unityplayer[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
unityplayer.zip
Size 11.1MB
Sample260930-nte7ja1z3p
SHA256 daf019fdbb630d7d1c2ba7eedd89051fbb52deef51c1b17d8d65edf0259763b8
MD5 5cc171532821568ce8cd55d763d03acd
SHA1 84642d4a13ea5b9228e2544185d8c9d82ffcd8de
SHA512 508357423a3e80c0a0799d32e5c8c47200986bb69b0fd3c78a31a306648a25f9b74b4cadd5d519028293012964547d8d252fc410b6cae63bc5dc844e438ec9e6
SSDEEP 196608:P/XCz6SlHTYNoIl8L/TLb+80EYWS/4cUuJKyKF7d5BGd23YsC:P/XCz6gHTMlcLbmtVU7bJ5BG+0
TLSH
T15FC633AEFB322D812C32979253442935FBE7287FD268CC536899C2B3510E614E97D91F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
unpack001/UnityPlayer.dll

File Explorer

unityplayer.zip

.zip 11.1MB
README.txt

1KB
UnityPlayer.dll

.dll 24.7MB

unityplayer.zip

SHA256 daf019fdbb630d7d1c2ba7eedd89051fbb52deef51c1b17d8d65edf0259763b8
MD5 5cc171532821568ce8cd55d763d03acd
SHA1 84642d4a13ea5b9228e2544185d8c9d82ffcd8de
SHA512 508357423a3e80c0a0799d32e5c8c47200986bb69b0fd3c78a31a306648a25f9b74b4cadd5d519028293012964547d8d252fc410b6cae63bc5dc844e438ec9e6
SSDEEP 196608:P/XCz6SlHTYNoIl8L/TLb+80EYWS/4cUuJKyKF7d5BGd23YsC:P/XCz6gHTMlcLbmtVU7bJ5BG+0
TLSH
T15FC633AEFB322D812C32979253442935FBE7287FD268CC536899C2B3510E614E97D91F
MD5 SHA1 SHA512 SSDEEP TLSH

UnityPlayer.dll

IMPHASH 6391db36d4dec09fddfbea131bf948ea
SHA256 2688f587bf483bdbc9dc3a97248b49e2321c0282f603a53d45b29b4d38658ec5
MD5 63139061e9d0fca420687f5182419ab4
SHA1 edece64492f4bec300f5264588d9c96f126af454
SHA512 8fca8359c918e1eeba8099b231047a5591cc3d6e42039f345612ae60622e085463675164bb2d5b21628b1d22b03b56bdde463633f13b89faf307189084e1a1d3
SSDEEP 196608:f1Gevzyccqnrsi7v11Y4NudAyAYsYZ/QFlgLL+A5bgMIGGGW/YLED8YKgcco3S:f1XyccesKPNudARTon5d4YLEDl3WS
TLSH
T15E479D9662F840D8C83BE038965BA91BF7B1344A03709ADF12E106696F73BF15A7F711
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

a1:dc:05:81:06:09:a5:11:5e:27:10:ed:02:89:ae:41:f1:d8:c5:fa

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Unity Technologies Aps,OU=Core Developer Services,O=Unity Technologies Aps,L=København K,C=DK

Chains

Jul 29, 2020

CN=Unity Technologies Aps,OU=Core Developer Services,O=Unity Technologies Aps,L=København K,C=DK

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Unity Technologies Aps,OU=Core Developer Services,O=Unity Technologies Aps,L=København K,C=DK

Serial Number

03:88:3b:fb:88:38:ac:27:c4:5b:74:c5:0f:42:b2:5b

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 11, 2018 - Jul 10, 2021

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

20654824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\buildslave\unity\build\artifacts\UnityPlayer\Win64_nondev_m_r\UnityPlayer_Win64_mono_x64.pdb

