UnityPlayer[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
UnityPlayer.dll
Size 32.0MB
Sample260819-arcrqstdqc
SHA256 5e8199f1a791e698145f3c577a8064b09f7e29b3b357b20e746727356700dde9
MD5 87846db80afb2b4a432b012da65d54f9
SHA1 e5d8f7320bfccf292125868fc99f35b3be3e6dcf
SHA512 f602e520019b446b7283dc92858e13cc00479fdfed5266e58ff7dd6567694f099905dee0b138c40e6146cd87f40f04f800ccb5b58650cc286e0e6dcb54daa03d
SSDEEP 393216:w0ROFwDrNJ8zj/dYFLxjdJQKd96gKU3vuYCE06xsZm:wnWrNPNaYCv6J
TLSH
T1ED77AD56A2B940D8D47BD038875BA91BFBB1344907318ADB52E04AA56F33FF12A7F710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

UnityPlayer.dll

.dll 32.0MB

UnityPlayer.dll

IMPHASH b3e92be419d1d652da31b30b258c17ac
SHA256 5e8199f1a791e698145f3c577a8064b09f7e29b3b357b20e746727356700dde9
MD5 87846db80afb2b4a432b012da65d54f9
SHA1 e5d8f7320bfccf292125868fc99f35b3be3e6dcf
SHA512 f602e520019b446b7283dc92858e13cc00479fdfed5266e58ff7dd6567694f099905dee0b138c40e6146cd87f40f04f800ccb5b58650cc286e0e6dcb54daa03d
SSDEEP 393216:w0ROFwDrNJ8zj/dYFLxjdJQKd96gKU3vuYCE06xsZm:wnWrNPNaYCv6J
TLSH
T1ED77AD56A2B940D8D47BD038875BA91BFBB1344907318ADB52E04AA56F33FF12A7F710
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

79:9a:25:c5:d8:da:ef:fb:e8:67:28:91:76:66:c3:81:29:d5:74:96:af:b4:14:25:bd:3b:ff:0b:4e:8e:c7:e4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3183233,CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 11, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

03:e6:cb:30:35:09:9e:63:9e:f3:35:ea:cd:37:c0:1f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 11, 2023 - Jun 8, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

26756972

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\build\output\unity\unity\artifacts\UnityPlayer\Win_x64_VS2022_VB_nondev_i_m\UnityPlayer_Win64_player_il2cpp_x64.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

kernel32

Sleep GlobalLock GlobalUnlock GlobalAlloc GetSystemPowerStatus GlobalMemoryStatusEx CreateToolhelp32Snapshot GetTempPathW GetUserDefaultLocaleName GetSystemDirectoryA CreateFileA GetComputerNameW GetModuleFileNameA GetFileAttributesA GetEnvironmentVariableA GetCurrentDirectoryA RtlCaptureContext SuspendThread GetThreadContext ResumeThread RtlLookupFunctionEntry RtlVirtualUnwind ReadProcessMemory OutputDebugStringA CreateWaitableTimerExW SetWaitableTimer WaitForSingleObjectEx SleepEx SetThreadDescription GetLogicalProcessorInformationEx LocalFree FormatMessageW K32GetProcessMemoryInfo Thread32First Thread32Next GetNativeSystemInfo VirtualQuery GetSystemInfo CreateThread SetThreadPriority GetThreadPriority GetCurrentThreadId SwitchToThread LocalAlloc SetDllDirectoryW CreateMutexA GetWindowsDirectoryW ExpandEnvironmentStringsW GetCurrentDirectoryW OutputDebugStringW DebugBreak SetUnhandledExceptionFilter GetCommandLineW HeapAlloc GetProcessHeap HeapFree LoadLibraryExW GetTickCount CreateEventW GetOverlappedResult ResetEvent WaitForMultipleObjects CancelIo FormatMessageA InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList CreateProcessW CreatePipe SetHandleInformation GetProcessId GetExitCodeProcess SetErrorMode VirtualAlloc VirtualProtect VirtualFree GetErrorMode RemoveDirectoryW VerifyVersionInfoW GetACP InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection AttachConsole WaitForMultipleObjectsEx GetTimeZoneInformation GetStartupInfoA ReleaseSemaphore GetFileSize CreateSemaphoreExW TlsAlloc TlsFree InitializeCriticalSectionAndSpinCount GetStdHandle SetThreadAffinityMask UnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx RtlPcToFileHeader RtlUnwind HeapSize HeapReAlloc HeapQueryInformation ExitProcess GetModuleHandleExW DuplicateHandle GetConsoleOutputCP GetConsoleMode FreeLibraryAndExitThread GetFileType ReadConsoleW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime FlsAlloc DeleteFileW CreateDirectoryW CreateFileW GetFileAttributesExW GetCurrentThread GetCurrentProcess TerminateProcess FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW VerSetConditionMask LoadLibraryA GetDiskFreeSpaceExW SetFileTime SystemTimeToFileTime GetSystemTime GetFullPathNameW ReplaceFileW FlushFileBuffers GetTempFileNameW GetFileSizeEx SetEndOfFile WriteFile ReadFile SetFilePointer WriteConsoleW GetModuleHandleA CreateEventExW SetEvent QueryPerformanceFrequency QueryPerformanceCounter GetLocalTime IsDebuggerPresent SetFilePointerEx FindClose FindNextFileW FindFirstFileW FindFirstFileExW MoveFileExW CopyFileW GetLocaleInfoEx GetCPInfo SetFileAttributesW SetConsoleCtrlHandler WaitForSingleObject OpenThread CreateEventA SetLastError FreeLibrary GetProcAddress LoadLibraryW CloseHandle GetFileAttributesW GetModuleFileNameW GetModuleHandleW WideCharToMultiByte RaiseException GetSystemTimeAsFileTime GetCurrentProcessId MultiByteToWideChar GetLastError InitializeSListHead ExitThread GetSystemDirectoryW InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateWaitableTimerA InitOnceBeginInitialize InitOnceComplete GetStringTypeW TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer LCMapStringEx TlsGetValue TlsSetValue InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList LoadLibraryExA

