iw5mp[.]cdx | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
iw5mp.cdx
Size 5.3MB
Sample261002-e5vxpaha93
SHA256 c997fdb177785c67df59b04cc29f34c70f6610426d929508d52f2ac142d054de
MD5 afc10744d008bef4df1fc8ec72a3b84f
SHA1 ca365be3b8ec9672ff4c06e6b091f1c621cc34bc
SHA512 4989406d17dd7eafa246ba1b49e48cf5ff7773c61bc1b1f3129f5cf6b3eeec47d34d66bf8dc350fbb1202a9f212bfd318ff4b34d5272d79df7db91097abd3f21
SSDEEP 98304:CYRMGUmtSfnzm1chLW+BCIuecUNIz0KULviUb5nCsBxXF8/D/XfVCWlN0:CYLSm1chLW9YcUNIzWLR5CsD2XdHN0
TLSH
T15B461212B75096A7C0A54375449BE7A116B2FCA0ABE37323B2C4736E1CB57E01F67AD0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
iw5mp.cdx

File Explorer

iw5mp.cdx

.exe 5.3MB

iw5mp.cdx

IMPHASH 049783a673553542b46f1b803f2fa085
SHA256 c997fdb177785c67df59b04cc29f34c70f6610426d929508d52f2ac142d054de
MD5 afc10744d008bef4df1fc8ec72a3b84f
SHA1 ca365be3b8ec9672ff4c06e6b091f1c621cc34bc
SHA512 4989406d17dd7eafa246ba1b49e48cf5ff7773c61bc1b1f3129f5cf6b3eeec47d34d66bf8dc350fbb1202a9f212bfd318ff4b34d5272d79df7db91097abd3f21
SSDEEP 98304:CYRMGUmtSfnzm1chLW+BCIuecUNIz0KULviUb5nCsBxXF8/D/XfVCWlN0:CYLSm1chLW9YcUNIzWLR5CsD2XdHN0
TLSH
T15B461212B75096A7C0A54375449BE7A116B2FCA0ABE37323B2C4736E1CB57E01F67AD0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

35:fa:c1:69:1f:56:f9:d5:7b:33:43:39:49:14:a2:be:5c:c1:35:62

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Activision Publishing,O=Activision Publishing,L=Santa Monica,ST=California,C=US

Chains

Jul 28, 2015

CN=Activision Publishing,O=Activision Publishing,L=Santa Monica,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Activision Publishing,O=Activision Publishing,L=Santa Monica,ST=California,C=US

Serial Number

21:f2:e3:d8:f1:b4:20:a8:27:44:18:18:d9:7d:87:1a

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 23, 2015 - Mar 24, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

109322992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\trees\iw5\game\pc\iw5mp.pdb

steam_api

SteamAPI_RegisterCallResult SteamRemoteStorage SteamUser SteamNetworking SteamGameServer SteamAPI_UnregisterCallResult SteamAPI_UnregisterCallback SteamAPI_RegisterCallback SteamAPI_RunCallbacks SteamGameServer_Shutdown SteamMasterServerUpdater SteamGameServer_Init SteamAPI_Init SteamAPI_Shutdown SteamApps SteamMatchmakingServers SteamMatchmaking SteamFriends SteamUtils SteamGameServer_RunCallbacks

mss32

_AIL_set_redist_directory@4 _AIL_set_3D_distance_factor@8 _AIL_set_3D_rolloff_factor@8 _AIL_set_speaker_configuration@16 _AIL_filter_property@20 _AIL_set_preference@8 _AIL_open_digital_driver@16 _AIL_speaker_configuration@20 _AIL_stream_status@4 _AIL_sample_status@4 _AIL_sample_3D_position@16 _AIL_sample_volume_pan@12 _AIL_sample_ms_position@12 _AIL_set_sample_volume_levels@12 _AIL_set_room_type@8 _AIL_open_stream@12 _AIL_stream_ms_position@12 _AIL_sample_playback_rate@4 _AIL_set_sample_playback_rate@8 _AIL_set_stream_loop_count@8 _AIL_set_sample_reverb_levels@12 _AIL_set_stream_ms_position@8 _AIL_set_file_callbacks@16 _AIL_set_sample_3D_distances@16 _AIL_sample_channel_levels@8 _AIL_set_sample_channel_levels@12 _AIL_pause_stream@8 _AIL_close_stream@4 _AIL_resume_sample@4 _AIL_stop_sample@4 _AIL_end_sample@4 _AIL_set_DirectSound_HWND@8 _AIL_stream_sample_handle@4 _AIL_set_sample_3D_position@16 _AIL_digital_CPU_percent@4 _AIL_shutdown@0 _RIB_load_static_provider_library@8 _AIL_startup@0 _AIL_set_sample_processor@12 _AIL_sample_processor@8 _AIL_sample_stage_property@24 _AIL_find_filter@8 _AIL_open_filter@8 _AIL_allocate_sample_handle@4 _AIL_init_sample@12 _AIL_set_sample_loop_count@8 _AIL_set_sample_info@8 _AIL_stream_info@20 _AIL_set_sample_ms_position@8 _AIL_size_processed_digital_audio@16 _AIL_process_digital_audio@24 RIB_register_interface RIB_unregister_interface _AIL_mem_free_lock@4 _AIL_mem_alloc_lock@4 _AIL_digital_configuration@16

