SporeApp[.]exe | Triage™

Resubmissions

01/11/2026, 21:55

261101-1svbaadv5z3

01/11/2026, 21:54

261101-1sjjsadv413

Sharing

Copy URL Twitter E-mail

General

Target
SporeApp.exe
Size 23.7MB
Sample261101-1sjjsadv41
SHA256 99e5de9e5891421e518526080671844775198e0b6b125e8b71d54df821ce03c1
MD5 32aad7cad752048c9686ff9eb924263d
SHA1 b3c6b8554c6c3c1d521939ca8fd422451446a501
SHA512 b5587c07875702e1538dc5fa873863db7d8dd66ecfb8a24df3f06ab74bbe193f9e5a214aa11eeed4d5679d038342c1e137d2d5fddbd4ffa111be9a578d12c95a
SSDEEP 393216:DABHbrbozHTWZCljrLlzJ5Ud7sghGy3W7KJ0JY+/hVhQasHAliiiiiiiiiiiiiig:DlTWsIhL2Rziiiiiiiiiiiiiiiiiiif
TLSH
T1DC479E05A2E7C0F4D41535B9B0AA7E6BD5297F508F2846C3AFE43E4FEAB05C059F6242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SporeApp.exe

File Explorer

SporeApp.exe

.exe 23.7MB

SporeApp.exe

IMPHASH 112f956e17464540656faf37b6672eed
SHA256 99e5de9e5891421e518526080671844775198e0b6b125e8b71d54df821ce03c1
MD5 32aad7cad752048c9686ff9eb924263d
SHA1 b3c6b8554c6c3c1d521939ca8fd422451446a501
SHA512 b5587c07875702e1538dc5fa873863db7d8dd66ecfb8a24df3f06ab74bbe193f9e5a214aa11eeed4d5679d038342c1e137d2d5fddbd4ffa111be9a578d12c95a
SSDEEP 393216:DABHbrbozHTWZCljrLlzJ5Ud7sghGy3W7KJ0JY+/hVhQasHAliiiiiiiiiiiiiig:DlTWsIhL2Rziiiiiiiiiiiiiiiiiiif
TLSH
T1DC479E05A2E7C0F4D41535B9B0AA7E6BD5297F508F2846C3AFE43E4FEAB05C059F6242
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14553569

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\BuildAgent\max-spore001-spore\CMBuild\SporeEP1_RL\out\Win32\Release\SporeApp.pdb

winmm

timeEndPeriod timeBeginPeriod timeGetTime

wsock32

send listen connect accept getsockname getsockopt __WSAFDIsSet select recv ioctlsocket gethostbyname closesocket WSAStartup WSACleanup WSAGetLastError sendto recvfrom inet_ntoa socket bind shutdown getpeername setsockopt

psapi

GetModuleInformation

steam_api

SteamApps SteamAPI_Shutdown SteamAPI_Init

kernel32

GlobalMemoryStatusEx QueryPerformanceFrequency SetThreadPriority SetPriorityClass GetPriorityClass GetThreadPriority GetCurrentThread SetThreadAffinityMask GetProcessAffinityMask GetProcAddress GetModuleHandleA CloseHandle DeviceIoControl CreateFileA LocalFree LocalAlloc GetModuleFileNameA GetSystemInfo GetVersionExA FreeLibrary LoadLibraryA GetComputerNameExA CompareStringW LCMapStringW InterlockedIncrement InterlockedDecrement GetSystemDirectoryW GetVersionExW IsDebuggerPresent SetProcessAffinityMask OpenProcess GetCurrentProcessId SetThreadExecutionState GetLocaleInfoW SetLastError EnumResourceNamesA GetSystemDefaultLCID GetWindowsDirectoryW GetTickCount VirtualQuery ResumeThread GetCurrentThreadId CreateEventA FormatMessageA FlushFileBuffers TerminateProcess SetUnhandledExceptionFilter GetComputerNameA SystemTimeToFileTime GetSystemTime GetModuleFileNameW OutputDebugStringA GetExitCodeThread TlsAlloc TlsSetValue DuplicateHandle SetThreadIdealProcessor SleepEx CreateMutexA WaitForSingleObject TryEnterCriticalSection ReleaseMutex InterlockedExchangeAdd InterlockedCompareExchange CreateSemaphoreA ReleaseSemaphore InterlockedExchange TlsFree RaiseException QueueUserAPC CreateThread HeapAlloc GetProcessHeap HeapFree InitializeCriticalSectionAndSpinCount VirtualFree VirtualAlloc GetSystemTimeAsFileTime GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetVersion GetModuleHandleW FindFirstFileW FindNextFileW FindClose SetEvent CancelIo GetLongPathNameW WaitForMultipleObjectsEx FindCloseChangeNotification FindNextChangeNotification WaitForMultipleObjects FindFirstChangeNotificationW CreateFileW GetVolumeInformationW MultiByteToWideChar WideCharToMultiByte GetLastError GetFileSize SetEndOfFile SetFilePointer ReadFile WriteFile GetFileAttributesW DeleteFileW MoveFileExW CopyFileW SetFileAttributesW GetTempPathW GetVolumePathNameW CreateDirectoryW GetFullPathNameW RemoveDirectoryW SetEnvironmentVariableA GetEnvironmentVariableA LoadLibraryW GetACP GetFullPathNameA GetProcessTimes GetCommandLineA Sleep MoveFileA CreateDirectoryA RemoveDirectoryA GetCurrentDirectoryA UnhandledExceptionFilter GetStartupInfoA FlushConsoleInputBuffer FindFirstFileA FindNextFileA GlobalMemoryStatus GetStdHandle GetFileType QueryPerformanceCounter TlsGetValue GetDiskFreeSpaceExA GetVolumeInformationA GetDriveTypeA GetLogicalDrives InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection DeleteFileA GetCurrentProcess

