Manhunt2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Manhunt2.exe
Size 3.1MB
Sample260811-pt8phstbpd
SHA256 f90f02454240d09058d0cc8e975d741652bfbea6e1de9e5e61c0fdbafb685441
MD5 1fc192736e54c23585e82ee8d1057af9
SHA1 9a7053ada233b3aeb2433509dbeba9c45b086cbc
SHA512 a243f57ad312b816d1f37312f56d027cbf98db0174522e18bace932828c695ed1b2bfc511b02f7e34bb8707d3078219f84d1f24bfaab1f609368bc2e83f2045d
SSDEEP 24576:n8qvkZUeUAvWT2jmmX1agk90I/nyf63EZOpzx8pViAdQWyY0xq3yugnyePC2lZom:nDkiesT5mTwhmcxY0UGcrWBPlbs94ZA+
TLSH
T19EE57E12E796E171D45919784DAA52AA9E72A384C73803C37FF82B47EF35FEC4931284
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Manhunt2.exe

File Explorer

Manhunt2.exe

.exe 3.1MB

Manhunt2.exe

IMPHASH 39e65eab83e0e6d32006bf325364dd58
SHA256 f90f02454240d09058d0cc8e975d741652bfbea6e1de9e5e61c0fdbafb685441
MD5 1fc192736e54c23585e82ee8d1057af9
SHA1 9a7053ada233b3aeb2433509dbeba9c45b086cbc
SHA512 a243f57ad312b816d1f37312f56d027cbf98db0174522e18bace932828c695ed1b2bfc511b02f7e34bb8707d3078219f84d1f24bfaab1f609368bc2e83f2045d
SSDEEP 24576:n8qvkZUeUAvWT2jmmX1agk90I/nyf63EZOpzx8pViAdQWyY0xq3yugnyePC2lZom:nDkiesT5mTwhmcxY0UGcrWBPlbs94ZA+
TLSH
T19EE57E12E796E171D45919784DAA52AA9E72A384C73803C37FF82B47EF35FEC4931284
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2212513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d3dx9_35

D3DXCreateEffectPool D3DXCreateEffectEx D3DXMatrixInverse D3DXMatrixOrthoLH D3DXMatrixMultiply D3DXMatrixTranspose

winmm

timeBeginPeriod timeEndPeriod

comctl32

ord17

fmod_event

?setCallback@Event@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW43@PAUFMOD_EVENT@@W4FMOD_EVENT_CALLBACKTYPE@@PAX22@Z2@Z _FMOD_EventSystem_Create@4 ?start@Event@FMOD@@QAG?AW4FMOD_RESULT@@XZ ?setVolume@Event@FMOD@@QAG?AW4FMOD_RESULT@@M@Z ?stop@Event@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z ?getUserData@Event@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z ?setPaused@Event@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z ?setPitch@Event@FMOD@@QAG?AW4FMOD_RESULT@@M@Z ?set3DAttributes@Event@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@00@Z ?getPropertyByIndex@Event@FMOD@@QAG?AW4FMOD_RESULT@@HPAX_N@Z ?setUserData@Event@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z ?getState@Event@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z _FMOD_File_SetDiskBusy@4 _FMOD_Debug_SetLevel@4

fmodex

?stop@Channel@FMOD@@QAG?AW4FMOD_RESULT@@XZ ?createStream@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z ?setPaused@Channel@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z ?getOpenState@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_OPENSTATE@@PAIPA_N@Z ?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ ?isPlaying@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z ?getPaused@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z ?setCallback@Channel@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_CHANNEL_CALLBACKTYPE@@P6G?AW43@PAUFMOD_CHANNEL@@0HII@ZH@Z ?setSpeakerLevels@Channel@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_SPEAKER@@PAMH@Z ?setFrequency@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z ?set3DMinMaxDistance@Channel@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z ?set3DAttributes@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@0@Z ?getPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z ?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z ?getSubSound@Sound@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAV12@@Z ?setMode@Sound@FMOD@@QAG?AW4FMOD_RESULT@@I@Z ?setPriority@Channel@FMOD@@QAG?AW4FMOD_RESULT@@H@Z ?getFrequency@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z ?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_CHANNELINDEX@@PAVSound@2@_NPAPAVChannel@2@@Z FMOD_Memory_Initialize FMOD_Memory_GetStats ?set3DListenerAttributes@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_VECTOR@@000@Z ?setSoftwareFormat@System@FMOD@@QAG?AW4FMOD_RESULT@@HW4FMOD_SOUND_FORMAT@@HHW4FMOD_DSP_RESAMPLER@@@Z ?setSpeakerMode@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@@Z ?setDSPBufferSize@System@FMOD@@QAG?AW4FMOD_RESULT@@IH@Z ?getDriverCaps@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAIPAH1PAW4FMOD_SPEAKERMODE@@@Z ?setSoftwareChannels@System@FMOD@@QAG?AW4FMOD_RESULT@@H@Z ?getVersion@System@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z ?setVolume@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z

