Start_CampForestGreen[.]exe

General

Target
Start_CampForestGreen.exe
Size 130KB
Sample260802-zza1js1hme
SHA256 34aea1f8f77b8594336394cd1c6ac323a2ce641e02d9a0f5dffde3b5a876465b
MD5 27927dbaf6593575b988b7c649166f42
SHA1 ef0608bd314013c67bfc689428eb18a0f6673c7b
SHA512 c3597a31f929aef15625a2b4d3ecd7d926a6cf10c8f1766cd784e5b32cc9ae997c31407e9481d8043d92e41ab0713b6825e4fde7e3585d012226e0734793f2e8
SSDEEP 3072:454A68rM8rar9p8DHQE3UP6VaXYXN9l/4u2GHS:WgAYz8Dw8vNPZH
TLSH
T1BBD39E0762B025F8D1724A34CB6C4609D376FC76396BCF9F87902256AF325919E35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Start_CampForestGreen.exe

File Explorer

Start_CampForestGreen.exe

.exe 130KB

Start_CampForestGreen.exe

IMPHASH 6965597c50e79d174fc4cf1d2c47454f
SHA256 34aea1f8f77b8594336394cd1c6ac323a2ce641e02d9a0f5dffde3b5a876465b
MD5 27927dbaf6593575b988b7c649166f42
SHA1 ef0608bd314013c67bfc689428eb18a0f6673c7b
SHA512 c3597a31f929aef15625a2b4d3ecd7d926a6cf10c8f1766cd784e5b32cc9ae997c31407e9481d8043d92e41ab0713b6825e4fde7e3585d012226e0734793f2e8
SSDEEP 3072:454A68rM8rar9p8DHQE3UP6VaXYXN9l/4u2GHS:WgAYz8Dw8vNPZH
TLSH
T1BBD39E0762B025F8D1724A34CB6C4609D376FC76396BCF9F87902256AF325919E35F22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

BootstrapPackagedGame-Win64-Shipping.pdb

kernel32

GetFileAttributesW CloseHandle GetLastError WaitForSingleObject GetExitCodeProcess CreateProcessW GetModuleFileNameW LoadResource LockResource SizeofResource LoadLibraryW FindResourceW WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LCMapStringW CreateFileW

user32

wsprintfW MessageBoxW

shell32

ShellExecuteExW

shlwapi

PathCombineW PathRemoveFileSpecW PathCanonicalizeW

Name

.text

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Start_CampForestGreen.exe

kernel32

user32

shell32

shlwapi

generic