Race_Steam[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Race_Steam.exe
Size 7.1MB
Sample260817-f1qb3stdrc
SHA256 eac51e7c9ca2aff9688dc3ae371a357c1a43cba371c1d23ec189b199bf4821c8
MD5 0889803b61a88075f3d100ae8d131526
SHA1 f23fdffb9a8a1cda65ba31e12f97c4e81f7326bb
SHA512 9e0054399fe07136c19f6ed9eea254b350867f3314079b62fedda4ab8d2bcc5d783ffcca35244bd443535e99aef3252fe796ed0bc6889f33b65dfc4e6d1e26d6
SSDEEP 98304:h624mIHyg69kQ4Go+eKWsy3h2hED5XiA/6hZQK5r:o24mIHnhf+eLsy30hEDZiACDQwr
TLSH
T18D76CF51F24851F4E347157468A6633AA6389FB1277416C3B9E83E17BA33FE05C7A28C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Race_Steam.exe

File Explorer

Race_Steam.exe

.exe 7.1MB

Race_Steam.exe

IMPHASH b16759b601f022734eb1fe8477abb1fe
SHA256 eac51e7c9ca2aff9688dc3ae371a357c1a43cba371c1d23ec189b199bf4821c8
MD5 0889803b61a88075f3d100ae8d131526
SHA1 f23fdffb9a8a1cda65ba31e12f97c4e81f7326bb
SHA512 9e0054399fe07136c19f6ed9eea254b350867f3314079b62fedda4ab8d2bcc5d783ffcca35244bd443535e99aef3252fe796ed0bc6889f33b65dfc4e6d1e26d6
SSDEEP 98304:h624mIHyg69kQ4Go+eKWsy3h2hED5XiA/6hZQK5r:o24mIHnhf+eLsy30hEDZiACDQwr
TLSH
T18D76CF51F24851F4E347157468A6633AA6389FB1277416C3B9E83E17BA33FE05C7A28C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3267976

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\P4\Venom\Game\Race_Steam.pdb

steam_api

SteamAPI_RunCallbacks SteamAPI_Shutdown SteamGameServer_Init SteamGameServer SteamAPI_UnregisterCallback SteamAPI_RegisterCallback SteamGameServer_RunCallbacks SteamAPI_Init SteamGameServer_Shutdown SteamUser

steam

SteamClearError SteamStat SteamGetc SteamMountAppFilesystem SteamOpenFile SteamFindClose SteamGetUser SteamStartup SteamPutc SteamUnmountFilesystem SteamMountFilesystem SteamFindNext SteamFindFirst SteamBlockingCall SteamGetAppUpdateStats SteamIsAppSubscribed SteamSeekFile SteamTellFile SteamFlushFile SteamEnumerateApp SteamWriteFile SteamGetAppIds SteamGetAppStats SteamCleanup SteamUnmountAppFilesystem SteamLogResourceLoadFinished SteamLogResourceLoadStarted SteamReadFile SteamCloseFile SteamGetEncryptedUserIDTicket

wininet

InternetOpenA InternetCloseHandle InternetReadFile InternetOpenUrlA

ws2_32

gethostbyname gethostname WSASetLastError getservbyport gethostbyaddr getservbyname WSASocketA inet_ntoa WSAStartup sendto listen bind shutdown setsockopt ioctlsocket getpeername getsockname ntohs htonl select WSAGetLastError htons send recv socket connect inet_addr closesocket WSACleanup accept recvfrom

dinput8

DirectInput8Create

d3dx9_36

D3DXAssembleShaderFromFileA D3DXAssembleShader D3DXCompileShaderFromFileA D3DXCompileShader D3DXCreateEffect D3DXLoadSurfaceFromFileInMemory D3DXLoadSurfaceFromSurface D3DXCreateVolumeTexture D3DXCreateCubeTexture D3DXCreateTexture D3DXGetImageInfoFromFileInMemory D3DXFillCubeTexture D3DXFillTexture D3DXVec3Normalize D3DXVec2Normalize D3DXMatrixPerspectiveFovLH D3DXMatrixPerspectiveOffCenterLH D3DXMatrixReflect D3DXVec3Hermite D3DXMatrixOrthoLH D3DXPlaneTransform D3DXSaveSurfaceToFileA D3DXGetImageInfoFromFileA D3DXMatrixMultiply

mss32

_AIL_pause_stream@8 _AIL_set_sample_processor@12 _AIL_set_filter_sample_preference@12 _AIL_enumerate_filters@12 _AIL_open_filter@8 _AIL_sample_status@4 _AIL_resume_sample@4 _AIL_stop_sample@4 _AIL_end_sample@4 _AIL_init_sample@4 _AIL_allocate_sample_handle@4 _AIL_release_sample_handle@4 _AIL_file_read@8 _AIL_WAV_info@8 _AIL_set_file_callbacks@16 _AIL_set_stream_volume_levels@12 _AIL_shutdown@0 _AIL_open_digital_driver@16 _AIL_startup@0 _AIL_waveOutClose@4 _AIL_mem_free_lock@4 _AIL_start_stream@4 _AIL_set_stream_loop_count@8 _AIL_register_stream_callback@8 _AIL_open_stream@12 _AIL_start_sample@4 _AIL_set_sample_position@8 _AIL_set_sample_playback_rate@8 _AIL_set_sample_volume_levels@12 _AIL_set_sample_loop_count@8 _AIL_set_sample_file@12 _AIL_serve@0 _AIL_set_preference@8 _AIL_set_DirectSound_HWND@8 _AIL_close_stream@4

