MW2 Galaxy[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MW2 Galaxy.exe
Size 9.7MB
Sample261030-m5ppnsec64
SHA256 e83612b897e6e9aeb8e437fd649050688ce9ddf8a979c2ecaf4b9b1adc7f848a
MD5 e9104daa4f2ef78d10b57c160447bd3d
SHA1 b4b0990be5bb9438ddcd799b8049b2925352c13d
SHA512 c8b78d27bcd2f037082b9bd255101f8369b9f0a2dcdafa861a679523215f5eb24bd6f2cbc00a7f881629a645f9b25d6c0ea3a7f582bac7b19ac0a8f21c40bb01
SSDEEP 196608:jhxQgOsbP4Wd6uWcWHaz02o3Dt3U2ruCIXIG/Y:VxQgOsbP4WdbFWHaz0L3RHRG/Y
TLSH
T131A68C69F6A800E5D4268178C566F232D6717C1487B007DF2E987BBA2F73AD01E7A70D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MW2 Galaxy.exe

File Explorer

MW2 Galaxy.exe

.exe 9.7MB

MW2 Galaxy.exe

IMPHASH 38e42081781f34401ef0cd98197ca98a
SHA256 e83612b897e6e9aeb8e437fd649050688ce9ddf8a979c2ecaf4b9b1adc7f848a
MD5 e9104daa4f2ef78d10b57c160447bd3d
SHA1 b4b0990be5bb9438ddcd799b8049b2925352c13d
SHA512 c8b78d27bcd2f037082b9bd255101f8369b9f0a2dcdafa861a679523215f5eb24bd6f2cbc00a7f881629a645f9b25d6c0ea3a7f582bac7b19ac0a8f21c40bb01
SSDEEP 196608:jhxQgOsbP4Wd6uWcWHaz02o3Dt3U2ruCIXIG/Y:VxQgOsbP4WdbFWHaz0L3RHRG/Y
TLSH
T131A68C69F6A800E5D4268178C566F232D6717C1487B007DF2E987BBA2F73AD01E7A70D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3665872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\drose\Desktop\mw2 working\new loader\x64\Release\MW2 Galaxy.pdb

bcrypt

BCryptGenRandom

advapi32

CryptSignHashW CryptEnumProvidersW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt DeregisterEventSource RegisterEventSourceW ReportEventW CryptGenRandom CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt

crypt32

CertGetCertificateContextProperty CertOpenSystemStoreW CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertFreeCRLContext CertAddCertificateContextToStore CertFreeCTLContext CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertDuplicateCertificateContext

secur32

InitSecurityInterfaceW

ws2_32

getsockopt listen send WSACreateEvent shutdown getservbyname getservbyport gethostbyaddr inet_ntoa inet_addr gethostbyname gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo WSAEnumNetworkEvents htonl select __WSAFDIsSet WSAIoctl WSASetLastError setsockopt recv getsockname getpeername connect bind accept WSACleanup WSAStartup ntohs socket htons closesocket WSAGetLastError WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSACloseEvent

iphlpapi

if_nametoindex

user32

UnhookWindowsHookEx EnumWindows PostThreadMessageA MessageBoxW GetUserObjectInformationW GetProcessWindowStation GetWindowThreadProcessId SetWindowsHookExA

kernel32

HeapSize WriteConsoleW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage GetTimeZoneInformation SetEndOfFile HeapReAlloc CreateProcessW GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree FlushFileBuffers HeapAlloc GetCommandLineW GetCommandLineA GetModuleFileNameW SetStdHandle SetConsoleCtrlHandler SetFilePointerEx GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread ExitThread ExitProcess VirtualQuery GetFileType LoadLibraryExW InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent DeviceIoControl CreateFileW CloseHandle VirtualFree VirtualAlloc GetCurrentThreadId GetProcAddress GetCurrentProcessId ReadFile GetModuleFileNameA Process32First SetLastError SetConsoleTitleA GetCurrentProcess WriteFile OutputDebugStringA LoadLibraryExA lstrcatA CreateToolhelp32Snapshot Sleep GetLastError GetFileAttributesA Process32NextW CreateFileA LoadLibraryA DeleteFileW Process32Next Process32FirstW LoadLibraryW GetLocalTime GetWindowsDirectoryW Beep FreeLibrary ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection FormatMessageA SleepEx QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx CreateThread GetFullPathNameW MoveFileExW MultiByteToWideChar GetEnvironmentVariableA GetModuleHandleW GetStdHandle RtlUnwind PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW WideCharToMultiByte GetFileSizeEx LocalFree InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetSystemTimeAsFileTime GetEnvironmentVariableW GetSystemInfo VirtualProtect GetACP RtlVirtualUnwind InitializeCriticalSection ReleaseSemaphore WaitForSingleObject GetExitCodeThread CreateSemaphoreA GetSystemDirectoryA GetSystemTime SystemTimeToFileTime FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW GetLocaleInfoEx GetCurrentDirectoryW FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetTickCount64 InitOnceBeginInitialize InitOnceComplete EncodePointer DecodePointer LCMapStringEx

shell32

ShellExecuteW SHGetFolderPathA

ntdll

RtlCaptureContext RtlLookupFunctionEntry

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

MW2 Galaxy.exe

bcrypt

advapi32

crypt32

secur32

ws2_32

iphlpapi

user32

kernel32

shell32

ntdll

generic