Static task
static1
General
-
Target
Pokemon-Battle-Revolution-Europe-Australia-E-639548.zip
-
Size
20.2MB
-
MD5
819f259165a08e6d90fc8654f18fad4e
-
SHA1
71dae429ba2b9b1c0361f30371bc61e94fb17b49
-
SHA256
48be68e80225db067028fe123de721a72b07fbf8906077628ad80edd9a551187
-
SHA512
6e4f85173e3c89260b78b6fde0bf9d6bec815ac554d0d656d3e8627a34e657e34dfc03098fac209d85bb40ae668caaed38eddc41168a662d310be305544054fd
-
SSDEEP
393216:2tbitdF7MWhgHLU/AcwHQWJCLwHMqU3hS9kdwspa4y//Ec44nNRK4oP:2A7UNDRCMHMh3hS9kdwXEcd7CP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Setup_10024.exe
Files
-
Pokemon-Battle-Revolution-Europe-Australia-E-639548.zip.zip
-
Setup_10024.exe.exe windows:6 windows x86 arch:x86
d514a0a043584816db80d35d2586aa85
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFileExistsW
kernel32
GetFileAttributesA
DeleteCriticalSection
GetFileAttributesExW
SetFileAttributesW
GetDateFormatW
FindFirstFileExA
WaitForMultipleObjects
HeapSize
CreateSemaphoreA
LocalFree
GetSystemTimeAsFileTime
GetModuleFileNameW
SetEnvironmentVariableA
IsValidCodePage
TerminateProcess
CreateFileA
GetModuleHandleExW
GetVersion
TryAcquireSRWLockExclusive
FreeEnvironmentStringsW
GetProcessHeap
HeapAlloc
GetDriveTypeW
CreateDirectoryW
InitializeCriticalSection
GetFileAttributesW
RtlUnwind
SetFilePointerEx
VirtualAlloc
SetCurrentDirectoryW
SetFileAttributesA
AcquireSRWLockExclusive
GetCPInfo
ReadFile
GetTempPathW
SetUnhandledExceptionFilter
FindNextFileW
GetCurrentProcess
CreateThread
CreateDirectoryA
FormatMessageA
WakeAllConditionVariable
GetLocaleInfoW
ResetEvent
IsValidLocale
UnhandledExceptionFilter
WriteConsoleW
EncodePointer
GetFileInformationByHandle
DeleteFileA
TlsSetValue
GetFileType
GetStringTypeW
LoadLibraryExW
FormatMessageW
SetFileTime
GetTickCount64
GetACP
GetTickCount
SetStdHandle
GlobalMemoryStatus
LeaveCriticalSection
InitializeSListHead
HeapFree
SetFilePointer
EnterCriticalSection
MultiByteToWideChar
GetTimeZoneInformation
SetEvent
ExitThread
TlsFree
LCMapStringEx
GetVersionExA
WriteFile
GetConsoleCP
FindFirstFileW
GetUserDefaultLCID
GetFileSizeEx
FlushFileBuffers
FindClose
GetFullPathNameW
SleepEx
Sleep
TlsAlloc
GetCurrentProcessId
TlsGetValue
GetSystemDirectoryW
CreateEventA
ExitProcess
ReleaseSemaphore
LoadLibraryW
VerifyVersionInfoW
WideCharToMultiByte
WaitForSingleObjectEx
DeleteFileW
RemoveDirectoryW
RemoveDirectoryA
LCMapStringW
GetTimeFormatW
DecodePointer
GetLastError
GetModuleHandleW
GetModuleHandleA
GetFileSize
GetCurrentDirectoryW
FindFirstFileA
GetTempPathA
SetLastError
GetOEMCP
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
IsDebuggerPresent
GetConsoleMode
HeapReAlloc
GetModuleFileNameA
lstrcatA
GetEnvironmentVariableA
GetFinalPathNameByHandleW
FreeLibraryAndExitThread
CreateFileW
AreFileApisANSI
GetStdHandle
PeekNamedPipe
RaiseException
GetEnvironmentStringsW
GetStartupInfoW
ReadConsoleW
GetLocaleInfoEx
QueryPerformanceCounter
WaitForSingleObject
MoveFileExW
LoadLibraryA
CloseHandle
EnumSystemLocalesW
QueryPerformanceFrequency
FindNextFileA
CompareStringW
SystemTimeToTzSpecificLocalTime
GetProcAddress
GetCommandLineW
FreeLibrary
IsProcessorFeaturePresent
VerSetConditionMask
GetCurrentThreadId
ReleaseSRWLockExclusive
GetCommandLineA
lstrlenA
VirtualFree
SetEndOfFile
GetSystemInfo
GetProcessAffinityMask
FileTimeToSystemTime
GetCurrentDirectoryA
SetCurrentDirectoryA
user32
DialogBoxParamA
KillTimer
GetDlgItem
DialogBoxParamW
EndDialog
DestroyWindow
CharUpperW
LoadStringA
SetWindowTextW
SendMessageA
GetWindowLongA
ShowWindow
SetWindowTextA
SetTimer
wsprintfA
MessageBoxA
SetWindowLongA
PostMessageA
CharUpperA
LoadIconA
LoadStringW
MessageBoxW
shell32
ShellExecuteExA
oleaut32
VariantClear
SysAllocStringLen
SysStringLen
bcrypt
BCryptGenRandom
advapi32
CryptDestroyKey
CryptImportKey
CryptAcquireContextW
CryptEncrypt
CryptReleaseContext
CryptCreateHash
CryptDestroyHash
CryptHashData
CryptGetHashParam
crypt32
CertFreeCertificateContext
CertCreateCertificateChainEngine
CertCloseStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertFreeCertificateChain
PFXImportCertStore
CertOpenStore
CryptDecodeObjectEx
CertFindCertificateInStore
CertFreeCertificateChainEngine
CertGetCertificateChain
CertGetNameStringW
CryptQueryObject
CertFindExtension
CryptStringToBinaryW
wldap32
ord216
ord301
ord145
ord219
ord46
ord14
ord147
ord73
ord208
ord41
ord117
ord26
ord27
ord127
ord167
ord142
ord79
ord133
ws2_32
gethostname
htons
getsockopt
send
WSACloseEvent
WSACreateEvent
WSAWaitForMultipleEvents
WSAResetEvent
WSAEnumNetworkEvents
WSAIoctl
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
ioctlsocket
setsockopt
WSAEventSelect
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
socket
getaddrinfo
freeaddrinfo
recvfrom
sendto
getpeername
Sections
.text Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