3d06644f748c24369b02c48f2c95d094250c4d7091bdf88e52563879bd1403ec

Sharing

Copy URL Twitter E-mail

General

Target
3d06644f748c24369b02c48f2c95d094250c4d7091bdf88e52563879bd1403ec
Size 1.3MB
Sample260703-a264bsdz4m
SHA256 3d06644f748c24369b02c48f2c95d094250c4d7091bdf88e52563879bd1403ec
MD5 5504b436b191b58b4774aa5aebd7ed7e
SHA1 0d223d8aeef1a178a9c28abd40bf8ad3dfba9e01
SHA512 21828bfdd36695e44dd484f4b00107f2c13ccc09af1be358c19c5d7afd7e5cf9fe666fb5b06655bba5c53928f6d5a33e76e8c7aa8aea74e4d1adf74f82cea414
SSDEEP 24576:rWRonmBYBc0KJQGZ7X0J7uhLxO0DRkR9t:jToQGJX+uhIt
TLSH
T1E4557D20BA97C235E3B201B1BD7DAA5D502DBD680B2640CBE3D43A1E1871EC26E77757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d06644f748c24369b02c48f2c95d094250c4d7091bdf88e52563879bd1403ec

File Explorer

3d06644f748c24369b02c48f2c95d094250c4d7091bdf88e52563879bd1403ec

.exe 1.3MB

3d06644f748c24369b02c48f2c95d094250c4d7091bdf88e52563879bd1403ec

IMPHASH 31dd49190ece7958df1a818ef793828a
SHA256 3d06644f748c24369b02c48f2c95d094250c4d7091bdf88e52563879bd1403ec
MD5 5504b436b191b58b4774aa5aebd7ed7e
SHA1 0d223d8aeef1a178a9c28abd40bf8ad3dfba9e01
SHA512 21828bfdd36695e44dd484f4b00107f2c13ccc09af1be358c19c5d7afd7e5cf9fe666fb5b06655bba5c53928f6d5a33e76e8c7aa8aea74e4d1adf74f82cea414
SSDEEP 24576:rWRonmBYBc0KJQGZ7X0J7uhLxO0DRkR9t:jToQGJX+uhIt
TLSH
T1E4557D20BA97C235E3B201B1BD7DAA5D502DBD680B2640CBE3D43A1E1871EC26E77757
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

806889

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Code\Package\haiwai\master-6.0_en_20260514163717\simulator\bin\dnmultiplayer.pdb

kernel32

IsProcessorFeaturePresent IsDebuggerPresent DecodePointer EncodePointer GetSystemTimeAsFileTime Sleep TerminateProcess TerminateThread CreateThread ReleaseSemaphore CreateSemaphoreW RemoveDirectoryW DeleteFileW UnmapViewOfFile MapViewOfFile CreateFileMappingW GetCurrentThreadId WriteFile FindNextFileW QueryPerformanceCounter SetEvent CreateMutexW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetWindowsDirectoryW K32GetModuleFileNameExW K32EnumProcessModules OpenProcess GetExitCodeProcess GetCurrentProcessId CreateEventW CreateProcessW GetStartupInfoW CreatePipe GetSystemDirectoryW GlobalMemoryStatusEx GlobalUnlock GlobalLock GetSystemInfo MulDiv FindResourceW SizeofResource LockResource LoadResource FreeResource ReadFile GetFileSize FindFirstFileW FindClose ExitProcess WaitForSingleObject LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetTickCount DeleteCriticalSection WideCharToMultiByte CloseHandle GetFileTime CreateFileW FreeLibrary GetModuleFileNameW LoadLibraryW GetLastError GetPrivateProfileStringW GetVersionExW GetProcAddress GetModuleHandleW GlobalFree GlobalAlloc GetUserDefaultUILanguage GetLocalTime MultiByteToWideChar

user32

SetCaretPos ShowCaret HideCaret CreateCaret GetCaretPos GetCaretBlinkTime GetWindowTextLengthW GetWindowTextW SetRect FillRect DrawTextW CharPrevW LoadImageW AdjustWindowRectEx GetPropW SetPropW GetMenu ShowWindow GetClassInfoExW RegisterClassExW RegisterClassW CallWindowProcW DefWindowProcW GetWindow GetParent PtInRect IsRectEmpty IntersectRect MapWindowPoints GetCursorPos InvalidateRect GetUpdateRect EndPaint BeginPaint ReleaseDC ReleaseCapture SetCapture GetFocus GetActiveWindow GetSysColor CharNextW DestroyWindow IsWindow CreateWindowExW PostMessageW DispatchMessageW TranslateMessage GetMessageW LoadCursorW OffsetRect UnionRect SetCursor wvsprintfW SetWindowLongW GetWindowLongW ScreenToClient MessageBoxW GetClientRect SetWindowRgn IsZoomed GetSystemMetrics GetMonitorInfoW MonitorFromWindow IsIconic SendMessageW SetWindowPos SetForegroundWindow BringWindowToTop SystemParametersInfoW EnumDisplayMonitors CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo GetWindowThreadProcessId GetClassNameW FindWindowExW MoveWindow EnableWindow GetWindowRect PostQuitMessage GetDesktopWindow SetWindowTextW ClientToScreen SetFocus EnumWindows GetDC SetTimer KillTimer wsprintfW MapVirtualKeyW GetKeyState IsWindowVisible

