MKKE[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MKKE.exe
Size 11.1MB
Sample260605-phpghagt7q
SHA256 ebc52aa29752feb6de39dd49faf02c3b2c06db97c90a2ca4e77db0a7f89bc21d
MD5 ffcaeffc1039e460ba31b28ab2226f78
SHA1 50b238914b26153a7caa1ffe36e6a06875bbd7b3
SHA512 9285f5487b17b4ad6cb1978f522050dce4e3260ab3a069e973b39e03e209e8e7cb8021aced9f77d7b3e257b7e89a805c164ab711e874d5ec5d3dd85e9d9e3561
SSDEEP 98304:fnMYb7qdNyYpQVJJFD8WV3I9qxJ2tGDYWpOOiTPumYRKBN7Ra13ZTq6i2M:PMYb7qdkzxAWpULwKz2M
TLSH
T104C66C40A7EBC1B4CE4A38757166372FD529D2451B182AC7E3E8294D9EF26C03EF7246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MKKE.exe

File Explorer

MKKE.exe

.exe 11.1MB

MKKE.exe

IMPHASH bb1172430811e02e99398d7e0926dea1
SHA256 ebc52aa29752feb6de39dd49faf02c3b2c06db97c90a2ca4e77db0a7f89bc21d
MD5 ffcaeffc1039e460ba31b28ab2226f78
SHA1 50b238914b26153a7caa1ffe36e6a06875bbd7b3
SHA512 9285f5487b17b4ad6cb1978f522050dce4e3260ab3a069e973b39e03e209e8e7cb8021aced9f77d7b3e257b7e89a805c164ab711e874d5ec5d3dd85e9d9e3561
SSDEEP 98304:fnMYb7qdNyYpQVJJFD8WV3I9qxJ2tGDYWpOOiTPumYRKBN7Ra13ZTq6i2M:PMYb7qdkzxAWpULwKz2M
TLSH
T104C66C40A7EBC1B4CE4A38757166372FD529D2451B182AC7E3E8294D9EF26C03EF7246
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7859071

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Develop\Combo\MK9\Binaries\MK9PCGame-Retail.pdb

dbghelp

SymGetModuleInfo64 SymGetOptions SymSetOptions SymInitialize SymLoadModule64 SymGetModuleBase64 SymFunctionTableAccess64 StackWalk64 SymGetLineFromAddr64 SymGetSymFromAddr64 MiniDumpWriteDump

binkw32

_BinkGetFrameBuffersInfo@8 _BinkNextFrame@4 _BinkDoFrame@4 _BinkClose@4 _BinkSetVolume@12 _BinkGoto@12 _BinkPause@8 _BinkOpenDirectSound@4 _BinkSetSoundSystem@8 _BinkSetSoundTrack@8 _BinkOpen@8 _BinkWait@4 _BinkRegisterFrameBuffers@8 _BinkShouldSkip@4 _BinkGetRects@8

ws2_32

getsockname listen htonl gethostname ntohl recvfrom WSAStartup bind freeaddrinfo getaddrinfo select sendto accept setsockopt WSACleanup send getsockopt ntohs connect WSACancelAsyncRequest recv WSAAsyncGetHostByName htons gethostbyname inet_addr WSAGetLastError socket ioctlsocket closesocket

