pes2013[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

pes2013.exe
Size

28.2MB
MD5

34b9b8d694669befb6f16ed9571272dc
SHA1

d15cd8146b42a283d9014e66dfd70c73e984bddb
SHA256

7cfe56c82c7cca1f77c8935118fa720bc27990786acfb056e8b9f20574aa5bba
SHA512

3d680d9bdfa424e978a59742c5245106b5be17fff6e6e765b59f7a24002a312a81267b518a4fd2b224bc219640e4b449b191bc6758613753d0eaf5bfe03a288d
SSDEEP

393216:TUuuE4KLMNapCn0g6ovWFZY7QymQPTYNBBX97XenHCOR39nN/jowtrdqOXi60U50:InE4KANapdg6LFZY7QdNfX97XWosPYo0

Score

1^/10

Malware Config

Signatures

Files

pes2013.exe
.exe windows:5 windows x86 arch:x86

Password: xd

1e9dfe6c5b698ebf4ba95b84673ab800

Code Sign

29:fa:b5:3f:04:e3:ef:61:ba:9c:a5:86:e6:c9:90:d2
Certificate

Issuer

CN=OptiJuegos

Not Before

01/01/2013, 03:00

Not After

01/01/2099, 03:00

Subject

CN=OptiJuegos

Extended Key Usages

ExtKeyUsageCodeSigning

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f3:2b:7c:63:5c:92:aa:b6:69:18:91:4b:14:d9:96:95:76:42:45:3d
Signer

Actual PE Digest

f3:2b:7c:63:5c:92:aa:b6:69:18:91:4b:14:d9:96:95:76:42:45:3d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

H:\soccer\pes13_final_cert\pes13\Project\vs_win_master\00_Solution\Release_LTCG\PES13_MASTER_Release_LTCG.pdb

Imports

d3d9

Direct3DCreate9

ddraw

DirectDrawCreate

dsound

ord12
ord11
ord2

kernel32

CreateDirectoryW
SetWaitableTimer
WaitForSingleObject
CancelWaitableTimer
SetThreadPriority
RaiseException
CreateWaitableTimerA
ResumeThread
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
GetCommandLineA
GetStartupInfoA
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
ExitProcess
ExitThread
CreateThread
RtlUnwind
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetCPInfo
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
HeapCreate
VirtualFree
GetTickCount
GetCurrentProcessId
HeapSize
HeapAlloc
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
IsValidCodePage
ReadFile
GetConsoleCP
GetConsoleMode
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
GetStringTypeW
GetLocaleInfoW
SetFilePointer
CreateDirectoryA
SetStdHandle
Sleep
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetTimeZoneInformation
SetEndOfFile
GetProcessHeap
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetFileSize
FindFirstFileA
RemoveDirectoryA
FindClose
MoveFileA
FindNextFileA
DeleteFileA
GetFileAttributesExA
CreateFileW
SetFileAttributesA
GetFileAttributesExW
SetFileAttributesW
InterlockedCompareExchange
InterlockedExchangeAdd
TryEnterCriticalSection
CreateSemaphoreA
ReleaseSemaphore
SetErrorMode
SuspendThread
SetFileTime
CreateEventA
GetFullPathNameA
SetEvent
GetThreadPriority
ResetEvent
GetExitCodeThread
GetFileAttributesA
CloseHandle
GetVersionExA
ReleaseMutex
QueryPerformanceFrequency
GetProcessAffinityMask
CreateMutexA
GetModuleHandleA
GetLocalTime
GetModuleFileNameW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
lstrcatA
lstrcpyA
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
GetFullPathNameW
GetCurrentDirectoryA
GetExitCodeProcess
CreateProcessA
GetDriveTypeA
SignalObjectAndWait
GetSystemDirectoryA
FindResourceA
WideCharToMultiByte
QueryPerformanceCounter
GetSystemInfo
SetCurrentDirectoryW
GetLastError
GetCurrentProcess
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GlobalMemoryStatus
CreateFileA
GetFileAttributesW
LoadLibraryA
GetProcAddress
LocalAlloc
FindNextFileW
DeleteFileW
CopyFileW
GetTempPathW
GetFileSizeEx
FreeLibrary
MultiByteToWideChar
SetThreadExecutionState
SizeofResource
WriteConsoleA
LoadResource
GetDiskFreeSpaceExW
GetStringTypeA
SetThreadAffinityMask
GetLogicalDriveStringsW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
lstrcmpiA
GetShortPathNameA
GetComputerNameA
SetNamedPipeHandleState
WaitNamedPipeA
LoadLibraryW
LoadLibraryExA
LoadLibraryExW
OutputDebugStringA
GetSystemTime
CreateFileMappingA
lstrlenW
SetCurrentDirectoryA
lstrcmpA
OpenEventA
OpenMutexA
QueryDosDeviceA
GetTempPathA
GetThreadContext
IsBadReadPtr
WritePrivateProfileStringA
VirtualQuery
MoveFileExW
RemoveDirectoryW
VirtualProtect
ConnectNamedPipe
GetStartupInfoW
CreateProcessW
CreateNamedPipeA
CopyFileA
GetTempFileNameA
GetSystemDirectoryW
MoveFileExA
GetUserDefaultLangID
LockResource
GlobalAlloc
GlobalLock
DeviceIoControl
GetLogicalDrives
GetVolumeInformationA
MapViewOfFile
OpenProcess
UnmapViewOfFile
FormatMessageA
DuplicateHandle
WaitForMultipleObjects
GetVolumeInformationW
GetFileInformationByHandle
SystemTimeToFileTime
GetEnvironmentVariableA
GetVersion
GetPriorityClass
FlushInstructionCache
lstrlenA
IsBadWritePtr
GetWindowsDirectoryA
HeapDestroy
IsBadCodePtr
SetConsoleCtrlHandler
FlushConsoleInputBuffer
LocalLock
GlobalUnlock
GlobalFree
LocalUnlock
LocalFree
ReadConsoleInputA
SetConsoleMode
CompareFileTime
GetCurrentDirectoryW
GetFileTime
SetPriorityClass

