McLovinGame[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
McLovinGame.zip
Size 1.0MB
Sample260808-nbehaadb82
SHA256 96fa3645e7e68f61ffb9ed75af353722283b3b7817f826833a78beda12ee8bf2
MD5 c7c1688346033e92e3b89267f683e5b0
SHA1 c1d9121a2776bdc4cc17fb2b34fc584cc36b7586
SHA512 c9b14dfccd2ecf6898db02c08bcf501f4882cced3e9c24b02fd7dbd7ac05c162f0d7076759617af4015585bc5f1debb5e51664c7fd351912b3f0f3f26adcf566
SSDEEP 24576:Rr58xAUe+hJs69nBohss84f22YO/iiVCk6cRbcGmQ1H4Oh:n8aUeGCN1fP/iiOwbdmQ1j
TLSH
T1813533EBC09864C5C85958607E684DB4E40DD7FBD7D7E2085EE701329C2D18ACAA1FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/McLovinGame/loader.exe

File Explorer

McLovinGame.zip

.zip 1.0MB
McLovinGame/McLovin.png

.jpg 282KB
McLovinGame/game.html

.html .js 11KB
McLovinGame/loader.exe

.exe 1.5MB

McLovinGame.zip

SHA256 96fa3645e7e68f61ffb9ed75af353722283b3b7817f826833a78beda12ee8bf2
MD5 c7c1688346033e92e3b89267f683e5b0
SHA1 c1d9121a2776bdc4cc17fb2b34fc584cc36b7586
SHA512 c9b14dfccd2ecf6898db02c08bcf501f4882cced3e9c24b02fd7dbd7ac05c162f0d7076759617af4015585bc5f1debb5e51664c7fd351912b3f0f3f26adcf566
SSDEEP 24576:Rr58xAUe+hJs69nBohss84f22YO/iiVCk6cRbcGmQ1H4Oh:n8aUeGCN1fP/iiOwbdmQ1j
TLSH
T1813533EBC09864C5C85958607E684DB4E40DD7FBD7D7E2085EE701329C2D18ACAA1FBB
MD5 SHA1 SHA512 SSDEEP TLSH

McLovinGame/loader.exe

IMPHASH 85764be90204f791b27a27cfe813963d
SHA256 ef1990355254c36fcb47c6f5957f90100389066a54b4c0b78560f2cfe303a0b7
MD5 d6b0f6406291a7aadeee359fad184b71
SHA1 397b07c416734ee7e9d6175bd0bb9ef8d2ae056b
SHA512 2b0dc476900609d50b0796ee1d596f888d00fe0945b39417b2cfa07b278aa1e17636f43370e8cf474d2655257e7b932cfcfa8ec87a6d2da6537a1cb5d150004b
SSDEEP 24576:42ctIvKqwpMKvT7QvYMy91tA2DP2crkmQNHElqKlRRaBIqHxXyM4M:NToMKvPQvOi8AmQNsrlLaxxXyA
TLSH
T146659D4B77B2C1F4CB66C1BAC9E11233DE3674641B3897C72160CA1E9FA3AD54A35722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

775052

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wsock32

WSAGetLastError getservbyname htonl send recv inet_addr WSAAsyncSelect inet_ntoa gethostbyname WSASetLastError ioctlsocket htons gethostbyaddr getservbyport ntohs WSAStartup gethostname shutdown WSACleanup closesocket connect socket

winmm

joyGetPosEx mciSendStringW joyGetDevCapsW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

comctl32

ImageList_GetIconSize ImageList_Create ImageList_Destroy ImageList_AddMasked ImageList_ReplaceIcon CreateStatusWindowW

psapi

GetProcessImageFileNameW

wininet

InternetCloseHandle InternetReadFileExA InternetReadFile InternetOpenW InternetOpenUrlW

