7e710875be4d15c92031b9ff9f274b856df9555972aaebccf8538f87d3141b95

Sharing

Copy URL Twitter E-mail

General

Target
7e710875be4d15c92031b9ff9f274b856df9555972aaebccf8538f87d3141b95
Size 5.7MB
Sample261102-d6g7jsst7j
SHA256 7e710875be4d15c92031b9ff9f274b856df9555972aaebccf8538f87d3141b95
MD5 fbace805b36d738ef974bdd6d94b2ed0
SHA1 dd22feff1730b57bdc7ac3234509be27f3869f05
SHA512 c56c649662b98ce106d98997426eb9041142a0e88a75213db7bdc91490a6d19d80db1be3e3c16171dc55fc1e4227583425857e25939b64ca91b60eb2f99b3d69
SSDEEP 98304:GuQvEkvCnCW02zrwnlQ2RPlptI+vvgBPAbnEeO9lP:eWnCW02zrwnllQPADc
TLSH
T16E569E20B9C18235FAD230B65ABDFB6F917D5AE8072541C7638C196A6E70CC22B35377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e710875be4d15c92031b9ff9f274b856df9555972aaebccf8538f87d3141b95

File Explorer

7e710875be4d15c92031b9ff9f274b856df9555972aaebccf8538f87d3141b95

.exe 5.7MB

7e710875be4d15c92031b9ff9f274b856df9555972aaebccf8538f87d3141b95

IMPHASH 516ce9ccf2d66b7e677c735e85f0da94
SHA256 7e710875be4d15c92031b9ff9f274b856df9555972aaebccf8538f87d3141b95
MD5 fbace805b36d738ef974bdd6d94b2ed0
SHA1 dd22feff1730b57bdc7ac3234509be27f3869f05
SHA512 c56c649662b98ce106d98997426eb9041142a0e88a75213db7bdc91490a6d19d80db1be3e3c16171dc55fc1e4227583425857e25939b64ca91b60eb2f99b3d69
SSDEEP 98304:GuQvEkvCnCW02zrwnlQ2RPlptI+vvgBPAbnEeO9lP:eWnCW02zrwnllQPADc
TLSH
T16E569E20B9C18235FAD230B65ABDFB6F917D5AE8072541C7638C196A6E70CC22B35377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3641504

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\TMoore\AppData\Local\zu_release\2026.11.02_20261102_000758\wt\src\client\Engine\built\Release_Ship3\Runtime\Exe_LithTech\Zu-Online.pdb

winmm

timeBeginPeriod timeKillEvent timeSetEvent timeEndPeriod mmioInstallIOProcA timeGetTime

dinput8

DirectInput8Create

dsound

ord1

kernel32

RaiseException SetUnhandledExceptionFilter TerminateProcess GetLocalTime QueryPerformanceCounter QueryPerformanceFrequency DecodePointer InitializeCriticalSectionEx MultiByteToWideChar GetTempPathA GetTempFileNameA DebugBreak FreeLibrary LoadLibraryA FormatMessageA GetVersionExA IsBadReadPtr WaitForMultipleObjects SuspendThread ResumeThread PulseEvent GetModuleHandleA GetProcAddress ExitThread TerminateThread SetFilePointer LocalFree GetSystemInfo LoadResource LockResource SizeofResource FindResourceA IsProcessorFeaturePresent WideCharToMultiByte CreateFileW SetPriorityClass InterlockedExchange InterlockedCompareExchange GetFullPathNameA lstrcmpiA OutputDebugStringW InterlockedFlushSList GlobalMemoryStatus IsBadWritePtr GetTempFileNameW MoveFileW MoveFileA DeleteFileW FreeResource CompareStringA InterlockedDecrement InterlockedIncrement WriteConsoleW SetEndOfFile GetTimeZoneInformation HeapSize GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage CreateDirectoryW SetStdHandle GetCurrentDirectoryW SetCurrentDirectoryW HeapReAlloc GetFileAttributesExW SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetCurrentProcess SetCurrentDirectoryA GetEnvironmentVariableA CreateEventA ResetEvent SetEvent GetLastError HeapCompact MoveFileExA CreateFileMappingA UnmapViewOfFile MapViewOfFile VirtualFree VirtualAlloc SetThreadPriority GetCurrentThread GetCurrentProcessId CreateMutexA ReleaseMutex GetProcessHeap HeapFree HeapAlloc WriteFile ReadFile GetFileSize GetFileAttributesA CreateFileA OutputDebugStringA MulDiv InterlockedPushEntrySList DeleteFileA CreateThread Sleep WaitForSingleObject CloseHandle GetTickCount GetCurrentThreadId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection IsDBCSLeadByte lstrcpyA SetLastError FlsAlloc FindResourceW GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect IsThreadAFiber GetTempPathW ReadConsoleW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetStdHandle GetModuleFileNameW GetFullPathNameW PeekNamedPipe GetFileType GetFileInformationByHandle GetDriveTypeW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread UnhandledExceptionFilter FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindNextFileW FindFirstFileExW VirtualQuery EncodePointer FlsFree FlsSetValue DuplicateHandle ReleaseSemaphore CreateSemaphoreA DisableThreadLibraryCalls GetThreadPriority GetFileSizeEx FlushFileBuffers GetCurrentDirectoryA FindClose FindFirstFileA GetModuleFileNameA GetWindowsDirectoryA ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwind FlsGetValue

