Windows7Games_for_Windows_11_10_8[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Windows7Games_for_Windows_11_10_8.exe
Size 146.7MB
Sample260928-sbf4bsxt5j
SHA256 80b9ed664e92c955f8a6944075a33d96666d6400d6a6ea10977f68e64e152989
MD5 9b0166d0569f6f5371b10521e105e957
SHA1 3204f8f6084afffd12ac3aaf907ab7828ffda8b0
SHA512 46511185c10a7c6747a270a05f5450b66c5eb20621fc9107a444fa3c509a789986c06f4b6a2a58b75d3897b4934cfbfd72638dcc20ce75f803ce9a42c99b3a0a
SSDEEP 3145728:wc5apNl/YrhWp5iJC3+V4wOn5t7jMBel/M+eIVZ3ddvZBNnUxzaykG92:wlNl/YrEp5QCuV4whBel/5eS3HvZnu7Q
TLSH
T1AB783351BE1DE011E4414334663C0ECCB88EA627E9FE239EB9D49BF67DAD48ADD4418C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
Windows7Games_for_Windows_11_10_8.exe
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/Chess/chess.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

Windows7Games_for_Windows_11_10_8.exe

.exe 146.7MB
$PLUGINSDIR/LangDLL.dll

.dll 5KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

201KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
Chess/chess.exe

.exe 3.0MB

Windows7Games_for_Windows_11_10_8.exe

IMPHASH f10e4da994053bf80c20cee985b32e29
SHA256 80b9ed664e92c955f8a6944075a33d96666d6400d6a6ea10977f68e64e152989
MD5 9b0166d0569f6f5371b10521e105e957
SHA1 3204f8f6084afffd12ac3aaf907ab7828ffda8b0
SHA512 46511185c10a7c6747a270a05f5450b66c5eb20621fc9107a444fa3c509a789986c06f4b6a2a58b75d3897b4934cfbfd72638dcc20ce75f803ce9a42c99b3a0a
SSDEEP 3145728:wc5apNl/YrhWp5iJC3+V4wOn5t7jMBel/M+eIVZ3ddvZBNnUxzaykG92:wlNl/YrEp5QCuV4whBel/5eS3HvZnu7Q
TLSH
T1AB783351BE1DE011E4414334663C0ECCB88EA627E9FE239EB9D49BF67DAD48ADD4418C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

13516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton SetWindowPos SetCursor GetSysColor SetClassLongA GetWindowLongA IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersionExA GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/LangDLL.dll

IMPHASH 274b99a815ba574d8c9e1712916d8b30
SHA256 ba46a03088f690ce966043f49761ff3a3a0dca236160794de841dfecc3588d1e
MD5 b21a3377e66b941df6d5b7cf8ba7a43a
SHA1 e7ed27fce2db9cdc11ca3c640806731dcef3864a
SHA512 f011a824c0ff7f87c6da112898f4afc87e12c5b39fb40ffcc0955012e79a4302597d892224b3b47e8143480605c73275d3799d6d2000cdf179c2912241f86916
SSDEEP 48:im1YEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0Jsof5dwe:F1apl9NLBAZuYtR0/d
TLSH
T138C17537A3C105F5E6944273265363C35713A97477A6804FCB6712BA1A20CB79D6EB83
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

5582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
MD5 792b6f86e296d3904285b2bf67ccd7e0
SHA1 966b16f84697552747e0ddd19a4ba8ab5083af31
SHA512 97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
SSDEEP 192:rFiQJ771Jt17C8F1A5xjGNNvgFOiLb7lrT/L93:X71Jt48F2eNvgFF/L
TLSH
T140425A0583618EF3F5962D3C00667E2F2B79BE3416F140639FE34481A99A1CFA975392
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 a87bd092fa5bc00661525455b9f866b68c14c29224520c4e38f56f47234cfc1e
MD5 f5b0c649b0cfc103fb113d013d48cacb
SHA1 f89286966000cb053b7e94100c76ec6d1129af07
SHA512 e184101a03ee1c8896efb0029a02a23e46d422bc0f250ef15349c8214d44156afe2b5f739d8a2339bc2d1c05984fc55651c36c71897cd4b14f41dd37a25cfb01
SSDEEP 96:oYDlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4V8qndYv0PLE:oYp34z/x3sREskpxSdO0PLE
TLSH
T15612F8135A4454B3C9E6223A31AA2F2EDB3C932490627D02C7779E1A2BB42167D3E356
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Chess/chess.exe