shlwapi

StrCmpLogicalW

uxtheme

EnableThemeDialogTexture SetWindowTheme IsAppThemed

dwmapi

DwmGetWindowAttribute

kernel32

GlobalFree GlobalUnlock WideCharToMultiByte GetCPInfo GetSystemDirectoryA LoadLibraryA GetProcAddress FreeLibrary GetCurrentThreadId GetEnvironmentVariableW IsValidCodePage LoadLibraryW GetLastError OutputDebugStringW lstrcmpiW GetStringTypeExW CreateThread SetThreadPriority GetExitCodeThread CloseHandle CreateMutexW VirtualProtect SetLastError GetModuleHandleW GetDiskFreeSpaceExW GetDriveTypeW CreateFileW DeviceIoControl SetVolumeLabelW GetVolumeInformationW GetDiskFreeSpaceW SetEnvironmentVariableW MultiByteToWideChar GetFullPathNameW GetFileAttributesW CreateDirectoryW ReadFile DeleteFileW LoadResource LockResource WriteFile SizeofResource SetCurrentDirectoryW CompareStringOrdinal CopyFileW SetFileAttributesW FindFirstFileW FindNextFileW FindClose FileTimeToLocalFileTime LocalFileTimeToFileTime GetSystemTimeAsFileTime SetFileTime GlobalLock MoveFileW GetCurrentProcessId OpenProcess TerminateProcess SetPriorityClass GetProcessId QueryDosDeviceW EnterCriticalSection LeaveCriticalSection Beep GetLocalTime GetDateFormatW GetTimeFormatW GetDateFormatEx GetTickCount64 GetSystemTime GetSystemDefaultUILanguage GetComputerNameW GetCurrentDirectoryW GetSystemWindowsDirectoryW GetTempPathW WaitForSingleObject GetExitCodeProcess WriteProcessMemory ReadProcessMemory GetVersionExW InitializeCriticalSection DeleteCriticalSection GetModuleFileNameW SetDllDirectoryW GetModuleHandleExW GetShortPathNameW CreateProcessW FormatMessageW CompareStringW RemoveDirectoryW GetCurrentProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW GetPrivateProfileStringW GetPrivateProfileSectionW GetPrivateProfileSectionNamesW WritePrivateProfileStringW WritePrivateProfileSectionW SetEndOfFile GetACP GetFileType GetStdHandle SetFilePointerEx SystemTimeToFileTime FileTimeToSystemTime GetFileSize IsWow64Process VirtualAllocEx VirtualFreeEx EnumResourceNamesW LoadLibraryExW GlobalSize FindResourceW SetErrorMode Sleep GetTickCount MulDiv RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx GetCommandLineA GetCommandLineW ExitProcess SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx HeapSize HeapReAlloc HeapQueryInformation IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetProcessHeap FindFirstFileExW GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GlobalAlloc SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW GetFileSizeEx RtlPcToFileHeader

