pes2013[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

pes2013.exe
Size

28.2MB
MD5

f49bcbbf6b5ac78aa06d0a6bc01149b4
SHA1

6d7969f56a7599b4273a4a2c9a637747c71ef9d4
SHA256

60a90a0638af7cbd455def613c89cd0c709d229ff9df8d3daea4b87c4aa9abc7
SHA512

23537f6d4a713894d87a4b2b35df77a3d491c60f6243265f9106b643f963d48a82d8670250ff7942129cad484c24dc011e989913ea50b8ea2e4de0f3ea6b32cb
SSDEEP

393216:5UuuE4KLMNapCn0g6ovWFZY7QymQPTYNBBX97XenHCOR39nN/jowtrdqOUi60U5p:+nE4KANapdg6LFZY7QdNfX97XWos8Yop

Score

1^/10

Malware Config

Signatures

Files

pes2013.exe
.exe windows:5 windows x86 arch:x86

1e9dfe6c5b698ebf4ba95b84673ab800

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:5f:56:05:33:90:57:a5:65:ae:5d:13:73:92:7f:29
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/06/2012, 00:00

Not After

04/06/2013, 23:59

Subject

CN=Konami Digital Entertainment Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Consumer software,O=Konami Digital Entertainment Co.\, Ltd.,L=Minato-ku,ST=Tokyo,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:c2:59:38:33:b2:7a:a6:c9:41:99:98:99:98:cf:48:77:38:f9:8b
Signer

Actual PE Digest

1f:c2:59:38:33:b2:7a:a6:c9:41:99:98:99:98:cf:48:77:38:f9:8b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

H:\soccer\pes13_final_cert\pes13\Project\vs_win_master\00_Solution\Release_LTCG\PES13_MASTER_Release_LTCG.pdb

Imports

d3d9

Direct3DCreate9

ddraw

DirectDrawCreate

dsound

ord12
ord11
ord2

kernel32

CreateDirectoryW
SetWaitableTimer
WaitForSingleObject
CancelWaitableTimer
SetThreadPriority
RaiseException
CreateWaitableTimerA
ResumeThread
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
GetCommandLineA
GetStartupInfoA
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
ExitProcess
ExitThread
CreateThread
RtlUnwind
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetCPInfo
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
HeapCreate
VirtualFree
GetTickCount
GetCurrentProcessId
HeapSize
HeapAlloc
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
IsValidCodePage
ReadFile
GetConsoleCP
GetConsoleMode
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
GetStringTypeW
GetLocaleInfoW
SetFilePointer
CreateDirectoryA
SetStdHandle
Sleep
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetTimeZoneInformation
SetEndOfFile
GetProcessHeap
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetFileSize
FindFirstFileA
RemoveDirectoryA
FindClose
MoveFileA
FindNextFileA
DeleteFileA
GetFileAttributesExA
CreateFileW
SetFileAttributesA
GetFileAttributesExW
SetFileAttributesW
InterlockedCompareExchange
InterlockedExchangeAdd
TryEnterCriticalSection
CreateSemaphoreA
ReleaseSemaphore
SetErrorMode
SuspendThread
SetFileTime
CreateEventA
GetFullPathNameA
SetEvent
GetThreadPriority
ResetEvent
GetExitCodeThread
GetFileAttributesA
CloseHandle
GetVersionExA
ReleaseMutex
QueryPerformanceFrequency
GetProcessAffinityMask
CreateMutexA
GetModuleHandleA
GetLocalTime
GetModuleFileNameW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
lstrcatA
lstrcpyA
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
GetFullPathNameW
GetCurrentDirectoryA
GetExitCodeProcess
CreateProcessA
GetDriveTypeA
SignalObjectAndWait
GetSystemDirectoryA
FindResourceA
WideCharToMultiByte
QueryPerformanceCounter
GetSystemInfo
SetCurrentDirectoryW
GetLastError
GetCurrentProcess
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GlobalMemoryStatus
CreateFileA
GetFileAttributesW
LoadLibraryA
GetProcAddress
LocalAlloc
FindNextFileW
DeleteFileW
CopyFileW
GetTempPathW
GetFileSizeEx
FreeLibrary
MultiByteToWideChar
SetThreadExecutionState
SizeofResource
WriteConsoleA
LoadResource
GetDiskFreeSpaceExW
GetStringTypeA
SetThreadAffinityMask
GetLogicalDriveStringsW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
lstrcmpiA
GetShortPathNameA
GetComputerNameA
SetNamedPipeHandleState
WaitNamedPipeA
LoadLibraryW
LoadLibraryExA
LoadLibraryExW
OutputDebugStringA
GetSystemTime
CreateFileMappingA
lstrlenW
SetCurrentDirectoryA
lstrcmpA
OpenEventA
OpenMutexA
QueryDosDeviceA
GetTempPathA
GetThreadContext
IsBadReadPtr
WritePrivateProfileStringA
VirtualQuery
MoveFileExW
RemoveDirectoryW
VirtualProtect
ConnectNamedPipe
GetStartupInfoW
CreateProcessW
CreateNamedPipeA
CopyFileA
GetTempFileNameA
GetSystemDirectoryW
MoveFileExA
GetUserDefaultLangID
LockResource
GlobalAlloc
GlobalLock
DeviceIoControl
GetLogicalDrives
GetVolumeInformationA
MapViewOfFile
OpenProcess
UnmapViewOfFile
FormatMessageA
DuplicateHandle
WaitForMultipleObjects
GetVolumeInformationW
GetFileInformationByHandle
SystemTimeToFileTime
GetEnvironmentVariableA
GetVersion
GetPriorityClass
FlushInstructionCache
lstrlenA
IsBadWritePtr
GetWindowsDirectoryA
HeapDestroy
IsBadCodePtr
SetConsoleCtrlHandler
FlushConsoleInputBuffer
LocalLock
GlobalUnlock
GlobalFree
LocalUnlock
LocalFree
ReadConsoleInputA
SetConsoleMode
CompareFileTime
GetCurrentDirectoryW
GetFileTime
SetPriorityClass

