RE4 STEAM DOWNLOADER[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

RE4 STEAM DOWNLOADER.rar
Size

3.6MB
MD5

03b91aa4f0a18909a9949821fcb411a0
SHA1

7df56551dba5c9f22b79d241d89ae2ea2da94856
SHA256

f9682ed19930bf548f4fb1ca0bc88955b234f77b179f94900b53fe8044e39a67
SHA512

afe7a71f8852726eee5a0bbf0fd364004bc7262a0c2a4ce16ba304ac30fafdde81448ea2762d2e1881444a37596a91f10a27ad6b323503328dd1d2fbea169edf
SSDEEP

98304:1hZrR1pVpyBHY9E5kK4Pi8lmCbq2ryoOXl4XSF:1hNR1pVsSGxKi8lyAyoOXlPF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/downloader.exe

Files

RE4 STEAM DOWNLOADER.rar
.rar
config
downloader.exe
.exe windows:6 windows x64 arch:x64

2a893061ba36fc7f91848f738ea3b7d3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

downloader.pdb

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
HeapFree
SwitchToThread
CloseHandle
QueryPerformanceCounter
SetFileInformationByHandle
FlushFileBuffers
SetFilePointerEx
WaitForSingleObject
GetCurrentProcess
DuplicateHandle
GetLastError
CreateWaitableTimerExW
Sleep
SetWaitableTimer
GetSystemInfo
HeapReAlloc
GetStdHandle
GetFileType
FlushConsoleInputBuffer
ReadConsoleInputW
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GetConsoleMode
GetFileInformationByHandleEx
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
SetConsoleCursorPosition
SetConsoleMode
GetQueuedCompletionStatusEx
SetLastError
GetFinalPathNameByHandleW
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetModuleHandleA
GetProcAddress
PostQueuedCompletionStatus
GetSystemTimePreciseAsFileTime
MultiByteToWideChar
WriteConsoleW
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
lstrlenW
GetEnvironmentVariableW
CreateFileW
GetFileInformationByHandle
GetFullPathNameW
CreateDirectoryW
FindFirstFileW
FindClose
IsDebuggerPresent
HeapAlloc
GetProcessHeap
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
ReleaseMutex
RtlVirtualUnwind
WideCharToMultiByte
SetHandleInformation
CreateThread
LoadLibraryExA
InitializeSListHead
UnhandledExceptionFilter

crypt32

CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenStore
CertVerifyCertificateChainPolicy
CertAddCertificateContextToStore
CertDuplicateStore
CertEnumCertificatesInStore
CertGetCertificateChain
CertDuplicateCertificateChain
CertFreeCertificateChain
CertCloseStore

ntdll

NtWriteFile
NtCreateFile
RtlNtStatusToDosError
NtReadFile
NtCancelIoFileEx
NtDeviceIoControlFile

ws2_32

WSAGetLastError
getpeername
setsockopt
WSASend
send
recv
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
closesocket
getsockopt
connect
bind
WSAIoctl
ioctlsocket
WSASocketW
shutdown
getsockname

advapi32

RegCloseKey
RegQueryValueExW
SystemFunction036
RegOpenKeyExW

secur32

AcceptSecurityContext
InitializeSecurityContextW
DecryptMessage
FreeCredentialsHandle
AcquireCredentialsHandleA
DeleteSecurityContext
ApplyControlToken
QueryContextAttributesW
FreeContextBuffer
EncryptMessage

bcrypt

BCryptGenRandom

oleaut32

SysFreeString
SysStringLen

vcruntime140

__CxxFrameHandler3
memcpy
memcmp
__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
memset
memmove

api-ms-win-crt-math-l1-1-0

trunc
ceil
pow
truncf
__setusermatherr
round

api-ms-win-crt-runtime-l1-1-0

_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_exit
_initterm_e
_register_onexit_function
_initialize_onexit_table
_set_app_type
_seh_filter_exe
__p___argc
__p___argv
terminate
_crt_atexit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2a893061ba36fc7f91848f738ea3b7d3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

crypt32

ntdll

ws2_32

advapi32

secur32

bcrypt

oleaut32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 100KB - Virtual size: 100KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 100KB - Virtual size: 100KB

.reloc
Size: 11KB - Virtual size: 11KB