War3ROC_120d_Russian[.]exe

General

Target
War3ROC_120d_Russian.exe
Size 23.2MB
Sample260925-2mm6fsybrf
SHA256 d05cd75e597357f545267506baa8961529d6707dfcb10834ab7889c1c9fe0e8f
MD5 c35c300fff9ab61233304bdabe381435
SHA1 d6b19163c44f0209f82ed1d85267e2fe349726c6
SHA512 757da94075ff4e19e54ea9d57aa47aac17f89653c66ba9e38ba703ae28adf2527a3ff935fdabc3b9a3a8c1b24af5d8db42d5b16ce4fcdf8e983a0dc46f3123ca
SSDEEP 393216:G52MHmRUyzKAKPW1gmPUt2miqdelqkk0rNKVZZZyFa7lD3XybOBitt3nozE4/rcC:oBUUybKPYTPYbiwkVk0rNK3RZL1Bittq
TLSH
T16F373371FA04799ACC3A0D7CACC3D574B175E4E9C307E61B4294EAAA7CB730A0CD5295
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
War3ROC_120d_Russian.exe

File Explorer

War3ROC_120d_Russian.exe

.exe 23.2MB

War3ROC_120d_Russian.exe

IMPHASH fd51138ab55644c04d63d273c42b4131
SHA256 d05cd75e597357f545267506baa8961529d6707dfcb10834ab7889c1c9fe0e8f
MD5 c35c300fff9ab61233304bdabe381435
SHA1 d6b19163c44f0209f82ed1d85267e2fe349726c6
SHA512 757da94075ff4e19e54ea9d57aa47aac17f89653c66ba9e38ba703ae28adf2527a3ff935fdabc3b9a3a8c1b24af5d8db42d5b16ce4fcdf8e983a0dc46f3123ca
SSDEEP 393216:G52MHmRUyzKAKPW1gmPUt2miqdelqkk0rNKVZZZyFa7lD3XybOBitt3nozE4/rcC:oBUUybKPYTPYbiwkVk0rNK3RZL1Bittq
TLSH
T16F373371FA04799ACC3A0D7CACC3D574B175E4E9C307E61B4294EAAA7CB730A0CD5295
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

123312

Minor OS version

0

Major OS version

4

Entry point

10912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindFirstFileA FindNextFileA GetModuleHandleA FindClose GetLastError GetFileAttributesA CreateDirectoryA WriteFile CopyFileA CreateFileA GetLocalTime DeleteFileA CloseHandle WaitForSingleObject CreateProcessA SetThreadPriority CreateFileMappingA InitializeCriticalSection SetErrorMode GetStartupInfoA Sleep GetCurrentProcessId lstrcpynA VirtualQuery IsBadWritePtr IsBadReadPtr GetComputerNameA GetCurrentThread FlushFileBuffers SetLastError HeapAlloc FormatMessageA GetVersion GetCurrentProcess GetExitCodeProcess TerminateProcess GetCurrentThreadId HeapFree GetProcessHeap InterlockedIncrement InterlockedDecrement GetDriveTypeA GetVolumeInformationA GetDiskFreeSpaceA GetModuleFileNameA GetFileSize LoadLibraryA GetProcAddress MapViewOfFile FindResourceA LoadResource LockResource SizeofResource LeaveCriticalSection EnterCriticalSection ExitProcess VirtualAlloc VirtualFree GetSystemInfo DeleteCriticalSection OutputDebugStringA FreeResource GetTickCount CreateThread CreateEventA SetEvent ReadFile SetFilePointer FreeLibrary UnmapViewOfFile

user32

MessageBoxA IsWindowVisible IsWindow LoadStringA SetForegroundWindow GetTopWindow GetLastActivePopup FindWindowA wsprintfA SetWindowTextA LoadIconA SetClassLongA GetDlgItem GetWindowRect EnableWindow ShowWindow MoveWindow SetFocus EndDialog DialogBoxParamA

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr strspn _initterm __getmainargs _acmdln exit _XcptFilter _exit ??1type_info@@UAE@XZ _onexit __dllonexit free calloc _purecall isprint strrchr strncpy strchr isdigit _snprintf qsort fclose fopen strtoul _except_handler3 _vsnprintf vsprintf _CIpow _strnicmp memmove _fullpath strstr toupper sprintf strpbrk isspace

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA RegFlushKey RegDeleteKeyA RegCreateKeyExA RegSetValueExA GetUserNameA

Resubmissions

Sharing