AC4BFSP[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AC4BFSP.exe
Size 43.0MB
Sample260719-y16ceaes21
SHA256 bc11ad7924e1eca7363ee86aa3332c05386d0a05896c0b7370131daee9ab5150
MD5 2058342866688f780c8b34526a65bc35
SHA1 418ce329881797d8f591380600510302a1c5b5db
SHA512 ddcc4bf7d9310e65e4f0824ffc88709199dbcd49dbbec5da08de15c737b768da3e40330093d3d3a313e951516dc5ed3594c3836423dfb850cf62814b120189c7
SSDEEP 393216:6OotfrIljCnu6uWo1SEfYao43Rak1fDjk/2pK1ANg2nDdtwIGoEQG560elV7H:MIljCREAao43Rak1fDjXcANg2nD0gE4l
TLSH
T180A78C06AB0966B6E98D123380EF3F357639D4214BEA03D317D813166DB53D37A732A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

AC4BFSP.exe

.exe 43.0MB

AC4BFSP.exe

IMPHASH c33b4b04d33e4bec6f5ec08beeafa504
SHA256 bc11ad7924e1eca7363ee86aa3332c05386d0a05896c0b7370131daee9ab5150
MD5 2058342866688f780c8b34526a65bc35
SHA1 418ce329881797d8f591380600510302a1c5b5db
SHA512 ddcc4bf7d9310e65e4f0824ffc88709199dbcd49dbbec5da08de15c737b768da3e40330093d3d3a313e951516dc5ed3594c3836423dfb850cf62814b120189c7
SSDEEP 393216:6OotfrIljCnu6uWo1SEfYao43Rak1fDjk/2pK1ANg2nDdtwIGoEQG560elV7H:MIljCREAao43Rak1fDjXcANg2nD0gE4l
TLSH
T180A78C06AB0966B6E98D123380EF3F357639D4214BEA03D317D813166DB53D37A732A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

a0:fb:1e:7c:63:b2:63:a8:d1:f1:ee:f2:b5:b7:4b:eb:15:7d:16:d4:bc:ad:82:db:cf:88:b8:fd:40:70:9b:6b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=UBISOFT ENTERTAINMENT INC.,O=UBISOFT ENTERTAINMENT INC.,L=Montreal,ST=Quebec,C=CA

Chains

Jul 7, 2023

CN=UBISOFT ENTERTAINMENT INC.,O=UBISOFT ENTERTAINMENT INC.,L=Montreal,ST=Quebec,C=CA

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=UBISOFT ENTERTAINMENT INC.,O=UBISOFT ENTERTAINMENT INC.,L=Montreal,ST=Quebec,C=CA

Serial Number

0a:0b:aa:56:7d:6e:3c:d3:eb:ba:3e:8b:7d:7d:87:f1

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 8, 2022 - Jul 16, 2025

Minor OS version

Major OS version

Entry point

11639238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Work\assassin\assassin\acga\output\win32\exe\scimitar_engine_win32_f.pdb

ws2_32

getsockopt socket getsockname bind connect send recv setsockopt ioctlsocket closesocket accept listen sendto recvfrom inet_ntoa getnameinfo gethostbyname gethostname ntohl ntohs inet_addr htons htonl WSAStartup __WSAFDIsSet WSACleanup select WSAGetLastError WSAIoctl WSAGetOverlappedResult WSAWaitForMultipleEvents WSASocketA WSASendTo WSAResetEvent WSARecvFrom WSACreateEvent WSACloseEvent freeaddrinfo getaddrinfo