kernel32

SleepEx GetFileType ExpandEnvironmentStringsA PeekNamedPipe WaitForMultipleObjects GetStartupInfoA TerminateProcess UnhandledExceptionFilter QueryPerformanceCounter DebugBreak IsDebuggerPresent InterlockedExchangeAdd InterlockedExchange GetCurrentThreadId DeleteCriticalSection CreateMutexA ReleaseMutex CloseHandle WaitForSingleObject OpenMutexA GetLastError GetCommandLineA SetErrorMode GetVersionExA GetCommandLineW GetCurrentProcess GetCurrentProcessId CreateFileA CreateSemaphoreA InterlockedDecrement InterlockedIncrement GetTickCount ReleaseSemaphore GetSystemInfo SetFilePointer WriteFile DeleteFileA FlushFileBuffers VirtualFree GlobalMemoryStatusEx VirtualAlloc ConvertFiberToThread SwitchToFiber ConvertThreadToFiber DeleteFiber QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection Sleep MultiByteToWideChar WideCharToMultiByte lstrlenW GetComputerNameA RaiseException CreateEventA SetEvent ResetEvent TerminateThread SetThreadPriority LocalAlloc ReadFile SetCurrentDirectoryA GetFileSize SetFileAttributesA GetFileAttributesA lstrlenA SetEndOfFile CreateDirectoryA SetThreadAffinityMask CreateThread GetFileSizeEx CopyFileA MoveFileExA FindClose FindNextFileA FindFirstFileA RemoveDirectoryA ExitProcess LoadLibraryA FreeLibrary GetProcAddress GetLocalTime GlobalMemoryStatus GetCurrentThread FormatMessageA GlobalUnlock GlobalLock GlobalAlloc CreateProcessA CreateProcessW GetModuleFileNameW GetModuleFileNameA GetUserDefaultUILanguage OutputDebugStringA GetPrivateProfileStringW CreateFileW CreateDirectoryW InterlockedCompareExchange SetCriticalSectionSpinCount SetStdHandle FreeConsole GetConsoleWindow SetConsoleScreenBufferSize GetStdHandle AllocConsole WriteConsoleA SetConsoleWindowInfo GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleA SetUnhandledExceptionFilter GetSystemTimeAsFileTime VirtualQuery SetLastError GetSystemDirectoryA SetWaitableTimer CreateWaitableTimerA OpenFile GetTempPathA GetTimeZoneInformation

user32

ClipCursor MapWindowPoints PostQuitMessage GetKeyboardLayout DestroyWindow PostMessageA IsWindow GetClientRect GetClipCursor ScreenToClient GetCursorPos SetCursorPos ClientToScreen InvalidateRect GetSystemMetrics EndPaint BeginPaint DefWindowProcA SetForegroundWindow UpdateWindow ShowWindow MapVirtualKeyA SystemParametersInfoA RegisterClassExA LoadCursorA CloseClipboard SetClipboardData EmptyClipboard GetActiveWindow CharLowerBuffA ShowCursor SetCapture SetWindowPos GetWindowRect SetWindowLongA AdjustWindowRect GetClipboardData GetKeyState SetActiveWindow SetFocus SetCursor GetDesktopWindow LoadIconA ReleaseCapture wsprintfW IsIconic GetForegroundWindow MessageBoxW MessageBoxA TranslateMessage PeekMessageA DispatchMessageA CreateWindowExA OpenClipboard

gdi32

CreateCompatibleBitmap GetDIBits GetStockObject DeleteObject CreateDIBSection SetDIBits CreateCompatibleDC SelectObject GetObjectA BitBlt DeleteDC

advapi32

CryptGenRandom RegCloseKey RegSetValueExA RegQueryValueExA RegOpenKeyExA RegOpenKeyA RegEnumKeyA CryptReleaseContext CryptAcquireContextA

shell32

CommandLineToArgvW SHGetFolderPathW SHGetFolderPathA ShellExecuteA

ole32

CoSetProxyBlanket CoCreateInstance CoInitialize CoCreateGuid CoUninitialize PropVariantClear CLSIDFromString CoTaskMemFree

oleaut32

SysAllocString SysFreeString

msvcp90

?length@?$char_traits@D@std@@SAIPBD@Z ?assign@?$char_traits@D@std@@SAXAADABD@Z ?_Copy_s@?$char_traits@D@std@@SAPADPADIPBDI@Z ?max@?$numeric_limits@I@std@@SAIXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?good@ios_base@std@@QBE_NXZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?width@ios_base@std@@QBEHXZ ?flags@ios_base@std@@QBEHXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z ?width@ios_base@std@@QAEHH@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?uncaught_exception@std@@YA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?_BADOFF@std@@3JB ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?to_int_type@?$char_traits@D@std@@SAHABD@Z ?eq@?$char_traits@D@std@@SA_NABD0@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?eof@?$char_traits@D@std@@SAHXZ ?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z ?not_eof@?$char_traits@D@std@@SAHABH@Z ?to_char_type@?$char_traits@D@std@@SADABH@Z ?compare@?$char_traits@D@std@@SAHPBD0I@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?ends@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Xlen@_String_base@std@@SAXXZ ?_Xran@_String_base@std@@SAXXZ ?deallocate@?$allocator@G@std@@QAEXPAGI@Z ?allocate@?$allocator@G@std@@QAEPAGI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPBDH@Z ?_Xsgetn_s@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADIH@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADH@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z

