5fa7fb839178beb3e0732dd8e08f403ac1a7db3b9763290df67b1525e006fa3b

Sharing

Copy URL Twitter E-mail

General

Target
5fa7fb839178beb3e0732dd8e08f403ac1a7db3b9763290df67b1525e006fa3b
Size 5.1MB
Sample261102-w38jfaew6n
SHA256 5fa7fb839178beb3e0732dd8e08f403ac1a7db3b9763290df67b1525e006fa3b
MD5 47a931a5249759899cae502820e74522
SHA1 793fac24684fb4cf619450ac07b10e7c120d3068
SHA512 f101dd12ca2e5b8bd5c52d44ec1627d8f84cbfe2dee28b4ae1e246cde5972f59a3f484d74da27b65ecff0f389d6c4351608568e796035b1d35113bceebdf55e9
SSDEEP 98304:ZdXc/LAcKK0J+7/PKL5VQyOuW2OMTAgmBiDI3UvbRjmsY3Ey:ZdXQAvzJ+VcvbgRU
TLSH
T1C246BE207916C1B1E99211F59A7CBFEF45AC9A300F6455D393C81E6EDD702C32B32A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5fa7fb839178beb3e0732dd8e08f403ac1a7db3b9763290df67b1525e006fa3b

File Explorer

5fa7fb839178beb3e0732dd8e08f403ac1a7db3b9763290df67b1525e006fa3b

.exe 5.1MB

5fa7fb839178beb3e0732dd8e08f403ac1a7db3b9763290df67b1525e006fa3b

IMPHASH fdd030fbc00488ea60391370bec2ea34
SHA256 5fa7fb839178beb3e0732dd8e08f403ac1a7db3b9763290df67b1525e006fa3b
MD5 47a931a5249759899cae502820e74522
SHA1 793fac24684fb4cf619450ac07b10e7c120d3068
SHA512 f101dd12ca2e5b8bd5c52d44ec1627d8f84cbfe2dee28b4ae1e246cde5972f59a3f484d74da27b65ecff0f389d6c4351608568e796035b1d35113bceebdf55e9
SSDEEP 98304:ZdXc/LAcKK0J+7/PKL5VQyOuW2OMTAgmBiDI3UvbRjmsY3Ey:ZdXQAvzJ+VcvbgRU
TLSH
T1C246BE207916C1B1E99211F59A7CBFEF45AC9A300F6455D393C81E6EDD702C32B32A9B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2621346

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\user\Desktop\Source_SILME\Binary\Client\bin\Release\metin2client.pdb