user32

RegisterDeviceNotificationA
GetWindowRect
IsIconic
AttachThreadInput
GetMonitorInfoA
RedrawWindow
DrawMenuBar
SystemParametersInfoA
GetWindowThreadProcessId
MonitorFromRect
EndPaint
SetCursor
GetMessageA
RegisterClassExA
PostQuitMessage
SetForegroundWindow
LoadIconA
GetClientRect
SetFocus
BeginPaint
TranslateMessage
MessageBoxA
GetForegroundWindow
SetWindowLongA
InvalidateRect
UnregisterClassA
GetWindowLongA
CreateWindowExA
PeekMessageA
TranslateAcceleratorA
GetCursorPos
ShowWindow
DispatchMessageA
AdjustWindowRectEx
UpdateWindow
ScreenToClient
SetWindowPos
EnumDisplaySettingsA
GetDC
ReleaseDC
ShowCursor
GetKeyboardLayout
DefWindowProcA
GetActiveWindow
PostMessageA
MessageBoxW
GetSystemMetrics
CallWindowProcA
GetDoubleClickTime
SetWindowTextW
EnableWindow
FlashWindow
SendMessageW
DestroyWindow
CreateWindowExW
CharLowerBuffA
SetWindowTextA
GetSysColor
GetProcessWindowStation
GetUserObjectInformationW
GetDesktopWindow
SetDlgItemTextA
SetDlgItemTextW
EndDialog
GetKeyboardType
SendMessageA
GetSubMenu
GetMenu
EnableMenuItem
CheckMenuItem
CharLowerA
LoadCursorA
GetWindowTextA
GetParent
GetClassNameA
GetClassLongA
EnumChildWindows
DestroyCursor
wsprintfA
GetCursor
FindWindowExA
FindWindowA
EnumWindows
UnregisterHotKey
RegisterHotKey
GetDlgItem
DialogBoxIndirectParamA
SendDlgItemMessageA
GetSysColorBrush
LoadStringA
CopyImage
wsprintfW
LoadImageA
SetSystemCursor
GetMenuState
LoadCursorFromFileA

gdi32

GetDeviceCaps
GetStockObject

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptCreateHash
CryptImportKey
CryptGetHashParam
CryptSetHashParam
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
RegisterEventSourceA
RegEnumValueA
OpenThreadToken
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
IsValidSid
QueryServiceStatus
CloseServiceHandle
OpenServiceA
OpenSCManagerA
DeleteService
ControlService
StartServiceA
CreateServiceA
DeregisterEventSource
ReportEventA
RegEnumKeyA
RegSetKeySecurity
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
GetUserNameA
RegDeleteKeyA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteA
SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderPathW
ShellExecuteExA
SHGetSpecialFolderPathA

