6b6c0a789d7d49ae9ec133ace74d8b7b8a425f9c5ca793b5bb76002b16044aef
- SHA256 6b6c0a789d7d49ae9ec133ace74d8b7b8a425f9c5ca793b5bb76002b16044aef
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Dead Space Remake TÜRKÇE YAMA/dxgi.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Dead Space Remake TÜRKÇE YAMA/dxgi.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 6b6c0a789d7d49ae9ec133ace74d8b7b8a425f9c5ca793b5bb76002b16044aef
- Size 246KB
- Sample260916-1ercgatth1
- SHA256 6b6c0a789d7d49ae9ec133ace74d8b7b8a425f9c5ca793b5bb76002b16044aef
- MD5 bb434c43eda65b62238348d25e0fe83d
- SHA1 b9769643cd33858268f1870c874779bf2ecc3c46
- SHA512 e88da03dcec7d65041ac5db4fee655010f7f3f270be8b23a46438da773a547c3a4a9b26b864e0d911c859619166a0ec834d484b0d5affd41bdb39d5b451e91c2
- SSDEEP 6144:x8R8pEerlz+fWRgCdEZ12ivaGF4OYMIS03ngTACt9cVM0Igt:+gEGlzj/6ZVvDdJzlt9h01t
- TLSH T1843423B34BEA8077E76C0678EB0341DECAE95DDB42BD52063A3599E5134600126FEFC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Dead Space Remake TÜRKÇE YAMA/dxgi.dll
File Explorer
-
6b6c0a789d7d49ae9ec133ace74d8b7b8a425f9c5ca793b5bb76002b16044aef.zip 246KB
-
Dead Space Remake TÜRKÇE YAMA/Data/Win32/loc/hu.toc534KB
-
Dead Space Remake TÜRKÇE YAMA/dxgi.dll.dll 57KB
Dead Space Remake TÜRKÇE YAMA/Data/Win32/loc/hu.toc
- SHA256 ea74c5981feabd1c230c48ae73958aa1a62f4750eecfaaae97cb496e6925ec02
- MD5 e4d1418e028fcd378128cafacb228996
- SHA1 5fd29c9fcc3c893148ff87c2c8a7bdfde6016267
- SHA512 88370a89ea69f61cb88608cb591e9c7d0de93cc1cfeb1a3d057ee5bd386abec03829abd3b6324f513c9c0d13ab5583ddeff17d39ffdfdf4dd76e124b4720cab2
- SSDEEP 12288:T4iEPjY7FJ5I3pqwxQfl1LwfgUIIkxeUgZIzKBkgEFX0HPt:os7ix
- TLSH T1E7C43ACCB897E81C572902BEE5573926FCCF3B416270D696CD3A6A1532C829706FB4C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Dead Space Remake TÜRKÇE YAMA/dxgi.dll
- IMPHASH a06b51f84b4013a4b04451499246278f
- SHA256 29bdb901696a681f939e4f42f6a8376674c77188a763812d752695a13324dbc4
- MD5 e3e1801915f04a71fcab774f620de5c2
- SHA1 2afcd858650920598b95a9c2abdb69917b0a3f98
- SHA512 12abbd2881b56534749e4210f683e5bbe1dabce0e78ab81a66adaaebb690a653797fadc0107ee0806a53c633625229d196266a024e242d3028d94eb49f7a84af
- SSDEEP 768:SknPFvLxSGDdfC3490zVFVGJ96/j/MuZ83qwIpfPpQVukJhaxh:7FjxFdafVFVGJE1830xQzhsh
- TLSH T197436C5FA39A04ECD56B927CC6A70653D3B27849031097CF37E1826A1F637D46ABBB10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
36664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Vsprj\DS_Public\x64\Release\dxgi.pdb
kernel32
GetCurrentProcess
GetModuleHandleA
K32GetModuleInformation
CreateThread
GetModuleHandleW
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetProcAddress
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
GetModuleFileNameW
GetSystemDirectoryW
LoadLibraryW
FreeLibrary
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
msvcp140
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_destroy_list
memmove
memcpy
memcmp
memset
memchr
__std_terminate
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
fputc
fflush
_fseeki64
fread
fsetpos
fclose
ungetc
setvbuf
fgetpos
fwrite
fgetc
_get_stream_buffer_pointers
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
_lock_file
_wsplitpath_s
_unlock_file
api-ms-win-crt-string-l1-1-0
isspace
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_execute_onexit_table
_cexit
_register_onexit_function
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_seh_filter_dll
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
api-ms-win-crt-math-l1-1-0
ceilf
CreateDXGIFactory
CreateDXGIFactory1
CreateDXGIFactory2
DXGID3D10CreateDevice
DXGID3D10CreateLayeredDevice
DXGID3D10GetLayeredDeviceSize
DXGID3D10RegisterLayers
DXGIDumpJournal
DXGIGetDebugInterface1
DXGIReportAdapterConfiguration
DirectInput8Create
DllMain_stub
X3DAudioCalculate
X3DAudioInitialize
XInputEnable
XInputGetBatteryInformation
XInputGetCapabilities
XInputGetDSoundAudioDeviceGuids
XInputGetKeystroke
XInputGetState
XInputSetState
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=260, version=31935,
count=3, id=259, version=31935,
count=19, id=261, version=31935,
count=6, id=257, version=31935,
count=3, id=257, version=29395,
count=156, id=1, productName=Unmarked objects,
count=8, id=265, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,