Minecraft[.]Client[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Minecraft.Client.exe
Size 11.6MB
Sample261102-3ba77azy4p
SHA256 d9b7594842b02d81c6e2245b8c040bf6113f8209bdd63c94181a2373d658fee9
MD5 ad5788a9ab860f3ba1ef316b6e16815d
SHA1 0f6902a1d0ff4759e367b5df078aa8286aac7938
SHA512 c3353c6cf0d493b4c6f7c9b1d92757957918c4493a51cbcd3f14ff431a8aa5c6148128b3c84a80a3720d80af1e55bb5c04847857df14009dbcf1d8d329f6da05
SSDEEP 49152:hJV9sc4oymdMgvhvuxN+0GirEoKkTr5c9Il4TBH2hNXnex8Xr/OXR1WrOnFJKxDg:h3rhy+0XrEofTr5c9ICErF+yUC4LIBA
TLSH
T1BCC6494A3AA891D4E17BC1BD8A9B8647E6B274554F309BCF0192035E2F33FD45E7B221
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Minecraft.Client.exe

File Explorer

Minecraft.Client.exe

.exe 11.6MB

Minecraft.Client.exe

IMPHASH 2b952f245e3dbddc94c7523625bcf29d
SHA256 d9b7594842b02d81c6e2245b8c040bf6113f8209bdd63c94181a2373d658fee9
MD5 ad5788a9ab860f3ba1ef316b6e16815d
SHA1 0f6902a1d0ff4759e367b5df078aa8286aac7938
SHA512 c3353c6cf0d493b4c6f7c9b1d92757957918c4493a51cbcd3f14ff431a8aa5c6148128b3c84a80a3720d80af1e55bb5c04847857df14009dbcf1d8d329f6da05
SSDEEP 49152:hJV9sc4oymdMgvhvuxN+0GirEoKkTr5c9Il4TBH2hNXnex8Xr/OXR1WrOnFJKxDg:h3rhy+0XrEofTr5c9ICErF+yUC4LIBA
TLSH
T1BCC6494A3AA891D4E17BC1BD8A9B8647E6B274554F309BCF0192035E2F33FD45E7B221
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7170216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\junit\Downloads\minecraft - Copy\x64\Release\Minecraft.Client.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_46

D3DCompile

iggy_w64

IggySetTraceCallbackUTF8 IggyPlayerCallMethodRS IggyPlayerSetDisplaySize IggyPlayerDrawTile IggyPlayerDrawTilesStart IggyPlayerDrawTilesEnd IggyFontInstallBitmapUTF8 IggyFontRemoveUTF8 IggyFontSetIndirectUTF8 IggyPlayerDraw IggyValuePathMakeNameRef IggyValueGetF64RS IggyValueGetBooleanRS IggyValueSetBooleanRS IggyPlayerCreateFromMemory IggyPlayerDestroy IggyPlayerProperties IggyPlayerSetUserdata IggyPlayerInitializeAndTickRS IggyPlayerReadyToTick IggyPlayerTickRS IggyPlayerCreateFastName IggyMakeEventKey IggyPlayerDispatchEventRS IggyDebugGetMemoryUseInfo IggyMakeEventMouseMove IggyFontInstallTruetypeUTF8 IggyFontInstallTruetypeFallbackCodepointUTF8 IggyGDrawMallocAnnotated IggyGDrawFree IggyGDrawSendWarning IggyDiscardVertexBufferCallback IggyPlayerSetFocusRS IggyPlayerGetFocusableObjects IggySetAS3ExternalFunctionCallbackUTF16 IggySetFontCachingCalculationBuffer IggySetTextureSubstitutionCallbacks IggySetCustomDrawCallback IggyPlayerGetUserdata IggyAudioUseDirectSound IggySetWarningCallback IggyLibraryDestroy IggyLibraryCreateFromMemoryUTF16 IggyInit IggySetGDraw IggyPlayerRootPath

mss64

AIL_startup AIL_shutdown AIL_last_error AIL_open_digital_driver AIL_close_digital_driver AIL_set_redist_directory AIL_set_sample_is_3D AIL_set_sample_playback_rate_factor AIL_set_sample_volume_levels AIL_sample_playback_rate AIL_register_falloff_function_callback AIL_open_stream AIL_close_stream AIL_stream_sample_handle MilesSetEventErrorCallback AIL_pause_stream AIL_stream_status AIL_set_3D_rolloff_factor MilesCompleteEventQueueProcessing MilesEnumerateSoundInstances MilesBeginEventQueueProcessing AIL_enqueue_event_end_named AIL_enqueue_event_buffer AIL_enqueue_event_start MilesEnqueueEventByName MilesAddSoundBank MilesStartupEventSystem AIL_enumerate_events AIL_set_listener_3D_orientation AIL_set_listener_3D_position AIL_set_sample_3D_position AIL_set_sample_3D_distances AIL_start_stream