user32

SetActiveWindow IsWindowVisible IsChild SetWindowRgn SetWindowPos EnumWindows IsZoomed IsIconic GetLayeredWindowAttributes SetLayeredWindowAttributes DestroyWindow RegisterClassExW SystemParametersInfoW CreateWindowExW GetMenu EnableMenuItem LoadAcceleratorsW AddClipboardFormatListener RemoveClipboardFormatListener LoadImageW CreateIconIndirect PostQuitMessage CheckMenuItem RegisterWindowMessageW DefWindowProcW SetForegroundWindow MonitorFromPoint GetSystemMenu GetMenuItemCount GetMenuItemID GetSubMenu GetMenuStringW ExitWindowsEx GetPropW GetClassLongW SetMenu SetPropW RemovePropW GetSysColor RedrawWindow DrawTextW SetParent GetClassInfoExW AdjustWindowRectEx UpdateWindow FlashWindow GetMessagePos GetSysColorBrush FillRect GetClassLongPtrW CallWindowProcW CheckRadioButton IntersectRect GetUpdateRect PtInRect CreateDialogIndirectParamW CreateAcceleratorTableW DestroyAcceleratorTable InsertMenuItemW RemoveMenu SetMenuItemInfoW GetMenuItemInfoW SetMenuDefaultItem CreateMenu CreatePopupMenu SetMenuInfo DestroyMenu TrackPopupMenuEx CopyImage CreateIconFromResourceEx DrawIconEx EnumClipboardFormats GetWindow BringWindowToTop GetQueueStatus GetLastActivePopup EnumChildWindows ActivateKeyboardLayout GetGUIThreadInfo GetWindowTextW mouse_event WindowFromPoint keybd_event SetKeyboardState GetKeyboardState GetCursorPos GetAsyncKeyState AttachThreadInput SendInput UnregisterHotKey RegisterHotKey SendMessageTimeoutW CharUpperW UnhookWindowsHookEx SetWindowsHookExW PostThreadMessageW IsCharAlphaNumericW IsCharUpperW IsCharLowerW ToUnicodeEx GetKeyboardLayout CallNextHookEx CharLowerW ReleaseDC DialogBoxParamW ScrollWindow GetSystemMetrics GetWindowRect GetWindowLongPtrW SetFocus DefDlgProcW MoveWindow MapWindowPoints GetClientRect EnableWindow MapDialogRect GetDlgItem SetWindowLongPtrW SetWindowTextW MessageBoxW OpenClipboard GetClipboardData GetClipboardFormatNameW CloseClipboard SetClipboardData EmptyClipboard PostMessageW FindWindowW EndDialog IsWindow DispatchMessageW TranslateMessage GetLastInputInfo LoadCursorW GetCursorInfo ClientToScreen MessageBeep GetIconInfo GetWindowTextLengthW InvalidateRect AdjustWindowRect SetDlgItemTextW SendDlgItemMessageW IsCharAlphaW DestroyIcon EnumDisplayMonitors GetMonitorInfoW BlockInput ShowWindow IsClipboardFormatAvailable CountClipboardFormats SetWindowLongW ScreenToClient IsDialogMessageW MapVirtualKeyExW GetAncestor SendMessageW IsWindowEnabled GetWindowLongW GetKeyState TranslateAcceleratorW KillTimer PeekMessageW GetFocus GetClassNameW GetWindowThreadProcessId GetForegroundWindow GetMessageW SetTimer GetParent GetDlgCtrlID VkKeyScanExW MapVirtualKeyW GetShellWindow GetKeyboardLayoutNameW GetDC

gdi32

GdiFlush CreateDIBSection EnumFontFamiliesExW SetBrushOrgEx CreatePatternBrush GetObjectW GetClipBox SetBkMode SetBkColor GetDeviceCaps CreateCompatibleDC CreateFontIndirectW GetStockObject CreateSolidBrush GetCharABCWidthsW GetTextMetricsW GetPixel GetDIBits SelectObject CreateDCW CreateFontW CreatePolygonRgn CreateRectRgn CreateRoundRectRgn CreateEllipticRgn DeleteObject BitBlt CreateCompatibleBitmap DeleteDC GetSystemPaletteEntries SetTextColor

advapi32

UnlockServiceDatabase RegDeleteKeyW RegSetValueExW RegCreateKeyExW RegQueryValueExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegDeleteValueW GetUserNameW RegConnectRegistryW RegCloseKey RegOpenKeyExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW CreateProcessWithLogonW OpenSCManagerW LockServiceDatabase CloseServiceHandle RegDeleteKeyExW

shell32

SHBrowseForFolderW DragFinish SHGetKnownFolderPath ExtractIconW DragQueryPoint SHEmptyRecycleBinW SHFileOperationW SHGetPathFromIDListW DragQueryFileW SHGetDesktopFolder SHGetMalloc SHCreateItemFromParsingName ShellExecuteExW SHGetFolderPathW Shell_NotifyIconW

ole32

CoCreateInstance CoTaskMemFree CLSIDFromString OleInitialize OleFlushClipboard OleUninitialize CoInitialize CoUninitialize CLSIDFromProgID CoGetObject StringFromGUID2 CreateStreamOnHGlobal

oleaut32

SafeArrayUnaccessData SafeArrayGetElemsize SafeArrayAccessData SafeArrayUnlock SafeArrayPtrOfIndex SafeArrayDestroy SysFreeString OleLoadPicture SysStringLen SafeArrayCreate VariantClear VariantChangeType SysAllocString SafeArrayCopy SysAllocStringLen GetActiveObject VariantCopyInd SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetDim SafeArrayLock