UnityPlayer[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
UnityPlayer.dll
Size 27.9MB
Sample260930-qephrsga65
SHA256 8953cd29c38c8de9680d3a151caf77ff88417ac8b0c931fd592ce17e789e4eef
MD5 d47015df43919059f17ac7cae5477d95
SHA1 c56be7cc47e1e57ed61ed62706dd51a99233aa10
SHA512 1cec7996e3791856ac7cad3f8b2031e79bfc6b266a84f795301936e85f7b474e2f578e5b2aaedfe0123f1b9593066dbbcde9571147b815591c1c73826508345e
SSDEEP 393216:lTV4eUVeUbeRRcXH6wavBTu8m3J6O6S6TZmCjZf8LU41mg2RuP3oEcHuRAD8+MvS:liPKX5fz4IrdF/
TLSH
T1E1579E9562B840D8C47BE0B8D65BA91BF771304A03718AEF12E146996F73BF01ABF750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
UnityPlayer.dll

File Explorer

UnityPlayer.dll

.dll 27.9MB

UnityPlayer.dll

IMPHASH 108d95e8bf1f1dde05e4927e23a07ced
SHA256 8953cd29c38c8de9680d3a151caf77ff88417ac8b0c931fd592ce17e789e4eef
MD5 d47015df43919059f17ac7cae5477d95
SHA1 c56be7cc47e1e57ed61ed62706dd51a99233aa10
SHA512 1cec7996e3791856ac7cad3f8b2031e79bfc6b266a84f795301936e85f7b474e2f578e5b2aaedfe0123f1b9593066dbbcde9571147b815591c1c73826508345e
SSDEEP 393216:lTV4eUVeUbeRRcXH6wavBTu8m3J6O6S6TZmCjZf8LU41mg2RuP3oEcHuRAD8+MvS:liPKX5fz4IrdF/
TLSH
T1E1579E9562B840D8C47BE0B8D65BA91BF771304A03718AEF12E146996F73BF01ABF750
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

a8:fe:13:02:33:a9:30:0c:4d:30:0c:6c:1a:bb:e8:20:af:aa:37:dd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Unity Technologies ApS,OU=Developer Services,O=Unity Technologies ApS,L=København,C=DK

Chains

Nov 8, 2022

CN=Unity Technologies ApS,OU=Developer Services,O=Unity Technologies ApS,L=København,C=DK

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Unity Technologies ApS,OU=Developer Services,O=Unity Technologies ApS,L=København,C=DK

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Unity Technologies ApS,OU=Developer Services,O=Unity Technologies ApS,L=København,C=DK

Serial Number

0f:7c:5a:5e:06:2a:bd:ba:fc:be:1e:c6:3d:4c:30:52

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 14, 2021 - Jul 18, 2024

Minor OS version

Major OS version

Entry point

23206816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\build\output\unity\unity\artifacts\UnityPlayer\Win64_VS2019_nondev_m_r\UnityPlayer_Win64_player_mono_x64.pdb