comctl32

ImageList_GetImageCount ImageList_Create ImageList_Add

winmm

timeBeginPeriod timeEndPeriod

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

kernel32

GetACP GetCPInfo LCMapStringW LCMapStringA VirtualQuery VirtualAlloc GetStartupInfoA GetProcessHeap GetCommandLineA HeapReAlloc ExitProcess GetModuleHandleA GetTimeZoneInformation HeapAlloc FileTimeToLocalFileTime FileTimeToSystemTime GetFullPathNameA GetDriveTypeA GetOEMCP IsValidCodePage HeapSize GetStdHandle HeapDestroy HeapFree GetSystemTimeAsFileTime RtlUnwind IsDebuggerPresent UnhandledExceptionFilter InterlockedDecrement InterlockedIncrement UnmapViewOfFile MapViewOfFile CloseHandle CreateProcessA FindClose FindNextFileA FindFirstFileA ReleaseMutex WaitForSingleObject CreateMutexA OutputDebugStringA GetVersionExA LocalFree GetCurrentProcess GetLastError GetCurrentThread DeleteFileA WideCharToMultiByte FreeLibrary GetProcAddress LoadLibraryA GetModuleFileNameA SetPriorityClass GetLocaleInfoA SetThreadAffinityMask Sleep GetLocalTime WriteConsoleW CreateThread GetProcessAffinityMask GetTempPathA Thread32Next GetCurrentProcessId Thread32First CreateToolhelp32Snapshot HeapCreate CreateDirectoryA CopyFileA GetFileAttributesA GetTickCount WriteFile CreateFileA SetEndOfFile SetFilePointer ReadFile CreateFileMappingA InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateEventA SetEvent ResetEvent GetExitCodeThread TlsAlloc TlsFree TlsGetValue TlsSetValue SleepEx FormatMessageA MoveFileA GetSystemInfo GetPriorityClass GlobalMemoryStatus GetFileSizeEx SetFilePointerEx GetFileInformationByHandle GetCompressedFileSizeA RaiseException GetExitCodeProcess SetFileTime GetFileAttributesExA ConnectNamedPipe CreateNamedPipeA FlushFileBuffers DisconnectNamedPipe GetCurrentThreadId SetUnhandledExceptionFilter GetComputerNameA GetSystemDirectoryA SetLastError TerminateThread lstrlenA CompareStringW CompareStringA MultiByteToWideChar InterlockedExchange QueryPerformanceFrequency QueryPerformanceCounter RemoveDirectoryA CompareFileTime SetThreadPriority ResumeThread SuspendThread QueueUserAPC VirtualFree GetCurrentDirectoryA SetFileAttributesA SetEnvironmentVariableA GetThreadLocale SetHandleCount GetFileType GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetStdHandle GetLocaleInfoW WriteConsoleA OpenThread GetConsoleOutputCP TerminateProcess

user32

DrawTextA PostQuitMessage CreateWindowExA RegisterClassExA EnumChildWindows LoadIconA UpdateWindow CloseClipboard GetClipboardData OpenClipboard IsDialogMessageA GetMessageA DispatchMessageA TranslateMessage PeekMessageA CreateDialogParamA GetParent GetDlgCtrlID IsWindowVisible GetKeyState DestroyWindow GetDesktopWindow ClipCursor UnregisterClassA AdjustWindowRectEx GetClientRect SystemParametersInfoA DefWindowProcA SetForegroundWindow SetTimer GetWindowRect MessageBoxA SetWindowPos ShowWindow SetWindowTextA GetScrollInfo LoadBitmapA SendMessageA GetDlgItem EnableWindow SendDlgItemMessageA GetWindowTextA GetKeyboardState MapVirtualKeyExA ToAsciiEx GetKeyboardLayout GetCursorPos SetCursorPos wsprintfA SetCursor DestroyCursor LoadImageA ShowCursor

gdi32

SetMapMode SetMapperFlags CreateFontIndirectA DeleteDC CreateCompatibleDC DeleteObject CreateDIBSection GetCharABCWidthsA GetCharWidth32A ExtTextOutA Polyline CreatePen SetTextAlign GetTextExtentPoint32A GetDeviceCaps SetBkColor SetTextColor SelectObject GetStockObject GetCharABCWidthsFloatA

comdlg32

GetOpenFileNameA

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

SHFileOperationA SHGetFolderPathA ShellExecuteA

ole32

CoCreateGuid

crypt32

CryptVerifyMessageSignature CertGetNameStringA CertFreeCertificateContext

imagehlp

ImageGetCertificateHeader ImageGetCertificateData ImageEnumerateCertificates

wintrust

WinVerifyTrust

d3d9

Direct3DCreate9

binkw32

_BinkWait@4 _BinkDoFrame@4 _BinkNextFrame@4 _BinkGetRects@8 _BinkCopyToBufferRect@44 _BinkCopyToBuffer@28 _BinkSetVolume@12 _BinkGoto@12 _BinkClose@4 _BinkOpenMiles@4 _BinkSetSoundSystem@8 _BinkGetError@0 _BinkOpenDirectSound@4 _BinkSetSoundTrack@8 _BinkOpen@8

dbghelp

MiniDumpWriteDump

generic

count=6, id=93, version=2179,

count=6, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=13, id=126, version=50327,

count=65, id=125, productName=VS2005 build 50727, version=50727,

count=49, id=114, version=50727,

count=1, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=4, id=93, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=28, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=25, productName=VS2002 (.NET) build 9466, version=9466,

count=7, id=123, productName=VS2005 build 50727, version=50727,

count=458, id=1, productName=Unmarked objects,

count=239, id=109, productName=VS2005 build 50727, version=50727,

count=494, id=110, productName=VS2005 build 50727, version=50727,

count=1, id=122, productName=VS2005 build 50727, version=50727,

count=1, id=124, productName=VS2005 build 50727, version=50727,

count=1, id=120, productName=VS2005 build 50727, version=50727,