General

Malware Config

Signatures

Files

• Essential Mod Installer.exe

  .exe windows:6 windows x64 arch:x64

  Password: testingminecraftmodessential

  e15e68914ca12b70d91eca951f8b1dbc

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:a1:08:a1:90:9d:09:e2:19:17:11:17:af:a2:9d:70

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  06-09-2023 00:00

  Not After

  04-10-2024 23:59

  Subject

  CN=ModCore Inc,O=ModCore Inc,L=Mount Vernon,ST=New York,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  13:63:54:79:eb:99:4d:6d:65:c0:95:ab:83:22:c7:cc:72:fd:f4:45:b2:c4:f9:c6:fb:cb:8d:c9:fc:9d:6d:51

  Signer

  Actual PE Digest

  13:63:54:79:eb:99:4d:6d:65:c0:95:ab:83:22:c7:cc:72:fd:f4:45:b2:c4:f9:c6:fb:cb:8d:c9:fc:9d:6d:51

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  api-ms-win-core-synch-l1-2-0

  WaitOnAddress

  WakeByAddressAll

  WakeByAddressSingle

  bcryptprimitives

  ProcessPrng

  advapi32

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  SystemFunction036

  GetTokenInformation

  OpenProcessToken

  d3dcompiler_47

  D3DCompile

  dwmapi

  DwmEnableBlurBehindWindow

  gdi32

  DeleteObject

  GetDeviceCaps

  CreateRectRgn

  kernel32

  GetConsoleOutputCP

  HeapSize

  SetFilePointerEx

  FlushFileBuffers

  HeapFree

  FreeLibrary

  HeapReAlloc

  GlobalFree

  GetLastError

  GlobalUnlock

  GetProcAddress

  SetThreadErrorMode

  LoadLibraryExW

  QueryPerformanceCounter

  CloseHandle

  SwitchToThread

  RemoveVectoredExceptionHandler

  GetCurrentThreadId

  AddVectoredExceptionHandler

  SetThreadStackGuarantee

  GetModuleHandleW

  GetCurrentProcess

  WaitForSingleObject

  WaitForMultipleObjects

  GetOverlappedResult

  GetExitCodeProcess

  GetSystemInfo

  UnmapViewOfFile

  GetQueuedCompletionStatusEx

  CreateIoCompletionPort

  SetFileCompletionNotificationModes

  SetLastError

  GetFinalPathNameByHandleW

  Sleep

  GetModuleHandleA

  PostQueuedCompletionStatus

  SetHandleInformation

  GetCurrentThread

  GetStdHandle

  GetConsoleMode

  MultiByteToWideChar

  WriteConsoleW

  QueryPerformanceFrequency

  FormatMessageW

  GetCurrentDirectoryW

  WaitForSingleObjectEx

  LoadLibraryA

  lstrlenW

  GetCurrentProcessId

  CreateMutexA

  ReleaseMutex

  RtlCaptureContext

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  GetEnvironmentVariableW

  GetTempPathW

  CreateFileW

  SetFileInformationByHandle

  GetFileInformationByHandle

  GetFileInformationByHandleEx

  GetFullPathNameW

  FindFirstFileW

  FindClose

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  CompareStringOrdinal

  GetModuleFileNameW

  GetSystemDirectoryW

  GetWindowsDirectoryW

  CreateProcessW

  GetFileAttributesW

  DuplicateHandle

  InitializeProcThreadAttributeList

  UpdateProcThreadAttribute

  DeleteProcThreadAttributeList

  CreateNamedPipeW

  CreateThread

  ReadFileEx

  SleepEx

  WriteFileEx

  CreateEventW

  CancelIo

  ReadFile

  ExitProcess

  HeapAlloc

  GetProcessHeap

  CreateFileMappingW

  MapViewOfFile

  VirtualProtect

  CreateEventA

  GlobalLock

  GlobalSize

  WideCharToMultiByte

  GlobalAlloc

  InitializeSListHead

  LCMapStringW

  CompareStringW

  FlsFree

  FlsSetValue

  FlsGetValue

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  IsProcessorFeaturePresent

  RtlUnwindEx

  RtlPcToFileHeader