user32

PostQuitMessage LoadIconA wsprintfA UnregisterClassA LoadStringA GetWindowLongA AdjustWindowRect SetWindowPos MsgWaitForMultipleObjects RegisterWindowMessageA GetQueueStatus PostThreadMessageA GetAsyncKeyState SendMessageTimeoutA GetKeyboardState ToAscii TranslateMessage DispatchMessageA DispatchMessageW PeekMessageA PeekMessageW DefWindowProcA RegisterClassA CreateWindowExA DestroyWindow ShowWindow IsIconic BeginPaint EndPaint GetWindowRect MessageBoxA GetDesktopWindow ShowCursor MessageBoxW GetForegroundWindow ClipCursor SetFocus LoadImageA SetCursor LoadCursorA

gdi32

GetTextFaceA ExtTextOutW MoveToEx ExtTextOutA SetTextAlign CreateFontIndirectA GetFontLanguageInfo GetCharacterPlacementW GetCharacterPlacementA GetGlyphOutlineA GetTextMetricsA GetObjectW TextOutA SetTextCharacterExtra Rectangle GetTextExtentPoint32A GetTextCharacterExtra CreateFontA GetStockObject GdiFlush TextOutW StrokeAndFillPath EndPath BeginPath CreateDIBSection GetTextMetricsW SetTextColor SetMapMode SetBkMode SetBkColor SelectObject GetGlyphOutlineW GetCharWidth32W DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontIndirectW CreateCompatibleDC RemoveFontResourceA AddFontResourceA GetObjectA

advapi32

RegOpenKeyA RegQueryValueExA RegCloseKey

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemFree CoUninitialize CoInitialize CoFreeUnusedLibraries

wsock32

WSAGetLastError WSASetLastError bind closesocket inet_ntoa getsockname htonl htons ioctlsocket ntohl ntohs recvfrom select sendto setsockopt socket gethostbyname gethostname WSAStartup WSACleanup

dbghelp

MiniDumpWriteDump

d3d9

Direct3DCreate9

oleaut32

SysFreeString SysAllocString

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

970KB

Virtual Size

972KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

98KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

207KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

207KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=48, id=259, version=33145,

count=205, id=261, version=33145,

count=4, id=253, version=35721,

count=29, id=259, version=35721,

count=22, id=260, version=35721,

count=1, id=260, version=36252,

count=32, id=260, version=33145,

count=23, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=51, id=261, version=35721,

count=4, id=25, version=9210,

count=2, id=28, version=9178,

count=19, id=257, version=33145,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=300, id=1, productName=Unmarked objects,

count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=12, id=95, version=2067,

count=6, id=18, version=8444,

count=146, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=341, id=261, version=36252,

count=1, id=256, version=36252,

count=1, id=255, version=36252,

count=1, id=151,

count=1, id=258, version=36252,