prestige_game[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
prestige_game.dll
Size 4.7MB
Sample261023-165deaes5t
SHA256 a28b5d1b4ec826607d1b429c82fe57c2d3a322e5799781486b19e64b07bd54d8
MD5 635294e415fad1128dcf2479c0514546
SHA1 0664641c1650250b89c718f9bf117446a783918e
SHA512 4717cb3c679c116682024ab446a28cca0222becc9886169d622b88a8dde8f65533fe6101226441031090572a6c565da500bea0c250687966d593027309cc6fd0
SSDEEP 98304:jdDGGmTz9dn6LFOjx1nbI8dA3hZ4sctQz:J69dn6LFOjx1nbte8VQz
TLSH
T148369DD330E521A8C527D57A8743E61FD6AF707A0B35D9C76288961A6E63CC03E38F25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
prestige_game.dll

File Explorer

prestige_game.dll

.dll 4.7MB

prestige_game.dll

IMPHASH 12acc18d5b394d2cddd1ff233be428be
SHA256 a28b5d1b4ec826607d1b429c82fe57c2d3a322e5799781486b19e64b07bd54d8
MD5 635294e415fad1128dcf2479c0514546
SHA1 0664641c1650250b89c718f9bf117446a783918e
SHA512 4717cb3c679c116682024ab446a28cca0222becc9886169d622b88a8dde8f65533fe6101226441031090572a6c565da500bea0c250687966d593027309cc6fd0
SSDEEP 98304:jdDGGmTz9dn6LFOjx1nbI8dA3hZ4sctQz:J69dn6LFOjx1nbte8VQz
TLSH
T148369DD330E521A8C527D57A8743E61FD6AF707A0B35D9C76288961A6E63CC03E38F25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

19:e7:86:26:48:31:b8:07:a9:26:b7:5a:b7:80:4a:0f:d5:be:8e:4b:6b:76:8b:de:e9:c0:16:b4:6e:7b:43:3c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Prestige Software Development,O=Prestige Software Development,ST=Limburg,C=NL

Chains

Aug 30, 2026

CN=Prestige Software Development,O=Prestige Software Development,ST=Limburg,C=NL

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Subject

CN=Prestige Software Development,O=Prestige Software Development,ST=Limburg,C=NL

Serial Number

64:b9:69:25:18:a7:1e:22:97:5b:cb:85:52:0f:1f:20

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 18, 2026 - Aug 18, 2027

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1340780

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\vikkn\Documents\Prestige Software Development\Prestige-Injector\x64\DLL\PrestigeInjector.pdb

ws2_32

htonl ioctlsocket getaddrinfo freeaddrinfo sendto listen accept recvfrom gethostname select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername connect bind WSACleanup WSAStartup ntohs WSAGetLastError WSASetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt

wldap32

ord30 ord79 ord35 ord33 ord200 ord32 ord27 ord143 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord301

crypt32

CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CryptDecodeObjectEx CertOpenStore CryptStringToBinaryA PFXImportCertStore CertFreeCertificateContext CertAddCertificateContextToStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension

normaliz

IdnToAscii IdnToUnicode

kernel32

InitOnceComplete GetFileInformationByHandleEx AreFileApisANSI GetTempPathW SetFileInformationByHandle GetFileAttributesExW GetLastError GetProcAddress FreeLibrary MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency VerSetConditionMask QueryPerformanceCounter WriteProcessMemory WriteFile WaitForSingleObject CreateFileW CreateToolhelp32Snapshot GetExitCodeThread Sleep CloseHandle Module32FirstW VirtualProtectEx VirtualAllocEx ReadProcessMemory CreateRemoteThread Module32NextW GetFileAttributesW GetExitCodeProcess GetCurrentProcess Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread GetThreadContext GetCurrentProcessId GetModuleHandleW OpenThread ReadFile LocalAlloc CreateFileA LocalFree VirtualQueryEx WaitForDebugEvent GetProcessId GetEnvironmentVariableA DebugActiveProcessStop ContinueDebugEvent DebugActiveProcess GetThreadId GetSystemTimeAsFileTime DebugSetProcessKillOnExit GetProcessIdOfThread OpenFileMappingW UnmapViewOfFile OpenProcess GetTickCount64 FlushViewOfFile CreateFileMappingW MapViewOfFile GetProcessTimes TerminateProcess Process32NextW Process32FirstW IsDebuggerPresent CheckRemoteDebuggerPresent GetModuleFileNameW ProcessIdToSessionId CreateProcessW CreateDirectoryA CreateThread QueryFullProcessImageNameW SetLastError GetCurrentThread ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetEvent CreateEventA GetSystemDirectoryA SleepEx FormatMessageW MoveFileExA WaitForSingleObjectEx GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx FindFirstFileW FindClose CreateDirectoryW InitOnceBeginInitialize GetLocaleInfoEx FormatMessageA DisableThreadLibraryCalls InitializeSListHead RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry VirtualFreeEx