msvcr90

isupper islower _stat64 __sys_nerr strerror getenv fputc strcat _fstat64 _lseeki64 _CIfmod _purecall ispunct toupper _stricmp memmove memcpy __CxxFrameHandler3 memset strncpy free malloc strncmp _strnicmp strstr atoi wcsstr swscanf sprintf strncpy_s _CIacos ceil _CIpow __libm_sse2_atan2 isdigit __libm_sse2_sin __libm_sse2_cos __libm_sse2_pow __libm_sse2_acos atof floor strrchr _snprintf _atoi64 __libm_sse2_atan rand isgraph _aligned_realloc _aligned_malloc _aligned_free vsprintf _vsnprintf _vswprintf_c_l _vscprintf vsprintf_s ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ _CxxThrowException ??0exception@std@@QAE@ABV01@@Z _invalid_parameter_noinfo strchr strncat qsort memmove_s _utime64 _difftime64 _gmtime64 _time64 _stat64i32 tolower strtod _wcsicmp wcsncpy exit sscanf _CIcos _getcwd abort ??0exception@std@@QAE@XZ isalpha fclose feof fopen fread __libm_sse2_tan sprintf_s wcstombs wcsncmp _CIasin strtoul __libm_sse2_asin _strtime _strdate __libm_sse2_exp __libm_sse2_log printf _wcsnicmp isspace sscanf_s rewind ftell fseek _mkdir _fpclass _strupr strtok isprint _mktime64 memcpy_s strftime _strtoui64 strcspn strnlen _itoa ?terminate@@YAXXZ _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer _except_handler4_common _amsg_exit __getmainargs _cexit _exit _XcptFilter _ismbblead _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ _invoke_watson _controlfp_s fputs fgets memchr _strtoi64 strcpy pow log memcmp calloc _strdup realloc strcmp strlen fwrite _fullpath wcstoul _snwprintf _open _close _read _CIatan2 _CIsqrt _CIlog10 _findnext64i32 _findfirst64i32 srand _CIexp _CIlog strspn wcscoll _wcsicoll strtol wcsncpy_s localeconv strcpy_s _vsnprintf_s _beginthreadex _itoa_s _wfopen_s fflush _errno _wstat64 _ftime64 isxdigit isalnum __iob_func _fileno _CIatan _CItan _CIsin _vsnwprintf

vcomp90

omp_get_thread_num _vcomp_for_dynamic_init _vcomp_for_dynamic_next _vcomp_single_begin _vcomp_single_end _vcomp_fork omp_get_max_threads _vcomp_leave_critsect _vcomp_enter_critsect _vcomp_barrier _vcomp_for_static_end _vcomp_for_static_simple_init omp_set_num_threads

steam_api

SteamAPI_RestartAppIfNecessary SteamAPI_IsSteamRunning SteamNetworking SteamAPI_UnregisterCallback SteamAPI_RegisterCallback SteamApps SteamAPI_Shutdown SteamRemoteStorage SteamUtils SteamAPI_Init SteamAPI_UnregisterCallResult SteamUserStats SteamAPI_RegisterCallResult SteamUser SteamFriends SteamGameServer SteamGameServerNetworking SteamMatchmaking SteamMatchmakingServers SteamGameServer_Shutdown SteamGameServer_Init SteamGameServer_RunCallbacks SteamAPI_RunCallbacks SteamClient

shlwapi

PathAppendW

physxcooking

NxGetCookingParams

winmm

waveOutClose timeSetEvent timeKillEvent timeGetTime waveOutWrite waveOutGetPosition waveOutReset waveOutGetDevCapsA waveOutUnprepareHeader waveOutGetNumDevs waveInGetNumDevs waveOutPrepareHeader waveOutOpen

dinput8

DirectInput8Create

dsound

ord11 ord2

xinput1_3

ord3 ord2

msacm32

acmFormatSuggest acmStreamOpen acmStreamConvert acmStreamPrepareHeader acmStreamSize acmStreamUnprepareHeader

wsock32

__WSAFDIsSet WSASetLastError getpeername

generic

count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=11, id=150, version=20413,

count=16, id=149, productName=VS2008 build 21022, version=21022,

count=21, id=131, productName=VS2008 build 21022, version=21022,

count=6, id=147, productName=VS2008 build 21022, version=21022,

count=11, id=132, productName=VS2008 build 21022, version=21022,

count=1, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=5, productName=Unmarked objects (old),

count=286, id=138, version=30729,

count=2, id=156, productName=VS2010 build 30319, version=30319,

count=17, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=94, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=629, id=1, productName=Unmarked objects,

count=337, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,