BlackOps[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

BlackOps.exe
Size

7.7MB
MD5

c1adab60073a2c6d637310f622d749fb
SHA1

ee5e0c1c4cd5d2b1319a0a0c87ac8204e3e8ade9
SHA256

2ba4a04e81de2b60582da0e4489efde21e6cb07904a223bae633b6ccaebbf759
SHA512

17a85ab3678c92076f7b3b5102281a4608cb474b431972cbc0715e766204c9a60ab85f4062a4eef63146688894bbe8740e7137197fc8a70ca552270588c8aa48
SSDEEP

98304:CU33YbMVGKRmHm0bZwO+o9O5a/I4dpzfRlFLael9PP1TyVqXqw:/GWpdO+o9O8/Xdpzf3FLaelDw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BlackOps.exe

Files

BlackOps.exe
.exe windows:5 windows x86 arch:x86

d2bad50735bf2d3989d63188c71e34ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\projects_pc\cod\codsrc\src\obj\t5\CoDSteam_CEG_bin\BlackOps.pdb

Imports

steam_api

SteamAPI_RegisterCallResult
SteamAPI_Shutdown
SteamAPI_UnregisterCallback
SteamAPI_UnregisterCallResult
SteamAPI_RunCallbacks
SteamAPI_RestartAppIfNecessary
SteamAPI_Init
SteamApps
SteamGameServer
SteamGameServer_RunCallbacks
SteamMasterServerUpdater
SteamGameServer_Init
SteamGameServer_Shutdown
SteamNetworking
SteamUserStats
SteamAPI_RegisterCallback
SteamUtils
SteamUser
SteamFriends

winmm

mixerSetControlDetails
timeEndPeriod
timeBeginPeriod
mixerGetControlDetailsA
mixerGetLineControlsA
mixerClose
mixerGetLineInfoA
mixerOpen
mixerGetNumDevs
waveInGetNumDevs
timeGetTime

wsock32

recvfrom
select
gethostname
WSAStartup
sendto
closesocket
htons
ioctlsocket
gethostbyname
WSAGetLastError
socket

binkw32

_BinkRegisterFrameBuffers@8
_BinkSetSoundSystem@8
_BinkClose@4
_BinkGetError@0
_BinkOpen@8
_BinkSetSoundTrack@8
_BinkSetIOSize@4
_BinkDoFrame@4
_BinkSetMemory@8
_BinkWait@4
_BinkOpenDirectSound@4
_BinkControlBackgroundIO@8
_BinkSetVolume@12
_BinkPause@8
_BinkShouldSkip@4
_BinkGetFrameBuffersInfo@8
_BinkNextFrame@4
_BinkGetRealtime@12

d3d9

Direct3DCreate9
D3DPERF_BeginEvent
D3DPERF_EndEvent

d3dx9_43

D3DXCompileShader
D3DXSaveSurfaceToFileA
D3DXCreateBuffer
D3DXGetShaderConstantTable
D3DXGetShaderInputSemantics
D3DXGetShaderOutputSemantics