kernel32

SetFilePointer SetFilePointerEx SetFileTime GetCurrentThreadId OpenThread SuspendThread ResumeThread LocalFree FormatMessageW CopyFileW MoveFileExW ReplaceFileW SystemTimeToFileTime Thread32First Thread32Next CreateMutexA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetEnvironmentVariableA GetCurrentDirectoryA GetCurrentDirectoryW GetFileAttributesA DebugBreak SetUnhandledExceptionFilter SetLastError GetErrorMode TerminateProcess CreateThread GetThreadContext ReadProcessMemory GetModuleFileNameA LocalAlloc GetOverlappedResult CancelIo ResetEvent GetTickCount GetStartupInfoA SetConsoleCtrlHandler GetSystemInfo SetDllDirectoryW SleepEx RaiseException GetThreadTimes SwitchToThread SetThreadPriority GetThreadPriority InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FormatMessageA QueryPerformanceCounter QueryPerformanceFrequency GetWindowsDirectoryW CreateIoCompletionPort GetQueuedCompletionStatus AttachConsole InitializeCriticalSectionAndSpinCount TryEnterCriticalSection ReleaseSemaphore GetLocalTime GetTimeZoneInformation IsDebuggerPresent CreateSemaphoreExW TlsAlloc TlsFree GetNativeSystemInfo VirtualQuery GetFileSize GetSystemPowerStatus GetComputerNameW LoadLibraryW GetModuleHandleW GetModuleFileNameW VirtualFree VirtualProtect VirtualAlloc GetProcessId CreateProcessW GetExitCodeProcess WaitForMultipleObjects CreateEventW WriteConsoleW SetEnvironmentVariableW GetTempFileNameW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetEndOfFile SetConsoleMode SetStdHandle GetProcessHeap EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapAlloc HeapFree FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW ReadConsoleW GetConsoleMode GetConsoleCP HeapQueryInformation HeapSize HeapReAlloc GetModuleHandleExW ExitProcess RtlPcToFileHeader RtlUnwindEx UnregisterWaitEx QueryDepthSList GetVersionExW FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation SignalObjectAndWait CreateTimerQueue GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW DecodePointer EncodePointer DuplicateHandle VerifyVersionInfoA ExpandEnvironmentStringsA InitializeCriticalSectionEx GetTickCount64 GlobalMemoryStatus GetFileType ExitThread InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead CreateWaitableTimerA SetWaitableTimer OpenEventA ReadConsoleInputW FlushConsoleInputBuffer SetThreadAffinityMask GetStdHandle CreatePipe SetHandleInformation OutputDebugStringA GetTempPathW WriteFile FlushFileBuffers CreateFileA GetFullPathNameW GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose DeleteFileW CreateFileW CreateDirectoryW ExpandEnvironmentStringsW GetSystemTimeAsFileTime GetSystemTime GlobalLock SetFileAttributesW RemoveDirectoryW GetCommandLineW GetLogicalProcessorInformationEx GetSystemDirectoryA ReadFile RtlUnwind GlobalUnlock GlobalAlloc CreateToolhelp32Snapshot GetUserDefaultLocaleName FreeEnvironmentStringsW GlobalMemoryStatusEx SetErrorMode LoadLibraryExW GetCurrentThread GetCurrentProcess GetLastError GetModuleHandleA MultiByteToWideChar WaitForSingleObject Sleep CreateEventA WaitForSingleObjectEx VerifyVersionInfoW CloseHandle CreateEventExW WaitForMultipleObjectsEx SetEvent VerSetConditionMask WideCharToMultiByte LoadLibraryA GetProcAddress FreeLibrary GetCurrentProcessId TlsSetValue TlsGetValue

user32

EnumDisplaySettingsA GetCaretBlinkTime DestroyWindow CreateWindowExW ShowWindow UpdateWindow GetDesktopWindow EnumDisplayDevicesA MonitorFromWindow ReleaseDC PeekMessageA MsgWaitForMultipleObjects AllowSetForegroundWindow GetUserObjectInformationW GetProcessWindowStation MessageBoxW TrackMouseEvent OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard IsClipboardFormatAvailable GetSystemMetrics EnumDisplaySettingsW SetWindowLongA AdjustWindowRectEx GetWindowPlacement EnumDisplayMonitors GetMonitorInfoW GetMonitorInfoA MonitorFromRect SetWindowLongPtrW GetDC SetCursor LoadCursorA DestroyCursor DestroyIcon CreateIconIndirect DefWindowProcW SetWindowPos GetClientRect GetWindowRect ScreenToClient GetWindowLongA SetWindowLongPtrA GetParent GetThreadDesktop GetUserObjectInformationA RegisterWindowMessageA SendMessageTimeoutA IsIconic SetForegroundWindow EnumWindows UnregisterClassW RegisterClassExW DialogBoxParamW EndDialog SetDlgItemTextA SetDlgItemTextW SendDlgItemMessageW MessageBoxA CopyRect OffsetRect LoadIconA GetKeyboardLayoutNameW TranslateMessage DispatchMessageA GetMessagePos GetMessageTime GetMessageExtraInfo RegisterDeviceNotificationW UnregisterDeviceNotification GetDoubleClickTime IsWindowVisible GetKeyState GetAsyncKeyState GetKeyNameTextW GetWindowLongPtrW ClipCursor SetCapture SetWindowTextW ValidateRect DragDetect KillTimer SetTimer GetFocus GetActiveWindow SetFocus RegisterClassW PostQuitMessage SendMessageW GetMessageA GetRawInputDeviceList RegisterRawInputDevices GetRawInputDeviceInfoW GetRawInputData SystemParametersInfoW PtInRect ClientToScreen GetCursorPos SetCursorPos ReleaseCapture ShowCursor

