81319d8520d98562d3c3286ff53e6d10N

Sharing

Copy URL Twitter E-mail

General

Target

81319d8520d98562d3c3286ff53e6d10N
Size

1.3MB
MD5

81319d8520d98562d3c3286ff53e6d10
SHA1

f0b06e9e1fa36da06087e1bb093908e7cf59357b
SHA256

ece0344956bd1feffd444b892cf7546f8aadc59ea87a2319161f389ee0d7ac91
SHA512

02ce898f3dc749ac3b66393c990ae6b6a7936c6ec22786c1d943497cbf2cfebb7d4d18682fa5fe47091f81f4287bba03e73256a9feb53eadfd5fcc10e0f301a0
SSDEEP

24576:JG3VnuT/6ZK5loqJ+YBXslOUIFrpd3xJNZY8TF8LCr:JoM8+rPJbdfNXT22

Score

1^/10

Malware Config

Signatures

Files

81319d8520d98562d3c3286ff53e6d10N
.exe windows:6 windows x64 arch:x64

1416311759d95f4d9a00e83c7b5d2ec0

Code Sign

04
Certificate

Issuer

CN=AC Root CA

Not Before

26/01/2023, 00:00

Not After

25/01/2043, 23:59

Subject

CN=AC Game 3rd Party CS CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06
Certificate

Issuer

CN=AC Game 3rd Party CS CA

Not Before

31/03/2023, 00:00

Not After

30/03/2028, 23:59

Subject

CN=AC Warface 3rd Party

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07/11/2023, 17:13

Not After

09/12/2034, 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fd:d9:3c:45:d2:83:ed:f7:9d:15:ff:db:3d:e5:a7:bc:aa:ba:48:2e:29:29:e8:6c:1d:82:ce:46:ec:35:d5:3e
Signer

Actual PE Digest

fd:d9:3c:45:d2:83:ed:f7:9d:15:ff:db:3d:e5:a7:bc:aa:ba:48:2e:29:29:e8:6c:1d:82:ce:46:ec:35:d5:3e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\wfc\main\Code\SDKs\CrashRpt\x64\Release\CrashSender.pdb

Imports

kernel32

CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
InitializeCriticalSection
Sleep
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GlobalAlloc
GlobalUnlock
GlobalLock
OpenFileMappingW
GetSystemDirectoryA
LoadLibraryA
GetTimeZoneInformation
CreateDirectoryW
GetFileAttributesExW
GetTempFileNameW
GetTempPathW
GlobalFree
FormatMessageW
CreateThread
WritePrivateProfileStringW
SystemTimeToFileTime
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetProcessHeap
HeapFree
HeapAlloc
EncodePointer
IsDebuggerPresent
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
CreateMutexW
WriteFile
ReadFile
GetFileInformationByHandle
GetVersionExW
CompareStringW
lstrcmpiW
lstrcmpW
MulDiv
FindResourceW
SizeofResource
LoadResource
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
GetCurrentThreadId
GetCommandLineW
MultiByteToWideChar
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
CopyFileW
lstrlenA
GetSystemTimeAsFileTime
CreateProcessW
LoadLibraryW
GetProcAddress
FreeLibrary
ReadProcessMemory
GetSystemTime
OpenProcess
GetProcessTimes
SetLastError
CloseHandle
OutputDebugStringW
DebugBreak
GetFullPathNameW
GetFileSizeEx
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
WideCharToMultiByte
lstrlenW
CreateEventW
WaitForSingleObject
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
GetPrivateProfileStringW
DecodePointer

user32

IntersectRect
EnumWindows
GetWindowThreadProcessId
EnumDisplayMonitors
GetCursorInfo
GetDlgCtrlID
MoveWindow
FlashWindow
PostQuitMessage
GetMonitorInfoW
MonitorFromWindow
MonitorFromPoint
CheckMenuRadioItem
GetWindow
SetWindowTextW
SetMenuItemInfoW
TrackPopupMenu
DeleteMenu
GetSubMenu
EnableMenuItem
DestroyMenu
LoadMenuW
GetActiveWindow
EndDialog
SystemParametersInfoW
LoadImageW
DestroyIcon
LoadCursorW
GetClassNameW
GetParent
GetDesktopWindow
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
OffsetRect
SetRectEmpty
FillRect
EmptyClipboard
SetClipboardData
KillTimer
CloseClipboard
OpenClipboard
AnimateWindow
GetScrollInfo
GetSystemMetrics
SetTimer
SetScrollInfo
UnregisterClassW
DrawFocusRect
CharNextW
GetGuiResources
GetMessageW
TranslateMessage
CharUpperW
SetProcessDefaultLayout
PostMessageW
IsDialogMessageW
GetIconInfo
LoadIconW
CopyRect
MessageBoxW
GetSysColorBrush
GetSysColor
MapWindowPoints
ScreenToClient
GetCursorPos
SetCursor
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
RedrawWindow
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
UpdateWindow
DispatchMessageW
PeekMessageW
SendMessageW
DefWindowProcW
CallWindowProcW
CreateWindowExW
IsWindow
DestroyWindow
ShowWindow
SetWindowPos
IsWindowVisible
CreateDialogParamW
GetDlgItem
SetFocus
GetFocus
GetKeyState
GetCapture
SetCapture
AdjustWindowRectEx
DrawTextW
IsWindowEnabled
ReleaseCapture
DrawTextExW
DrawIcon
GetMenu
LoadStringW
EnableWindow
DrawTextExA
DialogBoxParamW

