XComGame[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
XComGame.exe
Size 27.1MB
Sample261030-xtncksfx8q
SHA256 abf4f2681a91c7d12afa1ef7bb6eb54dd412e9006dfa56a10738523c955ee8bf
MD5 45b331025319697cc2adf02d516f8e2a
SHA1 045b44b5098862ddd67402ee3544aefb5e20a257
SHA512 3f37e0aae5c60023fdeb9f0666292ddedc8d397d55d9358bb68dfe494da3120e6f2321d5c52c3338ea6db9875949b16ddddcb20ac88f9762ab88c8a66aba9e90
SSDEEP 196608:zMMjintuGJhgk0cxqoN2SDptMn7eMp0LwjCOgRJ2noOhjPSXuW4:DktuyxSSDDk7eMp28noOhjSu
TLSH
T152577D0197EF40B6EA6B37B538B5672FD226F3160B2842C7C3501E564C717D0AA7A36B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XComGame.exe

File Explorer

XComGame.exe

.exe 27.1MB

XComGame.exe

IMPHASH f8468cf7a1ac7791e0c7ff2e296b9407
SHA256 abf4f2681a91c7d12afa1ef7bb6eb54dd412e9006dfa56a10738523c955ee8bf
MD5 45b331025319697cc2adf02d516f8e2a
SHA1 045b44b5098862ddd67402ee3544aefb5e20a257
SHA512 3f37e0aae5c60023fdeb9f0666292ddedc8d397d55d9358bb68dfe494da3120e6f2321d5c52c3338ea6db9875949b16ddddcb20ac88f9762ab88c8a66aba9e90
SSDEEP 196608:zMMjintuGJhgk0cxqoN2SDptMn7eMp0LwjCOgRJ2noOhjPSXuW4:DktuyxSSDDk7eMp28noOhjSu
TLSH
T152577D0197EF40B6EA6B37B538B5672FD226F3160B2842C7C3501E564C717D0AA7A36B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15643978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\f8dad38555ce5470\branches\UE3_XComPC\Binaries\Win32\XComGame-RETAIL.pdb

iphlpapi

GetAdaptersInfo

ws2_32

sendto send recvfrom recv setsockopt getsockopt WSACleanup gethostbyname inet_addr accept ntohl getsockname ioctlsocket select ntohs socket gethostname WSAStartup listen htonl htons closesocket WSAGetLastError bind connect

common

SteamGameServer SteamMatchmaking SteamNetworking SteamApps SteamMatchmakingServers SteamGameServer_Shutdown SteamRemoteStorage SteamAPI_RegisterCallback SteamAPI_Shutdown SteamAPI_UnregisterCallback SteamAPI_UnregisterCallResult SteamAPI_RegisterCallResult SteamGameServer_BSecure SteamFriends SteamUser SteamUtils SteamGameServer_GetSteamID SteamAPI_RestartAppIfNecessary SteamAPI_Init SteamUserStats SteamGameServer_Init SteamGameServerStats SteamGameServerNetworking SteamGameServerUtils SteamAPI_RunCallbacks SteamGameServer_RunCallbacks

dinput8

DirectInput8Create

xinput1_3

ord3 ord2

wininet

InternetSetStatusCallbackW InternetCrackUrlW InternetConnectW HttpOpenRequestW HttpSendRequestW InternetQueryOptionW InternetSetOptionW InternetReadFile InternetCloseHandle InternetOpenW

d3d9

D3DPERF_EndEvent Direct3DCreate9 D3DPERF_SetOptions D3DPERF_BeginEvent

d3dcompiler_43

D3DPreprocess D3DReflect D3DCompile

d3dx9_43

D3DXCreateMesh D3DXPreprocessShader D3DXUVAtlasPack D3DXMatrixInverse D3DXCompileShader D3DXDisassembleShader D3DXCreateBuffer D3DXUVAtlasPartition D3DXCleanMesh D3DXDebugMute D3DXCheckVersion

