BeamNG[.]drive[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
BeamNG.drive.exe
Size 890KB
Sample260910-1f2jtsywev
SHA256 e37be10e3bbf03fc97c7a0e510e169a30cf76fe99691122ebdd461aeaf3ef532
MD5 f0c123a9e40d0f5f22e96d97092a1c38
SHA1 fc64f61cf7275d8022fbdb7743e125f7bfa4d10a
SHA512 1014d47a9af7e35db078409c7d9502d9b13d8320493b482b708459c37023e37f7ee410add6b603373b812efac8e9f7655b8bef22fbd73c9c1c381199e0bd64ec
SSDEEP 24576:CPzH+0sTQ198IvnNTo/VcomJiXCkkKkk7nP:4+vIfdotcotP
TLSH
T13F153850B672B87EC1EDC131BDAA26256D2CDE0603C549C3D2D1EDF865132DAEF39298
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BeamNG.drive.exe

File Explorer

BeamNG.drive.exe

.exe 890KB

BeamNG.drive.exe

IMPHASH 8f28ee8043cac0fe1051fdf2b26c8da7
SHA256 e37be10e3bbf03fc97c7a0e510e169a30cf76fe99691122ebdd461aeaf3ef532
MD5 f0c123a9e40d0f5f22e96d97092a1c38
SHA1 fc64f61cf7275d8022fbdb7743e125f7bfa4d10a
SHA512 1014d47a9af7e35db078409c7d9502d9b13d8320493b482b708459c37023e37f7ee410add6b603373b812efac8e9f7655b8bef22fbd73c9c1c381199e0bd64ec
SSDEEP 24576:CPzH+0sTQ198IvnNTo/VcomJiXCkkKkk7nP:4+vIfdotcotP
TLSH
T13F153850B672B87EC1EDC131BDAA26256D2CDE0603C549C3D2D1EDF865132DAEF39298
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

462329

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\gameengine\root\game\BeamNG.drive.pdb

kernel32

CreateFileW WriteFile GetLastError SetErrorMode WaitNamedPipeW GetCurrentProcess TerminateProcess GetExitCodeProcess OpenProcess GlobalMemoryStatusEx Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetModuleFileNameW GetProcAddress FormatMessageW LoadLibraryW VerifyVersionInfoW CreateToolhelp32Snapshot Process32FirstW Process32NextW FlushFileBuffers AllocConsole SetConsoleTitleW VerSetConditionMask GetModuleHandleW LocalFree GetCommandLineW GetCommandLineA CreateProcessW WaitForSingleObject QueryPerformanceFrequency GetCurrentProcessId QueryPerformanceCounter CloseHandle GetFileAttributesW FindNextFileW FindFirstFileW IsProcessorFeaturePresent IsDebuggerPresent DecodePointer EncodePointer GetTimeZoneInformation FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetVolumeInformationA LoadLibraryA GetCurrentThreadId CreateThread DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetFilePointer FreeConsole SetConsoleTextAttribute GetConsoleScreenBufferInfo GetStdHandle FreeLibrary MultiByteToWideChar MoveFileW CopyFileW RemoveDirectoryW FindClose DeleteFileW FormatMessageA ExpandEnvironmentStringsA SetLastError VerifyVersionInfoA SleepEx Sleep GetTickCount GetFileAttributesExW GetFileSize ReadFile GetSystemTimeAsFileTime CreateDirectoryW GetDriveTypeA

user32

DestroyWindow LoadIconW SendMessageW MessageBoxA MessageBoxW GetMessageA GetMessageW TranslateMessage DispatchMessageW PostMessageW DefWindowProcW UnregisterClassA RegisterClassExA CreateWindowExA SetWindowPos

shell32

SHGetFolderPathW CommandLineToArgvW ShellExecuteW SHGetKnownFolderPath SHCreateDirectoryExW

ole32

CoInitialize CoCreateInstance CoUninitialize

advapi32

CryptAcquireContextA RegSetValueExW RegSetValueExA RegOpenKeyExA RegCreateKeyExA CryptDestroyHash OpenProcessToken CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData

ws2_32

sendto bind ioctlsocket freeaddrinfo socket getaddrinfo WSAIoctl WSAStartup WSACleanup WSAGetLastError closesocket htons inet_addr __WSAFDIsSet select WSASetLastError recv send connect getpeername getsockname getsockopt ntohs setsockopt

shlwapi

PathFileExistsW

msi

ord74 ord145 ord70

msvcp120

?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?uncaught_exception@std@@YA_NXZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z ?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?_BADOFF@std@@3_JB ?id@?$codecvt@DDH@std@@2V0locale@2@A ??_7ios_base@std@@6B@ ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Orphan_all@_Container_base12@std@@QAEXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Syserror_map@std@@YAPBDH@Z ?_Winerror_map@std@@YAPBDH@Z ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ _Getcoll _Strcoll ??_7facet@locale@std@@6B@ _Strxfrm ??0_Locinfo@std@@QAE@PBD@Z ??1_Locinfo@std@@QAE@XZ ??Bid@locale@std@@QAEIXZ ??0facet@locale@std@@IAE@I@Z ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?tolower@?$ctype@D@std@@QBEDD@Z ?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UAEXXZ ??_7_Facet_base@std@@6B@ ?_Xbad_alloc@std@@YAXXZ

