1141efed74f2c12a1a6d871ae4594afe69f1bc60be9177039b8beb1e6723a89e

Sharing

Copy URL

Twitter E-mail

General

Target

1141efed74f2c12a1a6d871ae4594afe69f1bc60be9177039b8beb1e6723a89e
Size

1.0MB
MD5

b0bac627c7a08f3dcb3475f02b71cf00
SHA1

37401c3187d6254f16e4678307a5c5b52be7a826
SHA256

1141efed74f2c12a1a6d871ae4594afe69f1bc60be9177039b8beb1e6723a89e
SHA512

745e166544486e4f3f0531819faac7e934a165139159ec4dca3b72d37fd44e923d14f6dd40292dd9d8cc2ee4c9fd1336b93661060c10f9dc4706be85ed60043a
SSDEEP

24576:5L/D+yLPbg0sWU8nIB0tSk60aRkoZyb7aabH+pFjPR30dzqRPjDbHmXBvG710:5L/D+yLP1U8IyT60aWSi7aabHijOdzyo

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
static1/unpack001/Crack/Game/Bin/3dmgame.dll	vmprotect

Files

1141efed74f2c12a1a6d871ae4594afe69f1bc60be9177039b8beb1e6723a89e
.7z
2014年全部热门单机游戏及汉化下载.url
.url
Crack/Game/Bin/3dmgame.dll
.dll windows x86

44693d9c88552c4a25f692c8b262b07f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DecodePointer
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW

shell32

SHCreateDirectoryExW

ole32

CoInitialize

oleaut32

VariantClear

msvcr100

_encoded_null

msvcp100

?_Xout_of_range@std@@YAXPBD@Z

shlwapi

PathAddBackslashW

Exports

Exports

GlowStorm

Sections

.text
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 668KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2
Size: 800KB - Virtual size: 800KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Crack/Game/Bin/3dmgame.ini
Crack/Game/Bin/TS4.par
Crack/Game/Bin/The.Sims.4.Launcher.exe
.exe windows x86

beb107aa3888a0b1979dd3b648d63d45

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyA
lstrlenA
GetStartupInfoA
CreateProcessA
VirtualAllocEx
WriteProcessMemory
GetProcAddress
GetModuleHandleA
CreateRemoteThread
WaitForSingleObject
VirtualFreeEx
ResumeThread
GetCurrentDirectoryA
GetPrivateProfileStringA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EncodePointer
HeapSetInformation
InterlockedCompareExchange
GetSystemTimeAsFileTime
Sleep
InterlockedExchange

msvcr100

?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
__set_app_type
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
exit
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
sprintf
_fmode

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 494KB - Virtual size: 494KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
www.3dmgame.com.url
.url

Sharing

General

Malware Config

Signatures

Files

44693d9c88552c4a25f692c8b262b07f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

msvcr100

msvcp100

shlwapi

Exports

Exports

Sections

.text Size: - Virtual size: 84KB

.rdata Size: - Virtual size: 23KB

.data Size: - Virtual size: 155KB

.rsrc Size: 512B - Virtual size: 436B

.vmp0 Size: - Virtual size: 7KB

.vmp1 Size: - Virtual size: 668KB

.vmp2 Size: 800KB - Virtual size: 800KB

.reloc Size: 512B - Virtual size: 248B

beb107aa3888a0b1979dd3b648d63d45

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcr100

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 904B

.rsrc Size: 494KB - Virtual size: 494KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: - Virtual size: 84KB

.rdata
Size: - Virtual size: 23KB

.data
Size: - Virtual size: 155KB

.rsrc
Size: 512B - Virtual size: 436B

.vmp0
Size: - Virtual size: 7KB

.vmp1
Size: - Virtual size: 668KB

.vmp2
Size: 800KB - Virtual size: 800KB

.reloc
Size: 512B - Virtual size: 248B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 904B

.rsrc
Size: 494KB - Virtual size: 494KB

.reloc
Size: 2KB - Virtual size: 1KB