Five.Nights.at.Freddys.v1.132.zip
- SHA256 d52e507caa1d7c8cfe9f9738ea10c5e24f85b4abc0500d1af0818b841f21bf37
Static task
static1
2 signatures
General
- Target Five.Nights.at.Freddys.v1.132.zip
- Size 219.5MB
- Sample261024-vd1a4acy4n
- SHA256 d52e507caa1d7c8cfe9f9738ea10c5e24f85b4abc0500d1af0818b841f21bf37
- MD5 1ea572a69779ca3283c4d6de09f8306d
- SHA1 3aaf0526a6ee36d408c1aef3d1863b6ce0c551b1
- SHA512 6d5c70e7d0d9134029c3919d1dd862409849f7919e85aad27f6829f3dc2c978643649934d42a1c1746d133db0633865a0417f9ab32f8958e1cffb058ebb6f166
- SSDEEP 6291456:Wt4baAhLt4sS6WT2lT5Q6bXgLqal85OJrJq6:Pa0pFN5QIQLqal85OJc6
- TLSH T167B833D970F9AC9495B3F19897E42E800EED612421438CED371E2ADD46E5FC2DEAE4C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Five.Nights.at.Freddys.v1.132/Five Nights at Freddy's/FiveNightsatFreddys.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Five.Nights.at.Freddys.v1.132/_Redist/dxwebsetup.exe
File Explorer
-
Five.Nights.at.Freddys.v1.132.zip.zip 219.5MB
-
Five.Nights.at.Freddys.v1.132/Five Nights at Freddy's/FiveNightsatFreddys.exe.exe 220.7MB
-
Five.Nights.at.Freddys.v1.132/HOW TO RUN GAME!!.txt215B
-
Five.Nights.at.Freddys.v1.132/_Redist/dxwebsetup.exe.exe 285KB
Five.Nights.at.Freddys.v1.132/Five Nights at Freddy's/FiveNightsatFreddys.exe
- IMPHASH 3a597e7b3ec8a722b64745095a57f9bb
- SHA256 862cd7ab7c81b20a4e848888bc2493dda0181759c39958a42cc5c3d02dfb195a
- MD5 d926fee3666c1c854a475a9766ad7ff7
- SHA1 6459df8e4ae6d8b4dd77273f6337bd77874a8276
- SHA512 0e5ff32ab864651e8dc54ca9488394d619316cf6bb1678f82cee758b0a5f973f3f436abeed1eac5dfbed6c7473c0d986cc317d0c8eaa34b4f98a1539440cec25
- SSDEEP 6291456:f/aRHk3y95IDXNBvbYrQOKKtE8DDY+XA+WKqg4Zn4XEboaN0yG:f/a23y95OXzMQOK2dXA+TqJn4XEboaZG
- TLSH T161B833A170D0B452E1E3A03286B5ED796B799821073344EB07D51FDB7DB5AC2EF3A482
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
456646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
ord17
winmm
timeBeginPeriod
joyGetDevCapsW
joyGetPosEx
timeGetTime
timeEndPeriod
kernel32
GetTempFileNameW
GlobalAddAtomW
GlobalDeleteAtom
GetModuleHandleW
lstrlenW
GetLocaleInfoA
LockResource
VirtualProtect
VirtualQuery
SetLastError
LoadResource
SizeofResource
FindResourceA
FindResourceW
IsBadReadPtr
IsBadWritePtr
SetFilePointerEx
OutputDebugStringW
LoadLibraryExW
GetConsoleMode
GetConsoleCP
LeaveCriticalSection
EnterCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
DeleteCriticalSection
GetVersionExW
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
InterlockedIncrement
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcessHeap
GetStdHandle
GetModuleHandleExW
ExitProcess
InterlockedDecrement
RtlUnwind
GetCommandLineA
HeapSize
HeapCompact
SetEnvironmentVariableW
HeapReAlloc
DeleteFileW
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
HeapFree
HeapAlloc
LoadLibraryExA
InterlockedExchange
RaiseException
GetVersion
GlobalFree
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTime
GetTempPathW
FindClose
FindNextFileW
FindFirstFileW
GetCurrentDirectoryW
SetErrorMode
WideCharToMultiByte
GlobalUnlock
GlobalLock
GlobalAlloc
GetExitCodeProcess
GetCommandLineW
Sleep
SetCurrentDirectoryW
CreateDirectoryW
CloseHandle
SetFilePointer
WriteFile
GetLastError
ReadFile
CreateFileW
GetCurrentThreadId
RemoveDirectoryW
GetModuleFileNameW
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryW
LCMapStringW