kernel32

SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait MoveFileA GetPrivateProfileStringA lstrlenA LoadLibraryA GetProcAddress GetModuleFileNameA FreeLibrary CreateMutexA ReleaseMutex DeleteFileA GetCurrentDirectoryA GetTickCount WriteConsoleW GetCurrentDirectoryW ReadProcessMemory GetCurrentProcess GetLastError CreateThreadpoolTimer GetComputerNameA GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetVolumeInformationA FindNextFileA FindFirstFileA FindClose MultiByteToWideChar SetEndOfFile HeapQueryInformation HeapSize OutputDebugStringW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc SetStdHandle DeleteFileW GetTimeZoneInformation CreateProcessW GetExitCodeProcess SetConsoleCtrlHandler ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FreeLibraryWhenCallbackReturns LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP SetFileAttributesA GetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType ExitProcess GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList InterlockedPushEntrySList RtlUnwind RaiseException GetThreadTimes GetCurrentThread QueryPerformanceFrequency SetLastError WaitNamedPipeW PeekNamedPipe GetModuleFileNameW GetSystemTimeAsFileTime GetStartupInfoW IsDebuggerPresent InitializeSListHead TerminateProcess UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive HeapFree FindResourceW FindResourceA SizeofResource LoadResource GetTickCount64 GetCurrentProcessorNumber WaitForSingleObjectEx SwitchToThread GetExitCodeThread GetNativeSystemInfo TryAcquireSRWLockExclusive WakeConditionVariable InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW GetLocaleInfoW FlushProcessWriteBuffers LockResource IsProcessorFeaturePresent InterlockedDecrement GetProcessHeap Module32Next Module32First Process32Next Process32First CreateToolhelp32Snapshot GetSystemInfo OpenProcess SetThreadPriority Sleep CreateEventA WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapValidate InterlockedIncrement GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFileW CreateDirectoryExW GetModuleHandleW DeviceIoControl AreFileApisANSI GetTempPathW SetFileTime SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindFirstFileW CreateFileW CreateDirectoryW SetCurrentDirectoryW GetLocaleInfoEx LocalFree FormatMessageA QueryPerformanceCounter CopyFileA CreateSemaphoreA ReleaseSemaphore GetLocaleInfoA CompareStringA WideCharToMultiByte lstrlenW GetVersionExA GetSystemDirectoryA GetModuleHandleA WriteFile SetFilePointer ReadFile GetCurrentThreadId SetUnhandledExceptionFilter GetFileSize CreateFileA CreateFileMappingA UnmapViewOfFile MapViewOfFile OutputDebugStringA GetTempFileNameA GetTempPathA RemoveDirectoryA CreateDirectoryA AllocConsole InitializeCriticalSection CloseHandle GetCurrentProcessId FlushFileBuffers GetFileAttributesA

user32

InvalidateRect GetClientRect FillRect SetRect OffsetRect LoadStringA MessageBoxA DrawTextW DrawTextA CharNextW GetClipboardData GetKeyboardLayout GetKeyboardLayoutNameA DispatchMessageA TranslateMessage GetMessageA LoadCursorA AdjustWindowRectEx GetWindowRect SetWindowTextA GetMenu RegisterClassA CharPrevExA CharNextExA SetWindowLongA GetWindowLongA UpdateWindow MoveWindow DestroyWindow IsWindow CreateWindowExA RegisterClassExA EndPaint BeginPaint ReleaseDC EmptyClipboard DefWindowProcA UnregisterClassA SetClipboardData CloseClipboard OpenClipboard ClientToScreen SetCursorPos LoadImageA DestroyCursor SetCursor ShowWindow ShowCursor GetKeyState SystemParametersInfoA LoadIconA FindWindowA ScreenToClient GetCursorPos GetDC PeekMessageA FlashWindowEx GetSystemMetrics ChangeDisplaySettingsA ReleaseCapture SetCapture GetCapture GetFocus SetWindowPos GetForegroundWindow GetAsyncKeyState PostQuitMessage SetFocus

gdi32

CreateSolidBrush CreateFontIndirectA GetCharABCWidthsFloatW GetTextExtentPoint32W SelectObject SetBkColor SetTextColor TextOutW CreateCompatibleDC DeleteDC SetBkMode SetDIBitsToDevice CreateDIBSection TextOutA GetObjectA DeleteObject EnumFontFamiliesExA PatBlt StretchBlt GetTextExtentPoint32A GetStockObject

advapi32

RegOpenKeyExA RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegOpenKeyA RegCloseKey CryptGenRandom RegQueryValueExA CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash

ole32

CoCreateInstance CoInitialize CoInitializeEx OleSetContainedObject OleUninitialize OleInitialize CoGetClassObject CoUninitialize

