UnityPlayer[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
UnityPlayer.dll
Size 32.1MB
Sample261001-pb1aesbd66
SHA256 656e09355d30d7ba5b8cf18c5bd86ce3322d247c334fe522bda184001a33d430
MD5 579999735522b164ce7954cfccb5f6c0
SHA1 d7194b0dae7469d7ebfba4b7ace400b165e1ecb8
SHA512 e0f45feb77f69faf7d64c5aac403429da47902c5007e850c77f75aeccec65a1c336d89c79c039bd2542a81337871fb3cab25b1e0628f307232c3dbc68aa6ff3e
SSDEEP 393216:XJp704U4xdTJ4SJe5d461eLRvZ1X1ALiP6onSMjV06:XUOuLALjV06
TLSH
T1AA779C56A2B950D8D47BD038D75BA91BEBB1344503308ADB62E14AA56F33FF02A7F710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

UnityPlayer.dll

.dll 32.1MB

UnityPlayer.dll

IMPHASH b1361005e4e1db1c9743155d15ed5ab8
SHA256 656e09355d30d7ba5b8cf18c5bd86ce3322d247c334fe522bda184001a33d430
MD5 579999735522b164ce7954cfccb5f6c0
SHA1 d7194b0dae7469d7ebfba4b7ace400b165e1ecb8
SHA512 e0f45feb77f69faf7d64c5aac403429da47902c5007e850c77f75aeccec65a1c336d89c79c039bd2542a81337871fb3cab25b1e0628f307232c3dbc68aa6ff3e
SSDEEP 393216:XJp704U4xdTJ4SJe5d461eLRvZ1X1ALiP6onSMjV06:XUOuLALjV06
TLSH
T1AA779C56A2B950D8D47BD038D75BA91BEBB1344503308ADB62E14AA56F33FF02A7F710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

f1:80:05:ec:5d:88:90:1a:8f:3d:68:e1:49:61:ac:a3:99:7e:e3:5b:4b:5a:f9:eb:7a:ee:12:8a:96:f1:15:fa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3183233,CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Feb 25, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

03:e6:cb:30:35:09:9e:63:9e:f3:35:ea:cd:37:c0:1f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 11, 2023 - Jun 8, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

26844104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\build\output\unity\unity\artifacts\UnityPlayer\Win_x64_VS2022_VB_nondev_i_m\UnityPlayer_Win64_player_il2cpp_x64.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

kernel32

Sleep GlobalLock GlobalUnlock GlobalAlloc GetSystemPowerStatus GlobalMemoryStatusEx CreateToolhelp32Snapshot GetTempPathW GetUserDefaultLocaleName GetSystemDirectoryA CreateFileA GetComputerNameW GetModuleFileNameA GetFileAttributesA GetEnvironmentVariableA GetCurrentDirectoryA RtlCaptureContext SuspendThread GetThreadContext ResumeThread RtlLookupFunctionEntry RtlVirtualUnwind ReadProcessMemory OutputDebugStringA CreateWaitableTimerExW SetWaitableTimer WaitForSingleObjectEx SleepEx SetThreadDescription GetLogicalProcessorInformationEx LocalFree FormatMessageW K32GetProcessMemoryInfo Thread32First Thread32Next GetNativeSystemInfo VirtualQuery GetSystemInfo CreateThread SetThreadPriority GetThreadPriority GetCurrentThreadId SwitchToThread LocalAlloc SetDllDirectoryW CreateMutexA GetWindowsDirectoryW ExpandEnvironmentStringsW GetCurrentDirectoryW OutputDebugStringW DebugBreak SetUnhandledExceptionFilter GetCommandLineW HeapAlloc GetProcessHeap HeapFree LoadLibraryExW GetTickCount CreateEventW GetOverlappedResult ResetEvent WaitForMultipleObjects CancelIo FormatMessageA InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList CreateProcessW CreatePipe SetHandleInformation GetProcessId GetExitCodeProcess SetErrorMode VirtualAlloc VirtualProtect VirtualFree GetErrorMode RemoveDirectoryW VerifyVersionInfoW GetACP InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection AttachConsole WaitForMultipleObjectsEx GetTimeZoneInformation ReleaseSemaphore GetFileSize CreateSemaphoreExW TlsAlloc TlsFree InitializeCriticalSectionAndSpinCount GetStdHandle SetThreadAffinityMask UnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx RtlPcToFileHeader RtlUnwind HeapSize HeapReAlloc HeapQueryInformation ExitProcess GetModuleHandleExW DuplicateHandle GetConsoleOutputCP GetConsoleMode FreeLibraryAndExitThread GetFileType ReadConsoleW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime FlsAlloc DeleteFileW CreateDirectoryW CreateFileW GetFileAttributesExW GetCurrentThread GetCurrentProcess TerminateProcess FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW VerSetConditionMask LoadLibraryA GetDiskFreeSpaceExW SetFileTime SystemTimeToFileTime GetSystemTime GetFullPathNameW ReplaceFileW FlushFileBuffers GetTempFileNameW GetFileSizeEx SetEndOfFile WriteFile ReadFile SetFilePointer WriteConsoleW GetModuleHandleA CreateEventExW SetEvent QueryPerformanceFrequency QueryPerformanceCounter GetLocalTime IsDebuggerPresent SetFilePointerEx FindClose FindNextFileW FindFirstFileW FindFirstFileExW MoveFileExW CopyFileW GetLocaleInfoEx GetCPInfo SetFileAttributesW SetConsoleCtrlHandler WaitForSingleObject OpenThread GetStartupInfoA CreateEventA SetLastError FreeLibrary GetProcAddress LoadLibraryW CloseHandle GetFileAttributesW GetModuleFileNameW GetModuleHandleW WideCharToMultiByte RaiseException GetSystemTimeAsFileTime GetCurrentProcessId MultiByteToWideChar GetLastError TlsGetValue TlsSetValue ExitThread InitializeSListHead InterlockedPopEntrySList GetSystemDirectoryW InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateWaitableTimerA InterlockedFlushSList LoadLibraryExA InitOnceBeginInitialize InitOnceComplete GetStringTypeW TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer LCMapStringEx InterlockedPushEntrySList

