
WSACreateEvent
WSAGetLastError
send
WSACleanup
closesocket
shutdown
recv
WSAStartup
connect
htons
inet_addr
socket
select
getsockopt

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod
waveInMessage
waveOutMessage
waveOutSetVolume
waveOutGetNumDevs
waveInGetNumDevs
waveOutGetDevCapsA
waveInGetDevCapsA
waveOutOpen
waveInOpen
waveOutClose
waveInClose
waveOutPrepareHeader
waveInPrepareHeader
waveOutUnprepareHeader
waveInUnprepareHeader
waveOutReset
waveInReset
waveInStart
waveInAddBuffer
waveInStop
waveOutWrite

kernel32

WriteConsoleW
SetStdHandle
LCMapStringW
HeapQueryInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
HeapSize
SetConsoleCtrlHandler
SetUnhandledExceptionFilter
GetTickCount
Sleep
ReadFile
WriteFile
SetFilePointerEx
GetFileSizeEx
CloseHandle
CreateFileA
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleA
GetComputerNameA
GetLastError
GetProcAddress
GetSystemInfo
SetThreadExecutionState
GetModuleFileNameA
SetErrorMode
GetCurrentDirectoryA
GetVersionExA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetSystemTime
SystemTimeToFileTime
GetLocalTime
FileTimeToSystemTime
SetFilePointer
MoveFileExA
InitializeCriticalSection
DeleteCriticalSection
GetFileAttributesA
LocalFree
GetCommandLineW
FormatMessageA
WideCharToMultiByte
InterlockedDecrement
lstrlenW
GlobalMemoryStatusEx
GetPrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileStringW
VirtualAlloc
GetFileAttributesW
TryEnterCriticalSection
DeleteFileA
GetCurrentThread
GetCurrentProcess
TlsAlloc
TlsFree
QueryPerformanceCounter
QueryPerformanceFrequency
TlsSetValue
TlsGetValue
FindNextFileA
FindClose
CreateDirectoryA
FindFirstFileA
OutputDebugStringA
lstrcmpiW
OpenProcess
CreateProcessW
LoadLibraryW
GetModuleHandleW
GetTimeZoneInformation
GetGeoInfoA
GetUserGeoID
GetFullPathNameW
SetThreadPriority
CreateThread
InterlockedExchange
CreateEventA
GetCurrentThreadId
GetSystemTimeAsFileTime
GetExitCodeThread
DuplicateHandle
GetThreadPriority
SleepEx
SwitchToThread
CreateMutexA
WaitForSingleObject
ReleaseMutex
InterlockedExchangeAdd
InterlockedCompareExchange
CreateSemaphoreA
ReleaseSemaphore
IsDebuggerPresent
SetThreadIdealProcessor
RaiseException
QueueUserAPC
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
ResumeThread
InitializeCriticalSectionAndSpinCount
VirtualFree
LoadLibraryA
FreeLibrary
VirtualQuery
HeapAlloc
GetProcessHeap
SetEnvironmentVariableA
GetCurrentProcessId
HeapFree
GetEnvironmentVariableA
SetEndOfFile
DeleteFileW
MultiByteToWideChar
MoveFileW
FindFirstFileW
FindNextFileW
CreateDirectoryW
RemoveDirectoryW
GetLogicalDrives
CreateFileW
GetDiskFreeSpaceA
GlobalAlloc
GlobalFree
GetDateFormatA
GetTimeFormatA
GetLocaleInfoA
GetModuleFileNameW
GetEnvironmentVariableW
SetEnvironmentVariableW
SetPriorityClass
GetPriorityClass
WaitForSingleObjectEx
ResetEvent
SetEvent
lstrlenA
ExitProcess
InterlockedIncrement
RtlUnwind
GetCommandLineA
HeapSetInformation
GetStartupInfoW
ExitThread
HeapReAlloc
GetConsoleCP
GetConsoleMode
CreateProcessA
MoveFileA
GetFullPathNameA
IsProcessorFeaturePresent
UnhandledExceptionFilter
TerminateProcess
SetHandleCount
GetStdHandle
GetFileType
HeapCreate
HeapDestroy
GetLocaleInfoW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetLastError
FlushFileBuffers
CreatePipe
EncodePointer
DecodePointer
GetExitCodeProcess
GetDriveTypeW
GetCurrentDirectoryW
GetUserDefaultLangID
FatalAppExitA
SetCurrentDirectoryW

user32

IsWindow
wsprintfA
RegisterClassW
SetRect
AdjustWindowRect
CreateWindowExW
SystemParametersInfoA
FindWindowW
GetDesktopWindow
GetForegroundWindow
PeekMessageW
DispatchMessageW
TranslateMessage
ShowWindow
SetCursor
PostQuitMessage
GetCursorPos
ScreenToClient
DefWindowProcW
GetClientRect
RegisterDeviceNotificationA
GetAsyncKeyState
PostMessageA
LockSetForegroundWindow
SetForegroundWindow
MessageBoxA

gdi32

GetStockObject

advapi32

RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

CommandLineToArgvW
SHCreateDirectoryExA
SHGetSpecialFolderPathA
ExtractIconA

ole32

CoInitializeEx
CoInitializeSecurity
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize
CoSetProxyBlanket

oleaut32

CreateErrorInfo
SetErrorInfo
VariantInit
VariantChangeType
GetErrorInfo
VarI8FromStr
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
VariantClear
SysFreeString
SysAllocString

dbghelp

SymCleanup
StackWalk64
SymFunctionTableAccess64
SymInitialize
SymGetModuleBase64

iphlpapi

GetAdaptersAddresses

Sections

.text
Size: 11.4MB - Virtual size: 11.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1008KB - Virtual size: 1008KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 10B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

b057a37fb4d07a1b360e146d4ecbcc41

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dxgi

d3d11

d3dcompiler_43

dsound

dinput8

psapi

xinput1_3

ws2_32

winmm

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

dbghelp

iphlpapi

Sections

.text Size: 11.4MB - Virtual size: 11.4MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 1008KB - Virtual size: 1008KB

.tls Size: 10B - Virtual size: 10B

.rsrc Size: 118KB - Virtual size: 118KB

Size: 4KB - Virtual size: 4KB

.text
Size: 11.4MB - Virtual size: 11.4MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 1008KB - Virtual size: 1008KB

.tls
Size: 10B - Virtual size: 10B

.rsrc
Size: 118KB - Virtual size: 118KB