MGSDelta[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MGSDelta.exe
Size 14.6MB
Sample260717-emdwfset4y
SHA256 a15799dfe4cb25e4aa901473d743dee70f20bd50b6d2919561e41873d8d0a9ba
MD5 b12666d4a42c96c1f7824121e4f45f1e
SHA1 aaef64bf7ae45e8f27196e7c302aaa7ed6ed167d
SHA512 2446ce4a11e8eedd70c5cf4408bdb84d0f03b212bd2a6a3697e9417021e26169a9e89f8756a95db3a04cc9eb91f38d756fdb2d715f9ec847fc86ecf4ec911f3c
SSDEEP 393216:QGfzB0BAevyu17HiBYAfzB0BAevyu17HiBYAfzB0BAevyu17HiBY:Qauh117HiBTuh117HiBTuh117HiB
TLSH
T106F633112B186252D886E531DA7E1317BF6438518F60DF978B3175E03E36ED4FA4E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MGSDelta.exe

File Explorer

MGSDelta.exe

.exe 14.6MB

MGSDelta.exe

IMPHASH 5f3888a1a5acd57e5e429025ad3da92e
SHA256 a15799dfe4cb25e4aa901473d743dee70f20bd50b6d2919561e41873d8d0a9ba
MD5 b12666d4a42c96c1f7824121e4f45f1e
SHA1 aaef64bf7ae45e8f27196e7c302aaa7ed6ed167d
SHA512 2446ce4a11e8eedd70c5cf4408bdb84d0f03b212bd2a6a3697e9417021e26169a9e89f8756a95db3a04cc9eb91f38d756fdb2d715f9ec847fc86ecf4ec911f3c
SSDEEP 393216:QGfzB0BAevyu17HiBYAfzB0BAevyu17HiBYAfzB0BAevyu17HiBY:Qauh117HiBTuh117HiBTuh117HiB
TLSH
T106F633112B186252D886E531DA7E1317BF6438518F60DF978B3175E03E36ED4FA4E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15524

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

BootstrapPackagedGame-Win64-Shipping.pdb

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

kernel32

CloseHandle GetLastError ConnectNamedPipe DisconnectNamedPipe PeekNamedPipe CreateNamedPipeW GetOverlappedResult WaitForSingleObject GetCurrentProcessId GetExitCodeProcess CreateThread CreateProcessW CreateFileMappingW MapViewOfFile FlushViewOfFile UnmapViewOfFile GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW LoadLibraryW lstrcmpiA CreateFileW ReadFile GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetProcessHeap LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetFileAttributesW WriteConsoleW SetLastError EnterCriticalSection GetConsoleMode GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType HeapAlloc HeapFree GetModuleHandleExW ExitProcess WriteFile GetStdHandle EncodePointer LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx LeaveCriticalSection

user32

DeferWindowPos EndDeferWindowPos IsWindowVisible SetWindowPos SetForegroundWindow PostMessageW BeginPaint BeginDeferWindowPos CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage GetForegroundWindow DefWindowProcW EndPaint SetWindowTextW PeekMessageW wsprintfW TranslateMessage AllowSetForegroundWindow GetClientRect MessageBoxW LoadIconW LoadCursorW SetWindowLongW GetWindowLongW DispatchMessageW

gdi32

GetStockObject

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

ShellExecuteExW

ole32

CoInitializeEx CoUninitialize

dwmapi

DwmSetWindowAttribute

shlwapi

PathCanonicalizeW PathRemoveExtensionW PathRemoveFileSpecW PathStripPathW ord12 PathCombineW

gdiplus

GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipDeleteBrush GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateFromHDC GdipDeleteGraphics GdipFillRectangleI GdipDrawImageRectI GdipCreateSolidFill

Name

.text

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

14.2MB

Virtual Size

14.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.bind

Size

225KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

MGSDelta.exe

rpcrt4

kernel32

user32

gdi32

advapi32

shell32

ole32

dwmapi

shlwapi

gdiplus

generic