iw5sp[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

iw5sp.exe
Size

4.5MB
MD5

96371a6f01b1e5465e0de0e5bc0c911b
SHA1

2f03652f3dfbdb2286c32a41e75b8676e96e0a47
SHA256

7823b4163b0810e9b041459a5297f90fdae02c1cfb710a675719fdef7aca854b
SHA512

656c6a728b464b916d45bde558f1b7d60b17b39cf08ddcab44e70b488e79fa30eb6021fc5544f22c1d384e83a29326a924a12b044a84c644af76d1e1852e80fd
SSDEEP

98304:ZYldeUzLjzunGrAEklIKKsvoe2prU/7EICIYGcIIIIII0jSzRemTVofsIB:ZYHeUzLjzunWAEHKKsvoe2prU/AILGIz

Score

1^/10

Malware Config

Signatures

Files

iw5sp.exe
.exe windows:5 windows x86 arch:x86

bfa2f498bed95dc32e9eb5f1827b64f1

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6c:40:9e:48:c3:2b:0d:11:00:f8:0b:9d:29:bc:1f:b9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

20/04/2009, 00:00

Not After

19/04/2012, 23:59

Subject

CN=Valve Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Steam,O=Valve Corporation,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a4:fd:55:be:b1:36:b5:af:de:14:78:b3:34:2b:95:aa:88:89:3b:58
Signer

Actual PE Digest

a4:fd:55:be:b1:36:b5:af:de:14:78:b3:34:2b:95:aa:88:89:3b:58

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\trees\iw5build6-iw-release\iw5\code_source\src\CodeOutput\iw5sp\Steam_CEG_bin\iw5sp.pdb

Imports

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

steam_api

SteamAPI_RegisterCallResult
SteamAPI_UnregisterCallResult
SteamAPI_UnregisterCallback
SteamAPI_RegisterCallback
SteamAPI_RunCallbacks
SteamRemoteStorage
SteamNetworking
SteamApps
SteamUtils
SteamMatchmaking
SteamFriends
SteamUserStats
SteamAPI_Init
SteamAPI_Shutdown
SteamUser

mss32

_AIL_sample_ms_position@12
_AIL_set_sample_volume_levels@12
_AIL_set_room_type@8
_AIL_open_stream@12
_AIL_stream_ms_position@12
_AIL_sample_playback_rate@4
_AIL_set_sample_playback_rate@8
_AIL_set_stream_loop_count@8
_AIL_set_sample_reverb_levels@12
_AIL_set_stream_ms_position@8
_AIL_stream_info@20
_AIL_set_sample_3D_distances@16
_AIL_sample_channel_levels@8
_AIL_set_sample_channel_levels@12
_AIL_pause_stream@8
_AIL_close_stream@4
_AIL_sample_volume_pan@12
_AIL_stop_sample@4
_AIL_end_sample@4
_AIL_set_DirectSound_HWND@8
_AIL_stream_sample_handle@4
_AIL_sample_status@4
_AIL_digital_CPU_percent@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_sample_processor@12
_AIL_sample_processor@8
_AIL_sample_stage_property@24
_AIL_find_filter@8
_AIL_open_filter@8
_AIL_allocate_sample_handle@4
_AIL_init_sample@12
_AIL_stream_status@4
_AIL_speaker_configuration@20
_AIL_resume_sample@4
_AIL_sample_3D_position@16
_AIL_size_processed_digital_audio@16
_AIL_process_digital_audio@24
_AIL_set_sample_info@8
_AIL_set_sample_loop_count@8
_AIL_set_sample_ms_position@8
_AIL_set_file_callbacks@16
_AIL_set_redist_directory@4
_AIL_set_3D_distance_factor@8
_AIL_set_3D_rolloff_factor@8
_AIL_open_digital_driver@16
_AIL_set_preference@8
_AIL_set_speaker_configuration@16
_AIL_set_sample_3D_position@16

binkw32

_BinkDoFrame@4
_BinkGoto@12
_BinkNextFrame@4
_BinkGetRealtime@12
_BinkControlBackgroundIO@8
_BinkGetRects@8
_BinkSetMemory@8
_BinkOpenMiles@4
_BinkSetSoundSystem@8
_BinkSetSoundTrack@8
_BinkGetFrameBuffersInfo@8
_BinkRegisterFrameBuffers@8
_BinkGetKeyFrame@12
_BinkSetMixBinVolumes@20
_BinkOpen@8
_BinkGetError@0
_BinkSetError@4
_BinkClose@4
_BinkPause@8
_BinkWait@4
_BinkSetIOSize@4

d3d9

Direct3DCreate9

powrprof

CallNtPowerInformation

ws2_32

htons
bind
closesocket
sendto
setsockopt
inet_addr
gethostbyname
WSAGetLastError
send
connect
ioctlsocket
recv
recvfrom
shutdown
ntohl
gethostname
inet_ntoa
select
__WSAFDIsSet
WSASetLastError
getsockopt
getsockname
WSAStartup
WSACleanup
ntohs
socket

