Noclip 2[.]13[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Noclip 2.13.exe
Size

594KB
MD5

068023465ac00fbd98392513a93da844
SHA1

c3d862eb9ad02b641be9e3cef9283780e744d0dd
SHA256

52c300351a4ff6e71743af180efd5535255951074319fe4f0660feb88360c46a
SHA512

f44ad0d3d609349f2a5640f1eae23978fa608b4a50b41e31394d9d7e680aadcc37cba68130e4aa097444374bdcc357758ae2e948952eb7924a32458194ad391d
SSDEEP

6144:qMvexVdbY/qhJ8U17DzFvb1zFvbAOxOnMjmqK0BwssDTH+gA:jmfb7htfR9RnOdqK0SP+gA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Noclip 2.13.exe

Files

Noclip 2.13.exe
.exe windows:6 windows x86 arch:x86

436ba3995f0bb66396a3b9fefc466275

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\user\Documents\Visual Studio 2017\Projects\Noclip 2.11\Release\Noclip 2.11.pdb

Imports

kernel32

Process32First
WriteProcessMemory
Module32Next
WaitForSingleObject
Module32First
OpenProcess
CreateToolhelp32Snapshot
GetLastError
Process32Next
CloseHandle
VirtualProtectEx
ReadProcessMemory
FreeLibrary
SetConsoleTitleA
Sleep
CreateFileW
HeapSize
ReadConsoleW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
RaiseException
LoadLibraryExW
HeapAlloc
HeapReAlloc
HeapFree
GetStdHandle
WriteFile
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
GetTimeZoneInformation
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetExitCodeProcess
CreateProcessA
GetFileAttributesExW
GetProcessHeap
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW

shell32

ShellExecuteA

Sections

.text
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 362KB - Virtual size: 362KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

436ba3995f0bb66396a3b9fefc466275

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

Sections

.text Size: 154KB - Virtual size: 154KB

.rdata Size: 62KB - Virtual size: 62KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 362KB - Virtual size: 362KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 154KB - Virtual size: 154KB

.rdata
Size: 62KB - Virtual size: 62KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 362KB - Virtual size: 362KB

.reloc
Size: 9KB - Virtual size: 9KB