msvcr120

??0bad_cast@std@@QAE@PBD@Z ??0bad_cast@std@@QAE@ABV01@@Z ??1bad_cast@std@@UAE@XZ exit fclose fflush fgetc fgetpos fputc fsetpos _fseeki64 fwrite setvbuf ungetc _lock_file _unlock_file memcpy_s modf ??_V@YAXPAX@Z fprintf sprintf_s sscanf strpbrk isxdigit strtoul calloc isdigit strncmp strchr strtol strrchr fgets fopen fputs qsort strtoll tolower isalpha strncpy strstr fread fseek isspace toupper isalnum _gmtime64 getenv strerror __sys_nerr _errno _stat64i32 isupper _snprintf_s _localtime64_s fopen_s ftell strtod _waccess _wchmod _mbsicmp rewind _snprintf _wfopen wcsncpy_s _wmkdir _wrename _wstat64 wcschr _fdopen _open_osfhandle _mktime64 bsearch printf atoi _lock _unlock _calloc_crt __dllonexit _onexit _except1 ??1type_info@@UAE@XZ _XcptFilter __crtGetShowWindowMode _amsg_exit __getmainargs __set_app_type _exit _cexit _ismbblead _configthreadlocale __setusermatherr _initterm_e _initterm _acmdln _fmode _commode ?terminate@@YAXXZ _crt_debugger_hook __crtUnhandledException __crtTerminateProcess _vsnprintf_s _except_handler4_common __crtSetUnhandledExceptionFilter _invoke_watson _controlfp_s realloc getc __iob_func memset memcpy __CxxFrameHandler3 _CxxThrowException ?what@exception@std@@UBEPBDXZ _time64 _localtime64 strftime ??1exception@std@@UAE@XZ ??0exception@std@@QAE@ABV01@@Z ??0exception@std@@QAE@ABQBD@Z memmove memchr malloc free _hypot ??3@YAXPAX@Z ??2@YAPAXI@Z _purecall sprintf _strdup _read _write ??0exception@std@@QAE@XZ _stricmp

comctl32

ord345

powrprof

PowerGetActiveScheme PowerSetActiveScheme

oleaut32

SysFreeString SysAllocString

NvOptimusEnablement PHYSFS_addToSearchPath PHYSFS_close PHYSFS_deinit PHYSFS_delete PHYSFS_deregisterArchiver PHYSFS_enumerateFiles PHYSFS_enumerateFilesCallback PHYSFS_enumerateFilesWithAttrb PHYSFS_eof PHYSFS_exists PHYSFS_fileLength PHYSFS_flush PHYSFS_freeList PHYSFS_getAllocator PHYSFS_getBaseDir PHYSFS_getCdRomDirs PHYSFS_getCdRomDirsCallback PHYSFS_getDirSeparator PHYSFS_getErrorByCode PHYSFS_getLastError PHYSFS_getLastErrorCode PHYSFS_getLastModTime PHYSFS_getLinkedVersion PHYSFS_getMountPoint PHYSFS_getPrefDir PHYSFS_getRealDir PHYSFS_getSearchPath PHYSFS_getSearchPathCallback PHYSFS_getUserDir PHYSFS_getWriteDir PHYSFS_init PHYSFS_isDirectory PHYSFS_isInit PHYSFS_isSymbolicLink PHYSFS_mkdir PHYSFS_mount PHYSFS_mountHandle PHYSFS_mountIo PHYSFS_mountMemory PHYSFS_openAppend PHYSFS_openRead PHYSFS_openWrite PHYSFS_permitSymbolicLinks PHYSFS_read PHYSFS_readBytes PHYSFS_readSBE16 PHYSFS_readSBE32 PHYSFS_readSBE64 PHYSFS_readSLE16 PHYSFS_readSLE32 PHYSFS_readSLE64 PHYSFS_readUBE16 PHYSFS_readUBE32 PHYSFS_readUBE64 PHYSFS_readULE16 PHYSFS_readULE32 PHYSFS_readULE64 PHYSFS_registerArchiver PHYSFS_removeFromSearchPath PHYSFS_seek PHYSFS_setAllocator PHYSFS_setBuffer PHYSFS_setErrorCode PHYSFS_setSaneConfig PHYSFS_setWriteDir PHYSFS_stat PHYSFS_supportedArchiveTypes PHYSFS_swapSBE16 PHYSFS_swapSBE32 PHYSFS_swapSBE64 PHYSFS_swapSLE16 PHYSFS_swapSLE32 PHYSFS_swapSLE64 PHYSFS_swapUBE16 PHYSFS_swapUBE32 PHYSFS_swapUBE64 PHYSFS_swapULE16 PHYSFS_swapULE32 PHYSFS_swapULE64 PHYSFS_symbolicLinksPermitted PHYSFS_tell PHYSFS_unmount PHYSFS_utf8FromLatin1 PHYSFS_utf8FromUcs2 PHYSFS_utf8FromUcs4 PHYSFS_utf8FromUtf16 PHYSFS_utf8ToUcs2 PHYSFS_utf8ToUcs4 PHYSFS_utf8ToUtf16 PHYSFS_write PHYSFS_writeBytes PHYSFS_writeSBE16 PHYSFS_writeSBE32 PHYSFS_writeSBE64 PHYSFS_writeSLE16 PHYSFS_writeSLE32 PHYSFS_writeSLE64 PHYSFS_writeUBE16 PHYSFS_writeUBE32 PHYSFS_writeUBE64 PHYSFS_writeULE16 PHYSFS_writeULE32 PHYSFS_writeULE64