user32

ReleaseCapture SetCapture RegisterDeviceNotificationW UnregisterDeviceNotification SystemParametersInfoW DispatchMessageW GetWindowLongA GetMessageExtraInfo GetKeyState MapVirtualKeyA GetRawInputData GetRawInputBuffer MessageBoxW EnumDisplaySettingsA DestroyCursor SetCursor LoadCursorA AllowSetForegroundWindow GetDC MonitorFromPoint SetWindowLongA LoadIconW GetWindowPlacement AdjustWindowRectExForDpi GetForegroundWindow EnumDisplaySettingsW LoadImageW GetRawInputDeviceList PtInRect GetPointerInfo RegisterRawInputDevices EnableMouseInPointer IsMouseInPointerEnabled GetKeyNameTextW MapVirtualKeyW ToUnicode GetKeyboardLayoutNameW GetRawInputDeviceInfoW GetKeyboardLayout MapVirtualKeyExA GetAsyncKeyState DestroyIcon GetCursorPos TrackMouseEvent GetSystemMetrics RegisterClassExW MessageBoxA DialogBoxParamW EndDialog SetDlgItemTextW SetDlgItemTextA LoadIconA SendDlgItemMessageW OffsetRect CopyRect SendMessageTimeoutA SetForegroundWindow EnumWindows GetUserObjectInformationA GetThreadDesktop RegisterWindowMessageA SetClipboardData EmptyClipboard CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard ReleaseDC GetDesktopWindow DispatchMessageA TranslateMessage DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes UpdateWindow SendMessageW GetMessageW PeekMessageW SetWindowTextW SetTimer ShowWindow GetActiveWindow GetParent ValidateRect KillTimer MonitorFromRect SetWindowLongPtrA IsWindowVisible SetWindowPos EnumDisplayMonitors EnumDisplayDevicesA PostQuitMessage DefWindowProcW SetWindowLongPtrW GetWindowLongPtrW DestroyWindow UnregisterClassW RegisterClassW SetCursorPos ClientToScreen ClipCursor ShowCursor GetClientRect MoveWindow GetWindowRect GetMonitorInfoW SetFocus GetFocus IsIconic PeekMessageA MsgWaitForMultipleObjects GetMonitorInfoA MonitorFromWindow CreateWindowExW GetCaretBlinkTime GetDoubleClickTime ScreenToClient

