C:\MEA\rc\TnT\Local\Bin\Contact\Win64\retail\Contact.Main_Win64_retail.pdb
Static task
static1
Behavioral task
behavioral1
Sample
MassEffectAndromeda.exe
Resource
win7-20240704-es
Behavioral task
behavioral2
Sample
MassEffectAndromeda.exe
Resource
win10v2004-20240802-es
General
-
Target
MassEffectAndromeda.exe
-
Size
72.1MB
-
MD5
7ad9db77bedc53236079b85c784f943e
-
SHA1
0fdcf0d5aecb69aa0aaf70f74cea480730834d8a
-
SHA256
e06230bedfb1202348e9fe88fe444caefa7f1d964680afc8840a3b803e38654c
-
SHA512
5ec0b7f43632135606453bfc511a3074df92a79b63c1f29c0af8aa85ee6288b8ebecd4fc7c282557cc79ca1b6f5e7c741b5f712cfaa51a98a9429ccc4a708ca8
-
SSDEEP
393216:aLBeFxqzZgwNakIWWUejDD+SrlbuiJ5IZyXdANW308rlNdvqOM7UIow/gSuxLjZ1:akw+pNaE71QUID3c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MassEffectAndromeda.exe
Files
-
MassEffectAndromeda.exe.exe windows:6 windows x64 arch:x64
Password: 123
2fc0b09b720388f88d5efb6da6ad23b3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
winmm
waveOutGetDevCapsA
waveOutUnprepareHeader
waveInUnprepareHeader
waveInReset
waveInAddBuffer
waveOutSetVolume
waveOutOpen
waveInGetDevCapsA
waveOutGetNumDevs
timeEndPeriod
waveOutPrepareHeader
waveInOpen
waveInPrepareHeader
waveOutReset
waveInStop
waveInStart
waveInMessage
timeGetTime
waveOutWrite
waveOutMessage
waveInClose
waveInGetNumDevs
timeGetDevCaps
timeBeginPeriod
waveOutClose
user32
SetWindowPos
GetMessageW
TranslateMessage
GetParent
GetClientRect
GetWindowRect
IsWindow
AttachThreadInput
LoadIconA
IsWindowVisible
GetKeyNameTextW
RegisterRawInputDevices
GetWindowLongPtrA
CallWindowProcW
GetRawInputData
DefWindowProcA
ActivateKeyboardLayout
GetWindowThreadProcessId
UpdateWindow
SetFocus
GetMessageA
PostThreadMessageA
PostQuitMessage
PostMessageW
SetForegroundWindow
SetCursor
GetWindowInfo
SetCursorPos
ShowCursor
ClipCursor
TrackMouseEvent
SetActiveWindow
IsIconic
PostMessageA
SystemParametersInfoA
SendMessageW
LoadCursorA
CreateWindowExW
RegisterClassExW
EnumDisplaySettingsA
DispatchMessageW
GetWindowPlacement
SetWindowPlacement
SendMessageA
MessageBoxA
CallWindowProcA
SetWindowLongPtrW
GetForegroundWindow
GetFocus
DefWindowProcW
SetWindowTextW
SetWindowLongA
GetWindowLongA
GetDoubleClickTime
MessageBoxW
ScreenToClient
GetKeyState
GetKeyboardState
GetAsyncKeyState
GetCursorPos
GetSystemMetrics
EnumDisplayDevicesA
EnumDisplaySettingsW
EnumDisplayDevicesW
RedrawWindow
ShowWindow
urlmon
URLOpenBlockingStreamA
URLDownloadToCacheFileA
shell32
ShellExecuteA
SHGetFolderPathW
SHCreateDirectoryExW
msvcp120
_Nan
?_Winerror_map@std@@YAPEBDH@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_BADOFF@std@@3_JB
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?out@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@H@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
_FInf
_FNan
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_Throw_C_error@std@@YAXH@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
_Mtx_destroy
_Mtx_unlock
_Mtx_lock
_Mtx_init
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
msvcr120
_isnan
__daylight
_ecvt
system
_strtoui64
feof
fseek
__iob_func
ldexp
wcsncpy
_localtime64
_localtime64_s
_gmtime64
_mktime64
isalnum
isprint
_strtoi64
qsort
_difftime64
toupper
modff
??1bad_cast@std@@UEAA@XZ
??0bad_cast@std@@QEAA@AEBV01@@Z
??0bad_cast@std@@QEAA@PEBD@Z
fflush
setvbuf
fsetpos
fgetpos
_fseeki64
fwrite
_unlock_file
_lock_file
getenv
ungetc
fputc
fgetc
??0exception@std@@QEAA@AEBV01@@Z
memcpy_s
strtoul
fclose
fprintf
fopen
tolower
_fullpath
_HUGE
_errno
strtol
realloc
_set_output_format
_set_purecall_handler
isspace
sprintf_s
_ftime64
longjmp
bsearch
exit
strtok_s
strrchr
_strupr
_strnicmp
atoi
vswprintf_s
_vsnprintf_s
sscanf
malloc
_snprintf
tanhf
atof
_stricmp
__timezone
isdigit
strcpy_s
strncpy
setlocale
rand
srand
isxdigit
_time64
sprintf
strchr
__argc
_purecall
printf