d3dx11_43

D3DX11CheckVersion

opengl32

wglDeleteContext wglMakeCurrent wglShareLists wglCreateContext wglGetProcAddress

x3daudio1_7

X3DAudioCalculate X3DAudioInitialize

xapofx1_5

CreateFX

nvtt

?errorString@nvtt@@YAPBDW4Error@1@@Z ??0InputOptions@nvtt@@QAE@XZ ??1CompressionOptions@nvtt@@QAE@XZ ??1InputOptions@nvtt@@QAE@XZ ??0OutputOptions@nvtt@@QAE@XZ ??0Compressor@nvtt@@QAE@XZ ?setTextureLayout@InputOptions@nvtt@@QAEXW4TextureType@2@HHH@Z ?setMipmapGeneration@InputOptions@nvtt@@QAEX_NH@Z ?setMipmapData@InputOptions@nvtt@@QAE_NPBXHHHHH@Z ?setGamma@InputOptions@nvtt@@QAEXMM@Z ?setWrapMode@InputOptions@nvtt@@QAEXW4WrapMode@2@@Z ?setFormat@InputOptions@nvtt@@QAEXW4InputFormat@2@@Z ?setFormat@CompressionOptions@nvtt@@QAEXW4Format@2@@Z ?setQuality@CompressionOptions@nvtt@@QAEXW4Quality@2@@Z ?setColorWeights@CompressionOptions@nvtt@@QAEXMMMM@Z ?enableCudaAcceleration@Compressor@nvtt@@QAEX_N@Z ??0CompressionOptions@nvtt@@QAE@XZ ?setNormalMap@InputOptions@nvtt@@QAEX_N@Z ??1OutputOptions@nvtt@@QAE@XZ ??1Compressor@nvtt@@QAE@XZ ?process@Compressor@nvtt@@QBE_NABUInputOptions@2@ABUCompressionOptions@2@ABUOutputOptions@2@@Z ?setErrorHandler@OutputOptions@nvtt@@QAEXPAUErrorHandler@2@@Z ?setOutputHandler@OutputOptions@nvtt@@QAEXPAUOutputHandler@2@@Z ?setOutputHeader@OutputOptions@nvtt@@QAEX_N@Z ?estimateSize@Compressor@nvtt@@QBEHABUInputOptions@2@ABUCompressionOptions@2@@Z

libvorbisfile

ov_pcm_seek_page ov_read ov_open_callbacks ov_info ov_pcm_total ov_time_total ov_clear

dbghelp

SymGetLineFromAddr64 SymGetSymFromAddr64 SymGetModuleInfo64 SymGetOptions SymSetOptions SymInitialize SymSetSearchPath SymLoadModule64 SymGetModuleInfoW64 MiniDumpWriteDump SymGetModuleBase64 StackWalk64 SymFunctionTableAccess64

winmm

timeBeginPeriod timeGetTime

kernel32

GlobalAlloc LocalAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter HeapSetInformation DecodePointer EncodePointer GetLocaleInfoW FormatMessageA SetErrorMode OutputDebugStringA CreateMutexA IsProcessorFeaturePresent CompareStringA OpenEventA HeapDestroy HeapCreate GetWindowsDirectoryW LoadLibraryA OpenFileMappingA GetSystemDirectoryW GetCurrentDirectoryW RemoveVectoredExceptionHandler GetStartupInfoW GetModuleFileNameA CreateEventA MapViewOfFile CreateFileA FileTimeToSystemTime CreateSemaphoreA AddVectoredExceptionHandler CreateFileMappingA UnmapViewOfFile GetEnvironmentStringsW ReleaseSemaphore GetModuleHandleExA SetLastError OpenFileById GetComputerNameA GetModuleHandleA GetFileInformationByHandleEx GetTimeZoneInformation GetSystemTimeAsFileTime lstrcmpiW HeapSize VirtualQuery GetProcessHeap HeapAlloc GetFileInformationByHandle GetTickCount HeapFree CreateMutexW ReleaseMutex VirtualFree VirtualAlloc GetProcessAffinityMask SetProcessAffinityMask IsDebuggerPresent GetCommandLineW GetTempPathW GetFullPathNameW SetDllDirectoryW GetProcessId CreateProcessW GetSystemInfo GlobalMemoryStatusEx CreateThread LocalFree QueryPerformanceCounter InterlockedDecrement InterlockedExchangeAdd DeleteCriticalSection EnterCriticalSection TryEnterCriticalSection LeaveCriticalSection MultiByteToWideChar lstrlenA LockResource SizeofResource LoadResource FindResourceW CloseHandle SetCurrentDirectoryW GetFileSize CreateFileW GetLastError CreateDirectoryW GetFileTime SystemTimeToFileTime GetSystemTime SetFilePointer GetCurrentProcess WideCharToMultiByte lstrlenW SetCriticalSectionSpinCount InitializeCriticalSection ReadFile DeleteFileW SetFileAttributesW GetFileAttributesW GetFileSizeEx WriteFile CopyFileW MoveFileW Sleep FindClose FindNextFileW FindFirstFileW DuplicateHandle OpenProcess GetFileType GetVersionExW RemoveDirectoryW GetCurrentThread InterlockedIncrement InterlockedCompareExchange TlsAlloc TlsSetValue QueryPerformanceFrequency TlsFree VerifyVersionInfoW VerSetConditionMask RtlCaptureStackBackTrace RtlCaptureContext GetFullPathNameA OutputDebugStringW RaiseException GetProcAddress GetModuleHandleW SetThreadIdealProcessor ExitProcess GetConsoleScreenBufferInfo GetConsoleWindow SetConsoleCtrlHandler GetCurrentThreadId FlushFileBuffers SetStdHandle GetCurrentProcessId SetEvent OpenEventW FreeConsole SetConsoleScreenBufferSize GetStdHandle AllocConsole WriteConsoleW SetConsoleTextAttribute SetConsoleTitleW WaitForSingleObject PulseEvent CreateEventW ResetEvent InterlockedExchange ResumeThread SuspendThread SetThreadPriority FormatMessageW GlobalUnlock GlobalLock TlsGetValue LoadLibraryW FreeLibrary GetLocalTime TerminateProcess GetExitCodeProcess GetModuleFileNameW GetComputerNameW GetEnvironmentVariableW

