GameSense[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
GameSense.exe
Size 3.1MB
Sample260810-1ybfcsvsct
SHA256 497b09be9ea70999dacfa856cd22d1b61a3b3c78065e6754f9e41cec408bfbeb
MD5 a40bf1e77ed42c2e7e107ae72e283f30
SHA1 a8b8199500e5b65cd1180c5282c354f42be73ad5
SHA512 48d424edf4907747f661b2fcf50aee3cdf47d18c5f378ce186899b120ad47265fc4b6dcdf0782f6c2c3b545bf3e750c6e909acb3c80c2146173a8991605ad0bf
SSDEEP 49152:VuSW/TC1ccU1bC8DVcinDq52bwWpo/Y7wjgTm0PxAwJHE6hkLnqV:x8TRVxRo/Y7mgTm05AwJHE6h
TLSH
T10EE58E0A97D516DAD7BA9438C88A9327FB74709AC73003DB6F81093D5F9B6E48B39701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GameSense.exe

File Explorer

GameSense.exe

.exe 3.1MB

GameSense.exe

IMPHASH 62eec636f9a427cb9beac9b5a3a80cfd
SHA256 497b09be9ea70999dacfa856cd22d1b61a3b3c78065e6754f9e41cec408bfbeb
MD5 a40bf1e77ed42c2e7e107ae72e283f30
SHA1 a8b8199500e5b65cd1180c5282c354f42be73ad5
SHA512 48d424edf4907747f661b2fcf50aee3cdf47d18c5f378ce186899b120ad47265fc4b6dcdf0782f6c2c3b545bf3e750c6e909acb3c80c2146173a8991605ad0bf
SSDEEP 49152:VuSW/TC1ccU1bC8DVcinDq52bwWpo/Y7wjgTm0PxAwJHE6hkLnqV:x8TRVxRo/Y7mgTm05AwJHE6h
TLSH
T10EE58E0A97D516DAD7BA9438C88A9327FB74709AC73003DB6F81093D5F9B6E48B39701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1515088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Pineapple\Downloads\obniggertated gamesense\obniggertated gamesense\GameSense_FIXED_M1_soul_cd\GameSense\bin\GameSense.pdb

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReceiveResponse

wininet

InternetCloseHandle InternetOpenUrlA InternetReadFile InternetOpenA

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

gdi32

CreateRectRgn CreateRoundRectRgn RemoveFontResourceExW CreatePen CreateFontW GetTextFaceW CreateDIBSection SetTextColor SetPixel SetBkMode SelectObject SelectClipRgn RoundRect CreateSolidBrush AddFontResourceExW GetTextExtentPoint32W GetStockObject GetDeviceCaps GetClipRgn Ellipse DeleteObject DeleteDC BitBlt CombineRgn CreateCompatibleBitmap CreateCompatibleDC

msimg32

AlphaBlend

user32

mouse_event MapVirtualKeyW MapVirtualKeyExW SetCapture ReleaseCapture SetTimer KillTimer GetSystemMetrics DrawTextW GetForegroundWindow GetDC UpdateLayeredWindow ShowWindow GetKeyNameTextW GetKeyboardLayoutList GetKeyboardLayout GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW IsWindow IsChild keybd_event SetWindowPos IsWindowVisible ToUnicodeEx SetLayeredWindowAttributes SetWindowLongPtrW ReleaseDC BeginPaint EndPaint SetWindowRgn SetCursor SetCursorPos IsWindowUnicode GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetDpiForSystem UpdateWindow IsIconic SetWindowDisplayAffinity CreateWindowExA RegisterClassExA UnregisterClassA DefWindowProcA SetProcessDpiAwarenessContext GetMonitorInfoW MonitorFromWindow LoadImageW LoadCursorW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindowThreadProcessId GetClassNameW EnumWindows InvalidateRect GetWindowLongPtrW PtInRect OffsetRect FillRect ScreenToClient ClientToScreen GetCursorPos GetWindowRect GetClientRect GetWindowTextW DestroyWindow

winmm

timeEndPeriod timeBeginPeriod

comdlg32

ChooseColorW

kernel32

GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA WriteFile GetStdHandle TerminateProcess ExitProcess IsProcessorFeaturePresent ReadFile FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection GetProcessHeap LeaveCriticalSection EnterCriticalSection GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize RaiseException RtlPcToFileHeader GetFileInformationByHandleEx AreFileApisANSI CreateFile2 GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW SetStdHandle GetFileAttributesW CloseHandle Sleep OpenProcess GetTickCount GetTickCount64 ReadProcessMemory WriteProcessMemory GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW GetExitCodeProcess CreateDirectoryA GetLastError DuplicateHandle GetCurrentProcess GetProcessId GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA RtlUnwind GetLocaleInfoEx LocalFree WakeAllConditionVariable FormatMessageA SleepConditionVariableSRW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx CreateFileW HeapSize IsValidLocale WriteConsoleW SetEndOfFile InitializeCriticalSectionEx GetLocaleInfoA

shell32

ShellExecuteW SHGetFolderPathA

shlwapi

PathFileExistsW

gdiplus

GdipAddPathLine GdipAddPathArc GdipAddPathBezier GdipAddPathRectangle GdipCloneBrush GdipDeleteBrush GdipStartPathFigure GdipCreatePen1 GdipDeletePen GdipClosePathFigure GdipDeletePath GdipCreatePath GdiplusStartup GdipFree GdipAlloc GdipSetPenStartCap GdipSetPenEndCap GdipSetPenLineJoin GdipCreateSolidFill GdipFillPath GdipFillEllipse GdipFillPolygon GdipDrawPath GdipDrawEllipse GdipDrawLine GdipScaleWorldTransform GdipTranslateWorldTransform GdipSetPixelOffsetMode GdipSetSmoothingMode GdipSetCompositingQuality GdipDeleteGraphics GdipCreateFromHDC GdipSetPenMode GdipSetPenMiterLimit

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

d3dcompiler_47

D3DCompile

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

GameSense.exe

d3d11

winhttp

wininet

dwmapi

gdi32

msimg32

user32

winmm

comdlg32

kernel32

shell32

shlwapi

gdiplus

imm32

d3dcompiler_47

generic