vsprintf_s
strstr
_dupenv_s
free
memmove
__argv
_fcvt
ferror
_tzset
_finite
_get_tzname
_endthreadex
_beginthreadex
_vsnprintf
memcpy
calloc
fgets
memset
fread
ftell
strncat
strftime
vsprintf
??0exception@std@@QEAA@XZ
??1exception@std@@UEAA@XZ
nextafterf
_snprintf_s
wcstombs
truncf
_controlfp
?what@exception@std@@UEBAPEBDXZ
??0exception@std@@QEAA@AEBQEBD@Z
_resetstkoflw
_fsopen
abort
fputs
modf
frexp
strerror
getc
strcspn
acos
_setjmp
strcoll
localeconv
isalpha
iscntrl
memchr
ispunct
isupper
islower
strpbrk
fscanf
asin
asinf
atan
atan2
atanf
ceil
ceilf
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crtSetUnhandledExceptionFilter
__crtCapturePreviousContext
__crtCaptureCurrentContext
__crtTerminateProcess
__crtUnhandledException
__crt_debugger_hook
?terminate@@YAXXZ
_commode
_fmode
_acmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_ismbblead
_cexit
_exit
__set_app_type
__getmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
_onexit
__C_specific_handler
__dllonexit
_calloc_crt
atol
swscanf
strtok
wcscmp
_waccess
_create_locale
_strtod_l
_strtoui64_l
_strtoi64_l
_vsnprintf_l
_vsprintf_l
_wcsupr
wcsstr
wcsrchr
memcmp
_wcsnicmp
_wcsicmp
_wfopen
sinf
cosf
atan2f
acosf
powf
expf
_CxxThrowException
__CxxFrameHandler3
_unlock
_lock
_wsplitpath_s
_itoa_s
_aligned_malloc
_aligned_free
strtod
cos
cosh
exp
floor
floorf
fmod
fmodf
log
_control87
clock
remove
rename
clearerr
_popen
strncmp
log10
log10f
logf
pow
sin
sinh
sqrt
sqrtf
strcmp
tan
tanf
tanh
_pclose
bcrypt
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptImportKeyPair
BCryptVerifySignature
BCryptDestroyKey
BCryptCloseAlgorithmProvider
kernel32
CreateSemaphoreW
GetFullPathNameW
LoadLibraryExW
SetLastError
GetSystemDirectoryW
MultiByteToWideChar
OutputDebugStringW
IsProcessorFeaturePresent
EncodePointer
lstrcmpiW
CreateProcessW
GetLocaleInfoW
lstrlenA
K32GetMappedFileNameW
Process32NextW
QueryDosDeviceW
GetFileType
LocalAlloc
Process32FirstW
GetFileAttributesW
GetComputerNameExA
ReadProcessMemory
GetModuleHandleW
GetNativeSystemInfo
GetFileSize
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VerifyVersionInfoW
VerSetConditionMask
ExitProcess
SetUnhandledExceptionFilter
SetFilePointer
FindNextFileA
FindFirstFileA
SetWaitableTimer
CreateWaitableTimerA
GetWindowsDirectoryW
GetFileSizeEx
GetLogicalDriveStringsW
GetTickCount
SwitchToThread
GetTickCount64
TlsFree
TlsAlloc
GetSystemInfo
SetThreadIdealProcessor
SetThreadPriorityBoost
ReleaseSemaphore
CreateSemaphoreA
TlsSetValue
RtlVirtualUnwind
RtlCaptureContext
TlsGetValue
OutputDebugStringA
GetThreadPriority
SetEnvironmentVariableA
GetTimeZoneInformation
GetModuleFileNameW
GetPriorityClass
GetDateFormatA
GetProcessHeap
GetTimeFormatA
HeapFree
HeapAlloc
GetLocaleInfoA
CreateEventExA
GetGeoInfoA
GetUserGeoID
GetUserDefaultLangID
SetThreadPriority
TryEnterCriticalSection
RtlLookupFunctionEntry
GetModuleHandleExA
GetComputerNameA
GetDiskFreeSpaceA
FileTimeToSystemTime
FileTimeToLocalFileTime
VirtualQuery
K32EnumProcessModules
K32GetModuleBaseNameA
GetCommandLineA
GetSystemTime
SetThreadAffinityMask
WaitForSingleObjectEx
QueueUserAPC
GetThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
WaitForSingleObject
CreateThread
IsDebuggerPresent
Thread32Next
Thread32First
ResumeThread
GetThreadContext
SuspendThread
OpenThread
LocalFree
FormatMessageA
GetFileInformationByHandle
GetLocalTime
CreateDirectoryA
GetFileAttributesA
ResetEvent
InitializeCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
CreateEventA
SetEvent
DeleteFileA
DecodePointer
InitializeCriticalSectionEx
RaiseException
GetEnvironmentVariableA
FreeLibrary
LoadLibraryA
CreateFileW
GetFileAttributesExW
SetEndOfFile
SetFileInformationByHandle
MoveFileW
DeleteFileW
RemoveDirectoryW
SetFileAttributesW
CopyFileW
FindNextFileW
WideCharToMultiByte
FindClose
FindFirstFileW
