Minecraft Free-20240521T231135Z-001[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Minecraft Free-20240521T231135Z-001.zip
Size

569KB
MD5

6dd4fea3237a3c58edfd4acb258f9a64
SHA1

b96c8a3e15c96d6c54bb333be570815dea4fef1f
SHA256

71324cd9e91d42cec601d1d002626bf721fc8ee97859e8730b82db8c14171658
SHA512

9ce1ea72b2e1e8a3e078d8caa16c4252af7f4e1789e887a9dd3e3c2c4953392e1c44b9dcff7b5415247ccbfde8abf13c0d5c7df22b226c35a0a76c9fa436ad7e
SSDEEP

12288:jFiR6U4YDmoREsRIftxrZBCilPogFce1FkK3bnhMlLZg4zz:BigYDmoesaBRlPogrjFwx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Minecraft Free/x32/System32/Windows.ApplicationModel.Store.dll

Files

Minecraft Free-20240521T231135Z-001.zip
.zip
Minecraft Free/Read me.txt
Minecraft Free/x32/File.txt
Minecraft Free/x32/System32/Windows.ApplicationModel.Store.dll
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Minecraft Free/x64/File.txt
Minecraft Free/x64/Syswow64/Windows.ApplicationModel.Store.dll
.dll windows:10 windows x86 arch:x86

f46d08ee2b5f9e762874668b5aa3344d

Code Sign

33:00:00:03:25:48:b2:9d:0e:7f:c5:f4:1f:00:00:00:00:03:25
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:29

Not After

03/03/2021, 18:29

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:b3:17:14:1c:5c:3b:9a:60:63:5f:80:e7:6a:3b:62:e7:a9:ef:47:23:34:76:af:cc:8c:f6:8c:c0:a3:2f:74
Signer

Actual PE Digest

09:b3:17:14:1c:5c:3b:9a:60:63:5f:80:e7:6a:3b:62:e7:a9:ef:47:23:34:76:af:cc:8c:f6:8c:c0:a3:2f:74

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Windows.ApplicationModel.Store.pdb

Imports

msvcrt

wcscpy_s
??_V@YAXPAX@Z
free
_purecall
_wtof
wcstoul
_vsnprintf
_snwprintf_s
memcpy_s
_wcstoui64
wcschr
_amsg_exit
_ftol2_sse
realloc
_errno
_ftol2
wcstod
_wcstoi64
_initterm
floor
_vsnwprintf
_wcsupr
_wcsdup
_wtol
wcsstr
_unlock
_except_handler4_common
_itow_s
_wcsicmp
wcscspn
_wtoi
_callnewh
wcsrchr
toupper
memmove_s
strchr
strrchr
_set_errno
strtol
strncpy_s
wcstombs
sprintf_s
memcmp
__CxxFrameHandler3
memcpy
memmove
_lock
malloc
_XcptFilter
_onexit
__dllonexit
mbstowcs_s
memset

ntdll

RtlUpcaseUnicodeChar
RtlNtStatusToDosError
NtQueryInformationProcess
NtQueryWnfStateData
RtlGetDeviceFamilyInfoEnum
EtwEventRegister
EtwEventUnregister
EtwEventSetInformation
RtlUnsubscribeWnfStateChangeNotification
EtwEventWriteTransfer
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlPublishWnfStateData

api-ms-win-core-kernel32-legacy-l1-1-0

FileTimeToDosDateTime

combase

NdrCStdStubBuffer2_Release
ord19
ord22
ord13
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
ord18
CStdStubBuffer2_CountRefs
CStdStubBuffer_DebugServerQueryInterface
ord17
ord21
CStdStubBuffer2_Disconnect
ord2
ord25
ord11
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
ord15
CStdStubBuffer_QueryInterface
ord24
ord23
ord10
ord6
CStdStubBuffer2_QueryInterface
ord16
CStdStubBuffer_AddRef
ord33
ord34
ord5
ord7
ord8
CStdStubBuffer2_Connect
ord9
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_IsIIDSupported
ord32
CStdStubBuffer_CountRefs
ord14
ord12
ord20

api-ms-win-core-libraryloader-l1-2-0

SizeofResource
GetModuleHandleW
FindResourceExW
FreeLibrary
LockResource
FreeResource
LoadStringW
GetModuleFileNameA
LoadResource
DisableThreadLibraryCalls
GetModuleHandleExW
GetProcAddress

api-ms-win-core-localization-l1-2-0

LCMapStringEx
GetLocaleInfoEx
GetUserGeoID
FormatMessageW
GetUserDefaultLocaleName
GetGeoInfoW

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentProcessId
GetProcessId
GetCurrentThread
OpenThread
GetProcessIdOfThread
TerminateProcess
OpenProcessToken
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

SetEvent
ReleaseMutex
WaitForSingleObjectEx
ReleaseSemaphore
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSectionEx
ResetEvent
WaitForMultipleObjectsEx
InitializeCriticalSection
WaitForSingleObject
OpenSemaphoreW
InitializeSRWLock
ReleaseSRWLockExclusive
CreateEventExW
CreateMutexExW
CreateSemaphoreExW
EnterCriticalSection
CreateEventW
DeleteCriticalSection
LeaveCriticalSection