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

ole32

CoCreateFreeThreadedMarshaler CoInitialize CoUninitialize PropVariantCopy PropVariantClear CoTaskMemAlloc CoCreateGuid StringFromGUID2 CoCreateInstance CoSetProxyBlanket CoTaskMemFree

shlwapi

PathCanonicalizeW PathFileExistsW SHDeleteKeyW

setupapi

SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

advapi32

CryptImportKey CryptDestroyKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptReleaseContext CryptAcquireContextA RegSetValueExA RegQueryValueExA RegDeleteValueA RegCreateKeyW GetUserNameA GetTokenInformation GetSidSubAuthority OpenProcessToken RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey CryptGetHashParam CryptEncrypt

gdi32

DeleteObject CreateDIBSection ChoosePixelFormat SetPixelFormat GetDeviceCaps CreateBitmap SwapBuffers

shell32

SHGetFolderPathW CommandLineToArgvW SHFileOperationW ShellExecuteW

opengl32

wglCreateContext wglDeleteContext wglGetCurrentContext wglMakeCurrent wglGetProcAddress wglGetCurrentDC

winmm

waveOutGetPosition waveOutReset waveOutWrite waveOutUnprepareHeader waveOutPrepareHeader waveInGetNumDevs waveOutOpen waveOutGetDevCapsW waveOutGetDevCapsA waveOutGetNumDevs timeGetTime timeBeginPeriod waveInGetDevCapsA waveInOpen waveInGetDevCapsW waveInClose waveInPrepareHeader waveInUnprepareHeader waveInAddBuffer waveInReset waveInStart waveOutClose timeEndPeriod

oleaut32

VariantChangeType VariantClear VariantInit SysAllocString SysFreeString

imm32

ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContextEx ImmAssociateContext ImmReleaseContext ImmGetConversionStatus ImmSetOpenStatus ImmGetContext

winhttp

WinHttpGetIEProxyConfigForCurrentUser

bcrypt

BCryptGenRandom

hid

HidP_SetUsageValue HidP_SetUsages HidP_GetData HidP_MaxDataListLength HidP_GetValueCaps HidP_GetButtonCaps HidP_GetCaps HidD_GetHidGuid HidD_GetPreparsedData HidD_FreePreparsedData HidD_GetProductString HidD_GetManufacturerString HidD_GetSerialNumberString HidD_GetAttributes

crypt32

CertCloseStore CertFreeCertificateContext CertAddEncodedCertificateToStore CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CertFreeCertificateChain

ws2_32

WSASocketA WSAGetLastError WSASetLastError send select recv ntohs listen inet_addr htons getsockname ioctlsocket connect closesocket bind accept recvfrom sendto setsockopt shutdown socket gethostname WSAStartup WSACleanup getsockopt WSASendDisconnect gethostbyaddr WSACancelAsyncRequest WSAAsyncGetHostByName WSASetEvent WSAResetEvent __WSAFDIsSet WSAIoctl getaddrinfo WSAEventSelect WSAEnumNetworkEvents WSAWaitForMultipleEvents WSASocketW WSACreateEvent WSACloseEvent WSARecvFrom htonl freeaddrinfo getnameinfo ntohl getpeername gethostbyname getprotobyname

Name

.text

Size

20.1MB

Virtual Size

20.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

250KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1009KB

Virtual Size

1008KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=36, id=259, version=25711,

count=31, id=259, version=26706,

count=37, id=260, version=26706,

count=1, id=109, productName=VS2005 build 50727, version=50727,

count=111, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=542, id=260, productName=VS2015 UPD2 build 23918, version=23918,

count=123, id=261, productName=VS2015 UPD2 build 23918, version=23918,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=173, version=30319,

count=9, id=261, productName=VS2015 [14.0] build 23026, version=23026,

count=219, id=261, version=25711,

count=2, id=262, version=25711,

count=62, id=260, version=25711,

count=39, id=257, version=25711,

count=550, id=1, productName=Unmarked objects,

count=7, id=199, version=41118,

count=120, id=261, version=26706,

count=265, id=260, version=27012,

count=59, productName=Unmarked objects (old),

count=778, id=261, version=27012,

count=1, id=256, version=27012,

count=1, id=255, version=27012,

count=1, id=258, version=27012,

Sharing

General

Malware Config

Signatures

File Explorer

unityplayer.zip

README.txt

UnityPlayer.dll

kernel32

user32

version

ole32

shlwapi

setupapi

advapi32

gdi32

shell32

opengl32

winmm

oleaut32

imm32

winhttp

bcrypt

hid

crypt32

ws2_32

generic