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitialize

d3dx9_30

D3DXGetImageInfoFromFileInMemory
D3DXCreateCubeTextureFromFileInMemoryEx
D3DXCreateTextureFromFileInMemoryEx
D3DXCreateVolumeTextureFromFileInMemoryEx
D3DXAssembleShader
D3DXCompileShader
D3DXGetShaderConstantTable
D3DXGetVertexShaderProfile
D3DXCreateTexture
D3DXLoadSurfaceFromMemory
D3DXLoadVolumeFromMemory
D3DXGetPixelShaderProfile
D3DXCreateVolumeTexture
D3DXCreateCubeTexture

winmm

timeKillEvent
timeSetEvent
timeGetSystemTime
timeBeginPeriod
timeGetTime

imm32

ImmGetContext
ImmAssociateContext

dinput8

DirectInput8Create

wininet

InternetCloseHandle
InternetOpenA
HttpSendRequestA
InternetSetStatusCallback
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCrackUrlA
InternetReadFileExA
InternetConnectA
HttpQueryInfoA

winhttp

WinHttpCheckPlatform
WinHttpReadData
WinHttpOpenRequest
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpSetStatusCallback
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpReceiveResponse

iphlpapi

GetIpAddrTable
SetIpForwardEntry
GetBestRoute
GetIpForwardTable
GetAdaptersInfo
GetNetworkParams
GetIfEntry
GetBestInterface
GetAdaptersAddresses

oleaut32

SysStringLen
SysFreeString
SysAllocString

shlwapi

PathFileExistsW
PathCombineA
PathCombineW
PathRemoveExtensionA
PathRemoveExtensionW
PathRemoveFileSpecA
PathFileExistsA
PathStripPathW
PathStripPathA
PathRemoveFileSpecW

comctl32

InitCommonControlsEx

wsock32

recv
WSASetLastError
send
shutdown
WSAGetLastError
closesocket

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 15.8MB - Virtual size: 15.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PSFD00
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 993KB - Virtual size: 6.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Stext
Size: 5.0MB - Virtual size: 10.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sitext
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Srdata
Size: 540KB - Virtual size: 538KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sdata
Size: 1.1MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sidata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.securom
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1e9dfe6c5b698ebf4ba95b84673ab800

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

5e:5f:56:05:33:90:57:a5:65:ae:5d:13:73:92:7f:29Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

1f:c2:59:38:33:b2:7a:a6:c9:41:99:98:99:98:cf:48:77:38:f9:8bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d9

ddraw

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

d3dx9_30

winmm

imm32

dinput8

wininet

winhttp

iphlpapi

oleaut32

shlwapi

comctl32

wsock32

version

Sections

.text Size: 15.8MB - Virtual size: 15.8MB

PSFD00 Size: 7KB - Virtual size: 7KB

.rdata Size: 1.9MB - Virtual size: 1.9MB

.data Size: 993KB - Virtual size: 6.5MB

.tls Size: 512B - Virtual size: 13B

.rsrc Size: 160KB - Virtual size: 160KB

Stext Size: 5.0MB - Virtual size: 10.1MB

Sitext Size: 32KB - Virtual size: 28KB

Srdata Size: 540KB - Virtual size: 538KB

Sdata Size: 1.1MB - Virtual size: 3.3MB

Sidata Size: 28KB - Virtual size: 24KB

.securom Size: 2.6MB - Virtual size: 2.6MB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

5e:5f:56:05:33:90:57:a5:65:ae:5d:13:73:92:7f:29
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

1f:c2:59:38:33:b2:7a:a6:c9:41:99:98:99:98:cf:48:77:38:f9:8b
Signer

.text
Size: 15.8MB - Virtual size: 15.8MB

PSFD00
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 993KB - Virtual size: 6.5MB

.tls
Size: 512B - Virtual size: 13B

.rsrc
Size: 160KB - Virtual size: 160KB

Stext
Size: 5.0MB - Virtual size: 10.1MB

Sitext
Size: 32KB - Virtual size: 28KB

Srdata
Size: 540KB - Virtual size: 538KB

Sdata
Size: 1.1MB - Virtual size: 3.3MB

Sidata
Size: 28KB - Virtual size: 24KB

.securom
Size: 2.6MB - Virtual size: 2.6MB