BattlefrontII%20495[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
BattlefrontII%20495.zip
Size 1.9MB
Sample261110-gyn7nsdd46
SHA256 80db70ec4287f557aa94aa3d28100a71c7b08538f1416fa3623e1d0c42dfe290
MD5 f377154d9bf2af170e4ba4d233549ede
SHA1 7b680bbdcd89c0e932d7ebc776254167b826af7a
SHA512 f0cad3a87535780b4c8e20825f6eddc39ff233a1d58b54f3524635fcd866ee7933d99a58e844693eb297a46163cd18768ac5e3cf3cf3d55fd3675e27d704c1a8
SSDEEP 49152:OauqdOLYuks8Cmvb7QJUGLNgjHdymBcWA75nkMYJ:FImsuvQSGLNgT4K5E1kM8
TLSH
T1789533338869A93BCF7B98300613A9D855DBA9B53124D731938C364DEC493F3E5866B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/BattlefrontII 495.exe

File Explorer

BattlefrontII%20495.zip

.zip 1.9MB
BattlefrontII 495.exe

.exe 4.2MB

BattlefrontII%20495.zip

SHA256 80db70ec4287f557aa94aa3d28100a71c7b08538f1416fa3623e1d0c42dfe290
MD5 f377154d9bf2af170e4ba4d233549ede
SHA1 7b680bbdcd89c0e932d7ebc776254167b826af7a
SHA512 f0cad3a87535780b4c8e20825f6eddc39ff233a1d58b54f3524635fcd866ee7933d99a58e844693eb297a46163cd18768ac5e3cf3cf3d55fd3675e27d704c1a8
SSDEEP 49152:OauqdOLYuks8Cmvb7QJUGLNgjHdymBcWA75nkMYJ:FImsuvQSGLNgT4K5E1kM8
TLSH
T1789533338869A93BCF7B98300613A9D855DBA9B53124D731938C364DEC493F3E5866B2
MD5 SHA1 SHA512 SSDEEP TLSH

BattlefrontII 495.exe

IMPHASH 2d7906bc080db40c8b5469d242e3353a
SHA256 ea9386536893abcf1ec7b5b0e6f3822be0a50d567989ff95a1d010ef323a683f
MD5 e1f77e1fd724f88eb24ece2d2e6c1a4f
SHA1 35c13c7fec595c76d00b9fd583a3d723671c5d50
SHA512 e094f2cf61505cbac5608362b23518245907be388cdad90171c320f918ae2a85400c531c01d5dbf6dfa0331aa01e4c35417210f327c90fc80ce74b8ca576f988
SSDEEP 98304:lNp/oFBSTtbpzdzSbT3vmQfhGxacI1GrBjCTSJwFUBClVTCC48T9zzeTcPlg1Cyf:J/o7STtbpBzSbT3vmQfhGxacI1GrBjCf
TLSH
T178167C00B562C1B5D6502179F9BE3E7FA13D7D540B2C42C363D82959B9F52C22AF22FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3484734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\cdprojekt\gog\battlefront2\main\Battlefront2\Build\PC GOG XPLAY Release\BattlefrontII.pdb

d3d9

Direct3DCreate9

d3dx9_43

D3DXQuaternionNormalize D3DXVec3TransformNormal D3DXVec3Normalize D3DXCheckTextureRequirements D3DXVec4Transform D3DXMatrixRotationY D3DXVec3TransformCoord D3DXMatrixScaling D3DXMatrixRotationAxis D3DXMatrixRotationQuaternion D3DXMatrixRotationZ D3DXMatrixInverse D3DXMatrixRotationX D3DXMatrixMultiply

ws2_32

ntohl inet_ntoa gethostname send closesocket socket bind gethostbyname WSAGetLastError setsockopt ntohs ioctlsocket connect WSAStartup recvfrom sendto htons

galaxy

?ResetInstance@GalaxyFactory@api@galaxy@@SAXXZ ?GetErrorManager@GalaxyFactory@api@galaxy@@SAPAVIErrorManager@23@XZ ?GetInstance@GalaxyFactory@api@galaxy@@SAPAVIGalaxy@23@XZ ?CreateInstance@GalaxyFactory@api@galaxy@@SAPAVIGalaxy@23@XZ

steam_api

SteamAPI_RegisterCallResult SteamAPI_Init SteamInternal_CreateInterface SteamAPI_GetHSteamPipe SteamAPI_RestartAppIfNecessary SteamAPI_Shutdown SteamAPI_UnregisterCallResult SteamInternal_ContextInit SteamAPI_RunCallbacks SteamAPI_GetHSteamUser