FlushFileBuffers
WriteFile
ReadFile
SetFilePointerEx
GetFileInformationByHandleEx
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
VirtualFree
VirtualAlloc
GetCurrentThread
DuplicateHandle
GetExitCodeThread
GetSystemTimeAsFileTime
GetProcAddress
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
CloseHandle
GetVersionExA
ReleaseMutex
GetCurrentThreadId
DeleteCriticalSection
CreateToolhelp32Snapshot
CreateMutexA
GetModuleHandleA
GetModuleFileNameA
GlobalMemoryStatusEx
Process32Next
GetLastError
TerminateProcess
Sleep
OpenProcess
CreateDirectoryW
Process32First
GetCurrentProcess
SetErrorMode
SetPriorityClass
SleepEx
dxgi
CreateDXGIFactory1
dwmapi
ord102
d3d11
D3D11CreateDevice
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
gdi32
SetDCBrushColor
GetStockObject
advapi32
GetUserNameA
RegGetValueA
RegCloseKey
RegQueryValueExA
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
GetCurrentHwProfileA
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA
dsound
ord3
ord8
wtsapi32
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
ws2_32
recvfrom
ntohs
ntohl
getaddrinfo
htons
htonl
inet_pton
select
closesocket
WSAGetLastError
send
recv
ioctlsocket
connect
WSAWaitForMultipleEvents
getsockopt
WSAResetEvent
WSACreateEvent
sendto
WSAGetOverlappedResult
WSACleanup
shutdown
getsockname
WSARecvFrom
WSARecv
WSAStartup
gethostname
WSAIoctl
WSASetEvent
WSACloseEvent
inet_addr
getpeername
listen
accept
setsockopt
socket
freeaddrinfo
bind
dbghelp
SymGetModuleBase64
StackWalk64
SymFunctionTableAccess64
SymUnloadModule64
SymLoadModule64
SymInitialize
SymSetOptions
MiniDumpWriteDump
psapi
GetModuleBaseNameW
EnumProcesses
iphlpapi
GetAdaptersAddresses
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
amd_ags_x64
agsInit
agsGetCrossfireGPUCount
agsDeInit
agsDriverExtensionsDX11_Init
agsDriverExtensionsDX11_IASetPrimitiveTopology
agsDriverExtensionsDX11_SetDepthBounds
agsSetDisplayMode
ole32
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoInitializeEx
CoInitialize
CoInitializeSecurity
CoSetProxyBlanket
oleaut32
VariantClear
SysAllocString
SysFreeString
VariantInit
anselsdk64
addUserControl
removeUserControl
isAnselAvailable
updateCamera
setConfiguration
dinput8
DirectInput8Create
mfplat
MFTEnumEx
MFShutdown
MFStartup
MFCreateMediaType
MFCreateSample
wsock32
WSAAsyncSelect
gethostbyname
inet_addr
__WSAFDIsSet
crypt32
CryptVerifyMessageSignature
CertGetNameStringW
CertFreeCertificateContext
wintrust
WinVerifyTrust
imagehlp
SymGetLineFromAddr64
SymGetSymFromAddr64
SymCleanup
SymFromAddr
ImageGetCertificateData
ImageGetCertificateHeader
UnDecorateSymbolName
ImageEnumerateCertificates
usp10
ScriptItemize
ScriptBreak
Exports
Exports
ANTITAMPER_SPOTCHECK_CODEMARKER
ANTITAMPER_TESTVALUE_CODEMARKER
ANTITAMPER_TRIGGER_CODEMARKER
AmdPowerXpressRequestHighPerformance
BiLinearInterpolate
ComputeUtility
FutureTrajMotionDataDistance
IsGameRuntime
JointAnglesMotionStateDistance
JointPosMotionDataDistance
MultiLinearInterpolate
NvOptimusEnablement
Sections
.text Size: 40.4MB - Virtual size: 40.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ctr Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10.2MB - Virtual size: 10.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10.8MB - Virtual size: 14.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rodata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
typeinfo Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fieldinf Size: 804KB - Virtual size: 804KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 1024B - Virtual size: 737B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 402KB - Virtual size: 402KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ooadk Size: 574KB - Virtual size: 574KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ooa Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