IMPHASH 00fbb766e808e50e691b3aeea88e7316
SHA256 0f43907c81a248e955e771c258329e929ff6f8ee10bd8431aa496d353c590487
MD5 bc31bb84d1084545d68d2e0b4504ba10
SHA1 d81e430349206aa30b657879ab82a42492707079
SHA512 f88aed9f569322ed0b78ecc057880e4083f18582ed83fbd5e1d1333cd9d4a779412d5f8dc598f091c8e76b738fa01525efea291847e00e148c9db140e890e26c
SSDEEP 49152:ho8boQhfD6UDvxvykXk1rBsgyegFKvc4clwY:zDm
TLSH
T1B1E54B23BF5D11B5C0AD8E3AC678C30BF7B1BC149B2097CF9552A6A6DE622D09DB5304
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

1548860

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Chess.pdb

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA GetUserNameW

kernel32

LockResource CreateDirectoryW LocalFree OutputDebugStringW MoveFileW LoadResource FindResourceW QueryPerformanceCounter QueryPerformanceFrequency GetVersionExW LoadLibraryA FreeLibrary GetLocaleInfoW HeapFree GetProcessHeap HeapAlloc CompareStringA GlobalFree GlobalAlloc lstrlenW SetEvent ResetEvent WaitForSingleObject WaitForMultipleObjects CreateEventW MultiByteToWideChar LoadLibraryW GetSystemDirectoryW SetCurrentDirectoryW DeleteCriticalSection GetProcAddress GetVersionExA InitializeCriticalSection GetFileType GetCurrentDirectoryW WriteConsoleW GetStdHandle GetTickCount64 CreateThread FormatMessageW LocalAlloc GetThreadLocale FindResourceExW ExpandEnvironmentStringsW LoadLibraryExW EnumResourceTypesW EnumResourceNamesW lstrcmpiA GetSystemInfo SetEndOfFile GlobalMemoryStatus GetFullPathNameA FreeResource SetFilePointer DeleteFileA GetTempPathA GetTempFileNameA ReadFile VirtualAlloc VirtualFree WriteFile FindResourceA CreateFileMappingA UnmapViewOfFile MapViewOfFile GetFileSize CreateFileA GetModuleHandleA IsProcessorFeaturePresent WideCharToMultiByte DebugBreak OutputDebugStringA UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount SetUnhandledExceptionFilter GetStartupInfoW CloseHandle DeleteFileW HeapSetInformation LeaveCriticalSection EnterCriticalSection Sleep MulDiv ExitProcess GetCurrentThreadId CreateMutexW GetLastError GetCommandLineW SizeofResource CreateFileW GetModuleHandleW GetModuleFileNameW RegisterApplicationRestart

gdi32

GetTextColor CreatePen Rectangle CreateRoundRectRgn ExtTextOutA GetObjectA SetTextAlign GetTextMetricsA GetCharacterPlacementA SetMapMode SetBkMode GetFontLanguageInfo CreateFontIndirectA CreateDIBSection DeleteDC GetCharacterPlacementW GetGlyphOutlineA GetTextMetricsW MoveToEx GetObjectW GetStockObject ExcludeClipRect BitBlt CreateBitmap CreateCompatibleDC ExtTextOutW SetBkColor SetTextColor GetTextExtentPoint32W SelectObject CreateFontIndirectW GetDeviceCaps DeleteObject CreateSolidBrush GetBkColor

user32

GetFocus DialogBoxParamW SetWindowTextW GetCursorInfo GetKeyboardLayoutList GetClientRect ClientToScreen SendMessageW GetSystemMetrics GetKeyboardLayout GetMenu EnableMenuItem GetSubMenu PeekMessageW GetMessageW TranslateMessage DispatchMessageW SetRect NotifyWinEvent GetWindowRect IsZoomed SetDlgItemTextW GetMenuItemCount GetMenuItemInfoW DefWindowProcW SetMenuItemInfoW SetMenuInfo TrackPopupMenu FindWindowW ShowWindow BringWindowToTop SetForegroundWindow LoadMenuW RemoveMenu SetWindowsHookExW GetKeyState GetMonitorInfoW MonitorFromWindow GetWindowPlacement SetWindowPlacement UpdateWindow RegisterRawInputDevices SetWindowPos PostQuitMessage GetMessageExtraInfo PostMessageW IsIconic GetDoubleClickTime GetProcessDefaultLayout DrawTextW GetSysColorBrush GetIconInfo LoadIconW CallWindowProcW SetWindowLongW EndPaint IsWindowEnabled BeginPaint EnumChildWindows SetWindowRgn EndDialog IsDialogMessageW GetClassNameW GetNextDlgTabItem GetNextDlgGroupItem CreateDialogParamW CreateDialogIndirectParamW SetFocus GetDlgCtrlID GetWindow SendInput GetParent GetForegroundWindow MessageBoxW KillTimer UnregisterClassW PtInRect OffsetRect ReleaseCapture SetCapture EqualRect UnionRect MonitorFromRect SetRectEmpty DestroyWindow DestroyMenu LoadAcceleratorsW UnhookWindowsHookEx ShowCursor CheckRadioButton CheckDlgButton EnableWindow GetDlgItem IsDlgButtonChecked SetCursor LoadCursorW LoadStringW CheckMenuItem GetDC SystemParametersInfoW ReleaseDC GetSysColor DrawFrameControl GetRawInputData GetCursorPos MapWindowPoints SetCursorPos CallNextHookEx EnumDisplayMonitors RegisterWindowMessageW RegisterClassW GetClassLongPtrW InvalidateRect AdjustWindowRect CreateWindowExW SetWindowLongPtrW GetWindowTextW GetWindowLongPtrW GetWindowLongW IsWindowVisible TranslateAcceleratorW DestroyAcceleratorTable SetTimer DrawEdge