kernel32

GetFileSize ReadFile SetFilePointer GetDiskFreeSpaceA ReleaseSemaphore WaitForSingleObject CreateSemaphoreA InterlockedIncrement InterlockedDecrement EncodePointer GetCurrentThread Sleep SetThreadPriority FindFirstFileA FindClose GetThreadPriority DeleteFileA GetLocalTime QueryPerformanceCounter QueryPerformanceFrequency GetTickCount OutputDebugStringA CreateFileA SleepEx WriteFile CreateDirectoryA CloseHandle GetLastError CreateMutexA IsDebuggerPresent FreeLibrary LoadLibraryA InterlockedExchange GetModuleHandleA SetLastError GetUserDefaultLangID GetVersionExA MultiByteToWideChar lstrcpyA lstrlenW DecodePointer IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetProcAddress CreateThread

user32

SetWindowTextA GetDlgItem EndDialog DialogBoxParamA DrawTextW GetCursorPos SetCursorPos SystemParametersInfoA MapVirtualKeyA ToUnicode ToAscii GetKeyboardState GetKeyState GetFocus GetWindowPlacement SetWindowPos DestroyWindow SetCursor PostQuitMessage LoadIconA GetClientRect SendMessageA TranslateMessage GetMenu SetRect CreateWindowExA PeekMessageA DefWindowProcA GetDesktopWindow DispatchMessageA AdjustWindowRect DestroyMenu FindWindowA LoadCursorA RegisterClassA ShowWindow PostMessageA GetForegroundWindow FillRect DrawTextA GetDC ReleaseDC

gdi32

TextOutA TextOutW MoveToEx GdiFlush GetObjectA CreateDIBSection GetStockObject SetBkColor SetBkMode LineTo DeleteObject DeleteDC CreateFontIndirectA CreateCompatibleDC GetDeviceGammaRamp SetICMMode SelectObject SetMapMode SetTextColor

advapi32

RegQueryValueExA RegCreateKeyExA RegOpenKeyExA RegCloseKey

msvcp120

?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z _Xtime_get_ticks _Thrd_sleep _Xtime_diff_to_millis2 xtime_get ?_Winerror_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z

msvcr120

_calloc_crt _unlock _lock ??1type_info@@UAE@XZ _wassert exit _mkdir _atoi64 __CxxFrameHandler3 strcoll _setjmp3 longjmp strcspn strtod strtoul strpbrk memchr iscntrl isalnum ispunct isxdigit islower isupper floor ceil _libm_sse2_tan_precise _libm_sse2_sqrt_precise __dllonexit _onexit ?terminate@@YAXXZ _XcptFilter __crtGetShowWindowMode _amsg_exit __getmainargs __set_app_type _cexit _ismbblead _configthreadlocale __setusermatherr _initterm_e _initterm _acmdln _fmode _commode _crt_debugger_hook __crtTerminateProcess _except1 _except_handler4_common __crtSetUnhandledExceptionFilter _invoke_watson _controlfp_s _stricmp _strlwr _strnicmp _wcsupr _strupr _wcsicmp _strdup _CxxThrowException _except_handler3 __crtUnhandledException strrchr strchr _snprintf strncpy _wmakepath _wfindfirst64i32 _wmkdir _wfopen _errno _wremove _findclose fread _wsplitpath _wfindnext64i32 fwrite _wfullpath fclose sprintf _purecall sscanf atoi qsort memcmp atof strncmp atol _findnext64i32 _makepath _fullpath _findfirst64i32 strtok _vsnprintf memmove ?wait@Concurrency@@YAXI@Z ?_Id@_CurrentScheduler@details@Concurrency@@SAIXZ fflush _exit fopen fprintf _strdate _strtime free malloc _time64 rand bsearch srand strftime _localtime64 isspace tolower toupper strncat isalpha isdigit strstr fgets fputc remove ftell fseek ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@XZ ??0exception@std@@QAE@ABV01@@Z rename ?_open@@YAHPBDHH@Z _lseek _write fmaxf _close memset memcpy isprint __iob_func feof ferror getc ungetc strerror fputs frexp ldexp _CIatan2 _CIfmod _libm_sse2_acos_precise _libm_sse2_asin_precise _libm_sse2_atan_precise _libm_sse2_cos_precise _libm_sse2_exp_precise _libm_sse2_log10_precise _libm_sse2_log_precise _libm_sse2_pow_precise _libm_sse2_sin_precise

dsound

ord11 ord9 ord7 ord1 ord12 ord2

dinput8

DirectInput8Create

binkw32

_BinkDoFrame@4 _BinkNextFrame@4 _BinkWait@4 _BinkClose@4 _BinkCopyToBuffer@28 _BinkSetVolume@12 _BinkSetIO@4 _BinkSetIOSize@4 _BinkSetSoundSystem@8 _BinkOpenDirectSound@4 _BinkDX9SurfaceType@4 _BinkSetMemory@8 _BinkGetError@0 _BinkOpen@8

winmm

timeGetTime

ole32

CoInitialize CoUninitialize CoCreateInstance

??$Allocate@VGalaxyAuthListener@gf@@AAH@gf@@YAPAVGalaxyAuthListener@0@AAH@Z ??$Allocate@VGalaxyFriendListListener@?A0x706288b3@@@gf@@YAPAVGalaxyFriendListListener@?A0x706288b3@@XZ ??$Allocate@VGalaxyGameJoinRequestedListener@?A0x706288b3@@@gf@@YAPAVGalaxyGameJoinRequestedListener@?A0x706288b3@@XZ ??$Allocate@VGalaxyLobbyCreatedListener@gf@@@gf@@YAPAVGalaxyLobbyCreatedListener@0@XZ ??$Allocate@VGalaxyLobbyDataListener@gf@@@gf@@YAPAVGalaxyLobbyDataListener@0@XZ ??$Allocate@VGalaxyLobbyEnteredListener@gf@@@gf@@YAPAVGalaxyLobbyEnteredListener@0@XZ ??$Allocate@VGalaxyLobbyLeftListener@gf@@@gf@@YAPAVGalaxyLobbyLeftListener@0@XZ ??$Allocate@VGalaxyLobbyListListener@gf@@@gf@@YAPAVGalaxyLobbyListListener@0@XZ ??$Allocate@VGalaxyLobbyMemberStateListener@gf@@@gf@@YAPAVGalaxyLobbyMemberStateListener@0@XZ ??$Allocate@VGalaxyLobbyOwnerChangeListener@gf@@@gf@@YAPAVGalaxyLobbyOwnerChangeListener@0@XZ ??0SteamAuthProvider@gf@@QAE@XZ ??4SteamAuthProvider@gf@@QAEAAV01@ABV01@@Z ?FromString@utils@gf@@YAHPBDH@Z ?FromString@utils@gf@@YAIPBDI@Z ?FromString@utils@gf@@YA_NPBD_N@Z ?GetEncryptedAppTicket@SteamAuthProvider@gf@@QAEHPADH@Z ?GetPersonaName@SteamAuthProvider@gf@@QAEPBDXZ ?Init@SteamAuthProvider@gf@@QAE_NIAA_N@Z ?IsInitialized@SteamAuthProvider@gf@@QAE_NXZ ?Shutdown@SteamAuthProvider@gf@@QAEXXZ ?ToString@utils@gf@@YAPBDH@Z ?ToString@utils@gf@@YAPBDI@Z ?ToString@utils@gf@@YAPBD_N@Z ?_sap@gf@@YAPAVSteamAuthProvider@1@XZ ?checkError@gf@@YA_NXZ ?connectionStringByIndex@friends@gf@@YAPBDI@Z ?deinitialize@gf@@YAXXZ ?friendByIndex@friends@gf@@YA?AVGalaxyID@api@galaxy@@I@Z ?friendCount@friends@gf@@YAIXZ ?friendNameByIndex@friends@gf@@YAPBDI@Z ?getAndResetDirty@friends@gf@@YA_NXZ ?initialize@gf@@YA_NXZ ?isFriend@friends@gf@@YA_NABVGalaxyID@api@galaxy@@@Z ?isInitialized@gf@@YA_NXZ ?isJoinableByIndex@friends@gf@@YA_NI@Z ?reset@friends@gf@@YAXXZ ?start@friends@gf@@YA_NXZ ?stop@friends@gf@@YAXXZ

generic

count=8, id=199, version=41118,

count=16, id=223, productName=VS2013 build 21005, version=21005,

count=20, id=224, productName=VS2013 build 21005, version=21005,

count=5, id=225, productName=VS2013 build 21005, version=21005,

count=4, id=221, productName=VS2013 build 21005, version=21005,

count=4, id=221, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=10, version=8966,

count=2, id=93, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=49, version=9044,

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, version=21202,

count=3, id=123, productName=VS2005 build 50727, version=50727,

count=356, id=1, productName=Unmarked objects,

count=264, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=13, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=126, version=50727,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=501, id=229, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,