d3d9

Direct3DCreate9

opengl32

wglMakeCurrent wglCreateContext wglDeleteContext glGetString

d3dcompiler_43

D3DCompile

d3d11

D3D11CreateDevice

d3dx11_43

D3DX11CreateTextureFromFileA

dxgi

CreateDXGIFactory1

gfsdk_ssao_win32

?NV_SSAO_Initialize@@YA?AW4NV_SSAO_Status@@PAUID3D11Device@@I@Z ?NV_SSAO_SetInputDepths@@YA?AW4NV_SSAO_Status@@PBUNV_SSAO_InputDepthData@@@Z ?NV_SSAO_ReleaseResources@@YA?AW4NV_SSAO_Status@@XZ ?NV_SSAO_RenderAO@@YA?AW4NV_SSAO_Status@@PAUID3D11DeviceContext@@PAUID3D11RenderTargetView@@W4NV_SSAO_RenderMask@@@Z ?NV_SSAO_SetParameters@@YA?AW4NV_SSAO_Status@@PBUNV_SSAO_Parameters@@@Z ?NV_SSAO_SetInputNormals@@YA?AW4NV_SSAO_Status@@PBUNV_SSAO_InputNormalData@@@Z

gfsdk_shadowlib.win32

?NV_ShadowLib_AddBuffer@@YA?AW4NV_ShadowLib_Status@@QIAUNV_ShadowLib_Ctx@@PAUNV_ShadowLib_BufferDesc@@PAPAI@Z ?NV_ShadowLib_OpenDX@@YA?AW4NV_ShadowLib_Status@@MQIAUNV_ShadowLib_Ctx@@QIAUID3D11Device@@QIAUID3D11DeviceContext@@PAUgfsdk_new_delete_t@@@Z ?NV_ShadowLib_CloseDX@@YA?AW4NV_ShadowLib_Status@@QIAUNV_ShadowLib_Ctx@@@Z ?NV_ShadowLib_FinalizeBuffer@@YA?AW4NV_ShadowLib_Status@@QIAUNV_ShadowLib_Ctx@@PAIPAPAUID3D11ShaderResourceView@@@Z ?NV_ShadowLib_RenderBufferUsingExternalMap@@YA?AW4NV_ShadowLib_Status@@QIAUNV_ShadowLib_Ctx@@PAUNV_ShadowLib_ExternalMapDesc@@PAUID3D11ShaderResourceView@@PAIPAUNV_ShadowLib_BufferRenderParams@@@Z ?NV_ShadowLib_ClearBuffer@@YA?AW4NV_ShadowLib_Status@@QIAUNV_ShadowLib_Ctx@@PAI@Z ?NV_ShadowLib_RemoveBuffer@@YA?AW4NV_ShadowLib_Status@@QIAUNV_ShadowLib_Ctx@@PAPAI@Z

gfsdk_godrayslib.win32

?GFSDK_GodraysLib_RenderVolume@@YA?AW4GFSDK_GodraysLib_Status@@QIAUGFSDK_GodraysLib_Ctx@@QIAUID3D11DeviceContext@@PBUGFSDK_GodraysLib_ShadowMapDesc@@PAUID3D11ShaderResourceView@@PBUGFSDK_GodraysLib_DepthBufferDesc@@3PBUGFSDK_GodraysLib_LightDesc@@PBUGFSDK_GodraysLib_ViewerDesc@@PBUGFSDK_GodraysLib_AirlightDesc@@MMW4GFSDK_GodraysLib_Technique@@W4GFSDK_GodraysLib_Quality@@W4GFSDK_GodraysLib_BufferSize@@_NIIPAUID3D11BlendState@@@Z ?GFSDK_GodraysLib_GetVersion@@YA?AW4GFSDK_GodraysLib_Status@@PAM@Z ?GFSDK_GodraysLib_OpenDX@@YA?AW4GFSDK_GodraysLib_Status@@MQIAUGFSDK_GodraysLib_Ctx@@QIAUID3D11Device@@QIAUID3D11DeviceContext@@PAUgfsdk_new_delete_t@@@Z ?GFSDK_GodraysLib_CloseDX@@YA?AW4GFSDK_GodraysLib_Status@@QIAUGFSDK_GodraysLib_Ctx@@@Z

gfsdk_multires.win32

GFSDK_MultiRes_CreateClassInterface

gfsdk_psm.win32

GFSDK_PSM_Create

gfsdk_gsa.win32

GFSDK_GSA_GetResolution GFSDK_GSA_InitializeSDK GFSDK_GSA_RegisterOption GFSDK_GSA_RegisterResolutions GFSDK_GSA_LoadConfigFile GFSDK_GSA_ReleaseSDK GFSDK_GSA_SetOptionValue GFSDK_GSA_SetResolution GFSDK_GSA_SaveConfigFile GFSDK_GSA_GetOptionValue

xinput1_3

ord3 ord2 ord4

dinput8

DirectInput8Create

bink2w32

_BinkSetSpeakerVolumes@20 _BinkOpenXAudio2@4 _BinkSetSoundSystem@8 _BinkWait@4 _BinkDoFrame@4 _BinkShouldSkip@4 _BinkRegisterFrameBuffers@8 _BinkSetSoundTrack@8 _BinkOpen@8 _BinkSetMemory@8 _BinkSetVolume@12 _BinkClose@4 _BinkSetIO@4 _BinkPause@8 _BinkGoto@12 _BinkNextFrame@4 _BinkGetFrameBuffersInfo@8

iphlpapi

GetAdaptersAddresses GetIfEntry GetBestInterface

uplay_r1_loader

UPLAY_ACH_GetAchievements UPLAY_ACH_EarnAchievement UPLAY_GetOverlappedOperationResult UPLAY_SAVE_Remove UPLAY_USER_GetEmailUtf8 UPLAY_USER_GetPasswordUtf8 UPLAY_OVERLAY_SetShopUrl UPLAY_USER_IsOwned UPLAY_OVERLAY_Show UPLAY_HasOverlappedOperationCompleted UPLAY_GetLastError UPLAY_Update UPLAY_USER_GetUsernameUtf8 UPLAY_SAVE_Close UPLAY_SAVE_SetName UPLAY_SAVE_Write UPLAY_SAVE_Open UPLAY_SAVE_Read UPLAY_Release UPLAY_USER_GetCdKeys UPLAY_GetNextEvent UPLAY_Quit UPLAY_SAVE_GetSavegames UPLAY_Startup

