analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE

Full analysis: https://app.any.run/tasks/a43a2efd-f0ef-40f7-81d1-38c0d36725ed
Verdict: No threats detected
Analysis date: March 11, 2020, 20:08:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C8F358AD4BE0D7565DDE2CB8A4539E99

SHA1:

21F50551B4AF2CF25E975E8FA80F4E942BA9F668

SHA256:

B413EE439D0D21D572B2AFA9713B547667710A78E6BD7F1BE33D91B7365DB054

SSDEEP:

98304:OZn90dzASChbZbsuq5qF63J+9DdTaNIe8QRuKSRoGgrg/ew/RllYb:Q9G/Chb2tcF2M95GNERoGNew/Rsb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE (PID: 3272)
      • Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE (PID: 3460)

    • Loads dropped or rewritten executable

      • Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE (PID: 3460)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE (PID: 1168)
      • Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE (PID: 3272)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x15eb
UninitializedDataSize: -
InitializedDataSize: 4760064
CodeSize: 36352
LinkerVersion: 9
PEType: PE32
TimeStamp: 2013:06:28 16:45:44+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 28-Jun-2013 14:45:44
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 28-Jun-2013 14:45:44
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00008D54
0x00008E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.56215
.rdata
0x0000A000
0x00002114
0x00002200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.44357
.data
0x0000D000
0x00002ADC
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.1026
.rsrc
0x00010000
0x00485FA0
0x00486000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.98624
.reloc
0x00496000
0x00000EEA
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.32883

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.77792
357
Latin 1 / Western European
English - United States
RT_MANIFEST
101
7.93477
4118
Latin 1 / Western European
English - United States
RT_GROUP_ICON
ARCHIVE
7.99782
4438513
Latin 1 / Western European
UNKNOWN
RT_RCDATA
DECOMPRESSOR
6.09788
197632
Latin 1 / Western European
UNKNOWN
RT_RCDATA

Imports

ADVAPI32.dll
KERNEL32.dll
SHLWAPI.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
4
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start total war attila v1.6.0 build 9824 trainer +19 mrantifun.exe no specs total war attila v1.6.0 build 9824 trainer +19 mrantifun.exe total war attila v1.6.0 build 9824 trainer +19 mrantifun.exe total war attila v1.6.0 build 9824 trainer +19 mrantifun.exe

Process information

PID
CMD
Path
Indicators
Parent process
2012"C:\Users\admin\AppData\Local\Temp\Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE" C:\Users\admin\AppData\Local\Temp\Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
1168"C:\Users\admin\AppData\Local\Temp\Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE" C:\Users\admin\AppData\Local\Temp\Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3272"C:\Users\admin\AppData\Local\Temp\cetrainers\CET72A8.tmp\Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE" -ORIGIN:"C:\Users\admin\AppData\Local\Temp\"C:\Users\admin\AppData\Local\Temp\cetrainers\CET72A8.tmp\Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE
Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
3460"C:\Users\admin\AppData\Local\Temp\cetrainers\CET72A8.tmp\extracted\Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE" "C:\Users\admin\AppData\Local\Temp\cetrainers\CET72A8.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\admin\AppData\Local\Temp\"C:\Users\admin\AppData\Local\Temp\cetrainers\CET72A8.tmp\extracted\Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE
Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE
User:
admin
Company:
Cheat Engine
Integrity Level:
HIGH
Description:
Cheat Engine
Exit code:
0
Version:
6.5.0.4555
Total events
31
Read events
29
Write events
2
Delete events
0

Modification events

(PID) Process:(3460) Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXEKey:HKEY_CURRENT_USER\Software\Cheat Engine\Window Positions
Operation:writeName:AdvancedOptions Position
Value:
7E010000FF0100007402000029010000
(PID) Process:(3460) Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXEKey:HKEY_CURRENT_USER\Software\Cheat Engine\Window Positions
Operation:writeName:frmAutoInject Position
Value:
8701000000050000AF0100004B010000
Executable files
4
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1168Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXEC:\Users\admin\AppData\Local\Temp\cetrainers\CET72A8.tmp\CET_Archive.dat —
MD5:—
SHA256:—
3272Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXEC:\Users\admin\AppData\Local\Temp\cetrainers\CET72A8.tmp\extracted\CET_TRAINER.CETRAINERbinary
MD5:DD2F87507A91DB5A156B72C266D89AB2
SHA256:316C887421CC66EF50A5C9922FD669F316F6792421FD6DB23C32BAB6F18512D3
3272Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXEC:\Users\admin\AppData\Local\Temp\cetrainers\CET72A8.tmp\extracted\defines.luatext
MD5:1DC41A0A351E745085FCC98A3933D91F
SHA256:A2E02DD32F0245FF31190288B368B3EFBBE7C48A95DD22C321231C2F46597D9B
1168Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXEC:\Users\admin\AppData\Local\Temp\cetrainers\CET72A8.tmp\Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXEexecutable
MD5:6852660B8CBB67EE3F1E31BF2F1E0AFD
SHA256:CD86234CF14DFC0E66AE9E575326FD0CF74723A5A60337F7079C0540B6DA5C8B
3272Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXEC:\Users\admin\AppData\Local\Temp\cetrainers\CET72A8.tmp\extracted\win32\dbghelp.dllexecutable
MD5:9139604740814E53298A5E8428BA29D7
SHA256:150782FCA5E188762A41603E2D5C7AAD6B6419926BCADF350EBF84328E50948F
3272Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXEC:\Users\admin\AppData\Local\Temp\cetrainers\CET72A8.tmp\extracted\lua53-32.dllexecutable
MD5:C8F47A0E750E07D86A47B3296FB59A97
SHA256:DCFD91F21DEE9E70179337A85D21B3CA925F1A6C21DE9576AA5219732B7C7A86
3272Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXEC:\Users\admin\AppData\Local\Temp\cetrainers\CET72A8.tmp\extracted\Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXEexecutable
MD5:7FD341BC6D65A263627DEF33B1657A1A
SHA256:FB416F9301C9528EE3FED2A5AF3B209C0A7F2FA710198F9C07AB8EE96A4CFA96
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE
Offset of LBR_Count=760
Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE
sizeof fxstate = 512
Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE
TSymhandler.create
Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE
TSymhandler.create 1
Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE
TSymhandler.create 2
Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE
TSymhandler.create 3
Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE
TSymbolListHandler.create 1
Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE
TSymbolListHandler.create 2
Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE
TSymbolListHandler.create exit
Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE
TSymhandler.create exit
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Total War Attila V1.6.0 Build 9824 Trainer +19 MrAntiFun.EXE