UNBANNED[.]GG SOFTWARE LOADER[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

UNBANNED.GG SOFTWARE LOADER.exe
Size

11.6MB
MD5

7e71c1a34814855801a66d0ea6c3a8a5
SHA1

e7ba1db4cc3b3ab1b8d03b1f6ca4174a70123c6b
SHA256

aaeefc92dba009517b0915c29471d1073adf205bf6adbfe02c9ee48c85e1a2f7
SHA512

1e1d9792a9c721f9e91d8c5a5671af2cb27f196048cc0c2241af85553ee4461b25651536c892916c1f33b59d1f31729e7100101871d63101f4ffdfb4cb3eddbe
SSDEEP

196608:FPbNMaJfUAk263I2Wg3wEXQ2ieVJVQPb+4LsuLkNsyLR0hVVTN3d01udz6gGi7:FzJfIf6vEXDnVJVuGs5qcuU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UNBANNED.GG SOFTWARE LOADER.exe

Files

UNBANNED.GG SOFTWARE LOADER.exe
.exe windows:6 windows x64 arch:x64

59e6d8c7aa7c78c701f9ce2b513668f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WaitForSingleObjectEx
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

MessageBoxA

advapi32

CheckTokenMembership

shell32

ShellExecuteA

msvcp140

?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ

normaliz

IdnToAscii

wldap32

ord79

crypt32

CertGetCertificateChain

ws2_32

__WSAFDIsSet

rpcrt4

UuidCreate

psapi

GetModuleInformation

vcruntime140

strstr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv

api-ms-win-crt-string-l1-1-0

isupper

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-stdio-l1-1-0

ungetc

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sections

.text
Size: - Virtual size: 410KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.nQi
Size: - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.eB9
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.=)b
Size: 11.6MB - Virtual size: 11.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

59e6d8c7aa7c78c701f9ce2b513668f9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcp140

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: - Virtual size: 410KB

.rdata Size: - Virtual size: 103KB

.data Size: - Virtual size: 139KB

.pdata Size: - Virtual size: 17KB

.nQi Size: - Virtual size: 6.9MB

.eB9 Size: 5KB - Virtual size: 4KB

.=)b Size: 11.6MB - Virtual size: 11.6MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 410KB

.rdata
Size: - Virtual size: 103KB

.data
Size: - Virtual size: 139KB

.pdata
Size: - Virtual size: 17KB

.nQi
Size: - Virtual size: 6.9MB

.eB9
Size: 5KB - Virtual size: 4KB

.=)b
Size: 11.6MB - Virtual size: 11.6MB

.rsrc
Size: 512B - Virtual size: 480B