  RaiseException

  EncodePointer

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  WriteFile

  TerminateProcess

  GetModuleHandleExW

  GetCommandLineA

  GetCommandLineW

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetEnvironmentVariableW

  SetStdHandle

  GetFileType

  GetStringTypeW

  FlsAlloc

  GetSystemTimeAsFileTime

  ole32

  CoInitializeEx

  RevokeDragDrop

  CoCreateInstance

  CoUninitialize

  OleInitialize

  RegisterDragDrop

  shell32

  DragQueryFileW

  DragFinish

  user32

  ClientToScreen

  GetCursorPos

  MapVirtualKeyW

  SendInput

  SetForegroundWindow

  GetClipboardData

  CloseClipboard

  OpenClipboard

  EmptyClipboard

  SetClipboardData

  RegisterWindowMessageA

  SystemParametersInfoA

  GetDC

  IsProcessDPIAware

  ShowWindow

  SendMessageW

  SetWindowLongW

  GetActiveWindow

  ShowCursor

  GetClipCursor

  ClipCursor

  GetKeyboardLayout

  ToUnicodeEx

  GetKeyState

  GetKeyboardState

  GetMenu

  AdjustWindowRectEx

  ReleaseCapture

  SetCapture

  MonitorFromRect

  DestroyWindow

  CloseTouchInputHandle

  RegisterRawInputDevices

  CreateWindowExW

  RegisterClassExW

  DestroyIcon

  MsgWaitForMultipleObjectsEx

  GetMessageW

  InvalidateRgn

  SetWindowPos

  GetWindowPlacement

  SetWindowPlacement

  ChangeDisplaySettingsExW

  RegisterTouchWindow

  GetSystemMetrics

  DispatchMessageW

  TranslateMessage

  MapVirtualKeyA

  GetUpdateRect

  PeekMessageW

  PostThreadMessageW

  ValidateRect

  GetRawInputData

  SetWindowLongPtrW

  DefWindowProcW

  GetWindowLongPtrW

  SetCursor

  LoadCursorW

  PostMessageW

  MonitorFromWindow

  SetWindowTextW

  GetClientRect

  RedrawWindow

  GetMonitorInfoW

  GetWindowLongW

  GetTouchInputInfo

  ScreenToClient

  MonitorFromPoint

  TrackMouseEvent

  uxtheme

  SetWindowTheme

  winmm

  timeBeginPeriod

  timeEndPeriod

  timeGetDevCaps

  bcrypt

  BCryptGenRandom

  ntdll

  NtReadFile

  NtWriteFile

  RtlNtStatusToDosError

  NtDeviceIoControlFile

  NtCreateFile

  NtCancelIoFileEx

  ws2_32

  WSAGetLastError

  getsockname

  WSASocketW

  ioctlsocket

  WSAIoctl

  bind

  closesocket

  connect

  getsockopt

  getpeername

  shutdown

  send

  recv

  WSACleanup

  WSAStartup

  freeaddrinfo

  getaddrinfo

  WSASend

  setsockopt

  crypt32

  CertOpenStore

  CertDuplicateCertificateChain

  CertFreeCertificateContext

  CertVerifyCertificateChainPolicy

  CertFreeCertificateChain

  CertGetCertificateChain

  CertAddCertificateContextToStore

  CertEnumCertificatesInStore

  CertCloseStore

  CertDuplicateCertificateContext

  CertDuplicateStore

  secur32

  EncryptMessage

  AcquireCredentialsHandleA

  FreeCredentialsHandle

  ApplyControlToken

  DeleteSecurityContext

  AcceptSecurityContext

  InitializeSecurityContextW

  QueryContextAttributesW

  DecryptMessage

  FreeContextBuffer

  Sections

  .text

  Size: 6.8MB - Virtual size: 6.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2.2MB - Virtual size: 2.2MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 239KB - Virtual size: 238KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 500B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 101KB - Virtual size: 100KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 37KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