File-Half-Life[.]2[.]Episode[.]One-814859[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

File-Half-Life.2.Episode.One-814859.zip
Size

20.2MB
MD5

922d8d7507de81d6b759f0dee4c9f660
SHA1

2b73125d2065c767f65e6f7978440c46b34a3994
SHA256

93c12f7eb9159a3b52c1607fa5b8ab0ecab478986df5fc98e923c716b9b0561f
SHA512

aa7ff9307a63f0c0ad1e838116e040e0ca8737b8ac70a423c402500143851da3ab8ccd07f2f4ed54a07026794544ba1a307e3bf259d8aa906cc0bf879a765d98
SSDEEP

393216:2WL7MWhgHLU/AcwHQWJCLwHMqU3hS9kwIcuPVwuOIXNGKxF09YfkzKxA:2WL7UNDRCMHMh3hS9kYudwhIcc8KxA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Setup_10024.exe

Files

File-Half-Life.2.Episode.One-814859.zip
.zip
Setup_10024.exe
.exe windows:6 windows x86 arch:x86

d514a0a043584816db80d35d2586aa85

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW

kernel32

GetFileAttributesA
DeleteCriticalSection
GetFileAttributesExW
SetFileAttributesW
GetDateFormatW
FindFirstFileExA
WaitForMultipleObjects
HeapSize
CreateSemaphoreA
LocalFree
GetSystemTimeAsFileTime
GetModuleFileNameW
SetEnvironmentVariableA
IsValidCodePage
TerminateProcess
CreateFileA
GetModuleHandleExW
GetVersion
TryAcquireSRWLockExclusive
FreeEnvironmentStringsW
GetProcessHeap
HeapAlloc
GetDriveTypeW
CreateDirectoryW
InitializeCriticalSection
GetFileAttributesW
RtlUnwind
SetFilePointerEx
VirtualAlloc
SetCurrentDirectoryW
SetFileAttributesA
AcquireSRWLockExclusive
GetCPInfo
ReadFile
GetTempPathW
SetUnhandledExceptionFilter
FindNextFileW
GetCurrentProcess
CreateThread
CreateDirectoryA
FormatMessageA
WakeAllConditionVariable
GetLocaleInfoW
ResetEvent
IsValidLocale
UnhandledExceptionFilter
WriteConsoleW
EncodePointer
GetFileInformationByHandle
DeleteFileA
TlsSetValue
GetFileType
GetStringTypeW
LoadLibraryExW
FormatMessageW
SetFileTime
GetTickCount64
GetACP
GetTickCount
SetStdHandle
GlobalMemoryStatus
LeaveCriticalSection
InitializeSListHead
HeapFree
SetFilePointer
EnterCriticalSection
MultiByteToWideChar
GetTimeZoneInformation
SetEvent
ExitThread
TlsFree
LCMapStringEx
GetVersionExA
WriteFile
GetConsoleCP
FindFirstFileW
GetUserDefaultLCID
GetFileSizeEx
FlushFileBuffers
FindClose
GetFullPathNameW
SleepEx
Sleep
TlsAlloc
GetCurrentProcessId
TlsGetValue
GetSystemDirectoryW
CreateEventA
ExitProcess
ReleaseSemaphore
LoadLibraryW
VerifyVersionInfoW
WideCharToMultiByte
WaitForSingleObjectEx
DeleteFileW
RemoveDirectoryW
RemoveDirectoryA
LCMapStringW
GetTimeFormatW
DecodePointer
GetLastError
GetModuleHandleW
GetModuleHandleA
GetFileSize
GetCurrentDirectoryW
FindFirstFileA
GetTempPathA
SetLastError
GetOEMCP
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
IsDebuggerPresent
GetConsoleMode
HeapReAlloc
GetModuleFileNameA
lstrcatA
GetEnvironmentVariableA
GetFinalPathNameByHandleW
FreeLibraryAndExitThread
CreateFileW
AreFileApisANSI
GetStdHandle
PeekNamedPipe
RaiseException
GetEnvironmentStringsW
GetStartupInfoW
ReadConsoleW
GetLocaleInfoEx
QueryPerformanceCounter
WaitForSingleObject
MoveFileExW
LoadLibraryA
CloseHandle
EnumSystemLocalesW
QueryPerformanceFrequency
FindNextFileA
CompareStringW
SystemTimeToTzSpecificLocalTime
GetProcAddress
GetCommandLineW
FreeLibrary
IsProcessorFeaturePresent
VerSetConditionMask
GetCurrentThreadId
ReleaseSRWLockExclusive
GetCommandLineA
lstrlenA
VirtualFree
SetEndOfFile
GetSystemInfo
GetProcessAffinityMask
FileTimeToSystemTime
GetCurrentDirectoryA
SetCurrentDirectoryA

user32

DialogBoxParamA
KillTimer
GetDlgItem
DialogBoxParamW
EndDialog
DestroyWindow
CharUpperW
LoadStringA
SetWindowTextW
SendMessageA
GetWindowLongA
ShowWindow
SetWindowTextA
SetTimer
wsprintfA
MessageBoxA
SetWindowLongA
PostMessageA
CharUpperA
LoadIconA
LoadStringW
MessageBoxW

shell32

ShellExecuteExA

oleaut32

VariantClear
SysAllocStringLen
SysStringLen

bcrypt

BCryptGenRandom

advapi32

CryptDestroyKey
CryptImportKey
CryptAcquireContextW
CryptEncrypt
CryptReleaseContext
CryptCreateHash
CryptDestroyHash
CryptHashData
CryptGetHashParam

crypt32

CertFreeCertificateContext
CertCreateCertificateChainEngine
CertCloseStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertFreeCertificateChain
PFXImportCertStore
CertOpenStore
CryptDecodeObjectEx
CertFindCertificateInStore
CertFreeCertificateChainEngine
CertGetCertificateChain
CertGetNameStringW
CryptQueryObject
CertFindExtension
CryptStringToBinaryW

wldap32

ord216
ord301
ord145
ord219
ord46
ord14
ord147
ord73
ord208
ord41
ord117
ord26
ord27
ord127
ord167
ord142
ord79
ord133

ws2_32

gethostname
htons
getsockopt
send
WSACloseEvent
WSACreateEvent
WSAWaitForMultipleEvents
WSAResetEvent
WSAEnumNetworkEvents
WSAIoctl
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
ioctlsocket
setsockopt
WSAEventSelect
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
socket
getaddrinfo
freeaddrinfo
recvfrom
sendto
getpeername

Sections

.text
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d514a0a043584816db80d35d2586aa85

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

shell32

oleaut32

bcrypt

advapi32

crypt32

wldap32

ws2_32

Sections

.text Size: 6.1MB - Virtual size: 6.1MB

.rdata Size: 200KB - Virtual size: 200KB

.data Size: 7KB - Virtual size: 19KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 72KB - Virtual size: 71KB

.text
Size: 6.1MB - Virtual size: 6.1MB

.rdata
Size: 200KB - Virtual size: 200KB

.data
Size: 7KB - Virtual size: 19KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 72KB - Virtual size: 71KB