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetFileType
user32
FillRect
GetMenuItemID
GetMenuStringW
ModifyMenuW
GetTabbedTextExtentW
SystemParametersInfoW
DrawEdge
DrawTextW
GetKeyboardLayout
PostQuitMessage
IntersectRect
SetRect
DrawFocusRect
InvertRect
CreateDialogParamA
CreateDialogParamW
CreateDialogIndirectParamA
CreateDialogIndirectParamW
DialogBoxParamA
DialogBoxIndirectParamA
DialogBoxIndirectParamW
LoadMenuA
LoadMenuW
LoadStringA
SetLastErrorEx
EndPaint
BeginPaint
PtInRect
GetDlgItem
MapVirtualKeyW
GetInputState
GetDlgItemTextW
GetUpdateRect
EndDialog
DestroyMenu
LoadMenuIndirectW
GetMenuItemCount
SetWindowPlacement
GetWindowPlacement
GetFocus
CallWindowProcW
RemovePropW
SetPropW
GetPropW
UnionRect
DestroyWindow
SetScrollPos
SetScrollRange
CreateWindowExW
GetParent
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetFocus
GetSysColor
GetDesktopWindow
RedrawWindow
UpdateWindow
SetWindowLongW
MessageBoxW
LoadStringW
DialogBoxParamW
RegisterClassW
RegisterClassExW
LoadImageW
IsIconic
DefMDIChildProcW
SetDlgItemTextW
SendDlgItemMessageW
LoadIconW
GetWindow
GetClassNameW
GetTopWindow
GetMonitorInfoW
MonitorFromWindow
GetSystemMetrics
OemToCharA
GetAsyncKeyState
GetActiveWindow
ShowCursor
SetCapture
ReleaseCapture
GetKeyState
GetWindowRect
MapWindowPoints
SetWindowPos
IsZoomed
GetWindowLongW
AdjustWindowRectEx
SendMessageW
LockWindowUpdate
IsWindowVisible
GetClientRect
SetWindowTextW
IsDialogMessageW
SetTimer
GetClipboardData
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
IsClipboardFormatAvailable
wsprintfW
ShowWindow
PostMessageW
CheckMenuItem
EnableMenuItem
GetMenu
InvalidateRect
SetCursorPos
ClientToScreen
ScreenToClient
GetCursorPos
GetKeyboardState
CopyRect
UnhookWindowsHookEx
KillTimer
SetWindowsHookExW
CallNextHookEx
DestroyIcon
GetSubMenu
DeleteMenu
GetMenuState
ReleaseDC
CreateIconIndirect
GetDC
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
TranslateMDISysAccel
GetMessageW
PeekMessageW
DrawMenuBar
gdi32
CreatePalette
GetDeviceCaps
SelectPalette
RealizePalette
GetObjectW
CreateFontIndirectW
CreatePen
Rectangle
SelectObject
MoveToEx
LineTo
CreateSolidBrush
GetStockObject
SetTextColor
SetBkMode
DeleteObject
GetClipRgn
ExcludeClipRect
SelectClipRgn
GetTextExtentPointW
TextOutW
SetTextAlign
SetROP2
GetNearestPaletteIndex
SetPolyFillMode
DPtoLP
SetBkColor
Polygon
CreateHatchBrush
GetCharWidthW
LPtoDP
GetTextMetricsW
SetDIBits
CreateCompatibleBitmap
CreateRectRgn
CreateBitmap
comdlg32
GetOpenFileNameW
GetSaveFileNameW
shell32
DragQueryFileW
DragAcceptFiles
ShellExecuteExW
Name
.text
Size
528KB
Virtual Size
527KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
129KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
23KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
296KB
Virtual Size
296KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=199, version=41118,
count=63, id=205, version=50929,
count=166, id=206, version=50929,
count=61, id=207, version=50929,
count=5, id=206, productName=VS2012 UPD3 build 60610, version=60610,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=626, id=1, productName=Unmarked objects,
count=8, id=207, productName=VS2012 UPD3 build 60610, version=60610,
count=36, id=211, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
Five.Nights.at.Freddys.v1.132/HOW TO RUN GAME!!.txt
- SHA256 3edb509fccf8f7f0fbb7355ec0d2e9bb9aaf92c6e2e5529103f7cbaf27a9b658
