FrostyConvert-FifaTool-v1[.]1[.]2-win-x64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
FrostyConvert-FifaTool-v1.1.2-win-x64.zip
Size 191.2MB
Sample261004-2n4jtsyemf
SHA256 ab296fbb8176307cb0364e4fa0e8383d9b2a6dc537e42ee426e57d51695ee79b
MD5 620032197e9701fa2d160eb923cc4dcc
SHA1 b477235277a52ca65b67b5b1badf92b4ddf9db8f
SHA512 cf40a800d3fdbd94bbd609bf55ebf06dc28c50e925d959e3ea0bcea39012b425b9ee7d851c78892da31f6102fd2c09b339c9c61d4b63d724fad2b15a5227f9d2
SSDEEP 3145728:K+mOK5IkBQsgmKEw0eG7WTuQ3E5EYc66pt2zk/vm5roy2RorcH/lTx3r2UyMYey8:K1ZVFgmlx7qE5ctd/u5B22rKxr1GPZ6v
TLSH
T136A83326E580EEACE07504FE66700DB07F18B02FB16DA715DC0372ECA71E6C5E5B6896
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Frosty Converter.exe
unpack001/FrostyConvert-FifaTool-v1.1.2-win-x64/Frosty Converter.exe
unpack001/FrostyConvert-FifaTool-v1.1.2-win-x64/oodle-data-shared.dll
unpack001/oodle-data-shared.dll

File Explorer

FrostyConvert-FifaTool-v1.1.2-win-x64.zip

.zip 191.2MB
Frosty Converter.exe

.exe 49.8MB
FrostyConvert-FifaTool-v1.1.2-win-x64/Frosty Converter.exe

.exe 49.8MB
FrostyConvert-FifaTool-v1.1.2-win-x64/INSTALL.txt

2KB
FrostyConvert-FifaTool-v1.1.2-win-x64/SPOTIFY CAMP NOU.fifamod

101.8MB
FrostyConvert-FifaTool-v1.1.2-win-x64/oodle-data-shared.dll

.dll 602KB
INSTALL.txt

2KB
oodle-data-shared.dll

.dll 602KB

FrostyConvert-FifaTool-v1.1.2-win-x64.zip

SHA256 ab296fbb8176307cb0364e4fa0e8383d9b2a6dc537e42ee426e57d51695ee79b
MD5 620032197e9701fa2d160eb923cc4dcc
SHA1 b477235277a52ca65b67b5b1badf92b4ddf9db8f
SHA512 cf40a800d3fdbd94bbd609bf55ebf06dc28c50e925d959e3ea0bcea39012b425b9ee7d851c78892da31f6102fd2c09b339c9c61d4b63d724fad2b15a5227f9d2
SSDEEP 3145728:K+mOK5IkBQsgmKEw0eG7WTuQ3E5EYc66pt2zk/vm5roy2RorcH/lTx3r2UyMYey8:K1ZVFgmlx7qE5ctd/u5B22rKxr1GPZ6v
TLSH
T136A83326E580EEACE07504FE66700DB07F18B02FB16DA715DC0372ECA71E6C5E5B6896
MD5 SHA1 SHA512 SSDEEP TLSH

Frosty Converter.exe

IMPHASH 8a34d2e5912e3d13caec44729685a874
SHA256 9c038b5ec562808245ee3236b332760a963a28f06fda696ab01d0d741fb398bf
MD5 6db11f09317e0841791386822991fa73
SHA1 564cac011a6bcdfc772522d097cd255ded66af84
SHA512 ef46dd48d6597bcb5f50ce6557efc2269db8b7812f6a8db031ade718a1b839213cf9bebc328f9e772e67f458b5fb6b7f033b8868758c2b202d060c089854fefe
SSDEEP 1572864:j99mjegUm1Jhb49a0eavlL6z4KcpkCXuKG1bU:j99mjHL69ZXWmjXZGdU
TLSH
T1F2B71256E2FD00ECD47AC0B8C6574627EBB2345513309BEB16A48A692F37BE16E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6066544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\src\runtime\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb

kernel32

ActivateActCtx FindResourceW GetWindowsDirectoryW GetModuleHandleW LoadLibraryExW LoadLibraryExA RtlCaptureContext WideCharToMultiByte GetConsoleOutputCP MapViewOfFileEx SetLastError SetThreadErrorMode RaiseException SetConsoleCtrlHandler DebugBreak FlsAlloc FlsSetValue FlsGetValue GetLocaleInfoEx GetUserDefaultLocaleName FlushProcessWriteBuffers ReadFile CreateNamedPipeA GetCurrentProcess WriteFile WaitForMultipleObjects WaitForSingleObject DuplicateHandle DisconnectNamedPipe CreateEventW CreateFileA CancelIoEx GetOverlappedResult ConnectNamedPipe FlushFileBuffers SetEvent ResetEvent WaitForSingleObjectEx VirtualAlloc VirtualFree VirtualQuery VirtualProtect SleepEx SwitchToThread MultiByteToWideChar SuspendThread ResumeThread LCMapStringEx FormatMessageW LocalFree GetModuleFileNameW GetEnvironmentVariableW CreateFileW GetFullPathNameW HeapAlloc HeapFree CreateFileMappingW HeapCreate GetProcessHeap HeapDestroy VerSetConditionMask VerifyVersionInfoW QueueUserAPC SetThreadPriority GetThreadPriority TlsSetValue TlsAlloc WaitForMultipleObjectsEx SignalObjectAndWait RtlLookupFunctionEntry SetThreadStackGuarantee LocateXStateFeature SetErrorMode RaiseFailFastException GetExitCodeProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter AddVectoredExceptionHandler GetThreadContext SetThreadContext GetEnabledXStateFeatures InitializeContext RtlRestoreContext SetXStateFeaturesMask CopyContext GetModuleHandleExW GetCommandLineW CreateProcessW GetCPInfo ExitProcess OutputDebugStringW RtlInstallFunctionTableCallback GetLogicalProcessorInformationEx SetThreadGroupAffinity GetThreadGroupAffinity UnmapViewOfFile GetProcessAffinityMask QueryInformationJobObject FlushInstructionCache RtlDeleteFunctionTable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitializeConditionVariable WakeAllConditionVariable AcquireSRWLockShared SleepConditionVariableSRW ReleaseSRWLockShared CreateMemoryResourceNotification WerRegisterRuntimeExceptionModule RtlUnwind CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer OpenEventW ExitThread HeapReAlloc TlsGetValue GetFileSize RtlAddFunctionTable CreateSemaphoreExW ReleaseSemaphore GetSystemDefaultLCID GetUserDefaultLCID OutputDebugStringA QueryThreadCycleTime SetFilePointer MapViewOfFile Sleep RemoveDirectoryW CreateDirectoryW GetEnvironmentStringsW GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetCurrentProcessId GetProcAddress CreateThread GetSystemInfo CloseHandle GetActiveProcessorGroupCount GetCurrentThread GetLastError FreeEnvironmentStringsW GetCurrentThreadId CreateActCtxW GetStdHandle FindNextFileW EnterCriticalSection FindFirstFileExW GetFileSizeEx InitializeCriticalSection GetTempPathW FindClose GetFileAttributesW GetConsoleMode GetFileAttributesExW LoadLibraryA GetCurrentDirectoryW WriteConsoleW DeleteCriticalSection CreateFileMappingA LeaveCriticalSection GetTickCount64 QueryPerformanceFrequency QueryPerformanceCounter IsDebuggerPresent GetNumaHighestNodeNumber SetThreadAffinityMask SetThreadIdealProcessorEx GetThreadIdealProcessorEx VirtualAllocExNuma GetNumaProcessorNodeEx VirtualUnlock GetLargePageMinimum IsProcessInJob K32GetProcessMemoryInfo GetLogicalProcessorInformation GlobalMemoryStatusEx RtlVirtualUnwind IsProcessorFeaturePresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader EncodePointer InitializeCriticalSectionAndSpinCount TlsFree TryAcquireSRWLockExclusive GetExitCodeThread GetStringTypeW InitializeCriticalSectionEx DecodePointer SetEnvironmentVariableW GetProcessGroupAffinity GetCurrentProcessorNumberEx

advapi32

LookupPrivilegeValueW RegGetValueW SetKernelObjectSecurity RegQueryValueExW RegOpenKeyExW GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation OpenProcessToken RegCloseKey SetThreadToken RevertToSelf OpenThreadToken EventWrite EventRegister EventWriteTransfer DeregisterEventSource RegisterEventSourceW ReportEventW AdjustTokenPrivileges

ole32

CLSIDFromProgID CoCreateGuid CoTaskMemAlloc CoUnmarshalInterface CoMarshalInterface CoGetMarshalSizeMax CoCreateFreeThreadedMarshaler CoGetClassObject CoGetContextToken CoGetObjectContext CoReleaseMarshalData CoInitializeEx CoRegisterInitializeSpy CoWaitForMultipleHandles CoUninitialize CoRevokeInitializeSpy CoTaskMemFree

