C:\Users\coop\Downloads\KeyAuth-CSGO-Loader-main\KeyAuth-CSGO-Loader-main\Release\Loader.pdb
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader_protected.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
22 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Loader_protected.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
1800 seconds
Behavioral task
behavioral3
Sample
processhacker-2.39-setup (1).exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
1800 seconds
General
-
Target
Loader_protected.zip
-
Size
3.6MB
-
MD5
fb8ca54509b0f16a1a026f1cf75f01ae
-
SHA1
ec126bc5c27c337d68d2a59578961167e5426736
-
SHA256
b5ead9cfb4ea0dfda439e61c9bd72c022aa356d19c8eed94fcb6680a984e079e
-
SHA512
a464473ac6ad900b43ba5f5d3164cf1904afb77938101f5ecf9c8eaea206c7aee368cb931de06acc65aadf8a8913e2bc958d6f776e288da9813cb024eef49a92
-
SSDEEP
98304:hcDC2rMgxCNhqBjxxYOPUhcniZztuRoT7Dof681qEWGLAH:hctrVxWqB9PUh19T7D7EW7
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Loader_protected.exe
Files
-
Loader_protected.zip.zip
-
Loader_protected.exe.exe windows:6 windows x86 arch:x86
b141bdc9f9eedc6337e0c93f768995b9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
socket
WSAGetLastError
bind
connect
getpeername
getsockname
freeaddrinfo
getaddrinfo
ioctlsocket
listen
htonl
accept
select
__WSAFDIsSet
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
setsockopt
ntohs
htons
getsockopt
closesocket
send
recv
getnameinfo
shutdown
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
CertAddCertificateContextToStore
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertOpenStore
advapi32
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
GetTokenInformation
CopySid
IsValidSid
OpenProcessToken
GetLengthSid
kernel32
MultiByteToWideChar
FormatMessageW
GetFileType
WriteFile
GetModuleHandleW
GetCurrentProcessId
GetSystemTimeAsFileTime
OutputDebugStringW
DeleteFiber
CreateFiber
LoadLibraryW
ConvertFiberToThread
ConvertThreadToFiber
FindClose
FindFirstFileW
FindNextFileW
GetSystemTime
SystemTimeToFileTime
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
CreateEventW
ResetEvent
SetEvent
SwitchToFiber
Process32First
WriteProcessMemory
HeapFree
SetLastError
SetConsoleTitleA
GetCurrentProcess
OutputDebugStringA
InitializeCriticalSectionEx
GetModuleHandleA
OpenProcess
HeapSize
CreateToolhelp32Snapshot
Sleep
GetLastError
CreateFileA
GetCurrentThread
LoadLibraryA
DeleteFileA
Process32Next
HeapReAlloc
CloseHandle
HeapAlloc
SetFileAttributesA
HeapDestroy
GetThreadContext
Beep
GetProcAddress
VirtualAllocEx
LocalFree
DeleteCriticalSection
GetProcessHeap
CreateRemoteThread
SetConsoleOutputCP
IsDebuggerPresent
CheckRemoteDebuggerPresent
QueryPerformanceCounter
QueryPerformanceFrequency
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
SleepEx
VerSetConditionMask
GetSystemDirectoryA
FreeLibrary
VerifyVersionInfoA
GetTickCount
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetFileSizeEx
ReadFile
GetEnvironmentVariableW
WideCharToMultiByte
GetStdHandle
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
user32
GetUserObjectInformationW
FindWindowA
MessageBoxA
GetProcessWindowStation
MessageBoxW
shell32
ShellExecuteA
msvcp140
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
_Thrd_detach
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
userenv
UnloadUserProfile
rpcrt4
RpcStringFreeA
UuidToStringA
UuidCreate
urlmon
URLDownloadToFileA
bcrypt
BCryptGenRandom
vcruntime140
strrchr
strchr
memset
memmove
memchr
_CxxThrowException
strstr
__std_terminate
__std_type_info_name
_purecall
wcsstr
memcpy
_except_handler4_common
__current_exception
__current_exception_context
__std_exception_destroy
__RTDynamicCast
__std_type_info_compare
__std_exception_copy
__CxxFrameHandler3
api-ms-win-crt-runtime-l1-1-0