winmm

timeGetDevCaps timeBeginPeriod timeEndPeriod timeGetTime

d3d8

Direct3DCreate8

python27

Py_BuildValue Py_InitModule4 PyImport_GetModuleDict PyExc_SystemError PyModule_AddIntConstant PyTuple_Size PyLong_AsLong PyTuple_GetItem PyInt_AsLong PyLong_FromLongLong PyDict_Next PyDict_Size PyExc_RuntimeError PyList_New PyList_Append PyInt_FromLong PyModule_AddStringConstant PyImport_ImportModule PyString_InternFromString PyObject_GetAttrString PyObject_GetAttr PyCallable_Check PyLong_AsLongLong PyFloat_AsDouble PyString_AsString PyErr_Clear PyErr_BadArgument PyErr_Print PyObject_CallObject PyNumber_Check PyErr_Occurred PyDict_SetItemString PyModule_GetDict PyErr_Fetch Py_SetProgramName Py_Initialize Py_Finalize PyRun_StringFlags PyErr_SetString PyDict_GetItemString PyTuple_SetItem PyTuple_New PyString_FromString PyEval_SetTrace Py_FlushLine PyImport_GetMagicNumber PyImport_AddModule PyObject_AsCharBuffer PyCode_Addr2Line PyEval_EvalCode Py_OptimizeFlag PyCode_Type PyUnicodeUCS2_DecodeUTF8 _PyLong_FromByteArray PyFloat_FromDouble PyComplex_FromCComplex PyString_FromStringAndSize PyList_SetItem PyDict_New PyDict_SetItem PyErr_NoMemory PyEval_GetRestricted PyCode_New PyMarshal_ReadObjectFromString _PyLong_New _Py_EllipsisObject PyExc_StopIteration PyExc_EOFError PyExc_ValueError PyArg_ParseTuple _Py_NoneStruct

imm32

ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmGetContext ImmIsIME ImmGetIMEFileNameA ImmNotifyIME

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

devil

ilBindImage ilLoad ilConvertImage ilDeleteImages ilEnable ilOriginFunc ilShutDown ilSave ilSetPixels ilTexImage ilGenImages ilCopyPixels ilInit ilGetInteger

granny2

_GrannyGetMeshBindingToBoneIndices@4 _GrannyFreeMeshBinding@4 _GrannyNewMeshBinding@12 _GrannyFreeModelInstance@4 _GrannyInstantiateModel@4 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyFreeLocalPose@4 _GrannyNewLocalPose@4 _GrannyUpdateModelMatrix@20 _GrannySampleModelAnimationsAccelerated@20 _GrannyFreeCompletedModelControls@4 _GrannySetModelClock@8 _GrannyGetWorldPose4x4@8 _GrannyGetFileInfo@4 _GrannyFreeFile@4 _GrannyFreeFileSection@8 _GrannyCopyMeshIndices@12 _GrannyConvertSingleObject@20 _GrannyFindMatchingMember@16 _GrannyGetMaterialTextureByType@8 _GrannySetLogCallback@4 _GrannyGetWorldPoseComposite4x4@8 _GrannyFindBoneByName@12 _GrannyGetMeshVertexCount@4 _GrannyMeshIsRigid@4 _GrannyNewMeshDeformer@16 _GrannyFreeMeshDeformer@4 _GrannyDeformVertices@24 GrannyPNT332VertexType _GrannyNewWorldPose@4 _GrannyGetMeshIndexCount@4 _GrannyFreeControl@4 _GrannyFreeControlOnceUnused@4 _GrannyCompleteControlAt@8 _GrannyControlIsComplete@4 _GrannyFreeControlIfComplete@4 _GrannyGetControlLoopCount@4 _GrannySetControlLoopCount@8 _GrannyGetControlSpeed@4 _GrannySetControlSpeed@8 _GrannyGetControlLocalDuration@4 _GrannySetControlEaseIn@8 _GrannySetControlEaseInCurve@28 _GrannySetControlEaseOut@8 _GrannySetControlEaseOutCurve@28 _GrannyGetControlRawLocalClock@4 _GrannySetControlRawLocalClock@8 _GrannyGetTotalTypeSize@4 _GrannyFreeWorldPose@4 _GrannyPlayControlledAnimation@12 _GrannyGetMeshTriangleGroupCount@4 _GrannyGetMeshTriangleGroups@4 _GrannyGetMeshVertexType@4 _GrannyCopyMeshVertices@12 _GrannyGetSourceSkeleton@4 _GrannyGetMeshVertices@4 _GrannyReadEntireFileFromMemory@8