user32

GetWindowLongW GetClipCursor DestroyWindow CallNextHookEx GetForegroundWindow GetCursorInfo AdjustWindowRectEx EnumDisplaySettingsW ChangeDisplaySettingsW ReleaseDC GetFocus IsIconic GetCursorPos SetCursorPos SetCapture GetDC GetCapture SetFocus SetActiveWindow GetWindowThreadProcessId MessageBoxA GetKeyboardState ToUnicodeEx GetWindowInfo MapVirtualKeyW GetKeyboardLayoutList ActivateKeyboardLayout ClientToScreen LoadCursorW RegisterClassW LoadImageW GetMessageW UnregisterClassW BeginPaint DrawStateW MapWindowPoints EndPaint PostMessageW SetRectEmpty DialogBoxParamW LoadIconW RegisterClassExW ShowWindow ScreenToClient SetWindowTextW GetTopWindow SetForegroundWindow RegisterHotKey UnregisterHotKey EndDialog GetSystemMetrics SystemParametersInfoW GetClipboardData MonitorFromWindow GetMonitorInfoW SetWindowLongW GetWindowPlacement SetWindowPlacement UpdateWindow TranslateMessage DispatchMessageW ShowOwnedPopups MessageBoxW SendInput GetDlgItem SetDlgItemTextW PeekMessageW DefWindowProcW GetActiveWindow OpenClipboard EmptyClipboard SetClipboardData CloseClipboard ShowCursor ReleaseCapture ClipCursor SetWindowPos GetWindowRect PostQuitMessage GetKeyboardLayoutNameA GetKeyboardLayout SetCursor SetWindowsHookExW UnhookWindowsHookEx GetKeyState PostThreadMessageW GetClientRect AdjustWindowRect InvalidateRect CreateWindowExW

gdi32

ChoosePixelFormat SetPixelFormat SwapBuffers GetStockObject GetObjectW CreateFontIndirectW DeleteObject SetBkColor CreateCompatibleBitmap GetDIBits SetTextColor CreateDCA SelectObject SetBkMode DeleteDC GetTextExtentPoint32W CreateCompatibleDC TextOutW