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

ole32

CoInitialize PropVariantCopy PropVariantClear RoGetAgileReference CoTaskMemAlloc CoCreateFreeThreadedMarshaler StringFromGUID2 CoCreateGuid CoSetProxyBlanket CoTaskMemFree CoCreateInstance CoUninitialize

shlwapi

SHDeleteKeyW PathCanonicalizeW

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiEnumDeviceInterfaces SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailW

advapi32

RegCreateKeyW RegCloseKey RegQueryValueExA RegSetValueExA RegDeleteValueA RegQueryValueExW GetUserNameA OpenProcessToken GetTokenInformation GetSidSubAuthority RegCreateKeyExW RegSetValueExW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegOpenKeyExW

gdi32

ChoosePixelFormat SetPixelFormat GetDeviceCaps SwapBuffers

shell32

SHFileOperationW ShellExecuteW SHGetKnownFolderPath CommandLineToArgvW SHGetFolderPathW

opengl32

wglGetCurrentContext wglGetProcAddress wglDeleteContext wglMakeCurrent wglGetCurrentDC wglCreateContext

winmm

waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite waveOutGetNumDevs waveOutGetPosition waveOutClose waveInGetDevCapsA waveInGetDevCapsW waveInOpen waveInClose waveInPrepareHeader waveOutOpen waveOutGetDevCapsW waveOutGetDevCapsA timeBeginPeriod waveInReset waveInGetNumDevs timeEndPeriod waveOutReset waveInUnprepareHeader waveInAddBuffer waveInStart timeGetTime

oleaut32

SysAllocString SysFreeString VariantInit VariantClear VariantChangeType

imm32

ImmSetCompositionStringW ImmNotifyIME ImmGetCompositionStringW ImmAssociateContextEx ImmAssociateContext ImmGetConversionStatus ImmReleaseContext ImmGetContext

iphlpapi

IcmpCreateFile IcmpSendEcho IcmpCloseHandle

winhttp

WinHttpOpen WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpCloseHandle

bcrypt

BCryptGenRandom

hid

HidP_GetData HidP_MaxDataListLength HidD_GetSerialNumberString HidD_GetManufacturerString HidD_GetProductString HidD_FreePreparsedData HidD_GetPreparsedData HidD_GetHidGuid HidP_SetUsages HidP_SetUsageValue HidP_GetButtonCaps HidP_GetValueCaps HidD_GetAttributes HidP_GetCaps

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize RoGetActivationFactory RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsDeleteString WindowsCreateStringReference WindowsCompareStringOrdinal WindowsGetStringRawBuffer WindowsDuplicateString

d3d11

D3D11On12CreateDevice D3D11CreateDevice

dxgi

CreateDXGIFactory2 CreateDXGIFactory

crypt32

CertFreeCertificateContext CertFreeCertificateChain CertVerifyCertificateChainPolicy CertCloseStore CertOpenStore CertAddEncodedCertificateToStore CertGetCertificateChain

ws2_32

htons inet_addr htonl WSASendDisconnect gethostbyaddr freeaddrinfo getaddrinfo inet_ntop WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACancelAsyncRequest WSAAsyncGetHostByName FreeAddrInfoExW WSAIoctl GetAddrInfoExW WSACloseEvent WSACreateEvent WSASocketW WSAWaitForMultipleEvents getsockopt GetAddrInfoExCancel inet_pton getpeername getprotobyname gethostbyname ntohl ioctlsocket __WSAFDIsSet closesocket WSASocketA recv select setsockopt WSASetLastError gethostname WSAGetLastError socket WSACleanup WSAStartup recvfrom send sendto connect shutdown bind ntohs getsockname listen accept

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute

Name

.text

Size

26.0MB

Virtual Size

26.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

312KB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

130KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=18, id=260, version=33218,

count=37, id=259, version=33218,

count=38, id=259, version=28900,

count=110, id=260, productName=VS2019 v16.8.0 build 29333, version=29333,

count=34, id=260, version=31935,

count=111, id=261, productName=VS2019 v16.8.0 build 29333, version=29333,

count=74, id=260, version=28900,

count=44, id=257, version=28900,

count=8, id=253, version=33218,

count=88, id=261, version=33218,

count=149, id=261, version=31935,

count=224, id=261, version=28900,

count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=603, id=1, productName=Unmarked objects,

count=33, productName=Unmarked objects (old),

count=1286, id=265, version=33523,

count=1, id=256, version=33523,

count=1, id=255, version=33523,

count=1, id=258, version=33523,