pes2013[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

pes2013.exe
Size

28.2MB
MD5

6928a9d9bb5b70f7601404177a5030d7
SHA1

f8f611d7cbd03d9a134244fa41650edc4ba0e2fe
SHA256

714350cce9dfe61bfd79c2b9ec68af8e794fe1f26ff0d792d56817dcebcce56b
SHA512

3885252a38f280a4003c86e06e900f9f4fff186b80495e7138012fe15bb9af4a2903cd8f164edfd68240954bdb21f350437242c5764439b9bf55b70613495be5
SSDEEP

393216:4UuuE4KLMNapCn0g6ovWFZY7QymQPTYNBBX97XensNOR39nN/jowtrdqOdi60U5p:LnE4KANapdg6LFZY7QdNfX97XuosFYop

Score

1^/10

Malware Config

Signatures

Files

pes2013.exe
.exe windows:5 windows x86 arch:x86

1e9dfe6c5b698ebf4ba95b84673ab800

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:5f:56:05:33:90:57:a5:65:ae:5d:13:73:92:7f:29
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04-06-2012 00:00

Not After

04-06-2013 23:59

Subject

CN=Konami Digital Entertainment Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Consumer software,O=Konami Digital Entertainment Co.\, Ltd.,L=Minato-ku,ST=Tokyo,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:e5:fa:61:83:a4:67:ca:55:8b:8e:c2:e9:01:3f:23:30:12:e8:17
Signer

Actual PE Digest

06:e5:fa:61:83:a4:67:ca:55:8b:8e:c2:e9:01:3f:23:30:12:e8:17

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

H:\soccer\pes13_final_cert\pes13\Project\vs_win_master\00_Solution\Release_LTCG\PES13_MASTER_Release_LTCG.pdb

Imports

d3d9

Direct3DCreate9

ddraw

DirectDrawCreate

dsound

ord12
ord11
ord2

kernel32

CreateDirectoryW
SetWaitableTimer
WaitForSingleObject
CancelWaitableTimer
SetThreadPriority
RaiseException
CreateWaitableTimerA
ResumeThread
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
GetCommandLineA
GetStartupInfoA
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
ExitProcess
ExitThread
CreateThread
RtlUnwind
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetCPInfo
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
HeapCreate
VirtualFree
GetTickCount
GetCurrentProcessId
HeapSize
HeapAlloc
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
IsValidCodePage
ReadFile
GetConsoleCP
GetConsoleMode
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
GetStringTypeW
GetLocaleInfoW
SetFilePointer
CreateDirectoryA
SetStdHandle
Sleep
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetTimeZoneInformation
SetEndOfFile
GetProcessHeap
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetFileSize
FindFirstFileA
RemoveDirectoryA
FindClose
MoveFileA
FindNextFileA
DeleteFileA
GetFileAttributesExA
CreateFileW
SetFileAttributesA
GetFileAttributesExW
SetFileAttributesW
InterlockedCompareExchange
InterlockedExchangeAdd
TryEnterCriticalSection
CreateSemaphoreA
ReleaseSemaphore
SetErrorMode
SuspendThread
SetFileTime
CreateEventA
GetFullPathNameA
SetEvent
GetThreadPriority
ResetEvent
GetExitCodeThread
GetFileAttributesA
CloseHandle
GetVersionExA
ReleaseMutex
QueryPerformanceFrequency
GetProcessAffinityMask
CreateMutexA
GetModuleHandleA
GetLocalTime
GetModuleFileNameW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
lstrcatA
lstrcpyA
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
GetFullPathNameW
GetCurrentDirectoryA
GetExitCodeProcess
CreateProcessA
GetDriveTypeA
SignalObjectAndWait
GetSystemDirectoryA
FindResourceA
WideCharToMultiByte
QueryPerformanceCounter
GetSystemInfo
SetCurrentDirectoryW
GetLastError
GetCurrentProcess
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GlobalMemoryStatus
CreateFileA
GetFileAttributesW
LoadLibraryA
GetProcAddress
LocalAlloc
FindNextFileW
DeleteFileW
CopyFileW
GetTempPathW
GetFileSizeEx
FreeLibrary
MultiByteToWideChar
SetThreadExecutionState
SizeofResource
WriteConsoleA
LoadResource
GetDiskFreeSpaceExW
GetStringTypeA
SetThreadAffinityMask
GetLogicalDriveStringsW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
lstrcmpiA
GetShortPathNameA
GetComputerNameA
SetNamedPipeHandleState
WaitNamedPipeA
LoadLibraryW
LoadLibraryExA
LoadLibraryExW
OutputDebugStringA
GetSystemTime
CreateFileMappingA
lstrlenW
SetCurrentDirectoryA
lstrcmpA
OpenEventA
OpenMutexA
QueryDosDeviceA
GetTempPathA
GetThreadContext
IsBadReadPtr
WritePrivateProfileStringA
VirtualQuery
MoveFileExW
RemoveDirectoryW
VirtualProtect
ConnectNamedPipe
GetStartupInfoW
CreateProcessW
CreateNamedPipeA
CopyFileA
GetTempFileNameA
GetSystemDirectoryW
MoveFileExA
GetUserDefaultLangID
LockResource
GlobalAlloc
GlobalLock
DeviceIoControl
GetLogicalDrives
GetVolumeInformationA
MapViewOfFile
OpenProcess
UnmapViewOfFile
FormatMessageA
DuplicateHandle
WaitForMultipleObjects
GetVolumeInformationW
GetFileInformationByHandle
SystemTimeToFileTime
GetEnvironmentVariableA
GetVersion
GetPriorityClass
FlushInstructionCache
lstrlenA
IsBadWritePtr
GetWindowsDirectoryA
HeapDestroy
IsBadCodePtr
SetConsoleCtrlHandler
FlushConsoleInputBuffer
LocalLock
GlobalUnlock
GlobalFree
LocalUnlock
LocalFree
ReadConsoleInputA
SetConsoleMode
CompareFileTime
GetCurrentDirectoryW
GetFileTime
SetPriorityClass

