Static task
static1
Behavioral task
behavioral1
Sample
Prison Architect 14k 64bit Trainer +6 MrAntiFun.exe
Resource
win11-20240802-en
General
-
Target
Prison Architect 14k 64bit Trainer +6 MrAntiFun.exe
-
Size
1.0MB
-
MD5
8d6be83e18a1cd06b85a80c9f3618ed6
-
SHA1
31560e6ac3b11a672ade21e13559d5ddb70fde05
-
SHA256
b1dc479a6614452515587a19aace0db70b24250aaa0f583df0d4fa519e270ea8
-
SHA512
10cb3033420a8d80c47596d6072fbac574b26da96c3d4c3dff587e90406bcd59530f2dfb903ebd04c28b397a4ed5828218a3208c02b42d9dd4a67f5d7fc7cf95
-
SSDEEP
24576:51n1ATNH7xGbA/FbVuJU/ZQu5VGbz0ZFlfX5D9:v1ATR1GbA/FBuJgV9d5D9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Prison Architect 14k 64bit Trainer +6 MrAntiFun.exe
Files
-
Prison Architect 14k 64bit Trainer +6 MrAntiFun.exe.exe windows:6 windows x64 arch:x64
4ca786393174bd52cd4111748037d394
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLastError
CreateToolhelp32Snapshot
Process32First
Process32Next
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
Module32First
Module32Next
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
OpenProcess
VirtualProtect
Beep
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CloseHandle
VirtualProtectEx
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WideCharToMultiByte
Sleep
RtlCaptureContext
user32
GetAsyncKeyState
shell32
ShellExecuteA
winmm
PlaySoundA
vcruntime140
__C_specific_handler
__telemetry_main_invoke_trigger
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__CxxFrameHandler3
__CxxRegisterExceptionObject
__CxxDetectRethrow
memmove
__CxxUnregisterExceptionObject
__CxxQueryExceptionSize
__CxxExceptionFilter
__telemetry_main_return_trigger
memset
__FrameUnwindFilter
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
abort
_register_onexit_function
_crt_atexit
_c_exit
_cexit
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_initialize_narrow_environment
_configure_narrow_argv
terminate
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_set_app_type
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
_set_new_mode
msvcp140
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
mscoree
_CorExeMain
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nep Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 666KB - Virtual size: 666KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 500.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 900B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 335KB - Virtual size: 335KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