dinput8

DirectInput8Create

binkw32

_BinkOpen@8 _BinkSetVolume@12 _BinkWait@4 _BinkClose@4 _BinkSetSoundSystem@8 _BinkDoFrame@4 _BinkShouldSkip@4 _BinkNextFrame@4 _BinkCopyToBufferRect@44 _BinkGetRects@8 _BinkOpenDirectSound@4 _BinkPause@8

shlwapi

PathAppendW PathFileExistsW

kernel32

GetConsoleMode GetConsoleCP GetLocaleInfoA GetStringTypeW GetStringTypeA GetCurrentProcessId GetTickCount GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA SetHandleCount SetFilePointer LCMapStringW LCMapStringA LoadLibraryA HeapSize VirtualAlloc VirtualFree HeapCreate HeapDestroy GetModuleFileNameA GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP InterlockedDecrement InterlockedIncrement GetCPInfo GetStartupInfoW GetProcessHeap GetSystemTimeAsFileTime FlushFileBuffers WideCharToMultiByte ExitProcess GetModuleHandleA RtlUnwind SetStdHandle IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess HeapFree HeapAlloc HeapReAlloc GetStdHandle WriteConsoleW CreateFileA WriteConsoleA EnterCriticalSection LeaveCriticalSection InitializeCriticalSection QueryPerformanceCounter QueryPerformanceFrequency DeleteCriticalSection GetModuleHandleW GetVersionExW MultiByteToWideChar FreeLibrary GetProcAddress LoadLibraryW GetCommandLineW SetThreadExecutionState Sleep GetLastError GetModuleFileNameW CloseHandle GetCurrentProcess lstrlenW GetVersionExA GetFileAttributesW ExpandEnvironmentStringsW CreateEventW WriteFile CreateFileW GetUserDefaultUILanguage ReadFile CompareFileTime SystemTimeToFileTime GetDiskFreeSpaceW SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetSystemTime FindClose FindFirstFileW SetFileAttributesW DeleteFileW Process32NextW Process32FirstW CreateToolhelp32Snapshot SetProcessAffinityMask GetConsoleOutputCP SetEndOfFile RaiseException GetFileType

user32

SendMessageW IsWindowVisible IsZoomed AdjustWindowRect IsIconic SetWindowPos SetWindowPlacement GetMenu GetWindowPlacement SetMenu SetWindowLongW GetWindowLongW DefWindowProcW GetCursorPos UnregisterClassW DestroyWindow DestroyMenu ScreenToClient CreateWindowExW PostQuitMessage RegisterClassW LoadCursorW DestroyAcceleratorTable DispatchMessageW TranslateMessage TranslateAcceleratorW PeekMessageW GetMonitorInfoW EnumDisplaySettingsW SystemParametersInfoA SetTimer UnhookWindowsHookEx SetWindowsHookExW CallNextHookEx GetIconInfo GetDC ReleaseDC ShowWindow GetSystemMetrics MessageBoxW GetClientRect SetCursor GetClassLongW GetWindowRect ClipCursor SetRect SystemParametersInfoW

gdi32

GetDIBits DeleteObject GetObjectW CreateCompatibleDC SelectObject GetStockObject DeleteDC

shell32

SHGetFolderPathW SHCreateDirectoryExW ShellExecuteW ExtractIconW CommandLineToArgvW