- MD5 562a018d5b9f880623cfcbddf948f1ec
- SHA1 2286f27d0920b69b8891f21f331ae82ca0767983
- SHA512 6c16f70733e08079b2240a9d361a880516fa6970285e9c84ed2a9a2ee9b9b772d2c744f24a5efaff1785e30770de1118ef6ad47a10e1df9c14fdf612fa5e5251
- TLSH T1CAD023FEFD9003D57940D043337A1C8D5514C45975108DC43CB4C264835E46386785E5
- MD5 SHA1 SHA512 TLSH
Five.Nights.at.Freddys.v1.132/_Redist/dxwebsetup.exe
- IMPHASH 1494de9b53e05fc1f40cb92afbdd6ce4
- SHA256 34f64699d4830145cae69bd40115b1f326e70fc6a98456cb3df996d947dddca4
- MD5 bcbb7c0cd9696068988953990ec5bd11
- SHA1 3c8243734cf43dd7bb2332ba05b58ccacfa4377c
- SHA512 551a2e3aa5fc7c0e79c3bd7c5333df5f1920ea83fe35b99adbbe865ea926fa772d72709bde2ea8f2685f4914cd96ff7b5b6f894f9b99f1120c2abe89c390a786
- SSDEEP 6144:3WK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQ43:mcvgLARDI1KIOzOR3
- TLSH T13454F15197E4817BE4FA1B351DF2025327797DA8ACB9E33E938618881D70380BE75B27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
25:ba:f7:87:7a:93:e9:f2:77:9a:d0:d8:84:ae:dd:db:7d:05:48:fb
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 30, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:b2:9b:00:00:00:00:00:15
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 21, 2011 - May 21, 2012
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:a2:30:00:00:00:00:00:08
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
1
Major OS version
5
Entry point
23134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegQueryInfoKeyA
kernel32
LocalFree
LocalAlloc
GetLastError
GetCurrentProcess
GetModuleFileNameA
lstrlenA
GetSystemDirectoryA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
lstrcmpA
FindFirstFileA
lstrcatA
lstrcpyA
_lclose
_llseek
_lopen
WritePrivateProfileStringA
GetWindowsDirectoryA
CreateDirectoryA
GetFileAttributesA
ExpandEnvironmentStringsA
IsDBCSLeadByte
GetShortPathNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcmpiA
GetProcAddress
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
CloseHandle
LoadResource
SizeofResource
FindResourceA
ReadFile
WriteFile
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetCurrentDirectoryA
GetTempFileNameA
ExitProcess
CreateFileA
LoadLibraryExA
lstrcpynA
GetVolumeInformationA
FormatMessageA
GetCurrentDirectoryA
GetVersionExA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetTempPathA
GetSystemInfo
CreateMutexA
SetEvent
CreateEventA
CreateThread
ResetEvent
TerminateThread
GetDriveTypeA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
LockResource
LoadLibraryA
GetDiskFreeSpaceA
MulDiv
EnumResourceLanguagesA
FreeLibrary
GlobalFree
gdi32
GetDeviceCaps
user32
ExitWindowsEx
wsprintfA
CharNextA
CharUpperA
CharPrevA
SetWindowLongA
GetWindowLongA
CallWindowProcA
DispatchMessageA
MsgWaitForMultipleObjects
PeekMessageA
SendMessageA
SetWindowPos
ReleaseDC
GetDC
GetWindowRect
SendDlgItemMessageA
GetDlgItem
SetForegroundWindow
SetWindowTextA
MessageBoxA
DialogBoxIndirectParamA
ShowWindow
EnableWindow
GetDlgItemTextA
EndDialog
GetDesktopWindow
MessageBeep
SetDlgItemTextA
LoadStringA
GetSystemMetrics
comctl32
ord17
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
243KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=13, id=25, version=9210,
count=126, id=1, productName=Unmarked objects,
count=1, id=69, version=9111,
count=24, id=28, version=9178,
count=1, id=61, version=9210,