binkw32

_BinkGetError@0 _BinkSetIOSize@4 _BinkSetError@4 _BinkClose@4 _BinkPause@8 _BinkWait@4 _BinkDoFrame@4 _BinkGoto@12 _BinkNextFrame@4 _BinkGetRealtime@12 _BinkControlBackgroundIO@8 _BinkGetRects@8 _BinkSetMixBinVolumes@20 _BinkGetKeyFrame@12 _BinkRegisterFrameBuffers@8 _BinkGetFrameBuffersInfo@8 _BinkSetSoundTrack@8 _BinkSetSoundSystem@8 _BinkOpenMiles@4 _BinkSetMemory@8 _BinkOpen@8

d3d9

Direct3DCreate9

dsound

ord11 ord6

powrprof

CallNtPowerInformation

ws2_32

WSAStartup gethostname ntohl connect send recv ioctlsocket __WSAFDIsSet recvfrom htonl sendto inet_addr gethostbyname WSAGetLastError htons ntohs setsockopt bind shutdown socket closesocket inet_ntoa WSACleanup getsockname getsockopt WSASetLastError select

winmm

waveInGetNumDevs mixerGetDevCapsA mixerSetControlDetails mixerOpen mixerGetLineInfoA mixerGetLineControlsA mixerGetControlDetailsA mixerClose timeEndPeriod timeBeginPeriod timeGetTime mixerGetNumDevs

kernel32

GetConsoleOutputCP WriteConsoleA GetProcessHeap SetEndOfFile SetStdHandle SetEnvironmentVariableA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA InitializeCriticalSectionAndSpinCount SetConsoleCtrlHandler GetTimeZoneInformation FlushFileBuffers CompareStringW CompareStringA GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID VirtualQuery GetConsoleMode GetConsoleCP SetHandleCount WriteConsoleW GetFileType PeekNamedPipe GetFileInformationByHandle GetStdHandle HeapCreate HeapSize DeleteCriticalSection IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess LCMapStringW MultiByteToWideChar WideCharToMultiByte LCMapStringA SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo GetStartupInfoA GetCommandLineA HeapReAlloc ExitProcess GetModuleHandleW GetFullPathNameA CreateDirectoryA RtlUnwind GetSystemTimeAsFileTime GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime HeapFree HeapAlloc GetTickCount GetLocaleInfoW WaitForMultipleObjects GetExitCodeThread TerminateThread ExpandEnvironmentStringsA GetVersion FlushConsoleInputBuffer ExitThread ReadConsoleInputA SetConsoleMode FindFirstFileA PulseEvent CreateSemaphoreA CreateMutexA SetFilePointer ReleaseSemaphore ReleaseMutex GetDiskFreeSpaceA LoadLibraryA FreeLibrary GlobalMemoryStatusEx FindNextFileA FindClose GetCurrentDirectoryA SetThreadExecutionState MulDiv SystemTimeToFileTime GetSystemTime SetPriorityClass SetErrorMode DeleteFileA GetCurrentProcessId InterlockedDecrement InterlockedExchange InterlockedExchangeAdd InterlockedIncrement GetFileSize GetLastError ReadFileEx SleepEx CloseHandle InterlockedCompareExchange ReadFile CreateFileA Sleep GetCurrentThreadId SetEvent ResetEvent CreateEventA WaitForSingleObject GetProcessAffinityMask GetCurrentProcess DuplicateHandle GetCurrentThread SetThreadPriority RaiseException CreateThread SuspendThread ResumeThread SetThreadAffinityMask GetThreadPriority VirtualAlloc VirtualFree QueryPerformanceCounter QueryPerformanceFrequency GetModuleFileNameA GetModuleHandleA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GlobalMemoryStatus GetProcAddress GetSystemInfo GetVersionExA SetProcessAffinityMask FormatMessageA GlobalUnlock GlobalSize GlobalLock Module32Next Module32First CreateToolhelp32Snapshot OpenProcess WriteFile

user32

GetProcessWindowStation UpdateWindow IsWindow AdjustWindowRectEx EnumDisplayMonitors MonitorFromPoint RegisterWindowMessageA MonitorFromWindow GetMonitorInfoA MoveWindow MapVirtualKeyA SystemParametersInfoA SetWindowsHookExA UnhookWindowsHookEx GetAsyncKeyState CallNextHookEx CloseWindow SetWindowTextA CallWindowProcA PostQuitMessage DestroyWindow ClipCursor ClientToScreen GetClientRect GetWindowRect SetWindowLongA GetWindowLongA GetWindowTextA ReleaseDC GetDC GetDesktopWindow EnumThreadWindows ChangeDisplaySettingsA GetSystemMetrics SetCursorPos SetFocus GetForegroundWindow ScreenToClient GetCursorPos ShowCursor PostMessageA ShowWindow DispatchMessageA TranslateMessage GetMessageA CloseClipboard GetClipboardData OpenClipboard PeekMessageA RegisterClassExA LoadCursorA LoadIconA MessageBoxA GetActiveWindow SetWindowPos AdjustWindowRect SendMessageA CreateWindowExA LoadImageA RegisterClassA DefWindowProcA GetUserObjectInformationW

gdi32

GetObjectA BitBlt GetBitmapBits DeleteObject DeleteDC SelectObject CreateCompatibleDC CreateDCA GetDeviceCaps CreateFontA CreateCompatibleBitmap SetDeviceGammaRamp CreateSolidBrush

advapi32

RegQueryInfoKeyA RegCloseKey RegOpenKeyExA RegEnumKeyExA RegisterEventSourceA ReportEventA DeregisterEventSource CryptAcquireContextA CryptGenRandom CryptReleaseContext RegQueryValueExA

shell32

ShellExecuteA

Sharing

General

Malware Config

Signatures

File Explorer

iw5mp.cdx

steam_api

mss32

binkw32

d3d9

dsound

powrprof

ws2_32

winmm

kernel32

user32

gdi32

advapi32

shell32

generic