analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe

Full analysis: https://app.any.run/tasks/ecad9455-33bf-4d91-8668-6c1fd40b576d
Verdict: Malicious activity
Analysis date: June 12, 2019, 11:29:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A013A0AE51952E019E5DC12AD58E12EF

SHA1:

9BC50BF78B77F4ED290FAFCFC9F22C18D1642AE7

SHA256:

2114DD0F39C05B33C09FC4E3E707D3790C795491F81B2829252E40B453FDA716

SSDEEP:

196608:abCqmSlkqlUgN7AktVweDO+oPG5eWWi/zio/i:YO2O+o+wWrX/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • TenioDL.exe (PID: 2916)
      • GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe (PID: 3824)
    • Application was dropped or rewritten from another process

      • TenioDL.exe (PID: 2916)
  • SUSPICIOUS

    • Low-level read access rights to disk partition

      • GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe (PID: 3824)
    • Creates files in the user directory

      • GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe (PID: 3824)
      • TenioDL.exe (PID: 2916)
    • Executable content was dropped or overwritten

      • GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe (PID: 3824)
    • Uses ICACLS.EXE to modify access control list

      • TenioDL.exe (PID: 2916)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

ProductVersion: 1,0,10900,123
ProductName: Tencent Gaming Buddy
OriginalFileName: GameDownload.exe
LegalCopyright: Copyright © 2017 Tencent. All Rights Reserved.
InternalName: GameDownload
FileVersion: 1.0.10900.123
FileDescription: Tencent Gaming Buddy - Install
CompanyName: Tencent
CharacterSet: Windows, Latin1
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.10900.123
FileVersionNumber: 1.0.10900.123
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x9e322
UninitializedDataSize: -
InitializedDataSize: 8377344
CodeSize: 1325056
LinkerVersion: 14
PEType: PE32
TimeStamp: 2019:06:04 10:42:43+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 04-Jun-2019 08:42:43
Detected languages:
  • Chinese - PRC
  • English - United States
Debug artifacts:
  • D:\jenkins_Trunk\workspace\RO\qqpcmgr_proj\AndroidEmulator\Output\Binfinal\GameDownload\GameDownload.pdb
CompanyName: Tencent
FileDescription: Tencent Gaming Buddy - Install
FileVersion: 1.0.10900.123
InternalName: GameDownload
LegalCopyright: Copyright © 2017 Tencent. All Rights Reserved.
OriginalFilename: GameDownload.exe
ProductName: Tencent Gaming Buddy
ProductVersion: 1,0,10900,123

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000130

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 04-Jun-2019 08:42:43
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00143760
0x00143800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.54513
.rdata
0x00145000
0x0005D44C
0x0005D600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.02137
.data
0x001A3000
0x000063B4
0x00004600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.74855
.gfids
0x001AA000
0x000003F4
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.04318
.tls
0x001AB000
0x00000009
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.QMGuid
0x001AC000
0x00000014
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x001AD000
0x007867E0
0x00786800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.42495
.reloc
0x00934000
0x00012844
0x00012A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.64734

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.89623
392
UNKNOWN
English - United States
RT_MANIFEST
2
2.89005
744
UNKNOWN
Chinese - PRC
RT_ICON
3
2.54353
296
UNKNOWN
Chinese - PRC
RT_ICON
4
4.35478
3752
UNKNOWN
Chinese - PRC
RT_ICON
5
5.17501
2216
UNKNOWN
Chinese - PRC
RT_ICON
6
3.47748
1384
UNKNOWN
Chinese - PRC
RT_ICON
7
3.0167
150
UNKNOWN
Chinese - PRC
RT_STRING
8
2.12138
68
UNKNOWN
Chinese - PRC
RT_STRING
9
4.05874
1128
UNKNOWN
Chinese - PRC
RT_ICON
10
0.867269
38
UNKNOWN
Chinese - PRC
RT_STRING

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
IMM32.dll
IPHLPAPI.DLL
KERNEL32.dll
NETAPI32.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll

Exports

Title
Ordinal
Address
curl_easy_cleanup
1
0x000688E0
curl_easy_duphandle
2
0x00068900
curl_easy_escape
3
0x00092EA0
curl_easy_getinfo
4
0x00068AE0
curl_easy_init
5
0x00068B00
curl_easy_pause
6
0x00068B40
curl_easy_perform
7
0x00068C60
curl_easy_recv
8
0x00068D50
curl_easy_reset
9
0x00068DA0
curl_easy_send
10
0x00068E50
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start gamedownload_pubg_mobile_tycs-cj-google-gdn_900202886_1.0.10900.123.exe no specs gamedownload_pubg_mobile_tycs-cj-google-gdn_900202886_1.0.10900.123.exe teniodl.exe icacls.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3068"C:\Users\admin\AppData\Local\Temp\GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe" C:\Users\admin\AppData\Local\Temp\GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exeexplorer.exe
User:
admin
Company:
Tencent
Integrity Level:
MEDIUM
Description:
Tencent Gaming Buddy - Install
Exit code:
3221226540
Version:
1.0.10900.123
3824"C:\Users\admin\AppData\Local\Temp\GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe" C:\Users\admin\AppData\Local\Temp\GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
explorer.exe
User:
admin
Company:
Tencent
Integrity Level:
HIGH
Description:
Tencent Gaming Buddy - Install
Version:
1.0.10900.123
2916C:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.exeC:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.exe
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
User:
admin
Company:
Tencent
Integrity Level:
HIGH
Description:
腾讯游戏云加速下载引擎(旋风Inside)
Version:
2, 0, 15, 26
324"C:\Windows\System32\icacls.exe" C:\Users\admin\AppData\Roaming\Tencent\Config\ /t /setintegritylevel lowC:\Windows\System32\icacls.exeTenioDL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
80
Read events
73
Write events
7
Delete events
0