kernel32

GetConsoleOutputCP
WriteConsoleA
SetEndOfFile
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
FlushFileBuffers
HeapCreate
WriteConsoleW
GetConsoleMode
GetConsoleCP
DeleteCriticalSection
SetHandleCount
SetFilePointer
GetFileType
PeekNamedPipe
GetStdHandle
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetCommandLineA
HeapReAlloc
GetModuleHandleW
CreateDirectoryA
RtlUnwind
GetDriveTypeA
FileTimeToLocalFileTime
MoveFileA
ReleaseMutex
CreateMutexA
CompareStringA
CompareStringW
SetEnvironmentVariableA
WaitForMultipleObjects
GetExitCodeThread
TerminateThread
ExpandEnvironmentStringsA
GetVersion
FlushConsoleInputBuffer
ExitThread
ReadConsoleInputA
SetConsoleMode
VirtualQuery
FindResourceW
OpenEventA
OpenFileMappingA
CreateSemaphoreA
CreateFileMappingA
MapViewOfFile
InterlockedDecrement
InterlockedExchangeAdd
GetFileSize
GetLastError
ReadFileEx
SleepEx
InterlockedIncrement
CloseHandle
InterlockedCompareExchange
InterlockedExchange
Sleep
GetCurrentThreadId
SetEvent
ResetEvent
CreateEventA
WaitForSingleObject
GetProcessAffinityMask
GetCurrentProcess
DuplicateHandle
GetCurrentThread
SetThreadPriority
RaiseException
CreateThread
SuspendThread
ResumeThread
SetThreadAffinityMask
GetThreadPriority
VirtualAlloc
VirtualFree
CreateFileA
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleFileNameA
GetModuleHandleA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GlobalMemoryStatus
GetProcAddress
GetSystemInfo
GetVersionExA
SetProcessAffinityMask
FormatMessageA
Module32Next
Module32First
CreateToolhelp32Snapshot
OpenProcess
WriteFile
ReadFile
GetCurrentProcessId
DeleteFileA
SetErrorMode
SetPriorityClass
GetSystemTime
SystemTimeToFileTime
MulDiv
SetThreadExecutionState
GetCurrentDirectoryA
FindClose
FindFirstFileA
FindNextFileA
GlobalMemoryStatusEx
FreeLibrary
LoadLibraryA
HeapFree
GetProcessHeap
lstrcmpiW
CreateFileW
GetFileInformationByHandle
GetFullPathNameW
HeapAlloc
HeapSize
GetTimeZoneInformation
GetComputerNameA
GetTickCount
ExitProcess
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetWindowsDirectoryW
GetModuleFileNameW
UnmapViewOfFile
LockResource
LoadResource
SizeofResource
GetConsoleWindow
GetCurrentDirectoryW
GetEnvironmentStringsW
GetCommandLineW
GetStartupInfoW
SetLastError
ReleaseSemaphore
GetFullPathNameA
GetModuleHandleExA

user32

GetProcessWindowStation
UpdateWindow
IsWindow
ClipCursor
ClientToScreen
GetClientRect
GetWindowRect
SetWindowLongA
GetWindowLongA
GetWindowTextA
ReleaseDC
GetDC
GetDesktopWindow
EnumThreadWindows
ChangeDisplaySettingsA
GetSystemMetrics
SetCursorPos
SetFocus
GetForegroundWindow
ScreenToClient
GetCursorPos
ShowCursor
PostMessageA
ShowWindow
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
RegisterClassExA
LoadCursorA
LoadIconA
MessageBoxA
GetActiveWindow
SetWindowPos
AdjustWindowRect
SendMessageA
CreateWindowExA
LoadImageA
RegisterClassA
DefWindowProcA
GetUserObjectInformationW
DestroyWindow
PostQuitMessage
CallWindowProcA
SetWindowTextA
CloseWindow
SystemParametersInfoA
MapVirtualKeyA
MoveWindow
GetMonitorInfoA
MonitorFromWindow
RegisterWindowMessageA
MonitorFromPoint
EnumDisplayMonitors
AdjustWindowRectEx

gdi32

GetBitmapBits
DeleteObject
DeleteDC
BitBlt
GetObjectA
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
GetDeviceCaps
CreateFontA
SelectObject
SetDeviceGammaRamp
CreateSolidBrush

advapi32

SetSecurityDescriptorDacl
RegQueryValueExW
RegOpenKeyExW
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegOpenKeyExA
RegCloseKey
RegQueryInfoKeyA
InitializeSecurityDescriptor
RegQueryValueExA
RegEnumKeyExA

shell32

ShellExecuteA

ole32

StringFromGUID2

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 758KB - Virtual size: 757KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 144KB - Virtual size: 30.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 33B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.version
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bfa2f498bed95dc32e9eb5f1827b64f1

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

6c:40:9e:48:c3:2b:0d:11:00:f8:0b:9d:29:bc:1f:b9Certificate

Extended Key Usages

Key Usages

a4:fd:55:be:b1:36:b5:af:de:14:78:b3:34:2b:95:aa:88:89:3b:58Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winmm

steam_api

mss32

binkw32

d3d9

powrprof

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 3.6MB - Virtual size: 3.6MB

.rdata Size: 758KB - Virtual size: 757KB

.data Size: 144KB - Virtual size: 30.9MB

.tls Size: 512B - Virtual size: 33B

.version Size: 512B - Virtual size: 4B

.rsrc Size: 93KB - Virtual size: 93KB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

6c:40:9e:48:c3:2b:0d:11:00:f8:0b:9d:29:bc:1f:b9
Certificate

a4:fd:55:be:b1:36:b5:af:de:14:78:b3:34:2b:95:aa:88:89:3b:58
Signer

.text
Size: 3.6MB - Virtual size: 3.6MB

.rdata
Size: 758KB - Virtual size: 757KB

.data
Size: 144KB - Virtual size: 30.9MB

.tls
Size: 512B - Virtual size: 33B

.version
Size: 512B - Virtual size: 4B

.rsrc
Size: 93KB - Virtual size: 93KB