f30c9491ab2bc19e5e19098ddc7b76c0b9a237ada313de35f1c9a1246b904835

Sharing

Copy URL Twitter E-mail

General

Target
f30c9491ab2bc19e5e19098ddc7b76c0b9a237ada313de35f1c9a1246b904835
Size 1.9MB
Sample260602-k2swtahv7x
SHA256 f30c9491ab2bc19e5e19098ddc7b76c0b9a237ada313de35f1c9a1246b904835
MD5 21fc860e4cc3700b47afaf6be9642d9e
SHA1 f071fbfd50cdfcda6e0b842172a0a7f02903992f
SHA512 f8385f3485ac845e70230a9db3ee99b125352b9732fa1a46a9855b370efc941eeaeed5113835f0dc78253742f6388345fb792310d093212ff98dc770e103808a
SSDEEP 49152:OLm8qVfQIcKNbZ9NQ7MGO7j2v54O8gJl7JQ:6E3NbZXy
TLSH
T127955C21E382911AFEF305FA89BD216D952CA7F1071844CB91C82ADED779BE07E31617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f30c9491ab2bc19e5e19098ddc7b76c0b9a237ada313de35f1c9a1246b904835

File Explorer

f30c9491ab2bc19e5e19098ddc7b76c0b9a237ada313de35f1c9a1246b904835

.exe 1.9MB

f30c9491ab2bc19e5e19098ddc7b76c0b9a237ada313de35f1c9a1246b904835

IMPHASH bb1460091e1e44c95f237ed760bcc19d
SHA256 f30c9491ab2bc19e5e19098ddc7b76c0b9a237ada313de35f1c9a1246b904835
MD5 21fc860e4cc3700b47afaf6be9642d9e
SHA1 f071fbfd50cdfcda6e0b842172a0a7f02903992f
SHA512 f8385f3485ac845e70230a9db3ee99b125352b9732fa1a46a9855b370efc941eeaeed5113835f0dc78253742f6388345fb792310d093212ff98dc770e103808a
SSDEEP 49152:OLm8qVfQIcKNbZ9NQ7MGO7j2v54O8gJl7JQ:6E3NbZXy
TLSH
T127955C21E382911AFEF305FA89BD216D952CA7F1071844CB91C82ADED779BE07E31617
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4346

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\UEProgram\FirstGame\Steamv159\sdk\steamworksexample\Debug\steamworksexample.pdb

d3dx9_43

D3DXCreateFontA

kernel32

IsDebuggerPresent OutputDebugStringA CloseHandle QueryPerformanceCounter QueryPerformanceFrequency SetEvent WaitForSingleObject CreateEventA Sleep GetCurrentThread SetThreadAffinityMask RaiseException ReadFile CreateFileW GetConsoleMode ReadConsoleW FlushFileBuffers DecodePointer SetFilePointerEx GetFileSizeEx HeapQueryInformation HeapSize HeapReAlloc HeapFree GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetConsoleOutputCP GetCurrentProcess GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetConsoleCtrlHandler OutputDebugStringW GetCurrentDirectoryW SetCurrentDirectoryW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetTempPathW WideCharToMultiByte MultiByteToWideChar GetSystemInfo HeapValidate HeapAlloc WriteFile ExitProcess WriteConsoleW GetFileType GetStdHandle GetModuleHandleExW GetModuleFileNameW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter SetEndOfFile TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetDriveTypeW GetFullPathNameW

user32

LoadCursorA GetClientRect LoadIconA RegisterClassA MessageBoxA GetMessageA TranslateMessage DispatchMessageA PeekMessageA DefWindowProcA PostQuitMessage UpdateWindow UnregisterClassA CreateWindowExA DestroyWindow ShowWindow SetFocus GetForegroundWindow

gdi32

GetStockObject

ole32

CoInitializeEx CoUninitialize

sdkencryptedappticket

SteamEncryptedAppTicket_BDecryptTicket SteamEncryptedAppTicket_GetTicketSteamID SteamEncryptedAppTicket_GetUserVariableData SteamEncryptedAppTicket_BIsTicketForApp

steam_api

SteamInternal_CreateInterface SteamInternal_FindOrCreateUserInterface SteamAPI_Shutdown SteamAPI_RestartAppIfNecessary SteamAPI_WriteMiniDump SteamAPI_GetHSteamUser SteamInternal_SteamAPI_Init SteamAPI_RegisterCallResult SteamAPI_UnregisterCallResult SteamAPI_RegisterCallback SteamAPI_UnregisterCallback SteamAPI_RunCallbacks SteamInternal_FindOrCreateGameServerInterface SteamGameServer_RunCallbacks SteamGameServer_GetHSteamUser SteamGameServer_Shutdown SteamInternal_GameServer_Init_V2 SteamInternal_ContextInit SteamAPI_SetMiniDumpComment

d3d9

Direct3DCreate9

xaudio2_9

ord1

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

315KB

Virtual Size

314KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f30c9491ab2bc19e5e19098ddc7b76c0b9a237ada313de35f1c9a1246b904835

d3dx9_43

kernel32

user32

gdi32

ole32

sdkencryptedappticket

steam_api

d3d9

xaudio2_9

generic