user32

RegisterDeviceNotificationA
GetWindowRect
IsIconic
AttachThreadInput
GetMonitorInfoA
RedrawWindow
DrawMenuBar
SystemParametersInfoA
GetWindowThreadProcessId
MonitorFromRect
EndPaint
SetCursor
GetMessageA
RegisterClassExA
PostQuitMessage
SetForegroundWindow
LoadIconA
GetClientRect
SetFocus
BeginPaint
TranslateMessage
MessageBoxA
GetForegroundWindow
SetWindowLongA
InvalidateRect
UnregisterClassA
GetWindowLongA
CreateWindowExA
PeekMessageA
TranslateAcceleratorA
GetCursorPos
ShowWindow
DispatchMessageA
AdjustWindowRectEx
UpdateWindow
ScreenToClient
SetWindowPos
EnumDisplaySettingsA
GetDC
ReleaseDC
ShowCursor
GetKeyboardLayout
DefWindowProcA
GetActiveWindow
PostMessageA
MessageBoxW
GetSystemMetrics
CallWindowProcA
GetDoubleClickTime
SetWindowTextW
EnableWindow
FlashWindow
SendMessageW
DestroyWindow
CreateWindowExW
CharLowerBuffA
SetWindowTextA
GetSysColor
GetProcessWindowStation
GetUserObjectInformationW
GetDesktopWindow
SetDlgItemTextA
SetDlgItemTextW
EndDialog
GetKeyboardType
SendMessageA
GetSubMenu
GetMenu
EnableMenuItem
CheckMenuItem
CharLowerA
LoadCursorA
GetWindowTextA
GetParent
GetClassNameA
GetClassLongA
EnumChildWindows
DestroyCursor
wsprintfA
GetCursor
FindWindowExA
FindWindowA
EnumWindows
UnregisterHotKey
RegisterHotKey
GetDlgItem
DialogBoxIndirectParamA
SendDlgItemMessageA
GetSysColorBrush
LoadStringA
CopyImage
wsprintfW
LoadImageA
SetSystemCursor
GetMenuState
LoadCursorFromFileA

gdi32

GetDeviceCaps
GetStockObject

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptCreateHash
CryptImportKey
CryptGetHashParam
CryptSetHashParam
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
RegisterEventSourceA
RegEnumValueA
OpenThreadToken
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
IsValidSid
QueryServiceStatus
CloseServiceHandle
OpenServiceA
OpenSCManagerA
DeleteService
ControlService
StartServiceA
CreateServiceA
DeregisterEventSource
ReportEventA
RegEnumKeyA
RegSetKeySecurity
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
GetUserNameA
RegDeleteKeyA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteA
SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderPathW
ShellExecuteExA
SHGetSpecialFolderPathA