kernel32

GetTimeZoneInformation EnumSystemLocalesEx IsValidLocaleName LCMapStringEx GetUserDefaultLocaleName CompareStringEx GetDateFormatEx GetTimeFormatEx FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount64 GetSystemTimeAsFileTime DeleteFileW FlushFileBuffers TerminateProcess GetCurrentProcess FlsFree FlsSetValue FlsGetValue FlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext ReadConsoleW SetEndOfFile GetConsoleMode GetConsoleCP GetStartupInfoW InitOnceExecuteOnce SetStdHandle FreeLibrary HeapSize GetOEMCP GetACP IsValidCodePage SetLastError LoadLibraryW LoadLibraryExW SetConsoleCtrlHandler AreFileApisANSI IsDebuggerPresent GetCPInfo FatalAppExitA GetCommandLineA IsProcessorFeaturePresent HeapReAlloc GetProcAddress GetModuleHandleW CreateFileW SetFilePointerEx HeapAlloc HeapFree RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader WriteConsoleW GetModuleHandleExW GetFileType GetStdHandle GetLocaleInfoEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW GetProcessHeap SetEnvironmentVariableA VirtualFree VirtualAlloc GlobalMemoryStatus TryEnterCriticalSection RaiseException WaitForMultipleObjects ResumeThread GetExitCodeThread SetThreadPriority GetCurrentThreadId GetCurrentThread CreateEventA ResetEvent GetModuleHandleA EnterCriticalSection LeaveCriticalSection TlsAlloc TlsGetValue TlsSetValue OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection Sleep GetTickCount CreateFileA GetFileSize ReadFile CloseHandle GetLastError WideCharToMultiByte OutputDebugStringW MultiByteToWideChar GetLocalTime GetCurrentDirectoryA InitializeCriticalSectionAndSpinCount DeleteCriticalSection FileTimeToSystemTime GetModuleFileNameA GetSystemTime CreateDirectoryA DeleteFileA FindClose FindFirstFileA FindFirstFileExA FindNextFileA GetFileAttributesA GetFileAttributesExA RemoveDirectoryA WriteFile CopyFileA DebugBreak ExitProcess WaitForSingleObject CreateThread CreateDirectoryW GetModuleFileNameW MoveFileA SystemTimeToFileTime SetEvent

user32

MapVirtualKeyA UpdateWindow BeginPaint EndPaint GetWindowRect AdjustWindowRect GetWindowLongA SetWindowLongA LoadCursorA LoadIconA MonitorFromWindow GetRawInputData GetMonitorInfoA GetClientRect ShowCursor SetCursorPos ClipCursor ClientToScreen RegisterRawInputDevices PostMessageA TranslateMessage DispatchMessageA PeekMessageA DefWindowProcA PostQuitMessage RegisterClassExA CreateWindowExA DestroyWindow ShowWindow SetWindowPos DialogBoxParamA EndDialog GetDlgItemTextA

advapi32

GetUserNameA

ws2_32

inet_addr __WSAFDIsSet accept bind closesocket connect ioctlsocket getpeername getsockopt htons listen recv recvfrom select send sendto setsockopt socket WSAStartup WSACleanup WSAGetLastError getaddrinfo freeaddrinfo inet_ntop

winmm

waveOutWrite waveOutUnprepareHeader waveOutPrepareHeader waveOutClose waveOutOpen waveInReset waveInStop waveInStart waveInAddBuffer waveInUnprepareHeader waveInPrepareHeader waveInClose waveInOpen waveInGetNumDevs waveOutReset

xinput9_1_0

XInputSetState XInputGetState

Name

.text

Size

8.2MB

Virtual Size

8.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

287KB

Virtual Size

846KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

450KB

Virtual Size

450KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

782B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Minecraft.Client.exe

d3d11

d3dcompiler_46

iggy_w64

mss64

kernel32

user32

advapi32

ws2_32

winmm

xinput9_1_0

generic