user32

RegisterDeviceNotificationA
GetWindowRect
IsIconic
AttachThreadInput
GetMonitorInfoA
RedrawWindow
DrawMenuBar
SystemParametersInfoA
GetWindowThreadProcessId
MonitorFromRect
EndPaint
SetCursor
GetMessageA
RegisterClassExA
PostQuitMessage
SetForegroundWindow
LoadIconA
GetClientRect
SetFocus
BeginPaint
TranslateMessage
MessageBoxA
GetForegroundWindow
SetWindowLongA
InvalidateRect
UnregisterClassA
GetWindowLongA
CreateWindowExA
PeekMessageA
TranslateAcceleratorA
GetCursorPos
ShowWindow
DispatchMessageA
AdjustWindowRectEx
UpdateWindow
ScreenToClient
SetWindowPos
EnumDisplaySettingsA
GetDC
ReleaseDC
ShowCursor
GetKeyboardLayout
DefWindowProcA
GetActiveWindow
PostMessageA
MessageBoxW
GetSystemMetrics
CallWindowProcA
GetDoubleClickTime
SetWindowTextW
EnableWindow
FlashWindow
SendMessageW
DestroyWindow
CreateWindowExW
CharLowerBuffA
SetWindowTextA
GetSysColor
GetProcessWindowStation
GetUserObjectInformationW
GetDesktopWindow
SetDlgItemTextA
SetDlgItemTextW
EndDialog
GetKeyboardType
SendMessageA
GetSubMenu
GetMenu
EnableMenuItem
CheckMenuItem
CharLowerA
LoadCursorA
GetWindowTextA
GetParent
GetClassNameA
GetClassLongA
EnumChildWindows
DestroyCursor
wsprintfA
GetCursor
FindWindowExA
FindWindowA
EnumWindows
UnregisterHotKey
RegisterHotKey
GetDlgItem
DialogBoxIndirectParamA
SendDlgItemMessageA
GetSysColorBrush
LoadStringA
CopyImage
wsprintfW
LoadImageA
SetSystemCursor
GetMenuState
LoadCursorFromFileA

gdi32

GetDeviceCaps
GetStockObject

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptCreateHash
CryptImportKey
CryptGetHashParam
CryptSetHashParam
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
RegisterEventSourceA
RegEnumValueA
OpenThreadToken
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
IsValidSid
QueryServiceStatus
CloseServiceHandle
OpenServiceA
OpenSCManagerA
DeleteService
ControlService
StartServiceA
CreateServiceA
DeregisterEventSource
ReportEventA
RegEnumKeyA
RegSetKeySecurity
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
GetUserNameA
RegDeleteKeyA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteA
SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderPathW
ShellExecuteExA
SHGetSpecialFolderPathA

