de6b5444854f69d277b496eb2884e75fd226a644d99ebc076979e3b0da08d1b8

Sharing

Copy URL Twitter E-mail

General

Target

de6b5444854f69d277b496eb2884e75fd226a644d99ebc076979e3b0da08d1b8
Size

68KB
MD5

f4c9abaf4ad8b15397801b25f36d298b
SHA1

b4a190fc4d5f854dc279d865df58ee1744dd9317
SHA256

de6b5444854f69d277b496eb2884e75fd226a644d99ebc076979e3b0da08d1b8
SHA512

d3d5affde2bda0a3f2afee6f531fd1cea5ad4a9b1eeb4652460491ed4c16db4110fafd81b357b4a8dd4f46ad11197a253c1c7fd95c9eec7ad5836f7431522d7b
SSDEEP

768:PYk7frasatNSXlWEfZMLaQHFBGC/AEfTUeo0Sg8viDKnz12sM2sM2sG:PYMTaRHSXlWEfZjQHFBGC/D71eqDUo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de6b5444854f69d277b496eb2884e75fd226a644d99ebc076979e3b0da08d1b8

Files

de6b5444854f69d277b496eb2884e75fd226a644d99ebc076979e3b0da08d1b8
.exe windows:4 windows x86 arch:x86

dbe4994c7e5493a0129f87d5767203b0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

X:\trunk\Diablo2\Builder\PDB\Game.pdb

Imports

kernel32

GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
GetLocaleInfoA
RtlUnwind
InitializeCriticalSection
VirtualAlloc
DeleteCriticalSection
InterlockedExchange
VirtualQuery
SetStdHandle
LCMapStringA
LCMapStringW
VirtualProtect
GetSystemInfo
HeapSize
FlushFileBuffers
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetModuleFileNameA
GetStdHandle
WriteFile
TerminateProcess
ExitProcess
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
SetLastError
TlsAlloc
GetVersionExA
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
GetLastError
GetCurrentDirectoryA
GetPrivateProfileStringA
GetCPInfo
GetOEMCP
GetACP
HeapAlloc
LeaveCriticalSection
EnterCriticalSection
SetFilePointer
HeapFree
VirtualFree
HeapCreate
HeapDestroy
GetPrivateProfileIntA
GetVersion
CloseHandle
OpenEventA
LoadLibraryA
GetProcAddress
SetCurrentDirectoryA
SetEvent
GetCurrentProcess
HeapReAlloc
FreeLibrary

user32

MessageBoxA

advapi32

CloseServiceHandle
RegSetValueExA
RegisterServiceCtrlHandlerA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyA
RegOpenKeyExA
SetServiceStatus
OpenSCManagerA
RegEnumValueA
FreeSid
OpenServiceA
RegOpenKeyA
RegCloseKey
StartServiceCtrlDispatcherA

storm

ord425
ord501
ord578
ord423
ord426
ord422

fog

ord10227
ord10101
ord10218
ord10143
ord10090
ord10082
ord10021
ord10019
ord10043
ord10116
ord10042
ord10089

d2win

ord10139
ord10005
ord10052
ord10086
ord10142
ord10032
ord10073
ord10158

d2sound

ord10002
ord10031

d2mcpclient

ord10018

d2gfx

ord10034
ord10053
ord10066
ord10081
ord10007
ord10084
ord10048

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dbe4994c7e5493a0129f87d5767203b0

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

storm

fog

d2win

d2sound

d2mcpclient

d2gfx

Sections

.text Size: 32KB - Virtual size: 29KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 16KB - Virtual size: 13KB

.text
Size: 32KB - Virtual size: 29KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 16KB - Virtual size: 13KB