msvcrt

tan tanh sinh fmod exp cosh ceil floorf atan2f powf __CxxFrameHandler3 ?terminate@@YAXXZ ??1type_info@@UEAA@XZ _onexit _lock __dllonexit _unlock __set_app_type _fmode _commode __setusermatherr _amsg_exit _initterm _acmdln exit _cexit _ismbblead _exit _XcptFilter __C_specific_handler __getmainargs _callnewh _CxxThrowException _vsnprintf _finite _clearfp _strdup setlocale sscanf iswalpha iswspace iswpunct iswdigit wcstombs isalnum atoi tolower isalpha isdigit atof isxdigit _fpclass _isnan isspace atol _ultoa toupper wcsncpy_s _vscwprintf _vsnwprintf_s _errno _wcsdup _beginthreadex wcscspn wcsspn memmove_s wcstol wcsncmp tanf _snwprintf_s cosf sinf ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ ??0exception@@QEAA@AEBQEBDH@Z frexp wcstombs_s fgetwc fwrite ftell fseek fclose fread _wfopen_s fputwc mbtowc strchr strncmp strcat_s fgetc wcsstr memmove wcstoul towlower _stricmp qsort time rand srand swprintf_s wcstod _wcsnicmp wcscat_s wcschr wcsrchr ?_set_new_mode@@YAHH@Z ?_set_new_handler@@YAP6AH_K@ZP6AH0@Z@Z _wtoi realloc mbstowcs_s _purecall _wcsicmp wcscpy_s free malloc sscanf_s memcpy memset sqrtf atan2 atan acos asin cos sin sqrt log pow floor memcmp acosf

oleaut32

SysAllocString VariantClear SysFreeString SysStringLen VariantInit

ntdll

WinSqmIncrementDWORD WinSqmAddToStream RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

ole32

CreateStreamOnHGlobal CoUninitialize CoInitialize CoCreateInstance CoTaskMemFree

shell32

ExtractIconW ShellExecuteW SHGetKnownFolderPath SHSetLocalizedName CommandLineToArgvW SHGetFolderPathW SHGetFolderPathEx ShellAboutW

comctl32

ImageList_Add ImageList_Create ImageList_Destroy InitCommonControlsEx

gdiplus

GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDrawImageRectI GdipDisposeImage GdipCloneImage GdipAlloc GdipFree GdipCreateBitmapFromResource GdipDeleteGraphics GdipCreateFromHDC GdipSetTextRenderingHint GdiplusShutdown GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesWrapMode GdipCreateLineBrushFromRectI GdipCreatePen1 GdipDeletePen GdipSetPenDashStyle GdipSetStringFormatHotkeyPrefix GdipGetImageGraphicsContext GdipGetDC GdipReleaseDC GdipDrawLineI GdipDrawRectangle GdipDrawRectangleI GdipFillRectangleI GdipFillRegion GdipMeasureString GdipDrawImagePointRectI GdipSetClipRectI GdipSetClipRegion GdipCreateRegionHrgn GdipDeleteRegion GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipLoadImageFromStream GdipGetImageWidth GdipGetImageHeight GdipImageRotateFlip GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap GdipSetStringFormatFlags GdipDrawString GdiplusStartup GdipDrawImageRectRectI

dsound

ord11

winmm

mmioSetInfo mmioCreateChunk mmioSeek mmioWrite mmioGetInfo mmioAdvance mmioAscend mmioRead mmioDescend mmioClose mmioOpenW timeGetTime

oleacc

LresultFromObject CreateStdAccessibleObject

slc

SLGetWindowsInformationDWORD

dinput8

DirectInput8Create

usp10

ScriptItemize ScriptBreak

shlwapi

PathFileExistsW

secur32

GetUserNameExW

xinput9_1_0

XInputGetState

Sharing

General

Malware Config

Signatures

File Explorer

Windows7Games_for_Windows_11_10_8.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Chess/chess.exe

advapi32

kernel32

gdi32

user32

msvcrt

oleaut32

ntdll

ole32

shell32

comctl32

gdiplus

dsound

winmm

oleacc

slc

dinput8

usp10

shlwapi

secur32

xinput9_1_0

generic