kernel32

GetModuleFileNameW GetComputerNameW GetSystemPowerStatus GetUserDefaultLocaleName K32GetProcessMemoryInfo CreateToolhelp32Snapshot DeleteFileW GetFileAttributesW GetTempFileNameW GlobalAlloc GlobalUnlock GlobalLock GetSystemTime GetSystemTimeAsFileTime ExpandEnvironmentStringsW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesExW ReadFile RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SuspendThread ResumeThread LocalFree CopyFileW MoveFileExW ReplaceFileW SystemTimeToFileTime Thread32First Thread32Next CreateMutexA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetEnvironmentVariableA GetCurrentDirectoryA GetCurrentDirectoryW GetFileAttributesA DebugBreak SetUnhandledExceptionFilter GetErrorMode GetThreadContext ReadProcessMemory GetModuleFileNameA LocalAlloc GetOverlappedResult CancelIo ResetEvent GetTickCount FormatMessageA GetWindowsDirectoryW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection CreateIoCompletionPort GetQueuedCompletionStatus DeleteCriticalSection AttachConsole InitializeCriticalSectionAndSpinCount TryEnterCriticalSection ReleaseSemaphore GetLocalTime GetTimeZoneInformation GetFileSizeEx IsDebuggerPresent CreateSemaphoreExW TlsAlloc TlsFree GetNativeSystemInfo VirtualQuery VerSetConditionMask CreateProcessW SetThreadAffinityMask DeleteProcThreadAttributeList ReadConsoleInputW InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive GlobalMemoryStatus GetFileType CreateWaitableTimerA OpenEventA InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead ExitThread EncodePointer DecodePointer CompareStringW LCMapStringW GetStringTypeW GetCPInfo UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW CreateTimerQueue SignalObjectAndWait GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread GetVersionExW DuplicateHandle QueryDepthSList UnregisterWaitEx RtlUnwindEx RtlPcToFileHeader RtlUnwind HeapReAlloc HeapSize HeapQueryInformation ExitProcess GetModuleHandleExW SetStdHandle GetConsoleOutputCP GetConsoleMode ReadConsoleW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetConsoleCP HeapFree HeapAlloc GetProcessHeap FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW SetConsoleCtrlHandler GetStartupInfoA TerminateProcess GetCurrentProcess WaitForSingleObject SetLastError GetFullPathNameW GetSystemDirectoryW GetModuleHandleW GetExitCodeProcess WaitForMultipleObjects CreateEventW CreatePipe OutputDebugStringA GetTempPathW WriteFile FlushFileBuffers CreateFileA GetCommandLineW GetLogicalProcessorInformationEx GetSystemDirectoryA GlobalMemoryStatusEx GetTimeFormatW SetConsoleMode UpdateProcThreadAttribute InitializeProcThreadAttributeList FlushConsoleInputBuffer GetThreadPriority SetThreadPriority GetCurrentThreadId GetProcessId SetErrorMode LoadLibraryExW CreateEventExW WaitForMultipleObjectsEx QueryPerformanceFrequency QueryPerformanceCounter GetStdHandle IsValidCodePage GetACP VerifyVersionInfoW CreateThread SwitchToThread GetModuleHandleA GetThreadTimes OpenThread SleepEx CloseHandle Sleep CreateEventA WaitForSingleObjectEx GetCurrentThread RaiseException SetWaitableTimer CreateWaitableTimerExW SetEvent FormatMessageW SetHandleInformation SetDllDirectoryW LoadLibraryW WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetLastError WideCharToMultiByte LoadLibraryA GetProcAddress FreeLibrary GetCurrentProcessId MultiByteToWideChar VirtualFree VirtualProtect VirtualAlloc GetSystemInfo TlsSetValue GetFileSize TlsGetValue

user32

KillTimer LoadIconW AdjustWindowRectEx MsgWaitForMultipleObjects PeekMessageA GetCaretBlinkTime GetDoubleClickTime GetUserObjectInformationW GetProcessWindowStation MessageBoxW SetTimer EnumDisplaySettingsW SetWindowLongA GetForegroundWindow GetWindowPlacement GetDC EnumDisplaySettingsA GetRawInputDeviceList RegisterRawInputDevices GetRawInputBuffer GetRawInputDeviceInfoW GetRawInputData SystemParametersInfoW GetWindowLongA PtInRect ScreenToClient GetCursorPos GetSystemMetrics ReleaseCapture SetCapture MapVirtualKeyExA MapVirtualKeyW MapVirtualKeyA ToUnicode GetKeyNameTextW GetAsyncKeyState GetKeyState UnregisterDeviceNotification RegisterDeviceNotificationW GetMessageExtraInfo DispatchMessageA TranslateMessage GetKeyboardLayout GetKeyboardLayoutNameW LoadIconA OffsetRect CopyRect SendDlgItemMessageW SetDlgItemTextW EndDialog DialogBoxParamW RegisterClassExW EnumWindows SetForegroundWindow SendMessageTimeoutA RegisterWindowMessageA GetUserObjectInformationA GetThreadDesktop LoadImageW DestroyIcon DestroyCursor LoadCursorA SetCursor IsClipboardFormatAvailable EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard TrackMouseEvent AllowSetForegroundWindow ReleaseDC GetDesktopWindow DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes UpdateWindow EnumDisplayMonitors GetMonitorInfoW GetMonitorInfoA MonitorFromWindow MonitorFromRect EnumDisplayDevicesA GetParent SetWindowLongPtrW SetWindowLongPtrA GetWindowLongPtrW ClipCursor ClientToScreen SetCursorPos ShowCursor GetWindowRect GetClientRect SetWindowTextW ValidateRect DragDetect GetFocus GetActiveWindow SetFocus IsIconic IsWindowVisible SetWindowPos MoveWindow ShowWindow DestroyWindow CreateWindowExW UnregisterClassW RegisterClassW PostQuitMessage DefWindowProcW SendMessageW GetMessageA MessageBoxA SetDlgItemTextA

