Ink!sans Fight - v0[.]39[.]exe

Target
Ink!sans Fight - v0.39.exe
Size 4.9MB
Sample260802-c9fx8acb53
SHA256 0a855fd4e5384d132e32d9996ff83316ff0cf5f7e995e032120aaefad421c185
MD5 9d620dd27a586fa0f8bd60a5d618d6ff
SHA1 ae20692c5234e5a09d8cbd0e513397f1c94a588b
SHA512 ac27b6660981a1663b6265faa70a53588f45ec75fc5d9cbf9aff414c1d58d7682df25f2c8c297bf83c59df0782f6bf29075c074eabc793d6fea3e589f0e67a20
SSDEEP 98304:PiQuE42N00DQDHO/sc5yor5Cvpau8tYVKAfz61ca9BsC9nAMS8QVjS:PRus00DQDHO/sc5yor5CvpawVVr6d1Aw
TLSH
T196368C80BA52C272D1422174E1AE6BFB25386D64CF14C6C7BBE43F3C79719D05AB385A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Ink!sans Fight - v0.39.exe

File Explorer

Ink!sans Fight - v0.39.exe

.exe 4.9MB

Ink!sans Fight - v0.39.exe

IMPHASH c2576cbfab04831d32374265b7cfd906
SHA256 0a855fd4e5384d132e32d9996ff83316ff0cf5f7e995e032120aaefad421c185
MD5 9d620dd27a586fa0f8bd60a5d618d6ff
SHA1 ae20692c5234e5a09d8cbd0e513397f1c94a588b
SHA512 ac27b6660981a1663b6265faa70a53588f45ec75fc5d9cbf9aff414c1d58d7682df25f2c8c297bf83c59df0782f6bf29075c074eabc793d6fea3e589f0e67a20
SSDEEP 98304:PiQuE42N00DQDHO/sc5yor5Cvpau8tYVKAfz61ca9BsC9nAMS8QVjS:PRus00DQDHO/sc5yor5CvpawVVr6d1Aw
TLSH
T196368C80BA52C272D1422174E1AE6BFB25386D64CF14C6C7BBE43F3C79719D05AB385A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2984061

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\hudson\ZeusBase\ZeusGreen\GameMaker\Runner\VC_Runner\Win32\Release-Zeus\Runner.pdb

wininet

InternetReadFile InternetCloseHandle HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCanonicalizeUrlA InternetWriteFile InternetConnectA InternetCrackUrlA HttpEndRequestW HttpQueryInfoA InternetGetConnectedState

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice

dbghelp

MiniDumpWriteDump SymInitialize SymFromAddr

winmm

mciSendStringA joyGetPosEx joyGetPos joyGetDevCapsA mciGetErrorStringA

ws2_32

gethostname socket setsockopt send recvfrom recv listen inet_ntoa inet_addr getsockopt WSAStartup connect closesocket bind accept getpeername select __WSAFDIsSet ntohs ntohl htons htonl WSACleanup WSAGetLastError WSAAddressToStringA getaddrinfo ioctlsocket freeaddrinfo sendto

gdiplus

GdiplusStartup GdiplusShutdown

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

rpcrt4

UuidToStringW UuidCreate

kernel32

FindFirstFileExA GetFullPathNameA SetCurrentDirectoryW HeapReAlloc GetTimeZoneInformation MoveFileExW SetFilePointerEx SetStdHandle ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW DecodePointer GetStringTypeW GetACP WriteFile GetStdHandle GetModuleFileNameA PeekNamedPipe GetFileType GetDriveTypeW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindFirstFileExW ReadFile SetFileAttributesW GetFileAttributesExW GetModuleHandleExW HeapWalk HeapValidate LoadLibraryExW InterlockedFlushSList InterlockedPushEntrySList EncodePointer RtlUnwind VirtualQuery GetProcessHeap HeapFree FindNextFileA IsValidCodePage HeapAlloc InitializeSListHead GetSystemTimeAsFileTime RaiseException InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetProcAddress LoadLibraryW WideCharToMultiByte CloseHandle WaitForSingleObjectEx CreateEventExW OutputDebugStringA MultiByteToWideChar GetOEMCP GetLastError GetCurrentDirectoryW DeleteFileW GetFullPathNameW SetLastError CreateThread GetExitCodeThread GetModuleHandleW LocalFree FormatMessageW SetCurrentDirectoryA GetCurrentDirectoryA FreeLibrary GetEnvironmentVariableW CreateDirectoryW FindClose FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW Sleep GetExitCodeProcess CreateProcessW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject SetWaitableTimer GetTickCount CreateWaitableTimerW GetCurrentProcess GetCurrentThread SetThreadPriority SetPriorityClass GlobalAlloc GlobalLock GlobalUnlock GlobalMemoryStatusEx GetSystemInfo GetVersionExW GetLocaleInfoW GetUserDefaultLCID ExitProcess lstrlenA GetCommandLineW ExpandEnvironmentStringsW CreateFileW GetFinalPathNameByHandleW SetUnhandledExceptionFilter SetErrorMode GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW MoveFileA RtlCaptureStackBackTrace TlsAlloc TlsGetValue TlsSetValue TlsFree IsProcessorFeaturePresent UnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetConsoleCtrlHandler OutputDebugStringW WriteConsoleW SetEndOfFile GetConsoleWindow HeapSize DeleteCriticalSection

user32

SetDlgItemTextW GetDlgItemTextW DrawTextW GetDC ReleaseDC SetWindowTextW ScreenToClient MoveWindow SetCursorPos ClientToScreen MapWindowPoints GetActiveWindow GetCursorPos wsprintfW GetAsyncKeyState keybd_event OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard IsClipboardFormatAvailable GetFocus SetWindowTextA GetDlgItem TranslateMessage DispatchMessageW PeekMessageW IsDialogMessageW CreateDialogParamW GetForegroundWindow UpdateWindow SetWindowLongW ChangeDisplaySettingsW EnumDisplaySettingsW MonitorFromWindow GetMonitorInfoW SetCursor AdjustWindowRectEx GetWindowRect GetClientRect SetForegroundWindow GetSystemMetrics ReleaseCapture SetCapture GetKeyState SetFocus BringWindowToTop SetWindowPos EndDialog SetDlgItemTextA DialogBoxParamW ShowWindow DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW PostMessageW SendMessageW MessageBoxW GetRawInputDeviceList GetRawInputDeviceInfoA LoadImageW LoadCursorW SetProcessDPIAware CallNextHookEx

gdi32

GetDeviceCaps DeleteObject SelectObject CreateFontA

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

ShellExecuteW SHGetFolderPathW

ole32

CoInitialize CoCreateInstance CoTaskMemFree CoCreateFreeThreadedMarshaler

dwmapi

DwmGetCompositionTimingInfo

Name

.text

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1001KB

Virtual Size

1000KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

518KB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

minATL

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.mydata

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

412B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

107KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Ink!sans Fight - v0.39.exe

wininet

dxgi

d3d11

dbghelp

winmm

ws2_32

gdiplus

comctl32

version

rpcrt4

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

dwmapi

generic