user32

DispatchMessageA MapVirtualKeyA GetRawInputData GetRawInputBuffer MessageBoxW GetWindowLongA AllowSetForegroundWindow GetDC TranslateMessage SystemParametersInfoW UnregisterDeviceNotification SetWindowLongA LoadIconW GetWindowPlacement AdjustWindowRectExForDpi GetForegroundWindow EnumDisplaySettingsW PtInRect GetMessageExtraInfo EnumDisplaySettingsA RegisterDeviceNotificationW SetCapture ReleaseCapture DestroyIcon DestroyCursor SetCursor LoadCursorA LoadImageW GetRawInputDeviceList RegisterRawInputDevices GetKeyNameTextW MapVirtualKeyW ToUnicode GetKeyboardLayoutNameW GetRawInputDeviceInfoW GetKeyboardLayout MapVirtualKeyExA GetAsyncKeyState GetKeyState GetCursorPos TrackMouseEvent GetSystemMetrics RegisterClassExW MessageBoxA DialogBoxParamW EndDialog SetDlgItemTextW SetDlgItemTextA LoadIconA SendDlgItemMessageW OffsetRect CopyRect SendMessageTimeoutA SetForegroundWindow EnumWindows GetUserObjectInformationA GetThreadDesktop RegisterWindowMessageA SetClipboardData EmptyClipboard CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard ReleaseDC GetDesktopWindow DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes UpdateWindow SendMessageW GetMessageA SetWindowTextW SetTimer ShowWindow GetActiveWindow GetParent ValidateRect IsIconic KillTimer MonitorFromRect SetWindowLongPtrA IsWindowVisible SetWindowPos EnumDisplayMonitors EnumDisplayDevicesA GetMonitorInfoA PostQuitMessage DefWindowProcW SetWindowLongPtrW GetWindowLongPtrW DestroyWindow UnregisterClassW RegisterClassW SetCursorPos ClientToScreen ClipCursor MonitorFromWindow ShowCursor GetClientRect MoveWindow GetWindowRect GetMonitorInfoW SetFocus GetFocus PeekMessageA MsgWaitForMultipleObjects CreateWindowExW GetCaretBlinkTime GetDoubleClickTime ScreenToClient