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen CreateErrorInfo QueryPathOfRegTypeLi LoadTypeLibEx SafeArrayGetVartype VariantChangeType SysAllocString LoadRegTypeLi SysAllocStringLen VariantClear VariantInit VarCyFromDec SafeArrayDestroy SafeArrayAllocDescriptorEx GetRecordInfoFromTypeInfo SafeArraySetRecordInfo SafeArrayAllocData SafeArrayGetElemsize SysStringByteLen SysAllocStringByteLen SafeArrayCreateVector SafeArrayPutElement SafeArrayGetDim SafeArrayGetLBound

user32

MessageBoxW LoadStringW

shell32

ShellExecuteW

api-ms-win-crt-string-l1-1-0

iswspace strncpy iswascii _strnicmp iswupper strncmp strncpy_s towlower wcscat_s _wcsdup wcscpy_s wcsncpy_s isalpha strnlen wcsncat_s strncat_s towupper strcpy_s strcmp _stricmp strcat_s isspace tolower wcsncmp _strdup strtok_s wcsnlen strlen _wcsnicmp _wcsicmp isdigit

api-ms-win-crt-heap-l1-1-0

_callnewh realloc _aligned_malloc malloc _set_new_mode free calloc _aligned_free

api-ms-win-crt-convert-l1-1-0

atoi atol _wcstoui64 strtol _wtoi _ltow_s strtoull strtoul wcstoul _atoi64

api-ms-win-crt-stdio-l1-1-0

fputwc __stdio_common_vsprintf_s _set_fmode __stdio_common_vfprintf __acrt_iob_func __p__commode ftell fseek __stdio_common_vsprintf fopen __stdio_common_vfwprintf setvbuf _setmode _dup _fileno fclose __stdio_common_vswprintf _flushall fwrite __stdio_common_vsnwprintf_s __stdio_common_vsnprintf_s _wfsopen _write __stdio_common_vsscanf fgets fflush fputs _wfopen

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _invalid_parameter_noinfo _wcserror_s _beginthreadex abort _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _errno _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table terminate _controlfp_s

api-ms-win-crt-filesystem-l1-1-0

_wremove _wrename

api-ms-win-crt-math-l1-1-0

truncf ilogbf copysignf copysign ceilf round asinh cbrt cos acosh atanh modf acoshf cbrtf atanhf modff asinhf _fdopen fmodf fmod tanhf fmaf fma floorf __setusermatherr acos acosf asin asinf atan atan2 atan2f log10 log10f log2 log2f logf floor expf pow log powf exp coshf roundf cosh sin sinf cosf sinh sinhf trunc sqrt sqrtf tan tanf tanh atanf ceil

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 wcsftime

api-ms-win-crt-locale-l1-1-0

_create_locale __pctype_func ___mb_cur_max_func ___lc_codepage_func _configthreadlocale setlocale _lock_locales _unlock_locales _free_locale ___lc_locale_name_func

Name

.text

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.CLR_UEF

Size

512B

Virtual Size

215B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

229KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Section

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

FrostyConvert-FifaTool-v1.1.2-win-x64/Frosty Converter.exe

IMPHASH 8a34d2e5912e3d13caec44729685a874
SHA256 9c038b5ec562808245ee3236b332760a963a28f06fda696ab01d0d741fb398bf
MD5 6db11f09317e0841791386822991fa73
SHA1 564cac011a6bcdfc772522d097cd255ded66af84
SHA512 ef46dd48d6597bcb5f50ce6557efc2269db8b7812f6a8db031ade718a1b839213cf9bebc328f9e772e67f458b5fb6b7f033b8868758c2b202d060c089854fefe
SSDEEP 1572864:j99mjegUm1Jhb49a0eavlL6z4KcpkCXuKG1bU:j99mjHL69ZXWmjXZGdU
TLSH
T1F2B71256E2FD00ECD47AC0B8C6574627EBB2345513309BEB16A48A692F37BE16E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6066544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\src\runtime\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb

kernel32

advapi32

ole32

oleaut32

user32

MessageBoxW LoadStringW

shell32

ShellExecuteW

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

_callnewh realloc _aligned_malloc malloc _set_new_mode free calloc _aligned_free

api-ms-win-crt-convert-l1-1-0

atoi atol _wcstoui64 strtol _wtoi _ltow_s strtoull strtoul wcstoul _atoi64

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

_wremove _wrename

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 wcsftime

api-ms-win-crt-locale-l1-1-0

_create_locale __pctype_func ___mb_cur_max_func ___lc_codepage_func _configthreadlocale setlocale _lock_locales _unlock_locales _free_locale ___lc_locale_name_func

Name

.text

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.CLR_UEF

Size

512B

Virtual Size

215B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

229KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Section

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

FrostyConvert-FifaTool-v1.1.2-win-x64/oodle-data-shared.dll

IMPHASH 5182d33b96544a85d5b271b1fb3b18e3
SHA256 1f28ffecd7ad1b75be89ea5a85ad74b4e7f998994d7dcf5f69eddfd3bca4aeb2
MD5 f9f4a7500853522898eee2acf670d205
SHA1 f3c732b3b230a8738d5a8bb19405de1e5687bae0
SHA512 ab551502d14836e3fd3e8756f48a1ebccd7e9889bdd79d831de2a3c136f8e80c7cba39d375b0876a41423d3f258d1993e4fb4d47359c0b3af996134ba26919cf
SSDEEP 12288:wYhPgMgt3COL0eACQoB4nvS14qEf1SYJPoNyQcLaWHjhFzaBMfbfb8n9CbGA0X19:bPgMgt3X0eACYbjZX5jhJakL4nMEXwk
TLSH
T199D49ED2A2D061E8D53B8039C767D253F7B1385A5310AAF753949AB23B87EE02B7D701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