_controlfp_s
_beginthreadex
_invalid_parameter_noinfo
strerror
exit
__sys_nerr
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_resetstkoflw
_initterm
_get_initial_narrow_environment
_invalid_parameter_noinfo_noreturn
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
system
terminate
raise
_errno
_exit
_initterm_e
strerror_s
signal
api-ms-win-crt-stdio-l1-1-0
_fseeki64
_wfopen
fread
fwrite
__stdio_common_vswprintf
setbuf
fputc
fflush
fclose
clearerr
fsetpos
_setmode
_fileno
ferror
feof
__stdio_common_vfprintf
__stdio_common_vsprintf
fgetc
fgets
__p__commode
fgetpos
ftell
setvbuf
fseek
ungetc
_set_fmode
__stdio_common_vsscanf
fputs
fopen
__acrt_iob_func
_get_stream_buffer_pointers
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
realloc
calloc
_callnewh
_aligned_malloc
_aligned_free
malloc
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
_gmtime64_s
_localtime64_s
api-ms-win-crt-convert-l1-1-0
strtod
strtoull
atoi
strtol
strtoll
strtoul
api-ms-win-crt-string-l1-1-0
_strnicmp
_strdup
isspace
strcspn
strspn
isupper
strcmp
strpbrk
strncmp
_stricmp
tolower
strncpy
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
_stat64
_fstat64i32
_access
_stat64i32
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-math-l1-1-0
_dclass
__setusermatherr
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 497KB - Virtual size: 496KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vlizer Size: 527KB - Virtual size: 528KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
processhacker-2.39-setup (1).exe.exe windows:1 windows x86 arch:x86
Code Sign
0f:f1:ef:66:bd:62:1c:65:b7:4b:4d:e4:14:25:71:7fCertificate
IssuerCN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before30/10/2013, 00:00Not After04/01/2017, 12:00SubjectCN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AUExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate
IssuerCN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before22/10/2014, 00:00Not After22/10/2024, 00:00SubjectCN=DigiCert Timestamp Responder,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5fCertificate
IssuerCN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before11/02/2011, 12:00Not After10/02/2026, 12:00SubjectCN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before10/11/2006, 00:00Not After10/11/2021, 00:00SubjectCN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
04:0c:b4:1e:4f:b3:70:c4:5c:43:44:76:51:62:58:2fCertificate
IssuerCN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before30/10/2013, 00:00Not After04/01/2017, 12:00SubjectCN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AUExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9Certificate
IssuerCN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before22/10/2013, 12:00Not After22/10/2028, 12:00SubjectCN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
02:ce:42:94:59:02:a4:f3:c0:40:b0:ff:77:93:d1:4fCertificate
IssuerCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before24/12/2015, 00:00Not After07/01/2025, 00:00SubjectCN=DigiCert SHA2 Timestamp Responder,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before07/01/2016, 12:00Not After07/01/2031, 12:00SubjectCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
83:33:12:d6:73:40:58:da:f9:36:91:31:58:17:af:f2:3f:e7:11:0a:e3:31:bd:85:7b:43:70:47:90:53:db:12Signer
Actual PE Digest83:33:12:d6:73:40:58:da:f9:36:91:31:58:17:af:f2:3f:e7:11:0a:e3:31:bd:85:7b:43:70:47:90:53:db:12Digest Algorithmsha256PE Digest Matchestrueb1:cd:ff:77:4a:7c:de:e6:76:24:73:fd:3c:9a:c6:c7:05:79:d7:d3Signer
Actual PE Digestb1:cd:ff:77:4a:7c:de:e6:76:24:73:fd:3c:9a:c6:c7:05:79:d7:d3Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 592B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