mss32

_AIL_mem_free_lock@4 _AIL_file_read@8 _AIL_set_file_callbacks@16 _AIL_WAV_info@8 _AIL_decompress_ASI@24 _AIL_decompress_ADPCM@12 _AIL_file_type@8 _AIL_open_digital_driver@16 _AIL_open_stream@12 _AIL_close_digital_driver@4 _AIL_auto_update_3D_position@8 _AIL_update_3D_position@8 _AIL_3D_sample_volume@4 _AIL_3D_sample_status@4 _AIL_set_3D_sample_loop_count@8 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_file@8 _AIL_end_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_enumerate_3D_providers@12 _AIL_start_3D_sample@4 _AIL_release_3D_sample_handle@4 _AIL_allocate_3D_sample_handle@4 _AIL_sample_volume_pan@12 _AIL_sample_status@4 _AIL_set_sample_loop_count@8 _AIL_set_sample_volume_pan@12 _AIL_end_sample@4 _AIL_resume_sample@4 _AIL_stop_sample@4 _AIL_start_sample@4 _AIL_set_sample_file@12 _AIL_init_sample@4 _AIL_release_sample_handle@4 _AIL_allocate_sample_handle@4 _AIL_last_error@0 _AIL_stream_status@4 _AIL_set_stream_loop_count@8 _AIL_stream_volume_levels@12 _AIL_set_stream_volume_levels@12 _AIL_pause_stream@8 _AIL_start_stream@4 _AIL_close_stream@4 _AIL_set_redist_directory@4 _AIL_shutdown@0 _AIL_startup@0 _AIL_set_3D_orientation@28 _AIL_set_3D_velocity@20 _AIL_set_3D_position@16 _AIL_close_3D_listener@4 _AIL_open_3D_listener@4 _AIL_close_3D_provider@4 _AIL_open_3D_provider@4 _AIL_stop_3D_sample@4

speedtreert

?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ ?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?SetTime@CSpeedTreeRT@@SAXM@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ??0SGeometry@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1CSpeedTreeRT@@QAE@XZ ??2CSpeedTreeRT@@SAPAXI@Z ??3CSpeedTreeRT@@SAXPAX@Z ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?DeleteTransientData@CSpeedTreeRT@@QAEXXZ

dinput8

DirectInput8Create

ws2_32

recv select send ioctlsocket WSAGetLastError connect WSACleanup htons inet_addr ntohl ntohs gethostbyname gethostname closesocket __WSAFDIsSet WSAStartup socket htonl

ddraw

DirectDrawCreate

shell32

SHGetSpecialFolderPathA

oleaut32

SysFreeString VariantClear SafeArrayCreate VariantInit SafeArrayAccessData SafeArrayDestroy SysAllocString

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

674KB

Virtual Size

674KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

211KB

Virtual Size

741KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

180KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

184KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=43, id=264, version=35228,

count=49, id=259, version=33145,

count=219, id=261, version=33145,

count=4, id=170, productName=VS2010 build 30319, version=30319,

count=59, id=261, version=31937,

count=2, id=262, version=33145,

count=58, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=48, version=9044,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=2, id=257, productName=VS2015 [14.0] build 23026, version=23026,

count=5, id=261, productName=VS2019 v16.11.1 build 30133, version=30133,

count=1, id=253, version=35207,

count=29, id=259, version=35207,

count=20, id=260, version=35207,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=28, version=9178,

count=83, id=29, version=9178,

count=1, id=18, version=8444,

count=8, productName=Unmarked objects (old),

count=4, id=25, version=9210,

count=1, id=260, version=35228,

count=43, id=260, version=33145,

count=25, id=257, version=33145,

count=570, id=1, productName=Unmarked objects,

count=101, id=261, version=35207,

count=302, id=261, version=35228,

count=1, id=255, version=35228,

count=1, id=151,

count=1, id=258, version=35228,