gdi32

TextOutW
SetViewportOrgEx
SelectPalette
GetDIBits
SetLayout
CreateHalftonePalette
GetDIBColorTable
CreateDIBSection
SelectClipRgn
SetStretchBltMode
CreateRectRgn
CreatePalette
CreateFontW
BitBlt
SetBkColor
CreateSolidBrush
Polygon
GetObjectW
SetTextColor
SetBkMode
SelectObject
GetStockObject
StretchBlt
RealizePalette
SetDIBits
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDCW
CreateCompatibleBitmap
CreateCompatibleDC

shell32

ShellExecuteW
SHFileOperationW
SHGetSpecialFolderPathW
Shell_NotifyIconW
CommandLineToArgvW
SHGetFileInfoW
ExtractIconW

ole32

CoUninitialize
CoCreateGuid
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc

oleaut32

SysFreeString
VarI4FromStr
VarR8FromStr
VarDateFromStr
VarDecFromStr
VarUI4FromStr
VarDecCmp

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

OpenProcessToken
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW

ws2_32

WSACleanup
WSAStartup
getservbyname
WSASetLastError
WSAGetLastError
getservbyport
gethostbyname
gethostbyaddr
socket
send
recv
ntohs
inet_ntoa
closesocket
connect
htonl
htons
inet_addr

dnsapi

DnsFree
DnsQuery_W

wininet

HttpEndRequestW
HttpSendRequestExW
HttpOpenRequestW
InternetSetOptionW
InternetQueryOptionW
HttpQueryInfoW
InternetReadFile
InternetConnectW
InternetCloseHandle
InternetOpenW
InternetWriteFile

rpcrt4

UuidToStringA
RpcStringFreeA

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

psapi

GetProcessMemoryInfo

comctl32

_TrackMouseEvent
ImageList_Create
ImageList_ReplaceIcon
ImageList_Remove
InitCommonControlsEx

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140

memmove
memcpy
_CxxThrowException
__std_exception_destroy
wcschr
wcsrchr
_purecall
__std_exception_copy
memset
wcsstr
memcmp
strchr
longjmp
__current_exception
__current_exception_context
__C_specific_handler
__intrinsic_setjmp
__std_type_info_destroy_list
__std_terminate
memchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_get_wide_winmain_command_line
_configure_wide_argv
_invalid_parameter_noinfo
_set_app_type
_seh_filter_exe
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
exit
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
terminate
_initterm
_initterm_e
_errno
_exit
abort
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_wide_environment

api-ms-win-crt-heap-l1-1-0

realloc
calloc
_callnewh
_recalloc
malloc
_set_new_mode
free

api-ms-win-crt-stdio-l1-1-0

fclose
__stdio_common_vsnprintf_s
_wfopen_s
__stdio_common_vfprintf
__stdio_common_vswprintf_s
_set_fmode
__stdio_common_vfwprintf
tmpfile
__stdio_common_vsscanf
feof
fflush
__stdio_common_vsprintf
__acrt_iob_func
_ftelli64
ftell
_fseeki64
fseek
fopen
ferror
_wfopen
fread
fwrite
__p__commode
fopen_s
__stdio_common_vsprintf_s
fputc
rewind

api-ms-win-crt-string-l1-1-0

toupper
strncmp
tolower
isspace
isalpha
iswspace
strncpy
wcscpy_s
wcsncpy_s
_wcsicmp
strcpy_s
wcstok_s
wcspbrk
wcsncmp
wcscspn
iswdigit
isalnum
strncpy_s
strcat_s
isdigit

api-ms-win-crt-convert-l1-1-0

_wtoi
atoi
_wtol
strtoul
strtod
atof

api-ms-win-crt-time-l1-1-0

_gmtime64
_time64
_localtime64_s
wcsftime
strftime
_gmtime64_s

api-ms-win-crt-filesystem-l1-1-0

_wstat64i32

api-ms-win-crt-environment-l1-1-0

getenv
_wdupenv_s

api-ms-win-crt-utility-l1-1-0

rand
qsort
srand

api-ms-win-crt-math-l1-1-0

ceil
ceilf
pow
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 932KB - Virtual size: 932KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 243KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1416311759d95f4d9a00e83c7b5d2ec0

Code Sign

04Certificate

Extended Key Usages

Key Usages

06Certificate

Extended Key Usages

Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

fd:d9:3c:45:d2:83:ed:f7:9d:15:ff:db:3d:e5:a7:bc:aa:ba:48:2e:29:29:e8:6c:1d:82:ce:46:ec:35:d5:3eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

comdlg32

advapi32

ws2_32

dnsapi

wininet

rpcrt4

version

psapi

comctl32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 932KB - Virtual size: 932KB

.rdata Size: 243KB - Virtual size: 243KB

.data Size: 6KB - Virtual size: 8KB

.pdata Size: 35KB - Virtual size: 35KB

.rsrc Size: 99KB - Virtual size: 99KB

.reloc Size: 2KB - Virtual size: 2KB

04
Certificate

06
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

fd:d9:3c:45:d2:83:ed:f7:9d:15:ff:db:3d:e5:a7:bc:aa:ba:48:2e:29:29:e8:6c:1d:82:ce:46:ec:35:d5:3e
Signer

.text
Size: 932KB - Virtual size: 932KB

.rdata
Size: 243KB - Virtual size: 243KB

.data
Size: 6KB - Virtual size: 8KB

.pdata
Size: 35KB - Virtual size: 35KB

.rsrc
Size: 99KB - Virtual size: 99KB

.reloc
Size: 2KB - Virtual size: 2KB