gdi32

GetTextMetricsW GetObjectW SetWindowOrgEx GetObjectA DeleteDC CreatePenIndirect CreateRectRgnIndirect CreateSolidBrush GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo AddFontResourceExW RemoveFontResourceW RoundRect SetStretchBltMode ExtSelectClipRgn SetBkColor RestoreDC StretchBlt SetTextColor CreateDIBSection MoveToEx TextOutW ExtTextOutW GdiFlush CreatePatternBrush GetDeviceCaps SelectObject SelectClipRgn SaveDC CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteObject Rectangle SetBkMode GetStockObject CombineRgn CreateRoundRectRgn

shell32

ord165 SHGetPathFromIDListW SHGetFolderPathW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteExW

ole32

CLSIDFromProgID OleLockRunning CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance CoUninitialize CoInitialize CLSIDFromString

msvcp120

?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ??0_Pad@std@@QAE@XZ ?_Release@_Pad@std@@QAEXXZ ??1_Pad@std@@QAE@XZ ?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z _Thrd_equal _Thrd_current ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_current_owns _Cnd_timedwait _Thrd_join _Do_call _Call_onceEx ?_1@placeholders@std@@3V?$_Ph@$00@2@A ?_2@placeholders@std@@3V?$_Ph@$01@2@A _Xtime_get_ticks ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Statvfs@sys@tr2@std@@YA?AUspace_info@123@PB_W@Z ?_Read_dir@sys@tr2@std@@YAPA_WAAY0BAE@_WPAXAAW4file_type@123@@Z ?_Remove_dir@sys@tr2@std@@YA_NPB_W@Z ?_Close_dir@sys@tr2@std@@YAXPAX@Z ?_Open_dir@sys@tr2@std@@YAPAXAAY0BAE@_WPB_WAAHAAW4file_type@123@@Z ?_Copy_file@sys@tr2@std@@YAHPB_W0_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?uncaught_exception@std@@YA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Orphan_all@_Container_base0@std@@QAEXXZ ?_Future_error_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z ??_7_Facet_base@std@@6B@ ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z ?tolower@?$ctype@_W@std@@QBE_W_W@Z ?is@?$ctype@_W@std@@QBE_NF_W@Z _Wcsxfrm ?_Incref@facet@locale@std@@UAEXXZ ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ??1_Locinfo@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ ??0_Locinfo@std@@QAE@PBD@Z ??0_Lockit@std@@QAE@H@Z ??1facet@locale@std@@MAE@XZ ??_7facet@locale@std@@6B@ ??0facet@locale@std@@IAE@I@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?id@?$ctype@_W@std@@2V0locale@2@A ??Bid@locale@std@@QAEIXZ ?id@?$collate@_W@std@@2V0locale@2@A _Wcscoll ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ ?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z ?_Throw_C_error@std@@YAXH@Z _Mtx_init _Mtx_lock _Mtx_unlock ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ _Cnd_wait _Cnd_broadcast _Cnd_destroy _Mtx_destroy _Cnd_register_at_thread_exit _Cnd_unregister_at_thread_exit ?_Throw_future_error@std@@YAXABVerror_code@1@@Z ?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z ?_Xinvalid_argument@std@@YAXPBD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z ?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?id@?$codecvt@DDH@std@@2V0locale@2@A ?always_noconv@codecvt_base@std@@QBE_NXZ ?_BADOFF@std@@3_JB ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??Bios_base@std@@QBE_NXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?width@ios_base@std@@QAE_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?width@ios_base@std@@QBE_JXZ ?flags@ios_base@std@@QBEHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ _Cnd_init ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?_Stat@sys@tr2@std@@YA?AW4file_type@123@PB_WAAH@Z ?_Make_dir@sys@tr2@std@@YAHPB_W@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?_Winerror_map@std@@YAPBDH@Z ?_Unlink@sys@tr2@std@@YAHPB_W@Z