dsound

ord11
ord6

kernel32

GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetEnvironmentVariableW
SetEnvironmentVariableA
InitializeCriticalSectionAndSpinCount
VirtualQuery
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapCreate
GetStdHandle
SetStdHandle
WriteConsoleA
QueryPerformanceCounter
InterlockedDecrement
CreateFileA
ReadFileEx
GetLastError
SleepEx
CloseHandle
GetFileSize
GetFileAttributesA
InterlockedIncrement
DebugBreak
ExitProcess
GetCurrentThreadId
SwitchToThread
InterlockedExchange
GetCurrentProcess
GetProcAddress
GetModuleHandleA
LoadLibraryA
RaiseException
Sleep
SetEvent
ResetEvent
CreateEventA
WaitForSingleObject
GetProcessAffinityMask
DuplicateHandle
GetCurrentThread
CreateThread
SuspendThread
ResumeThread
SetThreadPriority
SetFileAttributesA
VirtualAlloc
VirtualFree
QueryPerformanceFrequency
GetModuleFileNameA
InitializeCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
GetCurrentDirectoryA
GlobalMemoryStatus
SetProcessAffinityMask
GetThreadPriority
FormatMessageA
OutputDebugStringA
GetDriveTypeA
GetConsoleOutputCP
GlobalSize
GlobalLock
GetVersionExA
Module32Next
Module32First
CreateToolhelp32Snapshot
OpenProcess
WriteFile
ReadFile
GetCurrentProcessId
DeleteFileA
SetErrorMode
SetUnhandledExceptionFilter
DeleteCriticalSection
TerminateProcess
GetTickCount
MulDiv
SetPriorityClass
SetThreadExecutionState
FreeLibrary
WideCharToMultiByte
ReleaseMutex
ReleaseSemaphore
CreateMutexA
CreateSemaphoreA
SetFilePointer
PulseEvent
SetLastError
CreateEventW
GetProcessTimes
GetModuleHandleExA
GetFileTime
HeapFree
GetProcessHeap
GetFileInformationByHandle
CreateFileW
lstrcmpiW
lstrlenW
GetFullPathNameW
HeapAlloc
HeapSize
GetTimeZoneInformation
GetComputerNameA
GetSystemTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
InterlockedCompareExchange
GetSystemDirectoryW
GetWindowsDirectoryW
GetModuleFileNameW
UnmapViewOfFile
LockResource
LoadResource
SizeofResource
FindResourceW
GetConsoleWindow
GetCurrentDirectoryW
GetEnvironmentStringsW
GetCommandLineW
GetStartupInfoW
GetFullPathNameA
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
OpenEventA
GetSystemInfo
FindNextFileA
GetModuleHandleW
ExitThread
MultiByteToWideChar
HeapReAlloc
GetCommandLineA
GetStartupInfoA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
LCMapStringW
WriteConsoleW
CompareStringA
CompareStringW
SetEndOfFile
TerminateThread
GetExitCodeThread
FindFirstFileA
FileTimeToLocalFileTime
FindClose
CreateDirectoryA
IsDebuggerPresent
UnhandledExceptionFilter
MoveFileA
GlobalUnlock
RtlUnwind

user32

RegisterClassA
DefWindowProcA
DestroyWindow
PostQuitMessage
CallWindowProcA
SetWindowTextA
CloseWindow
CallNextHookEx
GetAsyncKeyState
SetWindowsHookExA
MapVirtualKeyA
MoveWindow
GetMonitorInfoA
MonitorFromWindow
RegisterWindowMessageA
LoadImageA
LoadIconA
LoadCursorA
RegisterClassExA
AdjustWindowRect
OpenClipboard
GetClipboardData
CloseClipboard
GetMessageA
DispatchMessageA
TranslateMessage
ShowWindow
PostMessageA
ShowCursor
ClientToScreen
GetCursorPos
CreateWindowExA
SendMessageA
ScreenToClient
GetForegroundWindow
SetFocus
SetCursorPos
GetActiveWindow
MessageBoxA
ChangeDisplaySettingsA
EnumThreadWindows
GetDesktopWindow
SetWindowPos
GetDC
ReleaseDC
GetWindowTextA
SetWindowLongA
GetWindowLongA
GetWindowRect
AdjustWindowRectEx
IsWindow
MonitorFromPoint
EnumDisplayMonitors
PeekMessageA
MessageBoxW
GetSystemMetrics

gdi32

DeleteDC
CreateFontA
ExtEscape
SetDeviceGammaRamp
GetDeviceCaps
CreateDCA
CreateSolidBrush

advapi32

CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueA

shell32

SHGetFolderPathA
ShellExecuteA

ole32

StringFromGUID2
CoInitializeEx
CoUninitialize
CLSIDFromString
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance

xinput1_3

ord3
ord4
ord2

psapi

GetProcessMemoryInfo

ws2_32

connect
ioctlsocket
setsockopt
bind
ntohs
send
inet_ntoa
recv
__WSAFDIsSet
getsockname

Sections

.text
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 233KB - Virtual size: 59.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 109B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.version
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2bad50735bf2d3989d63188c71e34ed

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

steam_api

winmm

wsock32

binkw32

d3d9

d3dx9_43

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

xinput1_3

psapi

ws2_32

Sections

.text Size: 5.6MB - Virtual size: 5.6MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 233KB - Virtual size: 59.0MB

.tls Size: 512B - Virtual size: 109B

.rodata Size: 2KB - Virtual size: 1KB

.version Size: 512B - Virtual size: 4B

.rsrc Size: 76KB - Virtual size: 76KB

.text
Size: 5.6MB - Virtual size: 5.6MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 233KB - Virtual size: 59.0MB

.tls
Size: 512B - Virtual size: 109B

.rodata
Size: 2KB - Virtual size: 1KB

.version
Size: 512B - Virtual size: 4B

.rsrc
Size: 76KB - Virtual size: 76KB