511940

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\OodleUE\OodleUE\build\builds\msvc\bin\Release\oodle-data-shared.pdb

OodleCore_Plugin_DisplayAssertion_Default OodleCore_Plugin_Free_Default OodleCore_Plugin_Free_None OodleCore_Plugin_MallocAligned_Default OodleCore_Plugin_MallocAligned_None OodleCore_Plugin_Printf_Default OodleCore_Plugin_Printf_Verbose OodleCore_Plugin_RunJob_Default OodleCore_Plugin_WaitJob_Default OodleCore_Plugins_SetAllocators OodleCore_Plugins_SetAssertion OodleCore_Plugins_SetJobSystem OodleCore_Plugins_SetJobSystemAndCount OodleCore_Plugins_SetPrintf OodleKraken_Decode_Headerless OodleLZDecoder_Create OodleLZDecoder_DecodeSome OodleLZDecoder_Destroy OodleLZDecoder_MakeValidCircularWindowSize OodleLZDecoder_MemorySizeNeeded OodleLZDecoder_Reset OodleLZLegacyVTable_InstallToCore OodleLZ_CheckSeekTableCRCs OodleLZ_Compress OodleLZ_CompressOptions_GetDefault OodleLZ_CompressOptions_Validate OodleLZ_CompressionLevel_GetName OodleLZ_Compressor_GetName OodleLZ_CreateSeekTable OodleLZ_Decompress OodleLZ_FillSeekTable OodleLZ_FindSeekEntry OodleLZ_FreeSeekTable OodleLZ_GetAllChunksCompressor OodleLZ_GetChunkCompressor OodleLZ_GetCompressScratchMemBound OodleLZ_GetCompressScratchMemBoundEx OodleLZ_GetCompressedBufferSizeNeeded OodleLZ_GetCompressedStepForRawStep OodleLZ_GetDecodeBufferSize OodleLZ_GetFirstChunkCompressor OodleLZ_GetInPlaceDecodeBufferSize OodleLZ_GetNumSeekChunks OodleLZ_GetSeekEntryPackedPos OodleLZ_GetSeekTableMemorySizeNeeded OodleLZ_Jobify_GetName OodleLZ_MakeSeekChunkLen OodleLZ_ThreadPhased_BlockDecoderMemorySizeNeeded Oodle_CheckVersion Oodle_GetConfigValues Oodle_LogHeader Oodle_SetConfigValues Oodle_SetUsageWarnings

oodle-data-shared.dll

IMPHASH 5182d33b96544a85d5b271b1fb3b18e3
SHA256 1f28ffecd7ad1b75be89ea5a85ad74b4e7f998994d7dcf5f69eddfd3bca4aeb2
MD5 f9f4a7500853522898eee2acf670d205
SHA1 f3c732b3b230a8738d5a8bb19405de1e5687bae0
SHA512 ab551502d14836e3fd3e8756f48a1ebccd7e9889bdd79d831de2a3c136f8e80c7cba39d375b0876a41423d3f258d1993e4fb4d47359c0b3af996134ba26919cf
SSDEEP 12288:wYhPgMgt3COL0eACQoB4nvS14qEf1SYJPoNyQcLaWHjhFzaBMfbfb8n9CbGA0X19:bPgMgt3X0eACYbjZX5jhJakL4nMEXwk
TLSH
T199D49ED2A2D061E8D53B8039C767D253F7B1385A5310AAF753949AB23B87EE02B7D701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

511940

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\OodleUE\OodleUE\build\builds\msvc\bin\Release\oodle-data-shared.pdb

Sharing

General

Malware Config

Signatures

File Explorer

FrostyConvert-FifaTool-v1.1.2-win-x64.zip

Frosty Converter.exe

kernel32

advapi32

ole32

oleaut32

user32

shell32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

FrostyConvert-FifaTool-v1.1.2-win-x64/Frosty Converter.exe

kernel32

advapi32

ole32

oleaut32

user32

shell32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

FrostyConvert-FifaTool-v1.1.2-win-x64/INSTALL.txt

FrostyConvert-FifaTool-v1.1.2-win-x64/SPOTIFY CAMP NOU.fifamod

FrostyConvert-FifaTool-v1.1.2-win-x64/oodle-data-shared.dll

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic

INSTALL.txt

oodle-data-shared.dll

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic