BattlefrontII 365[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
BattlefrontII 365.zip
Size 1.9MB
Sample261110-fsv8csda79
SHA256 729632937fda51e04319a855ecba6a2cca7fb6a8ce8b9f7ebdd2ceac1e909735
MD5 ec03deda2ee9e02890e2c13e13838a11
SHA1 faea7a95e4f0233960d2e044a1971ae0e7f1ffe7
SHA512 62dccb525d2ddfe842c0691eb5df53deea4df7087f4e8c54a08085144c5dfc4d621944242847e1b55d1a57667e83ea6d3db9bea5f090ec23ae747140cd950649
SSDEEP 49152:XauqdOLYuksq+8Q3nFMyr3Jn6bQlCgAf53RujPT:uImsw4nFMyr3HC5Run
TLSH
T1AB95333AE61D44610FAA60DCA349F35CF8FCB97630287143469066FC9D1A7B3BCA5AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/BattlefrontII 365.exe

File Explorer

BattlefrontII 365.zip

.zip 1.9MB
BattlefrontII 365.exe

.exe 4.2MB

BattlefrontII 365.zip

SHA256 729632937fda51e04319a855ecba6a2cca7fb6a8ce8b9f7ebdd2ceac1e909735
MD5 ec03deda2ee9e02890e2c13e13838a11
SHA1 faea7a95e4f0233960d2e044a1971ae0e7f1ffe7
SHA512 62dccb525d2ddfe842c0691eb5df53deea4df7087f4e8c54a08085144c5dfc4d621944242847e1b55d1a57667e83ea6d3db9bea5f090ec23ae747140cd950649
SSDEEP 49152:XauqdOLYuksq+8Q3nFMyr3Jn6bQlCgAf53RujPT:uImsw4nFMyr3HC5Run
TLSH
T1AB95333AE61D44610FAA60DCA349F35CF8FCB97630287143469066FC9D1A7B3BCA5AD1
MD5 SHA1 SHA512 SSDEEP TLSH

BattlefrontII 365.exe

IMPHASH 2d7906bc080db40c8b5469d242e3353a
SHA256 03fe22809f091f0520fea79ba4db715ec7483f1a60d1fa9f9b8eba28c9500975
MD5 450c4f8e2ebdf855ecd9db6c0b6a381c
SHA1 6e058d3da7e77320d66b78e82efa1303b07ac3b3
SHA512 e4af0f242833bff7b570e7df7130b5b73bf720c0a08a76a24f4513f65fac7c5bb052cde947557050094c46be8aa1cff5ad4b159bccc8ff79c6a481137524d8ac
SSDEEP 98304:lNp/oFBSTtbpzdzSbT3vmQfhGxacI1GrBjCTSJwFUBClVTCC48T9zzoTcPlg1Cyf:J/o7STtbpBzSbT3vmQfhGxacI1GrBjCh
TLSH
T144167C00B562C1B5D6502179F9BE3E7FA13D7D540B2C42C363D82959B9F52C22AF22FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3484734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\cdprojekt\gog\battlefront2\main\Battlefront2\Build\PC GOG XPLAY Release\BattlefrontII.pdb

d3d9

Direct3DCreate9

d3dx9_43

D3DXQuaternionNormalize D3DXVec3TransformNormal D3DXVec3Normalize D3DXCheckTextureRequirements D3DXVec4Transform D3DXMatrixRotationY D3DXVec3TransformCoord D3DXMatrixScaling D3DXMatrixRotationAxis D3DXMatrixRotationQuaternion D3DXMatrixRotationZ D3DXMatrixInverse D3DXMatrixRotationX D3DXMatrixMultiply

ws2_32

ntohl inet_ntoa gethostname send closesocket socket bind gethostbyname WSAGetLastError setsockopt ntohs ioctlsocket connect WSAStartup recvfrom sendto htons

galaxy

?ResetInstance@GalaxyFactory@api@galaxy@@SAXXZ ?GetErrorManager@GalaxyFactory@api@galaxy@@SAPAVIErrorManager@23@XZ ?GetInstance@GalaxyFactory@api@galaxy@@SAPAVIGalaxy@23@XZ ?CreateInstance@GalaxyFactory@api@galaxy@@SAPAVIGalaxy@23@XZ

steam_api

SteamAPI_RegisterCallResult SteamAPI_Init SteamInternal_CreateInterface SteamAPI_GetHSteamPipe SteamAPI_RestartAppIfNecessary SteamAPI_Shutdown SteamAPI_UnregisterCallResult SteamInternal_ContextInit SteamAPI_RunCallbacks SteamAPI_GetHSteamUser

kernel32

GetFileSize ReadFile SetFilePointer GetDiskFreeSpaceA ReleaseSemaphore WaitForSingleObject CreateSemaphoreA InterlockedIncrement InterlockedDecrement EncodePointer GetCurrentThread Sleep SetThreadPriority FindFirstFileA FindClose GetThreadPriority DeleteFileA GetLocalTime QueryPerformanceCounter QueryPerformanceFrequency GetTickCount OutputDebugStringA CreateFileA SleepEx WriteFile CreateDirectoryA CloseHandle GetLastError CreateMutexA IsDebuggerPresent FreeLibrary LoadLibraryA InterlockedExchange GetModuleHandleA SetLastError GetUserDefaultLangID GetVersionExA MultiByteToWideChar lstrcpyA lstrlenW DecodePointer IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetProcAddress CreateThread

user32

SetWindowTextA GetDlgItem EndDialog DialogBoxParamA DrawTextW GetCursorPos SetCursorPos SystemParametersInfoA MapVirtualKeyA ToUnicode ToAscii GetKeyboardState GetKeyState GetFocus GetWindowPlacement SetWindowPos DestroyWindow SetCursor PostQuitMessage LoadIconA GetClientRect SendMessageA TranslateMessage GetMenu SetRect CreateWindowExA PeekMessageA DefWindowProcA GetDesktopWindow DispatchMessageA AdjustWindowRect DestroyMenu FindWindowA LoadCursorA RegisterClassA ShowWindow PostMessageA GetForegroundWindow FillRect DrawTextA GetDC ReleaseDC

gdi32

TextOutA TextOutW MoveToEx GdiFlush GetObjectA CreateDIBSection GetStockObject SetBkColor SetBkMode LineTo DeleteObject DeleteDC CreateFontIndirectA CreateCompatibleDC GetDeviceGammaRamp SetICMMode SelectObject SetMapMode SetTextColor

advapi32

RegQueryValueExA RegCreateKeyExA RegOpenKeyExA RegCloseKey

msvcp120

?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z _Xtime_get_ticks _Thrd_sleep _Xtime_diff_to_millis2 xtime_get ?_Winerror_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z

msvcr120

_calloc_crt _unlock _lock ??1type_info@@UAE@XZ _wassert exit _mkdir _atoi64 __CxxFrameHandler3 strcoll _setjmp3 longjmp strcspn strtod strtoul strpbrk memchr iscntrl isalnum ispunct isxdigit islower isupper floor ceil _libm_sse2_tan_precise _libm_sse2_sqrt_precise __dllonexit _onexit ?terminate@@YAXXZ _XcptFilter __crtGetShowWindowMode _amsg_exit __getmainargs __set_app_type _cexit _ismbblead _configthreadlocale __setusermatherr _initterm_e _initterm _acmdln _fmode _commode _crt_debugger_hook __crtTerminateProcess _except1 _except_handler4_common __crtSetUnhandledExceptionFilter _invoke_watson _controlfp_s _stricmp _strlwr _strnicmp _wcsupr _strupr _wcsicmp _strdup _CxxThrowException _except_handler3 __crtUnhandledException strrchr strchr _snprintf strncpy _wmakepath _wfindfirst64i32 _wmkdir _wfopen _errno _wremove _findclose fread _wsplitpath _wfindnext64i32 fwrite _wfullpath fclose sprintf _purecall sscanf atoi qsort memcmp atof strncmp atol _findnext64i32 _makepath _fullpath _findfirst64i32 strtok _vsnprintf memmove ?wait@Concurrency@@YAXI@Z ?_Id@_CurrentScheduler@details@Concurrency@@SAIXZ fflush _exit fopen fprintf _strdate _strtime free malloc _time64 rand bsearch srand strftime _localtime64 isspace tolower toupper strncat isalpha isdigit strstr fgets fputc remove ftell fseek ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@XZ ??0exception@std@@QAE@ABV01@@Z rename ?_open@@YAHPBDHH@Z _lseek _write fmaxf _close memset memcpy isprint __iob_func feof ferror getc ungetc strerror fputs frexp ldexp _CIatan2 _CIfmod _libm_sse2_acos_precise _libm_sse2_asin_precise _libm_sse2_atan_precise _libm_sse2_cos_precise _libm_sse2_exp_precise _libm_sse2_log10_precise _libm_sse2_log_precise _libm_sse2_pow_precise _libm_sse2_sin_precise

dsound

ord11 ord9 ord7 ord1 ord12 ord2

dinput8

DirectInput8Create

binkw32

_BinkDoFrame@4 _BinkNextFrame@4 _BinkWait@4 _BinkClose@4 _BinkCopyToBuffer@28 _BinkSetVolume@12 _BinkSetIO@4 _BinkSetIOSize@4 _BinkSetSoundSystem@8 _BinkOpenDirectSound@4 _BinkDX9SurfaceType@4 _BinkSetMemory@8 _BinkGetError@0 _BinkOpen@8

winmm

timeGetTime

ole32

CoInitialize CoUninitialize CoCreateInstance

??$Allocate@VGalaxyAuthListener@gf@@AAH@gf@@YAPAVGalaxyAuthListener@0@AAH@Z ??$Allocate@VGalaxyFriendListListener@?A0x706288b3@@@gf@@YAPAVGalaxyFriendListListener@?A0x706288b3@@XZ ??$Allocate@VGalaxyGameJoinRequestedListener@?A0x706288b3@@@gf@@YAPAVGalaxyGameJoinRequestedListener@?A0x706288b3@@XZ ??$Allocate@VGalaxyLobbyCreatedListener@gf@@@gf@@YAPAVGalaxyLobbyCreatedListener@0@XZ ??$Allocate@VGalaxyLobbyDataListener@gf@@@gf@@YAPAVGalaxyLobbyDataListener@0@XZ ??$Allocate@VGalaxyLobbyEnteredListener@gf@@@gf@@YAPAVGalaxyLobbyEnteredListener@0@XZ ??$Allocate@VGalaxyLobbyLeftListener@gf@@@gf@@YAPAVGalaxyLobbyLeftListener@0@XZ ??$Allocate@VGalaxyLobbyListListener@gf@@@gf@@YAPAVGalaxyLobbyListListener@0@XZ ??$Allocate@VGalaxyLobbyMemberStateListener@gf@@@gf@@YAPAVGalaxyLobbyMemberStateListener@0@XZ ??$Allocate@VGalaxyLobbyOwnerChangeListener@gf@@@gf@@YAPAVGalaxyLobbyOwnerChangeListener@0@XZ ??0SteamAuthProvider@gf@@QAE@XZ ??4SteamAuthProvider@gf@@QAEAAV01@ABV01@@Z ?FromString@utils@gf@@YAHPBDH@Z ?FromString@utils@gf@@YAIPBDI@Z ?FromString@utils@gf@@YA_NPBD_N@Z ?GetEncryptedAppTicket@SteamAuthProvider@gf@@QAEHPADH@Z ?GetPersonaName@SteamAuthProvider@gf@@QAEPBDXZ ?Init@SteamAuthProvider@gf@@QAE_NIAA_N@Z ?IsInitialized@SteamAuthProvider@gf@@QAE_NXZ ?Shutdown@SteamAuthProvider@gf@@QAEXXZ ?ToString@utils@gf@@YAPBDH@Z ?ToString@utils@gf@@YAPBDI@Z ?ToString@utils@gf@@YAPBD_N@Z ?_sap@gf@@YAPAVSteamAuthProvider@1@XZ ?checkError@gf@@YA_NXZ ?connectionStringByIndex@friends@gf@@YAPBDI@Z ?deinitialize@gf@@YAXXZ ?friendByIndex@friends@gf@@YA?AVGalaxyID@api@galaxy@@I@Z ?friendCount@friends@gf@@YAIXZ ?friendNameByIndex@friends@gf@@YAPBDI@Z ?getAndResetDirty@friends@gf@@YA_NXZ ?initialize@gf@@YA_NXZ ?isFriend@friends@gf@@YA_NABVGalaxyID@api@galaxy@@@Z ?isInitialized@gf@@YA_NXZ ?isJoinableByIndex@friends@gf@@YA_NI@Z ?reset@friends@gf@@YAXXZ ?start@friends@gf@@YA_NXZ ?stop@friends@gf@@YAXXZ

generic

count=8, id=199, version=41118,

count=16, id=223, productName=VS2013 build 21005, version=21005,

count=20, id=224, productName=VS2013 build 21005, version=21005,

count=5, id=225, productName=VS2013 build 21005, version=21005,

count=4, id=221, productName=VS2013 build 21005, version=21005,

count=4, id=221, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=10, version=8966,

count=2, id=93, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=49, version=9044,

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, version=21202,

count=3, id=123, productName=VS2005 build 50727, version=50727,

count=356, id=1, productName=Unmarked objects,

count=264, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=13, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=126, version=50727,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=501, id=229, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,