user32

SetWindowLongW CreateWindowExW SetWindowPos GetWindowLongA GetSystemMetrics GetClientRect SetWindowTextW DestroyWindow GetDesktopWindow IsDlgButtonChecked CheckDlgButton GetDoubleClickTime wsprintfA RegisterClassA CreateWindowExA SetClipboardViewer IsClipboardFormatAvailable GetClipboardData TranslateMessage EmptyClipboard SetClipboardData CloseClipboard ChangeClipboardChain wsprintfW GetCursorPos GetKeyboardState DefWindowProcA PeekMessageA GetKeyboardLayout RegisterClassExW SetTimer SetCursor SetCursorPos IntersectRect ReleaseCapture SetCapture GetMenu AdjustWindowRectEx MoveWindow BeginPaint EndPaint EnumDisplayMonitors PeekMessageW DispatchMessageW ClientToScreen KillTimer UnregisterClassA GetKeyState PostMessageA ShowCursor GetWindowRect MonitorFromWindow IsZoomed GetAncestor IsIconic IsWindowVisible SetActiveWindow GetActiveWindow FillRect UpdateWindow ValidateRect InvalidateRect LoadIconA DestroyCursor GetIconInfo LoadImageW UnhookWindowsHookEx SetWindowsHookExA GetAsyncKeyState CallNextHookEx GetForegroundWindow GetWindowThreadProcessId GetMonitorInfoA ScreenToClient SendMessageA LoadCursorA SetWindowLongA SetFocus DefWindowProcW GetDC ReleaseDC SystemParametersInfoA GetProcessWindowStation GetUserObjectInformationW ShowWindow MessageBoxW MessageBoxA OpenClipboard PostQuitMessage

gdi32

CreateSolidBrush DeleteObject ExtEscape DeleteDC GetDeviceCaps CreateDCA

advapi32

GetUserNameW RegQueryValueExA RegOpenKeyExA RegSetValueExA RegEnumKeyExW RegQueryValueExW RegisterEventSourceA ReportEventA DeregisterEventSource RegOpenKeyExW RegCloseKey GetUserNameA

shell32

SHGetFolderPathW DragQueryFileW ShellExecuteW

ole32

OleInitialize RegisterDragDrop RevokeDragDrop CoLockObjectExternal OleUninitialize ReleaseStgMedium

msvcr90

tolower _controlfp_s _invoke_watson ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common _time32 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _initterm _acmdln _ismbblead _XcptFilter _exit _cexit __getmainargs _amsg_exit ?terminate@@YAXXZ _decode_pointer _onexit _lock _encode_pointer __dllonexit _unlock _getch signal isupper strcmp vfprintf ldexp vsprintf _aligned_free _aligned_malloc wcsncat _control87 wcscspn strncat _controlfp _ultoa _strlwr fputs _isnan _finite _searchenv _wsearchenv _spawnv _wspawnv _strtoui64 _wgetcwd _wstat64i32 _getdrive _wgetdcwd _fcvt _ecvt _beginthreadex _mktime64 strftime _localtime64 strtol strpbrk isprint atof atoi towupper setlocale _setmbcp _wcslwr _ltow strrchr _gmtime64 abort _snprintf ftell fflush _vsnprintf _errno ferror longjmp getenv tmpfile fseek _setjmp3 _ltoa fgets _stat64i32 strspn strcspn wcsrchr __iob_func _aligned_realloc exit _purecall _CIcos _CIsin _CIsqrt memset memcpy memmove _CIasin _CIfmod _CIacos fclose fprintf fopen fwrite sprintf _CIpow wcstoul _ultow strtod _CIlog floor ceil modf __CxxFrameHandler3 atol isdigit _strnicmp _CxxThrowException sscanf _stricmp swscanf wcstol wcsncmp _wtol wcsncpy strncpy strtoul strncmp toupper strchr isspace _wcsicmp isalnum wcstod isalpha wcsstr wcschr _wcsnicmp towlower iswctype isxdigit memchr strstr printf qsort _except_handler3 fread feof free realloc malloc _time64 rand _crt_debugger_hook

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA VerQueryValueW GetFileVersionInfoW

d3dx9_27

D3DXVec3Transform D3DXVec3TransformNormal D3DXCheckVersion D3DXGetPixelShaderProfile D3DXGetVertexShaderProfile D3DXMatrixMultiplyTranspose D3DXMatrixTranspose D3DXMatrixMultiply D3DXCompileShader

dinput8

DirectInput8Create

imm32

ImmDisableTextFrameService ImmGetCompositionStringW ImmSetCompositionStringW ImmNotifyIME ImmSetOpenStatus ImmSimulateHotKey ImmReleaseContext ImmGetConversionStatus ImmGetContext ImmGetOpenStatus ImmGetCandidateListW ImmSetConversionStatus

usp10

ScriptItemize ScriptBreak

dbghelp

UnDecorateSymbolName SymLoadModule64 SymInitialize SymSetOptions SymCleanup SymGetSymFromAddr64 SymGetLineFromAddr64

ws2_32

WSAIoctl WSASetLastError WSASocketA

dsound

ord1 ord9

d3d9

Direct3DCreate9

Name

.text

Size

15.8MB

Virtual Size

15.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

787KB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

13B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CONST

Size

512B

Virtual Size

31B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

916KB

Virtual Size

916KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=110, productName=VS2005 build 50727, version=50727,

count=1, id=5, version=8447,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=150, version=20413,

count=5, id=109, productName=VS2005 build 50727, version=50727,

count=24, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=123, productName=VS2005 build 50727, version=50727,

count=8, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=558, id=1, productName=Unmarked objects,

count=546, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=461, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1880, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,