Big Adventure\Big City Adventure 10 Barcelona\BigCityAdventureBarcelona[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Big Adventure\Big City Adventure 10 Barcelona\BigCityAdventureBarcelona.exe
Size

1.4MB
MD5

40c34405cff04dfe6e93622a262fdfe9
SHA1

57aad4efe68fec1438e51c7d6532a75925814bb5
SHA256

d386eeefe478bf749158b44f3213a18da4eaf4ee344592046ae69d0b1751e1ef
SHA512

13912447d7e4d75b35f8fb2c1213118b5fe00c2131e2e0c67b72fa46fd25b239915b9dc6b97c3bde21a936d1869f0d5a269ef877f26db4f8dec672d8c797de7e
SSDEEP

24576:xYFcvowJTgxBSSzEEbaRXjwPdtpQH2c6ETZnfk9k+k5e65fm9sgU:Ccwc1StRA2c6KZfk9k+kMufm+N

Score

1^/10

Malware Config

Signatures

Files

Big Adventure\Big City Adventure 10 Barcelona\BigCityAdventureBarcelona.exe
.exe windows:4 windows x86 arch:x86

Password: infected

da68a2119f03db7606602e702c103e33

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:42:e6:d0:d1:6b:e0:7e:09:42:f0:be:a6:71:5a:9e
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

06/03/2013, 00:00

Not After

05/03/2016, 23:59

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

fc:61:a5:93:b7:7d:24:35:83:56:18:96:ed:c9:70:dc:e2:5f:d6:9e
Signer

Actual PE Digest

fc:61:a5:93:b7:7d:24:35:83:56:18:96:ed:c9:70:dc:e2:5f:d6:9e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\_CCode\BCABarcelona\BigCityAdventureBarcelona.pdb

Imports

bass

BASS_ChannelSetAttributes
BASS_SampleGetChannel
BASS_ChannelPlay
BASS_ChannelPause
BASS_ChannelIsActive
BASS_ChannelSlideAttributes
BASS_SampleStop
BASS_StreamCreateFile
BASS_SampleLoad
BASS_ChannelGetLength
BASS_ChannelSeconds2Bytes
BASS_ChannelSetSync
BASS_ChannelSetPosition
BASS_ChannelRemoveSync
BASS_ChannelStop
BASS_ChannelIsSliding
BASS_Free
BASS_Init
BASS_StreamFree
BASS_SampleFree

kernel32

GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
GetLastError
RaiseException
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
WriteFile
GetStdHandle
GetModuleFileNameA
Sleep
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
HeapFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
LoadLibraryA
GetLocaleInfoA
FreeLibrary
InitializeCriticalSection
RtlUnwind
LCMapStringA
LCMapStringW
GetTimeFormatA
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetNumberFormatA
lstrcpyA
OutputDebugStringA
CreateFileA
SetFilePointer
GetLocalTime
FindResourceA
SizeofResource
LoadResource
LockResource
CreateMutexA
CreateDirectoryA
LocalFree
ReadFile
GetFileSize
CloseHandle
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
FormatMessageA
VirtualQuery
lstrcatA
GetSystemDirectoryA
GetFileTime
FileTimeToSystemTime
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
lstrlenA
lstrcpynA
FindClose
FindNextFileA
FindFirstFileA
GetFileAttributesA
lstrcmpiA
MulDiv
GetTickCount
lstrcmpA
DeleteFileA
GetSystemTimeAsFileTime
SetEndOfFile

user32

CloseClipboard
GetCursorPos
ScreenToClient
SetCapture
EmptyClipboard
ReleaseCapture
SetClipboardData
WindowFromPoint
SetTimer
ClientToScreen
KillTimer
LoadImageA
LoadCursorA
GetWindowLongA
SetCursor
CallWindowProcA
SetDlgItemTextA
CreateWindowExA
SetWindowLongA
DestroyWindow
MessageBoxA
DefWindowProcA
GetClipboardData
FillRect
DialogBoxIndirectParamA
ChangeDisplaySettingsA
EnumThreadWindows
wvsprintfA
DefDlgProcA
SendDlgItemMessageA
EndDialog
GetWindowRect
LoadIconA
IsCharAlphaNumericA
EqualRect
PeekMessageA
PostQuitMessage
MessageBeep
GetKeyState
ShowWindow
SystemParametersInfoA
ReleaseDC
UpdateWindow
GetSystemMetrics
IsIconic
SetForegroundWindow
FindWindowA
DispatchMessageA
TranslateMessage
GetMessageA
OpenClipboard
GetClientRect
SetRect
PtInRect
IntersectRect
CopyRect
OffsetRect
LoadStringA
InflateRect
GetDC
UnionRect
RegisterClassA

gdi32

GetTextMetricsA
GetGlyphOutlineA
GetGlyphIndicesA
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
CreateFontIndirectA
GetDeviceCaps
CreateCompatibleDC
DeleteObject
SelectObject
DeleteDC

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteA

winmm

timeGetTime

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 908KB - Virtual size: 907KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 732KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 352KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

da68a2119f03db7606602e702c103e33

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

5f:42:e6:d0:d1:6b:e0:7e:09:42:f0:be:a6:71:5a:9eCertificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

fc:61:a5:93:b7:7d:24:35:83:56:18:96:ed:c9:70:dc:e2:5f:d6:9eSigner

Headers

File Characteristics

PDB Paths

Imports

bass

kernel32

user32

gdi32

advapi32

shell32

winmm

version

Sections

.text Size: 908KB - Virtual size: 907KB

.rdata Size: 152KB - Virtual size: 149KB

.data Size: 56KB - Virtual size: 732KB

.rsrc Size: 352KB - Virtual size: 350KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

5f:42:e6:d0:d1:6b:e0:7e:09:42:f0:be:a6:71:5a:9e
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

fc:61:a5:93:b7:7d:24:35:83:56:18:96:ed:c9:70:dc:e2:5f:d6:9e
Signer

.text
Size: 908KB - Virtual size: 907KB

.rdata
Size: 152KB - Virtual size: 149KB

.data
Size: 56KB - Virtual size: 732KB

.rsrc
Size: 352KB - Virtual size: 350KB