39202f905c986a3d10b6ef03e59defc63a64f35a9791c995dc3d36a6dda55c7b
- SHA256 39202f905c986a3d10b6ef03e59defc63a64f35a9791c995dc3d36a6dda55c7b
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Sid Meiers Civilization VI v1.0-v20210128 Plus 22 Trainer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Sid Meiers Civilization VI v1.0-v20210128 Plus 22 Trainer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 39202f905c986a3d10b6ef03e59defc63a64f35a9791c995dc3d36a6dda55c7b
- Size 618KB
- Sample260811-n83alssemb
- SHA256 39202f905c986a3d10b6ef03e59defc63a64f35a9791c995dc3d36a6dda55c7b
- MD5 4cc4273c2abef410150ed39e553cef97
- SHA1 f110895317cb8e8ed757a6786e766e6342a9d5dd
- SHA512 8e7fed296ed7f3b0cbf595f5a300fdaf94096724b7705dbb89224a186e3c9a53e71e83196869c4bdc8fed052d8ca32bceec2bfca0a055a432938ad3d1f4ec5f3
- SSDEEP 12288:5lLkVk9QDpIj5jCGRGPhBry5BKRd8LjUDDdpHMUik3oBc04zBbCNCYdq:5laUiiCBU5B7jUDDfsVVfkoNCIq
- TLSH T1EBD423FAD0C53BB2A3EE1A8A77FF4A6FC510043700DFC1534948DEAE5BFA6516564828
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Sid Meiers Civilization VI v1.0-v20210128 Plus 22 Trainer.exe
File Explorer
-
39202f905c986a3d10b6ef03e59defc63a64f35a9791c995dc3d36a6dda55c7b.zip 618KB
-
Sid Meiers Civilization VI v1.0-v20210128 Plus 22 Trainer.exe.exe 1012KB
-
说明.txt1KB
Sid Meiers Civilization VI v1.0-v20210128 Plus 22 Trainer.exe
- IMPHASH 4fdbbc251f0d79b47aa6947551eb2299
- SHA256 61628f0adf7ee65f235a4f1a0eff9d841c41630ffed14d3183fc93ed7aa2ed02
- MD5 7a53c98be2d968bc525faec24f3a8365
- SHA1 d46224e8912188fe96c143011fc3f6b8c5991b57
- SHA512 aa4f8fe1f5db6475ce80d63644493b6ec41819fb8e40b2edb077ad8335f6de5f91b1eba6be6adc7c36a70d437d847a77dacd9f0cdd661e95b5ca4d12d2e11bc7
- SSDEEP 24576:RW4E+m7edi6j1FeaarZZROzeC4hgHFxEDS/Ky:RDWed/ZFeLVii7hgHHrKy
- TLSH T17625BE0667A401FCE0B7A27D89524906F7B6780B17B28FDF1394476B2F676E04E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
197700
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
CloseHandle
Sleep
GetCurrentProcessId
LoadLibraryW
GetProcAddress
WaitNamedPipeW
GetLastError
CreateFileW
ReadFile
WriteFile
GetModuleHandleA
LoadLibraryA
GetPrivateProfileStringW
WritePrivateProfileStringW
GetModuleHandleW
FindResourceW
LoadResource
SizeofResource
LockResource
GetFileAttributesW
GetModuleFileNameW
LoadLibraryExW
FreeLibrary
MultiByteToWideChar
GetCurrentProcess
IsWow64Process
SetLastError
ResumeThread
WaitForSingleObject
GetTempPathW
CreateDirectoryW
WriteConsoleW
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LocalFree
WideCharToMultiByte
GetStringTypeW
WaitForSingleObjectEx
SwitchToThread
GetCurrentThreadId
GetExitCodeThread
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SetEvent
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
ExitThread
GetStdHandle
HeapFree
HeapAlloc
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
user32
MessageBoxA
MessageBoxW
shell32
SHGetFolderPathW
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
SafeArrayDestroy
mscoree
CorBindToRuntime
CLRCreateInstance
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
winmm
PlaySoundW
Name
.text
Size
467KB
Virtual Size
466KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
160KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
344KB
Virtual Size
343KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=26715,
count=20, id=260, version=26715,
count=179, id=261, version=26715,
count=17, id=260, version=29118,
count=10, id=259, version=29118,
count=147, id=261, version=29118,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=15, id=257, version=26715,
count=180, id=1, productName=Unmarked objects,
count=17, id=265, version=29336,
count=1, id=255, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.8.4 build 29336, version=29336,
说明.txt
- SHA256 8fee13468671ac3192b726f769f358f78689e1e0f18792e9623511f67d34599f
- MD5 906893725a4e398f223375fdb86987b8
- SHA1 3444c6e008fdcbf3758a602510c1aa4840becc28
- SHA512 a38f8069d9c1471bc8c542d2458ab581c2d256784d6dd8be2a17c823c5b44304b51faf6e8778d9638c4fc98087e52e7df15de5818f1542ef22421a8c3bbc01a1
- TLSH T19031FC20E5C0A01960E96D04BB959591C3AF6595433DDFA46FC54AF083205D33C0FFDE
- MD5 SHA1 SHA512 TLSH