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

ole32

CoInitialize PropVariantCopy PropVariantClear RoGetAgileReference CoTaskMemAlloc CoCreateFreeThreadedMarshaler StringFromGUID2 CoCreateGuid CoSetProxyBlanket CoTaskMemFree CoCreateInstance CoUninitialize

shlwapi

PathCanonicalizeW SHDeleteKeyW

setupapi

SetupDiEnumDeviceInterfaces SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

advapi32

RegCreateKeyW RegCloseKey RegQueryValueExA RegSetValueExA RegDeleteValueA RegQueryValueExW GetUserNameA OpenProcessToken GetTokenInformation GetSidSubAuthority RegCreateKeyExW RegSetValueExW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegOpenKeyExW

gdi32

ChoosePixelFormat SetPixelFormat GetDeviceCaps SwapBuffers

shell32

SHGetFolderPathW SHGetKnownFolderPath ShellExecuteW SHFileOperationW CommandLineToArgvW

opengl32

wglGetProcAddress wglDeleteContext wglMakeCurrent wglGetCurrentDC wglCreateContext wglGetCurrentContext

winmm

waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite waveOutGetNumDevs waveOutGetPosition waveOutClose waveInGetDevCapsA waveInGetDevCapsW waveInOpen waveInClose waveInPrepareHeader waveOutOpen waveOutGetDevCapsW waveInReset waveOutGetDevCapsA timeBeginPeriod waveInGetNumDevs timeEndPeriod waveOutReset waveInUnprepareHeader waveInAddBuffer waveInStart timeGetTime

oleaut32

SysAllocString VariantClear SysFreeString VariantInit VariantChangeType

imm32

ImmSetCompositionStringW ImmNotifyIME ImmGetCompositionStringW ImmAssociateContextEx ImmAssociateContext ImmGetConversionStatus ImmReleaseContext ImmGetContext

iphlpapi

IcmpCreateFile IcmpSendEcho IcmpCloseHandle

winhttp

WinHttpOpen WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpCloseHandle

bcrypt

BCryptGenRandom

hid

HidP_GetData HidP_MaxDataListLength HidD_GetSerialNumberString HidD_GetManufacturerString HidD_GetProductString HidD_FreePreparsedData HidD_GetPreparsedData HidD_GetHidGuid HidP_SetUsages HidP_SetUsageValue HidP_GetButtonCaps HidP_GetValueCaps HidD_GetAttributes HidP_GetCaps

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize RoGetActivationFactory RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsDeleteString WindowsCreateStringReference WindowsCompareStringOrdinal WindowsGetStringRawBuffer WindowsDuplicateString

d3d11

D3D11On12CreateDevice D3D11CreateDevice

dxgi

CreateDXGIFactory2 CreateDXGIFactory

crypt32

CertFreeCertificateContext CertFreeCertificateChain CertVerifyCertificateChainPolicy CertCloseStore CertOpenStore CertAddEncodedCertificateToStore CertGetCertificateChain

ws2_32

htons inet_addr htonl WSASendDisconnect gethostbyaddr freeaddrinfo getaddrinfo WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACancelAsyncRequest WSAAsyncGetHostByName FreeAddrInfoExW WSAIoctl GetAddrInfoExW WSACloseEvent WSACreateEvent WSASocketW WSAWaitForMultipleEvents getsockopt GetAddrInfoExCancel getpeername getprotobyname gethostbyname ntohl ioctlsocket __WSAFDIsSet closesocket WSASocketA recv select setsockopt WSASetLastError gethostname WSAGetLastError socket WSACleanup WSAStartup recvfrom send sendto connect shutdown accept bind getsockname listen ntohs

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute

Name

.text

Size

25.9MB

Virtual Size

25.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

310KB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=18, id=260, version=33218,

count=37, id=259, version=33218,

count=38, id=259, version=28900,

count=107, id=260, productName=VS2019 v16.8.0 build 29333, version=29333,

count=34, id=260, version=31935,

count=111, id=261, productName=VS2019 v16.8.0 build 29333, version=29333,

count=74, id=260, version=28900,

count=44, id=257, version=28900,

count=9, id=253, version=33218,

count=90, id=261, version=33218,

count=149, id=261, version=31935,

count=223, id=261, version=28900,

count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=595, id=1, productName=Unmarked objects,

count=33, productName=Unmarked objects (old),

count=1271, id=265, version=33523,

count=1, id=256, version=33523,

count=1, id=255, version=33523,

count=1, id=258, version=33523,