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

rpcrt4

NdrClientCall4
UuidFromStringW
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcServerInqCallAttributesW
I_RpcBindingInqLocalClientPID
IUnknown_QueryInterface_Proxy
NdrOleAllocate
IUnknown_Release_Proxy
NdrOleFree
IUnknown_AddRef_Proxy
NdrStubCall2
NdrStubForwardingFunction
NdrDllCanUnloadNow
NdrDllGetClassObject
UuidCreate

api-ms-win-core-string-l1-1-0

CompareStringW
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsA

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
InitOnceExecuteOnce
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetLocalTime
GetTickCount
GetVersionExA
GetSystemTime
GetSystemTimeAsFileTime

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventProviderEnabled
EventWriteTransfer
EventActivityIdControl

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-security-base-l1-1-0

GetTokenInformation
ImpersonateLoggedOnUser
RevertToSelf
GetLengthSid
CopySid
DuplicateTokenEx
AllocateAndInitializeSid
FreeSid

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-file-l1-1-0

DeleteFileA
SetFilePointer
GetFileInformationByHandle
ReadFile
CreateFileA
CompareFileTime
FileTimeToLocalFileTime
FindFirstFileExA
FindNextFileA
FindClose
FindFirstFileA
CreateDirectoryW
CreateFileW
GetFileSize
DeleteFileW
WriteFile

api-ms-win-security-base-l1-2-0

CheckTokenMembershipEx

api-ms-win-core-file-l1-2-2

GetTempFileNameA
GetTempPathA

cabinet

ord10
ord13
ord14
ord11

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegOpenCurrentUser
RegOpenKeyExW
RegCloseKey

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW
RegDeleteKeyValueW

api-ms-win-core-path-l1-1-0

PathCchAddExtension
PathCchAppendEx

api-ms-win-core-localization-l2-1-0

GetCurrencyFormatEx

api-ms-win-shcore-stream-winrt-l1-1-0

CreateRandomAccessStreamOverStream

api-ms-win-core-url-l1-1-0

UrlEscapeW

cryptsp

CryptCreateHash
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptAcquireContextW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-eventing-legacy-l1-1-0

FlushTraceW
QueryTraceW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathCombineA
PathRemoveFileSpecA
PathAppendA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalFree

api-ms-win-security-capability-l1-1-0

CapabilityCheck

iertutil

ord85
ord74
ord89
ord76

winhttp

WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpReadData
WinHttpSetStatusCallback
WinHttpOpenRequest
WinHttpSendRequest
WinHttpSetOption
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetDefaultProxyConfiguration
WinHttpCloseHandle
WinHttpSetTimeouts
WinHttpOpen
WinHttpConnect
WinHttpCrackUrl

webservices

WsCreateError
WsReadXmlBufferFromBytes
WsSetInputToBuffer
WsMoveReader
WsReadToStartElement
WsGetReaderPosition
WsReadBytes
WsReadStartElement
WsCreateReader
WsFreeReader
WsFreeHeap
WsFreeError
WsCreateHeap
WsReadEndAttribute
WsReadStartAttribute
WsFindAttribute
WsReadChars

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.data Size: 4KB - Virtual size: 8KB

.idata Size: 11KB - Virtual size: 10KB

.didat Size: 512B - Virtual size: 428B

.rsrc Size: 62KB - Virtual size: 61KB

.reloc Size: 112KB - Virtual size: 112KB

f46d08ee2b5f9e762874668b5aa3344d

Code Sign

33:00:00:03:25:48:b2:9d:0e:7f:c5:f4:1f:00:00:00:00:03:25Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

09:b3:17:14:1c:5c:3b:9a:60:63:5f:80:e7:6a:3b:62:e7:a9:ef:47:23:34:76:af:cc:8c:f6:8c:c0:a3:2f:74Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-kernel32-legacy-l1-1-0

combase

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-util-l1-1-0

rpcrt4

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-file-l1-2-2

cabinet

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-path-l1-1-0

api-ms-win-core-localization-l2-1-0

api-ms-win-shcore-stream-winrt-l1-1-0

api-ms-win-core-url-l1-1-0

cryptsp

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-eventing-legacy-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-security-capability-l1-1-0

iertutil

winhttp

webservices

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.data Size: 4KB - Virtual size: 8KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 4KB - Virtual size: 8KB

.idata
Size: 11KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 428B

.rsrc
Size: 62KB - Virtual size: 61KB

.reloc
Size: 112KB - Virtual size: 112KB

33:00:00:03:25:48:b2:9d:0e:7f:c5:f4:1f:00:00:00:00:03:25
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

09:b3:17:14:1c:5c:3b:9a:60:63:5f:80:e7:6a:3b:62:e7:a9:ef:47:23:34:76:af:cc:8c:f6:8c:c0:a3:2f:74
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 4KB - Virtual size: 8KB

.idata
Size: 11KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 428B

.rsrc
Size: 62KB - Virtual size: 61KB

.reloc
Size: 112KB - Virtual size: 112KB