Modification events

(PID) Process:(3824) GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\MobileGamePC
Operation:writeName:SupplyId
Value:
900202886
(PID) Process:(3824) GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exeKey:HKEY_CURRENT_USER\Software\Tencent\MobileGamePC
Operation:writeName:sf
Value:
C:\Temp\TxGameDownload\MobileGamePCShared
(PID) Process:(2916) TenioDL.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2916) TenioDL.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2916) TenioDL.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\metnsd\clsid
Operation:writeName:SequenceID
Value:
4DE67D61E8274143A65DB60A84392BCC
Executable files
5
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3824GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exeC:\test.tmp
MD5:
SHA256:
2916TenioDL.exeC:\Users\admin\AppData\Local\Temp\etilqs_YEgQZPVFTAEjyfv
MD5:
SHA256:
2916TenioDL.exeC:\Users\admin\AppData\Local\Temp\etilqs_xebGtRIfVyC6BqE
MD5:
SHA256:
2916TenioDL.exeC:\Users\admin\AppData\Roaming\Tencent\File\user_game.initext
MD5:1FE38846B57E1B0BA0C8360C0187A240
SHA256:F9282BE19744E53E3A28D5D56594F469BC33FEB3D2D5E4A3A4263B2AA486472D
3824GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exeC:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.exeexecutable
MD5:8FB4E336F4C145EB6E379701C3AC59D1
SHA256:D7A59B5BA3F0FB3906EBAA7A67C76088995A1F37652A2AE9893977C19754D9BF
3824GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exeC:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.dllexecutable
MD5:34431EB1AE2D3AC86E3415D8C3E977A3
SHA256:8379E09C7A3A51BDB652418781CEED8067E324B656C7D5A307B9A77C899F0806
3824GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exeC:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\dr.dllexecutable
MD5:2814ACBD607BA47BDBCDF6AC3076EE95
SHA256:5904A7E4D97EEAC939662C3638A0E145F64FF3DD0198F895C4BF0337595C6A67
3824GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exeC:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL_core.dllexecutable
MD5:11D65A68132E918BD80E7E0A09029730
SHA256:36C18DEDAC0429375C583FCF9420CDC9ACE8A38BBAC9F33378B5B4D6739DA511
3824GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exeC:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\p2papp.dllexecutable
MD5:B1B101D86C417286E60F471FC8B79BB1
SHA256:91CFA1769BE449DFDFBF6BCC8049CE5C9218DF6DEAA66A0879528526B204A51A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
12
DNS requests
11
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3824
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
125.39.247.36:8000
p2pupgrade.gamedl.qq.com
CHINA UNICOM China169 Backbone
CN
unknown
3824
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
58.250.137.93:443
master.etl.desktop.qq.com
China Unicom Guangdong IP network
CN
malicious
2916
TenioDL.exe
125.39.248.51:8000
ps2.gamedl.qq.com
CHINA UNICOM China169 Backbone
CN
unknown
2916
TenioDL.exe
220.194.106.125:14309
config.gamedl.qq.com
CHINA UNICOM China169 Backbone
CN
unknown
2916
TenioDL.exe
125.39.248.35:8000
p2pupgrade.gamedl.qq.com
CHINA UNICOM China169 Backbone
CN
unknown
125.39.248.39:8000
CHINA UNICOM China169 Backbone
CN
unknown
2916
TenioDL.exe
163.177.93.188:8000
stun.qqlive.qq.com
China Unicom Shenzen network
CN
unknown
109.169.22.99:29179
iomart Cloud Services Limited.
GB
unknown
163.177.93.179:8000
China Unicom Shenzen network
CN
unknown

DNS requests

Domain
IP
Reputation
p2pupgrade.gamedl.qq.com
  • 125.39.247.36
  • 125.39.248.35
unknown
masterconn.qq.com
  • 203.205.142.202
whitelisted
master.etl.desktop.qq.com
  • 58.250.137.93
  • 58.251.106.185
whitelisted
masterconn2.qq.com
  • 123.151.71.34
unknown
stat.gamedl.qq.com
  • 111.161.93.163
  • 111.161.93.164
  • 111.161.93.165
  • 125.39.248.43
  • 125.39.248.44
  • 125.39.248.45
unknown
config.gamedl.qq.com
  • 220.194.106.125
  • 125.39.248.36
whitelisted
stun.qqlive.qq.com
  • 163.177.93.188
  • 163.177.93.245
  • 220.249.245.24
  • 220.249.245.138
  • 163.177.93.178
suspicious
ps2.gamedl.qq.com
  • 125.39.248.51
  • 60.28.190.146
unknown
p2pupdate.gamedl.qq.com
  • 125.39.248.35
  • 125.39.247.36
unknown

Threats

PID
Process
Class
Message
2916
TenioDL.exe
Generic Protocol Command Decode
ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag false)
2916
TenioDL.exe
Generic Protocol Command Decode
ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag true change port flag false)
2916
TenioDL.exe
Generic Protocol Command Decode
ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag true)
Generic Protocol Command Decode
ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag false)
Generic Protocol Command Decode
ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag false)
Process
Message
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
[Downloader] DriverType C: = 3
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
[Downloader] DriverType C: = 3
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
[Downloader] GetLogicalDrives 4
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
[Downloader] DriverType C: = 3