batman-arkham-knight-2.65.9.zip
- SHA256 15400fefbcb777d90388f9983bf17bf6aaf7d503e19db11522f23d9fecae86a3
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
batman-arkham-knight-2.65.9.zip
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
6 signatures
300 seconds
General
- Target batman-arkham-knight-2.65.9.zip
- Size 136.4MB
- Sample261022-3affhsgs6x
- SHA256 15400fefbcb777d90388f9983bf17bf6aaf7d503e19db11522f23d9fecae86a3
- MD5 602ef576e544bb0326e787908205f0ed
- SHA1 68643c32659c285d520dc540ab19d2c0f7c7d104
- SHA512 74826209b7cc3826eee72d6b4c2457f1ef1b0b75ef0866c54eb31a1cdee31e55cb43020879beb8fd99d3fdbdf6755af62b0564483fc4d755f817f9f3cc2484b3
- SSDEEP 3145728:o3S3Nm3uKRTZNy5kCf/nFSxgQ9JaeAGiiiD:o3mm3uylNWkCffFSxgQ907GiiiD
- TLSH T1C668BFDBCAB67780EC9A3739D878F45A9D54E6D58E7822EF381B7801263F9C4815E340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/batman-arkham-knight-2.65.9.exe unpack001/cmutil.dll
File Explorer
-
batman-arkham-knight-2.65.9.zip.zip 136.4MB
-
IntelligenceEngine.dll84.9MB
-
StorageProvider.dll43.9MB
-
batman-arkham-knight-2.65.9.exe.exe 96KB
-
cmutil.dll.dll 7.4MB
IntelligenceEngine.dll
- SHA256 a1b8b60a03a216c261442a37f27f6c09e40f9980c97a4f3eecdb1f61eeb8ff35
- MD5 1ca916f3f259691b0f32861d51fe9880
- SHA1 c6f6fb452fcd51faecbbcdfc3bf7836ebb2fe92d
- SHA512 d2df45a1965f2f4547664ac9fe3b98912b324232f01184a6a4f07e22da5f95bee237caabb8e5a490834bca77a9e687a0bac329f6895e9bf2c2a6ec95e1821a54
- SSDEEP 1572864:V3S3T7aoyp3257Kg4g+QwTZNz+5YtJgfyKxu2/F4HxgQJ3rJbmr+V:V3S3Nm3uKRTZNy5kCf/nFSxgQ9Jas
- TLSH T1681833C28AAA3757C9D31029B7528B40B1DF7C92D3F2E0DDA2D93F1508985B4BDE860D
- MD5 SHA1 SHA512 SSDEEP TLSH
StorageProvider.dll
- SHA256 ee6e36fc47be139989306fe9406a6d7d9f178c6019c5c98f325b91c0e8049a14
- MD5 817686effe20ba4695e023fbb059e341
- SHA1 0102d756fc97680c34f5d7fdb5576a9daee065af
- SHA512 e5d21ca437500dd40432f19fe15788a875a795a3446e05c9651da73ba0ced733697589892951c645dca6d806662462feab009a8e335059d28801ae0626ad87c8
- SSDEEP 196608:AtFlS+LEz0dIqhgRoKIWMAVeiFpTVUGiii5Yos4JwsOc2cbup9HMYQNAPdq4gMiQ:AUMdNhyIOklGiiinsncP29HMYQW5jR
- TLSH T189A7D6DFCAB67780AC9A7329D978F41ADD54E6D58E7C22EF381B7401263E9C4825E340
- MD5 SHA1 SHA512 SSDEEP TLSH
batman-arkham-knight-2.65.9.exe
- IMPHASH 109ba8ed3c458360a74ea1216207ca09
- SHA256 f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c
- MD5 4cc43fe4d397ff79fa69f397e016df52
- SHA1 8fd6cf81ad40c9b123cd75611860a8b95c72869c
- SHA512 851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157
- SSDEEP 1536:IuDT8WaTCxyBRTzVDnqeQCLGAtkHJDygsyux+bFrQe3tAljHZjlLKR8M187BM5jp:I2RJcRtnACkp5QGtA15Bi27BM5j9O1JE
- TLSH T171A3B51A27ED20E8E5B79774E97A4111EA72783427319BFF4690C4B95F22AD0EC34F12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
64048
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
cmstp.pdb
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegDeleteValueW
RegCreateKeyW
FreeSid
RegSetValueExW
RegCreateKeyExW
AllocateAndInitializeSid
AdjustTokenPrivileges
InitiateSystemShutdownW
LookupPrivilegeValueW
RegEnumValueW
kernel32
FreeLibrary
LoadLibraryExW
FindFirstFileW
WritePrivateProfileStringW
CompareStringW
FindNextFileW
GetCurrentProcess
lstrlenW
GetPrivateProfileIntW
GetPrivateProfileSectionW
FindClose
CreateFileW
SetFileAttributesW
GetLastError
CloseHandle
GetWindowsDirectoryW
WritePrivateProfileSectionW
GetCurrentProcessId
lstrcmpW
ExpandEnvironmentStringsW
LoadLibraryExA
lstrlenA
GetSystemDirectoryW
GetModuleHandleA
GetWindowsDirectoryA
LocalFree
CopyFileW
CreateMutexW
WaitForSingleObject
ReleaseMutex
GetProcessHeap
HeapAlloc
HeapFree
GetSystemInfo
GetVersionExW
SetCurrentDirectoryW
CreateDirectoryW
WideCharToMultiByte
LocalAlloc
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetFileType
RtlCaptureContext
GetStartupInfoW
Sleep
GetProcAddress
GetCurrentDirectoryW
GetPrivateProfileStringW
GetCommandLineW
GetModuleHandleW
lstrcmpiW
