2abc7d849c1ea960839718b3d2ba08d2b1a87486cc4734aecf01025ce51a9a79

Sharing

Copy URL Twitter E-mail

General

Target
2abc7d849c1ea960839718b3d2ba08d2b1a87486cc4734aecf01025ce51a9a79
Size 2.8MB
Sample260930-b3hykaxdpf
SHA256 2abc7d849c1ea960839718b3d2ba08d2b1a87486cc4734aecf01025ce51a9a79
MD5 a0a71a568fabcab8594e5eb16795787f
SHA1 84760db01b3ac6dea07b2ac15f48928f4450c59b
SHA512 56b1ac3be6ebdddb89bdf0cc913fe83a5e8673966237b46508327a4a91cd9d8fdfcd0fc140d031bc67f3cf25ca84364d69beb9a7ac378907e449a5a2bf4d91c9
SSDEEP 49152:zLJ031IntMaOzR5XVC9reXclltLyvH88YzRp5/NJvtWtGVLrTnNEYE:zK314qaOzbXVC9regrGvwb5/rn/NEY
TLSH
T166D5121276E0C0B5D17242318E6EF7F905BDBDB05E225A97B7C83A5D5E70281BB29323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2abc7d849c1ea960839718b3d2ba08d2b1a87486cc4734aecf01025ce51a9a79

File Explorer

2abc7d849c1ea960839718b3d2ba08d2b1a87486cc4734aecf01025ce51a9a79

.exe 2.8MB

2abc7d849c1ea960839718b3d2ba08d2b1a87486cc4734aecf01025ce51a9a79

IMPHASH fd300fd399507f2c9dd5767f3e683bcd
SHA256 2abc7d849c1ea960839718b3d2ba08d2b1a87486cc4734aecf01025ce51a9a79
MD5 a0a71a568fabcab8594e5eb16795787f
SHA1 84760db01b3ac6dea07b2ac15f48928f4450c59b
SHA512 56b1ac3be6ebdddb89bdf0cc913fe83a5e8673966237b46508327a4a91cd9d8fdfcd0fc140d031bc67f3cf25ca84364d69beb9a7ac378907e449a5a2bf4d91c9
SSDEEP 49152:zLJ031IntMaOzR5XVC9reXclltLyvH88YzRp5/NJvtWtGVLrTnNEYE:zK314qaOzbXVC9regrGvwb5/rn/NEY
TLSH
T166D5121276E0C0B5D17242318E6EF7F905BDBDB05E225A97B7C83A5D5E70281BB29323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

149175

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\NewChromeGame\src\setup\installer\bin\Release\ExtGame.pdb

kernel32

FindResourceW LoadResource SizeofResource LockResource MultiByteToWideChar DuplicateHandle GetCurrentProcess GetFileType SetFilePointer ReadFile SystemTimeToFileTime GetCurrentDirectoryW DosDateTimeToFileTime CreateDirectoryW WriteFile GetFileSize GetFileAttributesW FindResourceExW SetFileAttributesW DeleteFileW MoveFileW MoveFileExW RemoveDirectoryW FindFirstFileW FindNextFileW FindClose WritePrivateProfileStringW GetTickCount GetPrivateProfileStringW CreateMutexW InitializeCriticalSectionAndSpinCount RaiseException GetCurrentThreadId lstrcmpiW InterlockedDecrement InterlockedIncrement DecodePointer GetTempPathW GetTempFileNameW WaitForSingleObject GetLongPathNameW WideCharToMultiByte GetPrivateProfileIntW FlushInstructionCache ExitProcess SetLastError GetVersionExW GetConsoleMode GetStdHandle SetFilePointerEx GetModuleHandleExW GetOEMCP GetACP IsValidCodePage UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber EnterCriticalSection ChangeTimerQueueTimer CreateTimerQueueTimer DeleteCriticalSection InitializeCriticalSection LocalFree GetLastError LocalAlloc CreateProcessW LoadLibraryW GetModuleFileNameW LoadLibraryExA VirtualQuery SetThreadContext GetThreadContext ResumeThread SuspendThread lstrlenA ReleaseMutex HeapWalk CopyFileW LeaveCriticalSection GetCurrentProcessId CloseHandle CreateFileW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FreeLibrary LoadLibraryExW GetCurrentThread GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait HeapLock HeapUnlock SetEnvironmentVariableA WaitForSingleObjectEx SetEvent CreateTimerQueue EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetCPInfo CreateSemaphoreW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc Sleep CreateEventW SetUnhandledExceptionFilter UnhandledExceptionFilter GetProcAddress GetModuleHandleW WriteConsoleW FlushFileBuffers SetStdHandle UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes FreeEnvironmentStringsW DeleteTimerQueueTimer GetWindowsDirectoryW GetEnvironmentStringsW QueryPerformanceCounter RtlUnwind GetCommandLineW GetTimeZoneInformation GetConsoleCP ExitThread CreateThread IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsProcessorFeaturePresent VirtualAlloc VirtualFree GetExitCodeThread GetStringTypeW GetSystemTimeAsFileTime EncodePointer OpenProcess VerifyVersionInfoW VerSetConditionMask TerminateProcess WaitForMultipleObjects

user32

ShowWindow PostMessageW DefWindowProcW UnregisterClassW CharNextW DispatchMessageW TranslateMessage GetMessageW PeekMessageW DestroyWindow FindWindowW SendMessageTimeoutW SetTimer SetWindowLongW GetWindowLongW CallWindowProcW PostQuitMessage CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW IsWindow KillTimer

advapi32

RegEnumKeyExW RegQueryValueExW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW

shell32

SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteExW

ole32

CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoUninitialize CoCreateInstance

oleaut32

VariantClear SysFreeString SysAllocString VariantInit VarUI4FromStr

shlwapi

PathAppendW PathAddBackslashW SHSetValueW SHDeleteKeyW PathRemoveFileSpecW PathFileExistsW PathIsDirectoryW PathCombineW SHGetValueW StrStrIW PathIsRootW PathFindFileNameW

comctl32

InitCommonControlsEx

wininet

InternetOpenW InternetCloseHandle InternetReadFile HttpQueryInfoW HttpSendRequestW HttpAddRequestHeadersW HttpOpenRequestW InternetConnectW InternetCrackUrlW DeleteUrlCacheEntryW InternetSetOptionW

Name

.text

Size

343KB

Virtual Size

344KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

94KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

54KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1012KB

Virtual Size

1012KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=3, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=95, version=2179,

count=3, id=199, version=41118,

count=36, id=223, productName=VS2013 build 21005, version=21005,

count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,

count=246, id=224, productName=VS2013 build 21005, version=21005,

count=8, id=225, version=20806,

count=142, id=225, productName=VS2013 build 21005, version=21005,

count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=340, id=1, productName=Unmarked objects,

count=51, id=229, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,