kernel32

InterlockedExchange GetTimeZoneInformation SetConsoleCtrlHandler IsProcessorFeaturePresent GetCPInfo GetLocaleInfoW GetOEMCP IsValidCodePage LCMapStringW HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetConsoleMode SetConsoleMode HeapQueryInformation SetStdHandle ReadConsoleInputA SetUnhandledExceptionFilter UnhandledExceptionFilter HeapReAlloc GetDriveTypeW HeapAlloc HeapFree LocalFileTimeToFileTime FindFirstFileExA GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime ExitThread GetStartupInfoW HeapSetInformation GetCommandLineA GetCurrentDirectoryW PeekNamedPipe GetFileInformationByHandle GetConsoleCP GetACP GetStringTypeW RtlUnwind GetModuleHandleW EncodePointer DecodePointer FlushConsoleInputBuffer GlobalMemoryStatus GetStdHandle GetFileType ExpandEnvironmentStringsA TerminateProcess WaitForMultipleObjectsEx SleepEx CreateEventW EnumSystemLocalesA IsValidLocale WriteConsoleW GetProcessHeap CompareStringW SetEnvironmentVariableA LocalAlloc HeapCreate GetPrivateProfileIntW WritePrivateProfileStringW CloseHandle CreateProcessW GetCommandLineW GetModuleFileNameW GetPrivateProfileSectionNamesW GetPrivateProfileStringW GetModuleHandleA SetPriorityClass GetCurrentProcess Sleep WaitForSingleObject CreateMutexW CreateSemaphoreA ReleaseSemaphore SetCurrentDirectoryA GetModuleFileNameA SetErrorMode TlsGetValue DeleteFileW CreateFileW GetLastError GetFileSize ReadFileEx WriteFileEx CancelIo WriteFile CreateDirectoryW ReadFile MultiByteToWideChar FindClose GetFileAttributesA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection VirtualFree VirtualAlloc VirtualQuery GetEnvironmentVariableA GetCurrentDirectoryA GetCurrentThreadId SwitchToThread OpenThread SetLastError IsDebuggerPresent SetThreadAffinityMask GetVersion SetThreadPriority SetThreadPriorityBoost RaiseException SuspendThread ResumeThread GetCurrentThread GetLogicalDriveStringsA GetSystemInfo CreateEventA SetEvent ResetEvent GetProcessAffinityMask SetProcessAffinityMask FreeLibrary GetProcAddress LoadLibraryA GetLocaleInfoA GetUserDefaultLCID IsWow64Process GetVersionExA lstrlenA TlsAlloc TlsFree TlsSetValue InterlockedDecrement lstrlenW GetEnvironmentVariableW GlobalMemoryStatusEx InitializeCriticalSectionAndSpinCount InitializeCriticalSection DeleteCriticalSection TryEnterCriticalSection GetTickCount QueryPerformanceCounter GetLocalTime QueryPerformanceFrequency OutputDebugStringA DebugBreak GetOverlappedResult GetFileSizeEx CreateFileA VirtualProtect InterlockedExchangeAdd MoveFileA CopyFileA GetFileTime SetEndOfFile FlushFileBuffers SetFileAttributesA CreateDirectoryA FindFirstFileA RemoveDirectoryA FindNextFileA DeleteFileA WaitForMultipleObjects LocalFree SystemTimeToFileTime GetSystemTime SetFileTime CreateProcessA GetFullPathNameA FormatMessageA ExitProcess InterlockedIncrement AreFileApisANSI UnlockFile LockFile GetFileAttributesW LoadLibraryW GetCurrentProcessId GetSystemTimeAsFileTime LockFileEx GetTempPathA GetTempPathW GetFullPathNameW GetDiskFreeSpaceA GetDiskFreeSpaceW CreateThread GetExitCodeThread SetFilePointer

user32

SystemParametersInfoA ShowWindow DefWindowProcA DestroyWindow GetDC UpdateWindow CreateWindowExA AdjustWindowRect RegisterClassExA LoadIconA LoadCursorA LoadImageA TranslateMessage DispatchMessageA PeekMessageA GetAsyncKeyState PostQuitMessage UnregisterDeviceNotification RegisterDeviceNotificationA IsIconic MessageBoxW GetWindowRect GetDesktopWindow RegisterClassA UnregisterClassA ReleaseDC PostMessageA EnumDisplayDevicesA GetMonitorInfoA MonitorFromWindow GetActiveWindow MessageBoxA GetWindowPlacement IsWindowVisible IsWindow GetRawInputDeviceInfoA GetRawInputDeviceList GetForegroundWindow CallWindowProcW SetWindowLongW GetWindowLongW RegisterDeviceNotificationW GetUserObjectInformationW GetProcessWindowStation GetClientRect ShowCursor GetSystemMetrics

gdi32

SetPixelFormat CreateDCA ExtEscape DeleteDC ChoosePixelFormat

advapi32

RegOpenKeyExA RegQueryValueExA RegisterEventSourceA RegSetValueExA RegCreateKeyExA DeregisterEventSource ReportEventA RegCloseKey