msvcr120

malloc free mbstowcs_s _vsnwprintf_s memmove ??2@YAPAXI@Z ??3@YAXPAX@Z _purecall ??0exception@std@@QAE@ABV01@@Z ??_V@YAXPAX@Z wcstoul realloc swprintf_s swscanf_s iswdigit wcstol strchr ??0bad_cast@std@@QAE@ABV01@@Z ??1bad_cast@std@@UAE@XZ ??0bad_cast@std@@QAE@PBD@Z ?Alloc@Concurrency@@YAPAXI@Z ?Free@Concurrency@@YAXPAX@Z ?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z ?_GetCurrentInlineDepth@_StackGuard@details@Concurrency@@CAAAIXZ ?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z ?_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?set@event@Concurrency@@QAEXXZ ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@ABQBDH@Z ??0event@Concurrency@@QAE@XZ _controlfp_s _invoke_watson __crtSetUnhandledExceptionFilter _except_handler4_common _except1 _commode _fmode _wcmdln _initterm _initterm_e __setusermatherr _configthreadlocale _cexit _exit exit __set_app_type __wgetmainargs _amsg_exit __crtGetShowWindowMode _XcptFilter __crtTerminateProcess __crtUnhandledException _crt_debugger_hook ??1type_info@@UAE@XZ _onexit __dllonexit _calloc_crt _unlock _lock vsprintf_s _wcsnicmp _beginthreadex memchr sprintf wcscpy_s _vswprintf ??8type_info@@QBE_NABV0@@Z sscanf_s longjmp vswprintf_s srand ??0exception@std@@QAE@ABQBD@Z getchar qsort_s wcsncmp iswalnum _wtof wcstod _itow ??1event@Concurrency@@QAE@XZ isalnum isdigit _vsnwprintf _wcslwr wcsstr wcsrchr wcsncpy wcschr memset memcpy __CxxFrameHandler3 _CxxThrowException _wcsicmp _wtoi _lock_file _unlock_file fgetc ungetc memcpy_s fsetpos _fseeki64 fgetpos setvbuf fflush fputc fwrite fclose sprintf_s ?terminate@@YAXXZ _snprintf_s _snwprintf_s _errno ?__ExceptionPtrCopyException@@YAXPAXPBX1@Z ?__ExceptionPtrAssign@@YAXPAXPBX@Z ?__ExceptionPtrToBool@@YA_NPBX@Z _time64 ?__ExceptionPtrCreate@@YAXPAX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?__ExceptionPtrDestroy@@YAXPAX@Z ?__ExceptionPtrCopy@@YAXPAXPBX@Z ?_Oversubscribe@_Context@details@Concurrency@@SAX_N@Z ?_ScheduleTask@_CurrentScheduler@details@Concurrency@@SAXP6AXPAX@Z0@Z ?_NewCollection@_AsyncTaskCollection@details@Concurrency@@SAPAV123@PAV_CancellationTokenState@23@@Z rand ?wait@event@Concurrency@@QAEII@Z ??1scoped_lock@critical_section@Concurrency@@QAE@XZ ??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z ??1critical_section@Concurrency@@QAE@XZ _setjmp3 ??0critical_section@Concurrency@@QAE@XZ toupper

iphlpapi

GetAdaptersInfo

comctl32

ord17 _TrackMouseEvent

imm32

ImmSetCompositionWindow ImmSetCompositionFontW ImmReleaseContext ImmGetContext ImmGetVirtualKey

shlwapi

PathFileExistsW

msimg32

AlphaBlend

version

GetFileVersionInfoW VerQueryValueA GetFileVersionInfoSizeW

wininet

InternetOpenW InternetCloseHandle InternetConnectW InternetCrackUrlW HttpSendRequestW InternetReadFile HttpQueryInfoW HttpOpenRequestW

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

DuplicateTokenEx OpenProcessToken RegOpenKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

oleaut32

SysAllocString VariantInit VariantClear SysFreeString

gdiplus

GdipImageGetFrameDimensionsList GdipGetPropertyItemSize GdipGetPropertyItem GdipImageGetFrameCount GdipImageSelectActiveFrame GdipSetCompositingQuality GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipLoadImageFromStream GdipSetStringFormatLineAlign GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushI GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipSetInterpolationMode GdipGraphicsClear GdipDrawImage GdipDrawImageRectI GdipDeleteFontFamily GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipGetFamily GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatAlign

generic

count=2, id=199, version=41118,

count=10, id=223, productName=VS2013 build 21005, version=21005,

count=19, id=224, productName=VS2013 build 21005, version=21005,

count=1, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=37, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=221, productName=VS2013 build 21005, version=21005,

count=7, id=225, productName=VS2013 build 21005, version=21005,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=699, id=1, productName=Unmarked objects,

count=62, id=229, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,