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitialize

d3dx9_30

D3DXGetImageInfoFromFileInMemory
D3DXCreateCubeTextureFromFileInMemoryEx
D3DXCreateTextureFromFileInMemoryEx
D3DXCreateVolumeTextureFromFileInMemoryEx
D3DXAssembleShader
D3DXCompileShader
D3DXGetShaderConstantTable
D3DXGetVertexShaderProfile
D3DXCreateTexture
D3DXLoadSurfaceFromMemory
D3DXLoadVolumeFromMemory
D3DXGetPixelShaderProfile
D3DXCreateVolumeTexture
D3DXCreateCubeTexture

winmm

timeKillEvent
timeSetEvent
timeGetSystemTime
timeBeginPeriod
timeGetTime

imm32

ImmGetContext
ImmAssociateContext

dinput8

DirectInput8Create

wininet

InternetCloseHandle
InternetOpenA
HttpSendRequestA
InternetSetStatusCallback
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCrackUrlA
InternetReadFileExA
InternetConnectA
HttpQueryInfoA

winhttp

WinHttpCheckPlatform
WinHttpReadData
WinHttpOpenRequest
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpSetStatusCallback
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpReceiveResponse

iphlpapi

GetIpAddrTable
SetIpForwardEntry
GetBestRoute
GetIpForwardTable
GetAdaptersInfo
GetNetworkParams
GetIfEntry
GetBestInterface
GetAdaptersAddresses

oleaut32

SysStringLen
SysFreeString
SysAllocString

shlwapi

PathFileExistsW
PathCombineA
PathCombineW
PathRemoveExtensionA
PathRemoveExtensionW
PathRemoveFileSpecA
PathFileExistsA
PathStripPathW
PathStripPathA
PathRemoveFileSpecW

comctl32

InitCommonControlsEx

wsock32

recv
WSASetLastError
send
shutdown
WSAGetLastError
closesocket

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 15.8MB - Virtual size: 15.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PSFD00
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 993KB - Virtual size: 6.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Stext
Size: 5.0MB - Virtual size: 10.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sitext
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Srdata
Size: 540KB - Virtual size: 540KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sdata
Size: 1.1MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sidata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.securom
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: xd

1e9dfe6c5b698ebf4ba95b84673ab800

Code Sign

29:fa:b5:3f:04:e3:ef:61:ba:9c:a5:86:e6:c9:90:d2Certificate

Extended Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

f3:2b:7c:63:5c:92:aa:b6:69:18:91:4b:14:d9:96:95:76:42:45:3dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d9

ddraw

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

d3dx9_30

winmm

imm32

dinput8

wininet

winhttp

iphlpapi

oleaut32

shlwapi

comctl32

wsock32

version

Sections

.text Size: 15.8MB - Virtual size: 15.8MB

PSFD00 Size: 7KB - Virtual size: 8KB

.rdata Size: 1.9MB - Virtual size: 1.9MB

.data Size: 993KB - Virtual size: 6.5MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 160KB - Virtual size: 164KB

Stext Size: 5.0MB - Virtual size: 10.1MB

Sitext Size: 32KB - Virtual size: 32KB

Srdata Size: 540KB - Virtual size: 540KB

Sdata Size: 1.1MB - Virtual size: 3.3MB

Sidata Size: 28KB - Virtual size: 28KB

.securom Size: 2.6MB - Virtual size: 2.6MB

29:fa:b5:3f:04:e3:ef:61:ba:9c:a5:86:e6:c9:90:d2
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

f3:2b:7c:63:5c:92:aa:b6:69:18:91:4b:14:d9:96:95:76:42:45:3d
Signer

.text
Size: 15.8MB - Virtual size: 15.8MB

PSFD00
Size: 7KB - Virtual size: 8KB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 993KB - Virtual size: 6.5MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 160KB - Virtual size: 164KB

Stext
Size: 5.0MB - Virtual size: 10.1MB

Sitext
Size: 32KB - Virtual size: 32KB

Srdata
Size: 540KB - Virtual size: 540KB

Sdata
Size: 1.1MB - Virtual size: 3.3MB

Sidata
Size: 28KB - Virtual size: 28KB

.securom
Size: 2.6MB - Virtual size: 2.6MB