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitialize

d3dx9_30

D3DXGetImageInfoFromFileInMemory
D3DXCreateCubeTextureFromFileInMemoryEx
D3DXCreateTextureFromFileInMemoryEx
D3DXCreateVolumeTextureFromFileInMemoryEx
D3DXAssembleShader
D3DXCompileShader
D3DXGetShaderConstantTable
D3DXGetVertexShaderProfile
D3DXCreateTexture
D3DXLoadSurfaceFromMemory
D3DXLoadVolumeFromMemory
D3DXGetPixelShaderProfile
D3DXCreateVolumeTexture
D3DXCreateCubeTexture

winmm

timeKillEvent
timeSetEvent
timeGetSystemTime
timeBeginPeriod
timeGetTime

imm32

ImmGetContext
ImmAssociateContext

dinput8

DirectInput8Create

wininet

InternetCloseHandle
InternetOpenA
HttpSendRequestA
InternetSetStatusCallback
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCrackUrlA
InternetReadFileExA
InternetConnectA
HttpQueryInfoA

winhttp

WinHttpCheckPlatform
WinHttpReadData
WinHttpOpenRequest
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpSetStatusCallback
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpReceiveResponse

iphlpapi

GetIpAddrTable
SetIpForwardEntry
GetBestRoute
GetIpForwardTable
GetAdaptersInfo
GetNetworkParams
GetIfEntry
GetBestInterface
GetAdaptersAddresses

oleaut32

SysStringLen
SysFreeString
SysAllocString

shlwapi

PathFileExistsW
PathCombineA
PathCombineW
PathRemoveExtensionA
PathRemoveExtensionW
PathRemoveFileSpecA
PathFileExistsA
PathStripPathW
PathStripPathA
PathRemoveFileSpecW

comctl32

InitCommonControlsEx

wsock32

recv
WSASetLastError
send
shutdown
WSAGetLastError
closesocket

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 15.8MB - Virtual size: 15.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PSFD00
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 993KB - Virtual size: 6.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Stext
Size: 5.0MB - Virtual size: 10.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sitext
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Srdata
Size: 540KB - Virtual size: 538KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sdata
Size: 1.1MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sidata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.securom
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1e9dfe6c5b698ebf4ba95b84673ab800

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

5e:5f:56:05:33:90:57:a5:65:ae:5d:13:73:92:7f:29Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

06:e5:fa:61:83:a4:67:ca:55:8b:8e:c2:e9:01:3f:23:30:12:e8:17Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d9

ddraw

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

d3dx9_30

winmm

imm32

dinput8

wininet

winhttp

iphlpapi

oleaut32

shlwapi

comctl32

wsock32

version

Sections

.text Size: 15.8MB - Virtual size: 15.8MB

PSFD00 Size: 7KB - Virtual size: 7KB

.rdata Size: 1.9MB - Virtual size: 1.9MB

.data Size: 993KB - Virtual size: 6.5MB

.tls Size: 512B - Virtual size: 13B

.rsrc Size: 160KB - Virtual size: 160KB

Stext Size: 5.0MB - Virtual size: 10.1MB

Sitext Size: 32KB - Virtual size: 28KB

Srdata Size: 540KB - Virtual size: 538KB

Sdata Size: 1.1MB - Virtual size: 3.3MB

Sidata Size: 28KB - Virtual size: 24KB

.securom Size: 2.6MB - Virtual size: 2.6MB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

5e:5f:56:05:33:90:57:a5:65:ae:5d:13:73:92:7f:29
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

06:e5:fa:61:83:a4:67:ca:55:8b:8e:c2:e9:01:3f:23:30:12:e8:17
Signer

.text
Size: 15.8MB - Virtual size: 15.8MB

PSFD00
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 993KB - Virtual size: 6.5MB

.tls
Size: 512B - Virtual size: 13B

.rsrc
Size: 160KB - Virtual size: 160KB

Stext
Size: 5.0MB - Virtual size: 10.1MB

Sitext
Size: 32KB - Virtual size: 28KB

Srdata
Size: 540KB - Virtual size: 538KB

Sdata
Size: 1.1MB - Virtual size: 3.3MB

Sidata
Size: 28KB - Virtual size: 24KB

.securom
Size: 2.6MB - Virtual size: 2.6MB