DOOM64_x64[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DOOM64_x64.exe
Size 5.9MB
Sample261017-hmdr8sbs3n
SHA256 9fe16f104112a03313337147c3b20edb42c6691be4e09a9fe6af2bfd90d29496
MD5 61b1490824abb468cdc8daf8bc0115da
SHA1 98ecdd10bf3db3643610d6735856b7fe61a83c8e
SHA512 52c84a32120286eb65753bc8d24c8f94613541007df3bfec68ac9a4de04ff7cd786ebd7f8b6ddfe6d3bc7e19b95dd843435d95e9043a41869fa49a204e751ea9
SSDEEP 49152:FOqxXvdIPH2chaWLPklXlV1Ds5WxrKK+5t1XdDNwMj0JG5Qk9tCK6Hzj/o9uMYTW:naWlVVl6LpV0sFAzM+64YKo
TLSH
T125568D5E67B440DEC276C13EC996952BE2B230290B30AFCB1190566F6F379E05E7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DOOM64_x64.exe

File Explorer

DOOM64_x64.exe

.exe 5.9MB

DOOM64_x64.exe

IMPHASH 64390c2ff15b6eb9a37e383091458912
SHA256 9fe16f104112a03313337147c3b20edb42c6691be4e09a9fe6af2bfd90d29496
MD5 61b1490824abb468cdc8daf8bc0115da
SHA1 98ecdd10bf3db3643610d6735856b7fe61a83c8e
SHA512 52c84a32120286eb65753bc8d24c8f94613541007df3bfec68ac9a4de04ff7cd786ebd7f8b6ddfe6d3bc7e19b95dd843435d95e9043a41869fa49a204e751ea9
SSDEEP 49152:FOqxXvdIPH2chaWLPklXlV1Ds5WxrKK+5t1XdDNwMj0JG5Qk9tCK6Hzj/o9uMYTW:naWlVVl6LpV0sFAzM+64YKo
TLSH
T125568D5E67B440DEC276C13EC996952BE2B230290B30AFCB1190566F6F379E05E7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3338036

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\devstuff\doom64ex\kex3_osiris\bin64\osiris_x64.pdb

sdl2

SDL_SetMainReady SDL_iconv_string SDL_ShowSimpleMessageBox SDL_HapticRumbleSupported SDL_JoystickIsHaptic SDL_HapticNewEffect SDL_HapticOpenFromJoystick SDL_GetDisplayMode SDL_HapticUpdateEffect SDL_HapticDestroyEffect SDL_HapticRumblePlay SDL_HapticRunEffect SDL_HapticRumbleInit SDL_JoystickGetDeviceInstanceID SDL_HapticQuery SDL_HapticClose SDL_HapticRumbleStop SDL_HapticUnpause SDL_HapticPause SDL_MinimizeWindow SDL_GetWindowWMInfo SDL_GetPerformanceFrequency SDL_Delay SDL_GetPerformanceCounter SDL_UpdateWindowSurface SDL_RWFromFile SDL_ConvertSurface SDL_UpperBlitScaled SDL_FreeSurface SDL_LoadBMP_RW SDL_GetWindowSurface SDL_GameControllerGetAxis SDL_GetRelativeMouseState SDL_StopTextInput SDL_GameControllerAddMappingsFromRW SDL_GameControllerGetJoystick SDL_StartTextInput SDL_GetModState SDL_GameControllerGetAttached SDL_PollEvent SDL_WarpMouseInWindow SDL_GameControllerName SDL_GetMouseState SDL_GameControllerGetVendor SDL_GameControllerOpen SDL_wcslen SDL_SetRelativeMouseMode SDL_GameControllerGetProduct SDL_GameControllerClose SDL_SetHint SDL_JoystickInstanceID SDL_NumJoysticks SDL_RWFromConstMem SDL_PumpEvents SDL_GetHint SDL_GetWindowSize SDL_GetPrefPath SDL_SetWindowTitle SDL_CreateWindow SDL_GetCurrentDisplayMode SDL_GetWindowFlags SDL_GetWindowBordersSize SDL_GL_SetSwapInterval SDL_LoadObject SDL_UnloadObject SDL_GL_CreateContext SDL_GetClipboardText SDL_GL_GetSwapInterval SDL_DisableScreenSaver SDL_GetDisplayName SDL_SetWindowDisplayMode SDL_GL_SetAttribute SDL_GetDesktopDisplayMode SDL_SetClipboardText SDL_GL_GetProcAddress SDL_ShowCursor SDL_QuitSubSystem SDL_Quit SDL_GetError SDL_DestroyWindow SDL_SetWindowGrab SDL_GetNumVideoDisplays SDL_GetClosestDisplayMode SDL_Init SDL_GL_MakeCurrent SDL_GL_DeleteContext SDL_LoadFunction SDL_GetCPUCount SDL_GetDisplayUsableBounds SDL_ShowMessageBox SDL_GetBasePath SDL_GetNumDisplayModes SDL_free SDL_GL_SwapWindow SDL_strlen SDL_IsGameController

opengl32

wglGetCurrentContext

ws2_32

ioctlsocket sendto freeaddrinfo htons htonl recvfrom socket WSAStartup getaddrinfo closesocket bind WSACleanup ntohs connect recv send shutdown WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAWaitForMultipleEvents GetAddrInfoW FreeAddrInfoW WSAGetLastError

fmod

?release@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ ?init@System@FMOD@@QEAA?AW4FMOD_RESULT@@HIPEAX@Z ?set3DListenerAttributes@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEBUFMOD_VECTOR@@000@Z ?close@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ ?getUserData@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z ?getChannelsPlaying@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH0@Z ?release@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@XZ ?update@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ ?set3DMinMaxDistance@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@MM@Z ?set3DSettings@System@FMOD@@QEAA?AW4FMOD_RESULT@@MMM@Z ?set3DAttributes@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_VECTOR@@0@Z ?addDSP@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAVDSP@2@@Z ?setPan@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z ?isPlaying@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z ?setMode@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@I@Z ?setPitch@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z ?setVolume@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z ?getPaused@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z ?setPaused@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z ?stop@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@XZ ?setParameterFloat@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HM@Z ?getBypass@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z ?setBypass@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z ?setChannelGroup@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVChannelGroup@2@@Z ?setLoopPoints@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@IIII@Z ?createSound@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVSound@2@@Z ?createDSPByType@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_DSP_TYPE@@PEAPEAVDSP@2@@Z ?createChannelGroup@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAPEAVChannelGroup@2@@Z ?playSound@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVSound@2@PEAVChannelGroup@2@_NPEAPEAVChannel@2@@Z ?getMasterChannelGroup@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVChannelGroup@2@@Z FMOD_System_Create ?getLength@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII@Z ?removeDSP@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVDSP@2@@Z ?setParameterInt@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HH@Z ?setLoopPoints@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@IIII@Z

steam_api64

SteamAPI_RegisterCallback SteamAPI_RunCallbacks SteamInternal_ContextInit SteamAPI_RestartAppIfNecessary SteamAPI_Shutdown SteamAPI_UnregisterCallback SteamInternal_FindOrCreateUserInterface SteamAPI_UnregisterCallResult SteamAPI_RegisterCallResult SteamAPI_GetHSteamUser SteamAPI_Init

kernel32

WaitForSingleObject AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock FreeLibrary DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection ExitProcess FileTimeToDosDateTime VirtualQuery GetSystemTimeAsFileTime GlobalMemoryStatusEx FileTimeToLocalFileTime GetSystemInfo lstrcpyA LoadLibraryA lstrlenA GetModuleFileNameA RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext GetNumaNodeProcessorMaskEx SetThreadPriority SetThreadAffinityMask CreateProcessA GetCurrentProcessId Process32Next CreateToolhelp32Snapshot CreateThread SetHandleInformation Process32First WideCharToMultiByte MoveFileExW MultiByteToWideChar SetFileAttributesW RemoveDirectoryW lstrlenW DeleteFileW GetFileAttributesExW CreateFileW GetFileAttributesW AllocConsole GetProcAddress GetFileInformationByHandle WriteFile GetStdHandle SetConsoleTitleA DebugBreak RaiseException GetLastError GetLocaleInfoA TerminateProcess OutputDebugStringA GetCurrentProcess CreateDirectoryW GetModuleHandleA FormatMessageA LocalFree GetCurrentThreadId CloseHandle CreateFileA SetFilePointer ReadFile GetVolumeInformationA GetThreadId CreatePipe GetSystemDirectoryA SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetProcessHeap HeapFree HeapAlloc GetCommandLineW InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent FlushFileBuffers

user32

wvsprintfA wsprintfA CallNextHookEx UnhookWindowsHookEx SendMessageA LoadIconA SetWindowsHookExA

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteA

ole32

CoCreateGuid CoUninitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoTaskMemFree

oleaut32

VariantClear

advapi32

RegOpenKeyExA GetUserNameA RegQueryValueExA RegCloseKey

msvcp140

_Thrd_yield _Cnd_signal _Mtx_trylock _Query_perf_counter _Cnd_init_in_situ _Thrd_hardware_concurrency ?_Xlength_error@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?_Xbad_function_call@std@@YAXXZ _Query_perf_frequency ?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z ?_Throw_Cpp_error@std@@YAXH@Z _Unlock_shared_ptr_spin_lock _Lock_shared_ptr_spin_lock _Thrd_sleep ?_Xout_of_range@std@@YAXPEBD@Z _Cnd_destroy_in_situ _Cnd_broadcast _Mtx_unlock _Thrd_join _Cnd_init _Mtx_destroy _Xtime_get_ticks _Thrd_detach _Thrd_id _Thrd_start _Mtx_init _Cnd_wait _Cnd_destroy _Cnd_do_broadcast_at_thread_exit _Mtx_init_in_situ _Mtx_lock _Mtx_destroy_in_situ _Cnd_timedwait ?_Syserror_map@std@@YAPEBDH@Z ?_Throw_C_error@std@@YAXH@Z

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DReflect D3DCompile

winhttp

WinHttpConnect WinHttpOpen WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpWriteData WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpCloseHandle WinHttpSetStatusCallback

iphlpapi

GetAdaptersAddresses

vcruntime140

strchr _CxxThrowException __intrinsic_setjmp __std_type_info_compare memcmp __RTDynamicCast __C_specific_handler memset memmove memcpy longjmp memchr strrchr __std_exception_copy __std_exception_destroy strstr _purecall __std_terminate __CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _aligned_malloc calloc _aligned_free _callnewh _aligned_realloc realloc

api-ms-win-crt-runtime-l1-1-0

_errno _exit _invalid_parameter_noinfo _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit abort _cexit _seh_filter_exe _set_app_type _invalid_parameter_noinfo_noreturn _wassert _get_narrow_winmain_command_line _initterm _initterm_e _c_exit _register_thread_local_exe_atexit_callback exit terminate

api-ms-win-crt-stdio-l1-1-0

_fseeki64 fread fseek ferror fgets fputc fputs __stdio_common_vsscanf __stdio_common_vsprintf_s __stdio_common_vsprintf __stdio_common_vsnprintf_s __p__commode _getcwd _wfreopen fwrite _kbhit _set_fmode fflush ftell fclose __acrt_iob_func __stdio_common_vswprintf fopen __stdio_common_vfprintf rewind

api-ms-win-crt-convert-l1-1-0

atol _strtoui64 strtoull atoi mbsrtowcs_s strtol strtod atoll wcsrtombs_s atof _strtoi64

api-ms-win-crt-string-l1-1-0

isupper strtok toupper strncmp strcat_s strcspn wcsncpy_s iscntrl _strnicmp strncpy isxdigit tolower isdigit strcmp _stricmp strncpy_s

api-ms-win-crt-math-l1-1-0

ldexp atan ceil sin roundf modff cos __setusermatherr floor log sqrtf sinf powf exp log10f floorf tanf ceilf pow log2 atan2f cosf sqrt

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 asctime _ctime64

api-ms-win-crt-filesystem-l1-1-0

_findclose _wfindnext64i32 _fullpath _wfindfirst64i32 _stat64i32

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-conio-l1-1-0

_getch

generic

count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=261, version=27412,

count=2, id=199, version=41118,

count=32, id=261, version=26706,

count=10, id=260, version=26706,

count=7, id=259, version=26706,

count=4, id=257, version=26706,

count=2, id=262, version=27412,

count=15, id=260, version=27045,

count=229, id=261, version=27045,

count=2, id=257, productName=VS2017 v15.7.1 build 26428, version=26428,

count=2, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=24, id=257, version=27412,

count=1, id=260, productName=VS2019 v16.11.6 build 30137, version=30137,

count=3, id=257, productName=VS2019 v16.11.6 build 30137, version=30137,

count=502, id=1, productName=Unmarked objects,

count=130, id=260, version=27048,

count=274, id=265, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,