user32
GetDlgItemTextW
IsWindow
SetWindowTextW
EndDialog
CheckRadioButton
LoadStringW
MessageBoxW
CharPrevW
MessageBoxExW
IsDlgButtonChecked
SetFocus
GetDlgItem
CheckDlgButton
DialogBoxParamW
CharNextW
msvcrt
_exit
_amsg_exit
_vsnwprintf
__set_app_type
exit
_cexit
__C_specific_handler
_ismbblead
__setusermatherr
_initterm
_vsnprintf
__getmainargs
memset
?terminate@@YAXXZ
_commode
_fmode
_acmdln
_XcptFilter
wcscmp
cmutil
CmFree
WzToSzWithAlloc
GetOSVersion
GetOSMajorVersion
SzToWzWithAlloc
CmRealloc
CmMalloc
ole32
CoInitialize
CoUninitialize
shell32
SHGetDesktopFolder
ShellExecuteExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHFileOperationW
SHGetFolderPathW
SHGetMalloc
SHChangeNotify
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=27412,
count=3, id=259, version=27412,
count=18, id=260, version=27412,
count=17, id=257, version=27412,
count=141, id=1, productName=Unmarked objects,
count=21, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
cmutil.dll
- IMPHASH cb6974fb34268ef3f7c0f7c91700bacb
- SHA256 5b3c4e4c93fde55cab666c456a20f981a2899e514ca7dc73d4869108f7119a58
- MD5 d32d33174283a9e4a4d99162ab1a8a7e
- SHA1 337b7650a0973aab0ca9fe40f8472e0d1a7e06d5
- SHA512 346d6351bf0aecaa314032383dba98f9d624a23d098b9d3a3aa4b4970051cead82828e7d798eda4882c83f91673d1d6f109a36dd0cc0ea23a9f3f9552ab83a87
- SSDEEP 49152:uGwhA1gmHGmtmbOa0RngpKNgGhP0+ic1vXuZ:Ohz85myazpKN0K1vW
- TLSH T1EF7628293E118A12C2505FB28883C7FCAB373DA5A531D13731D64E76BBD3AD29E16760
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
30400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
user32
ShowWindow
EnableWindow
GetWindowLongPtrW
SetWindowLongPtrW
FindWindowExW
SetWindowLongW
FrameRect
ClientToScreen
SetCursor
SetWindowTextW
InvalidateRect
GetSystemMetrics
RegisterClassExW
UnregisterClassW
GetWindowThreadProcessId
GetClassNameW
EnumThreadWindows
EnumWindows
PostMessageW
gdi32
DeleteDC
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
WriteConsoleW
SetEndOfFile
HeapReAlloc
HeapSize
ReadConsoleW
GetStringTypeW
SetFilePointerEx
GetFileSizeEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
SetStdHandle
WriteFile
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetStdHandle
GetEnvironmentVariableW
CreateFileW
GetFileSize
GetFileType
ReadFile
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
Sleep
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
FlushInstructionCache
GetTickCount
GetNativeSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadLibraryW
lstrlenW
MultiByteToWideChar
AllocConsole
CreateToolhelp32Snapshot
Thread32First
Thread32Next
SetErrorMode
ExitProcess
CreateThread
GetSystemDirectoryW
IsWow64Process
lstrcmpiW
lstrcpynW
lstrcatW
FreeConsole
GetConsoleWindow
DeleteFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetTempPathW
GetLastError
DeleteCriticalSection
CreateEventW
WideCharToMultiByte
RaiseException
GetSystemInfo
VirtualQuery
FreeLibrary
LoadLibraryExA
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
FindClose
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
RtlLookupFunctionEntry
EncodePointer
TerminateProcess
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
LCMapStringW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
CmCompareVersion
CmDupStringA
CmDupStringW
CmFlushCache
CmFormatMessageA
CmFormatMessageW
CmFree
CmGetAllocFlags
CmGetBuildId
CmGetHeapStats
CmGetLastStatus
CmGetLogLevel
CmGetModuleDirW
CmHeapWalk
CmInitLibrary
CmIsWow64Process
CmLockHeap
CmMalloc
CmQueryFeature
CmRealloc
CmRegisterNotify
CmSetAllocFlags
CmSetLogLevel
CmShutdown
CmUnlockHeap
CmUnregisterNotify
CmValidatePtr
GetOSMajorVersion
GetOSVersion
SzToWzWithAlloc
WzToSzWithAlloc
Name
.text
Size
118KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.cormeta
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
7.2MB
Virtual Size
7.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