user32

RegisterClassExW PostQuitMessage SystemParametersInfoW UpdateWindow SetForegroundWindow GetKeyState GetDesktopWindow TranslateMessage PeekMessageW DispatchMessageW UnregisterClassW CreateWindowExW SetWindowPos DestroyWindow GetWindowRect DefWindowProcW GetWindowTextW GetMessageExtraInfo ShowWindow SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos ReleaseDC SetCursorPos ReleaseCapture IsWindowUnicode SetProcessDPIAware GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient MonitorFromWindow GetWindowThreadProcessId CopyIcon GetClassLongPtrW DestroyIcon DrawIconEx GetWindowTextLengthW IsWindowVisible EnumWindows AllowSetForegroundWindow SendMessageW GetDC

gdi32

CreateDIBSection DeleteObject SelectObject CreateCompatibleDC GetDeviceCaps DeleteDC

advapi32

CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt CryptGenRandom CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegOpenKeyExW RegQueryValueExW OpenThreadToken RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ExtractIconExW ShellExecuteA

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoUninitialize CoSetProxyBlanket

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

imm32

ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

msvcp140

?set_new_handler@std@@YAP6AXXZP6AXXZ@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Strcoll ?id@?$collate@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z _Strxfrm _Cnd_destroy_in_situ _Cnd_broadcast _Cnd_wait _Cnd_register_at_thread_exit ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z _Cnd_init_in_situ ?__ExceptionPtrCreate@@YAXPEAX@Z _Cnd_unregister_at_thread_exit ??0task_continuation_context@Concurrency@@AEAA@XZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?fail@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ??Bios_base@std@@QEBA_NXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z _Mtx_unlock _Thrd_join _Xtime_get_ticks _Thrd_detach _Query_perf_counter _Thrd_id _Thrd_sleep _Cnd_do_broadcast_at_thread_exit _Mtx_init_in_situ _Mtx_lock _Mtx_destroy_in_situ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ??Bid@locale@std@@QEAA_KXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

d3d11

D3D11CreateDeviceAndSwapChain

wtsapi32

WTSSendMessageW

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_destroy_list __current_exception_context __current_exception __C_specific_handler memchr strrchr memcmp __RTDynamicCast memset memmove memcpy _CxxThrowException __std_type_info_name _purecall __std_type_info_compare wcsrchr __std_exception_copy __std_exception_destroy strchr strstr __std_terminate

api-ms-win-crt-stdio-l1-1-0

ftell setvbuf __acrt_iob_func fflush _read _write fclose _fileno _close fseek __stdio_common_vfprintf fsetpos _lseeki64 __stdio_common_vsnprintf_s ungetc fwrite fopen_s _get_stream_buffer_pointers fgetpos fgets fputs feof fgetc _fseeki64 _wfopen __stdio_common_vsprintf __stdio_common_vswprintf fputc _open fread __stdio_common_vsscanf fopen

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-string-l1-1-0

strncmp tolower strspn _wcsicmp isspace strncpy strcspn strpbrk towlower isdigit strcmp _strdup strncpy_s

api-ms-win-crt-heap-l1-1-0

_callnewh _aligned_malloc calloc _aligned_free malloc free realloc

api-ms-win-crt-runtime-l1-1-0

_wassert system terminate _invalid_parameter_noinfo __sys_errlist __sys_nerr _errno _initterm abort _invalid_parameter_noinfo_noreturn _beginthreadex _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit

api-ms-win-crt-convert-l1-1-0

strtod wcstombs strtoll strtol strtoull strtoul atoi

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _stat64 _unlock_file _lock_file _unlink

api-ms-win-crt-time-l1-1-0

_gmtime64 strftime _time64 _mktime64

api-ms-win-crt-environment-l1-1-0

getenv _dupenv_s

api-ms-win-crt-math-l1-1-0

_fdopen _dclass _dsign fmaxf sqrtf acosf ceilf fminf cosf expf fmodf powf sinf lroundf

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

384KB

Virtual Size

384KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

443KB

Virtual Size

454KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vm_sec

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vlizer

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

prestige_game.dll

PE Signature issue

ws2_32

wldap32

crypt32

normaliz

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

imm32

d3dcompiler_47

msvcp140

d3d11

wtsapi32

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic