Game-1[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Game-1.exe
Size 579KB
Sample260812-1ctd2sveph
SHA256 c32d18f1982aff86251cf15e72f54d009f52f9a67304c41f13fa01d6b44e49b8
MD5 761649b31b845a64999179861468b134
SHA1 8f5a645bcb82ba5b006b6d4696e2cec624ddc142
SHA512 b4f4a93765fa97b7a279686e768637588ab9236ed1c86cb8126e824e475d8c2d62e38f21fbe437060aa09c283a0de7b6c2c0d4b8d79bc44a1a7ceddfbab2e8e4
SSDEEP 12288:JxDxC8d9NUFDr6ovxJOOQPFxvKpp0wYC:nd96FhvxJePF1spEC
TLSH
T1D6C46B25A6D801FCE2B7D1B88A574913E772B8460331AADF03D056A71F27AE45F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Game-1.exe

File Explorer

Game-1.exe

.exe 579KB

Game-1.exe

IMPHASH 71550a6d8e2559406a236fd888ea4229
SHA256 c32d18f1982aff86251cf15e72f54d009f52f9a67304c41f13fa01d6b44e49b8
MD5 761649b31b845a64999179861468b134
SHA1 8f5a645bcb82ba5b006b6d4696e2cec624ddc142
SHA512 b4f4a93765fa97b7a279686e768637588ab9236ed1c86cb8126e824e475d8c2d62e38f21fbe437060aa09c283a0de7b6c2c0d4b8d79bc44a1a7ceddfbab2e8e4
SSDEEP 12288:JxDxC8d9NUFDr6ovxJOOQPFxvKpp0wYC:nd96FhvxJePF1spEC
TLSH
T1D6C46B25A6D801FCE2B7D1B88A574913E772B8460331AADF03D056A71F27AE45F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

252448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen

ws2_32

closesocket connect htons socket inet_pton WSAStartup recv send

gdi32

SelectObject GetDIBits DeleteObject DeleteDC CreateCompatibleDC BitBlt CreateCompatibleBitmap

user32

DispatchMessageW SendMessageA SendMessageW DestroyWindow OpenClipboard CloseClipboard GetClipboardData GetKeyboardState ToUnicode GetMessageW GetForegroundWindow GetDC ReleaseDC GetWindowTextW GetDesktopWindow GetWindowThreadProcessId SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx SystemParametersInfoA TranslateMessage GetSystemMetrics

advapi32

RegOpenKeyExW GetTokenInformation GetUserNameA RegCloseKey RegDeleteTreeW RegSetValueExW OpenProcessToken RegCreateKeyExW

shell32

ShellExecuteW

avicap32

capCreateCaptureWindowW

winmm

waveInStop waveInReset waveInStart waveInAddBuffer waveInPrepareHeader waveInUnprepareHeader waveInClose waveInOpen

crypt32

CryptUnprotectData

bcrypt

BCryptFinishHash BCryptHashData BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider

ole32

CoUninitialize CoInitializeEx CoCreateInstance

kernel32

IsValidCodePage GetACP GetOEMCP FindFirstFileExW GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetCommandLineA LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetFileType HeapReAlloc HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize RtlVirtualUnwind RtlCaptureContext WriteConsoleW SetEndOfFile WriteFile GetStdHandle GetProcAddress IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary GetLocaleInfoW GetModuleFileNameW ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader GetEnvironmentVariableW CreateDirectoryW DeleteFileA DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesA GetFileAttributesW ReadFile RemoveDirectoryW SetFileAttributesW GetTempPathW CloseHandle CreatePipe PeekNamedPipe WaitForSingleObject Sleep GetCurrentProcess ExitProcess TerminateProcess CreateProcessA CreateProcessW GetTickCount RtlUnwind GetModuleHandleW GlobalUnlock GlobalLock LocalFree CopyFileW MoveFileW MoveFileExW GetComputerNameA MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency GetLastError WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive InitOnceBeginInitialize InitOnceComplete EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead

Name

.text

Size

433KB

Virtual Size

432KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Game-1.exe

winhttp

ws2_32

gdi32

user32

advapi32

shell32

avicap32

winmm

crypt32

bcrypt

ole32

kernel32

generic