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW ShellExecuteA

ole32

CoCreateInstance CoInitializeEx CoInitialize CoUninitialize CoSetProxyBlanket

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

wsock32

shutdown WSAAsyncSelect getpeername WSASetLastError

winmm

timeGetTime

wininet

InternetSetCookieExA

?CreateWithCustomAllocator@iZHybridReverbEngine@iZReverb@@SAXPAPAV12@IP6APAXI@ZP6AXPAX@ZIIW4Reverb_Quality@2@W4Reverb_Mode@2@_N@Z ?CreateWithCustomAllocator@iZHybridReverbEngine@iZReverb@@SAXPAPAV12@IPAXIIW4Reverb_Quality@2@W4Reverb_Mode@2@_N@Z ?CreateWithCustomAllocator@iZTrashBoxModelerEngine@iZTrashBoxModeler@@SAXPAPAV12@IIP6APAXI@ZP6AXPAX@ZIPBD_N@Z ?CreateWithCustomAllocator@iZTrashBoxModelerEngine@iZTrashBoxModeler@@SAXPAPAV12@IIPAXIPBD_N@Z ?CreateWithCustomAllocator@iZTrashDelayEngine@iZTrashDelay@@SAXPAPAV12@IIP6APAXI@ZP6AXPAX@ZI_N@Z ?CreateWithCustomAllocator@iZTrashDistortionEngine@iZTrashDistortion@@SAXPAPAV12@IIP6APAXI@ZP6AXPAX@ZI_N@Z ?CreateWithCustomAllocator@iZTrashDynamicsEngine@iZTrashDynamics@@SAXPAPAV12@IIP6APAXI@ZP6AXPAX@ZI_N@Z ?CreateWithCustomAllocator@iZTrashFiltersEngine@iZTrashFilters@@SAXPAPAV12@IIP6APAXI@ZP6AXPAX@ZI_N@Z ?CreateWithCustomAllocator@iZTrashMultibandDistortionEngine@iZTrashMultibandDistortion@@SAXPAPAV12@IIP6APAXI@ZP6AXPAX@ZI_N@Z ?CreateWithDefaultAllocator@iZHybridReverbEngine@iZReverb@@SAXPAPAV12@IIIW4Reverb_Quality@2@W4Reverb_Mode@2@_N@Z ?CreateWithDefaultAllocator@iZTrashBoxModelerEngine@iZTrashBoxModeler@@SAXPAPAV12@IIIPBD_N@Z ?CreateWithDefaultAllocator@iZTrashDelayEngine@iZTrashDelay@@SAXPAPAV12@III_N@Z ?CreateWithDefaultAllocator@iZTrashDistortionEngine@iZTrashDistortion@@SAXPAPAV12@III_N@Z ?CreateWithDefaultAllocator@iZTrashDynamicsEngine@iZTrashDynamics@@SAXPAPAV12@III_N@Z ?CreateWithDefaultAllocator@iZTrashFiltersEngine@iZTrashFilters@@SAXPAPAV12@III_N@Z ?CreateWithDefaultAllocator@iZTrashMultibandDistortionEngine@iZTrashMultibandDistortion@@SAXPAPAV12@III_N@Z ?DestroyEngine@iZHybridReverbEngine@iZReverb@@SAXPAV12@@Z ?DestroyEngine@iZTrashBoxModelerEngine@iZTrashBoxModeler@@SAXPAV12@@Z ?DestroyEngine@iZTrashDelayEngine@iZTrashDelay@@SAXPAV12@@Z ?DestroyEngine@iZTrashDistortionEngine@iZTrashDistortion@@SAXPAV12@@Z ?DestroyEngine@iZTrashDynamicsEngine@iZTrashDynamics@@SAXPAV12@@Z ?DestroyEngine@iZTrashFiltersEngine@iZTrashFilters@@SAXPAV12@@Z ?DestroyEngine@iZTrashMultibandDistortionEngine@iZTrashMultibandDistortion@@SAXPAV12@@Z GetDataBufferSize InitBufferSynchro ReadData WriteData

Name

.text

Size

26.2MB

Virtual Size

26.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.0MB

Virtual Size

9.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3.5MB

Virtual Size

39.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.shared

Size

256KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

137B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=4, id=152, version=20115,

count=71, id=158, productName=VS2010 SP1 build 40219, version=40219,

count=20, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, productName=Unmarked objects (old),

count=730, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=6, id=156, productName=VS2010 build 30319, version=30319,

count=8, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=8, id=156, version=21202,

count=27, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=9, id=171, productName=VS2010 build 30319, version=30319,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=439, id=1, productName=Unmarked objects,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1138, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=151,

count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,