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

ole32

CoSetProxyBlanket CoInitialize StringFromGUID2 CoUninitialize PropVariantCopy PropVariantClear CoCreateInstance CoCreateGuid CoTaskMemFree CoCreateFreeThreadedMarshaler CoTaskMemAlloc

shlwapi

SHDeleteKeyW PathCanonicalizeW

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsA

advapi32

RegQueryValueExA RegDeleteValueA RegCreateKeyW RegCloseKey RegSetValueExA RegQueryValueExW RegCreateKeyExW RegSetValueExW OpenProcessToken GetSidSubAuthority GetTokenInformation GetUserNameA CryptAcquireContextA CryptReleaseContext CryptGenRandom DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegOpenKeyExW

gdi32

SetPixelFormat ChoosePixelFormat SwapBuffers GetDeviceCaps

shell32

SHFileOperationW CommandLineToArgvW ShellExecuteW SHGetFolderPathW

opengl32

wglCreateContext wglGetProcAddress wglDeleteContext wglGetCurrentDC wglMakeCurrent wglGetCurrentContext

winmm

waveOutGetDevCapsW waveOutOpen waveOutClose waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite waveOutGetDevCapsA waveOutGetPosition waveInGetNumDevs waveInGetDevCapsA waveInGetDevCapsW waveInOpen waveInClose timeBeginPeriod timeEndPeriod timeGetTime waveInAddBuffer waveInStart waveOutReset waveInReset waveInPrepareHeader waveInUnprepareHeader waveOutGetNumDevs

oleaut32

SysAllocString SysFreeString VariantClear VariantChangeType VariantInit

imm32

ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContextEx ImmAssociateContext ImmReleaseContext ImmGetConversionStatus ImmNotifyIME ImmGetContext

winhttp

WinHttpCloseHandle WinHttpOpen WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser

bcrypt

BCryptGenRandom

hid

HidP_SetUsageValue HidP_SetUsages HidP_GetData HidP_MaxDataListLength HidP_GetValueCaps HidP_GetButtonCaps HidP_GetCaps HidD_GetHidGuid HidD_GetPreparsedData HidD_FreePreparsedData HidD_GetProductString HidD_GetManufacturerString HidD_GetSerialNumberString HidD_GetAttributes

crypt32

CertFreeCertificateChain CertVerifyCertificateChainPolicy CertAddEncodedCertificateToStore CertGetCertificateChain CertOpenStore CertFreeCertificateContext CertCloseStore

ws2_32

WSAStartup gethostname socket shutdown setsockopt sendto send select recvfrom recv WSASetLastError listen inet_addr htons htonl getsockname ioctlsocket connect closesocket bind accept __WSAFDIsSet WSAGetLastError WSAIoctl WSASocketA getaddrinfo freeaddrinfo getnameinfo ntohl WSACleanup getpeername gethostbyname getprotobyname WSARecvFrom getsockopt WSACloseEvent WSACreateEvent WSASocketW WSAWaitForMultipleEvents WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSASetEvent gethostbyaddr WSASendDisconnect WSAAsyncGetHostByName WSACancelAsyncRequest ntohs

dwmapi

DwmGetWindowAttribute

Name

.text

Size

22.6MB

Virtual Size

22.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

409KB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

128KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=37, id=259, version=28900,

count=18, id=260, version=29118,

count=31, id=259, version=29118,

count=1, id=109, productName=VS2005 build 50727, version=50727,

count=95, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=470, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=124, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=111, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=67, id=260, version=28900,

count=43, id=257, version=28900,

count=563, id=1, productName=Unmarked objects,

count=8, id=199, version=41118,

count=143, id=261, version=29118,

count=220, id=261, version=28900,

count=9, id=261, productName=VS2015 [14.0] build 23026, version=23026,

count=58, productName=Unmarked objects (old),

count=899, id=261, productName=VS2019 v16.8.0 build 29333, version=29333,

count=334, id=260, productName=VS2019 v16.8.0 build 29333, version=29333,

count=1, id=256, productName=VS2019 v16.8.0 build 29333, version=29333,

count=1, id=255, productName=VS2019 v16.8.0 build 29333, version=29333,

count=1, id=258, productName=VS2019 v16.8.0 build 29333, version=29333,