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey InitializeSecurityDescriptor SetSecurityDescriptorDacl GetUserNameW AdjustTokenPrivileges RegQueryInfoKeyW RegEnumKeyExA RegOpenKeyExA LookupPrivilegeValueW OpenProcessToken

shell32

CommandLineToArgvW ShellExecuteW SHGetFolderPathW ord680

ole32

CoFreeUnusedLibraries CoUninitialize StringFromGUID2 CoCreateInstance CoInitialize CoSetProxyBlanket CoTaskMemAlloc CoTaskMemFree CoCreateGuid

oleaut32

SysAllocStringByteLen SysStringLen SysFreeString SysAllocString

msvcp100

?_Xlength_error@std@@YAXPBD@Z ?_Orphan_all@_Container_base0@std@@QAEXXZ ?_Xout_of_range@std@@YAXPBD@Z

msvcr100

_strdup _fseeki64 ftell fclose fread _fpclass _isnan _finite ceil tolower _wmkdir _wtoi64 strstr atof vsprintf_s strncmp _wcstoui64 _snprintf strncpy atoi vswprintf_s sprintf_s _set_invalid_parameter_handler fgets __iob_func fflush _set_purecall_handler _vsnwprintf _vsnprintf memcmp sin cos ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@ABV01@@Z printf _CIsqrt strchr _CIatan2 _CIcos _CIsin _CIlog _CIatan _CItan strrchr strtol _wcsicoll wcscoll strtoul strspn strcspn iswpunct strtod localeconv _strtoui64 _controlfp_s _set_abort_behavior abort swscanf_s _vsnprintf_s _vsnwprintf_s _mktime64 _localtime64_s wprintf wcstoul _stricmp toupper _CIasin _CIacos free malloc strcat_s strcpy_s wcscat_s wcscpy_s qsort strncpy_s wcsncpy_s _wstrtime_s _wstrdate_s exit _wcsnicmp wcschr _wstat64i32 _time64 _gmtime64_s _wutime64 memset _CxxThrowException ldexp __CxxFrameHandler3 wcstod _wtof _wtoi _wcsicmp wcsrchr wcsstr _purecall memcpy memmove rand _CIpow _CIfmod floor frexp wcsncmp srand isdigit _lock _onexit ?terminate@@YAXXZ _except_handler4_common _amsg_exit __getmainargs _cexit _exit _XcptFilter _ismbblead _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _commode _fmode __set_app_type _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ _invoke_watson isspace _itoa_s _errno rewind _wfopen_s fwrite fseek _wstat64 _CIexp _ftime64 isxdigit sscanf_s _unlock _setjmp3 longjmp fprintf _CIlog10 __dllonexit

crypt32

CryptUnprotectData CryptProtectData

binkw32

_BinkShouldSkip@4 _BinkWait@4 _BinkNextFrame@4 _BinkGetRects@8 _BinkPause@8 _BinkSetSoundSystem@8 _BinkRegisterFrameBuffers@8 _BinkOpenXAudio2@4 _BinkGoto@12 _BinkSetSoundTrack@8 _BinkSetIOSize@4 _BinkSetSpeakerVolumes@20 _BinkGetError@0 _BinkDoFrame@4 _BinkGetFrameBuffersInfo@8 _BinkGetRealtime@12 _BinkGetKeyFrame@12 _BinkClose@4 _BinkOpen@8

physxextensions

NxCreateExtension

apexframework_x86

NxCreateApexSDK

powrprof

CallNtPowerInformation

imm32

ImmIsUIMessageW ImmGetDefaultIMEWnd ImmReleaseContext ImmAssociateContext ImmCreateContext ImmDestroyContext ImmSetOpenStatus ImmGetCompositionStringW ImmGetOpenStatus ImmGetIMEFileNameA ImmGetConversionStatus ImmSetConversionStatus ImmNotifyIME ImmSetCandidateWindow ImmSetCompositionWindow ImmGetProperty ImmGetCandidateListW ImmGetVirtualKey ImmSetCompositionStringW ImmAssociateContextEx ImmGetContext

psapi

GetProcessImageFileNameW GetProcessMemoryInfo

faultrep

ReportFault

generic

count=4, id=152, version=20115,

count=12, id=158, productName=VS2010 SP1 build 40219, version=40219,

count=34, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=8, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=6, id=156, version=21202,

count=6, id=156, productName=VS2010 build 30319, version=30319,

count=40, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=171, productName=VS2010 build 30319, version=30319,

count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=7, id=109, productName=VS2005 build 50727, version=50727,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=49, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=9, id=123, productName=VS2005 build 50727, version=50727,

count=690, id=1, productName=Unmarked objects,

count=1, id=125, productName=VS2005 build 50727, version=50727,

count=29, id=110, productName=VS2005 build 50727, version=50727,

count=1, id=124, productName=VS2005 build 50727, version=50727,

count=284, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=2, productName=Unmarked objects (old),

count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,