SouthPark_TFBW[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SouthPark_TFBW.exe
Size 221.0MB
Sample260809-2dcy5aen2z
SHA256 88351fccdf6d912a4d5b8d045d4c25859fae116137d4afdd80184391061756cf
MD5 26ace6edaed1ea4ec48f343a4d6b8173
SHA1 5546c7d7ee505a996dab13112342fdffa3cd0e7d
SHA512 5ced60a52df7c310ef3629c38c3fb9a274befb2adb7bdbdc2331c05b6f3c7587239c97d38e8653939c9bb25f6459eda09b5ef1450dfba9b840db94e2db432936
SSDEEP 3145728:esFV8bN4rySg2X8/srGyadBvkYrB8TKVR9DkEDJ24bc19T6B1nw:H8Wy0XrOvkkBzDsK
TLSH
T17CB8ADEBBAC118E9D553C2308559E279A5A1FB71078152DBA070C3A3BD7AEDC8C3C716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SouthPark_TFBW.exe

File Explorer

SouthPark_TFBW.exe

.exe 221.0MB

SouthPark_TFBW.exe

IMPHASH d79766625eb453066680ca095db392f2
SHA256 88351fccdf6d912a4d5b8d045d4c25859fae116137d4afdd80184391061756cf
MD5 26ace6edaed1ea4ec48f343a4d6b8173
SHA1 5546c7d7ee505a996dab13112342fdffa3cd0e7d
SHA512 5ced60a52df7c310ef3629c38c3fb9a274befb2adb7bdbdc2331c05b6f3c7587239c97d38e8653939c9bb25f6459eda09b5ef1450dfba9b840db94e2db432936
SSDEEP 3145728:esFV8bN4rySg2X8/srGyadBvkYrB8TKVR9DkEDJ24bc19T6B1nw:H8Wy0XrOvkkBzDsK
TLSH
T17CB8ADEBBAC118E9D553C2308559E279A5A1FB71078152DBA070C3A3BD7AEDC8C3C716
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

229564416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CloseServiceHandle CryptAcquireContextA CryptAcquireContextW CryptGenRandom CryptReleaseContext DeregisterEventSource GetUserNameA OpenSCManagerA OpenServiceA QueryServiceConfigA RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegQueryValueExW RegisterEventSourceA ReportEventA

bink2w64

BinkClose BinkGetFrameBuffersInfo BinkGetKeyFrame BinkGoto BinkOpen BinkOpenDirectSound BinkOpenXAudio2 BinkPause BinkRegisterFrameBuffers BinkSetFileOffset BinkSetFrameRate BinkSetMemory BinkSetSoundSystem BinkSetSoundTrack BinkSetVolume BinkSetWillLoop

gdi32

CreateDCA CreateSolidBrush DeleteDC DeleteObject ExtEscape CreateBitmap

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AllocConsole AttachConsole CloseHandle CopyFileA CreateDirectoryA CreateDirectoryW CreateEventA CreateEventExA CreateEventW CreateFileA CreateFileW CreateIoCompletionPort CreateMutexA CreateProcessA CreateSemaphoreExW CreateThread DeleteCriticalSection DeleteFileA EncodePointer EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExA FindFirstFileW FindNextFileA FormatMessageA FormatMessageW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameA GetComputerNameExA GetConsoleMode GetCurrentDirectoryA GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatA GetEnvironmentVariableA GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileAttributesExA GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetLastError GetLocalTime GetLocaleInfoA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessAffinityMask GetProcessHeap GetQueuedCompletionStatus GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemDirectoryW GetSystemTime GetSystemTimeAsFileTime GetSystemWindowsDirectoryA GetTempPathA GetThreadContext GetTickCount GetTickCount64 GetTimeFormatA GetUserDefaultLCID GetUserPreferredUILanguages GetVersionExA GlobalAlloc GlobalLock GlobalMemoryStatus GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapFree InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock InterlockedPopEntrySList InterlockedPushEntrySList IsBadStringPtrA IsDebuggerPresent LCMapStringEx LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree LockFileEx MultiByteToWideChar OpenMutexA OpenProcess OpenThread OutputDebugStringA PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleMode SetConsoleTitleA SetCurrentDirectoryA SetEndOfFile SetErrorMode SetEvent SetFileAttributesA SetFilePointerEx SetHandleInformation SetLastError SetProcessAffinityMask SetThreadAffinityMask SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnlockFileEx UnmapViewOfFile VerSetConditionMask VerifyVersionInfoA VirtualAlloc VirtualFree VirtualProtect WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile lstrcatW lstrcmpW lstrcpyW lstrlenA lstrlenW

ole32

CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize DoDragDrop OleInitialize RegisterDragDrop ReleaseStgMedium RevokeDragDrop

oleaut32

VariantClear SysFreeString

shell32

CommandLineToArgvW SHGetFolderPathA SHGetFolderPathW ShellExecuteA ShellExecuteExA

user32

AdjustWindowRect AdjustWindowRectEx CallWindowProcW ChangeDisplaySettingsA ClipCursor CloseClipboard CreateIconIndirect CreateWindowExW DestroyCursor DestroyWindow DispatchMessageW EmptyClipboard EnableWindow EnumDisplayDevicesA EnumDisplaySettingsA GetActiveWindow GetAncestor GetCaretBlinkTime GetClipboardData GetDoubleClickTime GetForegroundWindow GetKeyNameTextW GetMonitorInfoA GetWindowLongA GetWindowLongPtrA GetWindowRect GetWindowTextA GetWindowThreadProcessId IsWindowUnicode LoadCursorA MapVirtualKeyA MessageBoxA MsgWaitForMultipleObjects OpenClipboard PeekMessageA PeekMessageW RegisterClassExW RegisterClipboardFormatA RegisterDeviceNotificationA RegisterDeviceNotificationW RegisterRawInputDevices SendMessageA SendMessageW SetClipboardData SetCursor SetWindowLongPtrA SetWindowLongPtrW SetWindowPos SetWindowTextW SetWindowsHookExA ShowCursor ShowWindow SystemParametersInfoA TranslateMessage UnhookWindowsHookEx UnregisterClassW

winmm

timeEndPeriod timeGetDevCaps timeGetTime waveInClose waveInStop timeBeginPeriod

ws2_32

accept ioctlsocket inet_addr WSAGetLastError WSASetLastError WSAStartup WSACleanup inet_ntoa listen ntohs recv recvfrom select send bind setsockopt shutdown socket closesocket connect getpeername gethostbyname gethostname getsockname getsockopt htonl htons WSAIoctl WSARecv WSASend WSASocketA freeaddrinfo getaddrinfo

Name

.xdata

Size

31.4MB

Virtual Size

31.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

18.6MB

Virtual Size

18.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.arch

Size

5.5MB

Virtual Size

11.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.link

Size

512B

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.srdata

Size

39KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ

Name

.edata

Size

151.7MB

Virtual Size

151.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text1

Size

23KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xcode

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.cdx0

Size

424KB

Virtual Size

424KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cdx

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cdx1

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

424KB

Virtual Size

424KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SouthPark_TFBW.exe

advapi32

bink2w64

gdi32

kernel32

ole32

oleaut32

shell32

user32

winmm

ws2_32

generic