ac50a2f233bed117ea4aab2ec0437e1d04661664f24f1a59cfd29c9fad16f77a

Sharing

Copy URL

Twitter E-mail

General

Target

ac50a2f233bed117ea4aab2ec0437e1d04661664f24f1a59cfd29c9fad16f77a
Size

9.2MB
MD5

cdddbf0f10471979020add99af6129e0
SHA1

5ef2a6ddc735a5138118f58d68b4f4da11e2c5a8
SHA256

ac50a2f233bed117ea4aab2ec0437e1d04661664f24f1a59cfd29c9fad16f77a
SHA512

9a3a3ece0be8b0d7952efe7a0dc41d9afe7f67d11a5c01ec29a98153de1058e563ffee78521d3d0662c26c3604a1f392ef1b27ca1d978ddadee214e22907de87
SSDEEP

196608:N7Vzxmxq5RGJm5a7ZYKV6swx9WhVBb2HUkBSWmgnvgAvtiiDAk9dQY:NP8q5RRa7ZDVbi9uByHvS8YzWpQY

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
static1/unpack001/mxdbl.pc6.0831/冒险伴侣0831/Partner.dll	vmprotect
static1/unpack001/mxdbl.pc6.0831/冒险伴侣0831/冒險伴侶.exe	vmprotect

Files

ac50a2f233bed117ea4aab2ec0437e1d04661664f24f1a59cfd29c9fad16f77a
.zip
mxdbl.pc6.0831/冒险伴侣0831/Baidu_Com_90000168.exe
.exe windows x86

32f3282581436269b3a75b6675fe3e08

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:df:76:75:aa:a0:8d:1b:49:a8:3a:48:0f:14:85:5d:24
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

22-02-2012 09:18

Not After

22-02-2015 09:18

Subject

CN=Baidu (China) Co.\, Ltd.,O=Baidu (China) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:55

Not After

15-04-2021 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:cb:02:c2:58:99:4a:96:e8:84:d8:9a:93:74:4a:43:00:5d:7d:13
Signer

Actual PE Digest

0a:cb:02:c2:58:99:4a:96:e8:84:d8:9a:93:74:4a:43:00:5d:7d:13

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Baidu (China) Co.\, Ltd.,O=Baidu (China) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

06-08-2014 05:52
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 612KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mxdbl.pc6.0831/冒险伴侣0831/HYDati.dll
.dll regsvr32 windows x86

62c7ad5bf3b942835d292e08266e5025

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

__WSAFDIsSet
closesocket
shutdown
getsockopt
select
connect
setsockopt
htons
gethostbyname
socket
WSAStartup
send
WSAGetLastError
recv
ioctlsocket

kernel32

WideCharToMultiByte
FormatMessageA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
LocalFree
GetTempPathA
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
RaiseException
GetProcAddress
LoadLibraryA
GetModuleFileNameA
DeleteCriticalSection
LocalAlloc
FreeLibrary
lstrlenA
GetModuleHandleA
lstrcmpiA
IsDBCSLeadByte
lstrlenW
SizeofResource
LoadResource
FindResourceA
GetTickCount
GetThreadLocale
SetThreadLocale
GetModuleHandleW
TlsAlloc
HeapDestroy
HeapCreate
GetModuleFileNameW
GetStdHandle
WriteFile
ExitProcess
GetLocalTime
DeleteFileA
MultiByteToWideChar
Sleep
TlsGetValue
TlsSetValue
TlsFree
SetLastError
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetProcessHeap
GetCPInfo
LCMapStringW
RtlUnwind
GetCommandLineA
GetCurrentThreadId
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
LoadLibraryExA
HeapSize
IsProcessorFeaturePresent
SetEndOfFile
CreateFileW
WriteConsoleW
SetStdHandle
CreateFileA
LoadLibraryW
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
FlushFileBuffers
GetConsoleMode
GetConsoleCP
CloseHandle
ReadFile
GetStartupInfoW
GetFileType
SetHandleCount
SetFilePointer
EncodePointer
DecodePointer
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
MoveFileA

user32

CharNextW
CharNextA
ReleaseDC
GetWindowDC
GetDesktopWindow

advapi32

RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegQueryInfoKeyA
RegDeleteKeyA

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2

oleaut32

UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysStringLen
SysAllocString
VarUI4FromStr
SysFreeString
VariantClear

gdi32

CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
DeleteObject
DeleteDC
GetObjectA
GetDIBits

gdiplus

GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipSaveImageToFile
GdipCloneImage
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipAlloc
GdipFree

Exports

Exports

Charge
CheckAccAuthcode
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EnableLog
GetAnswer
QueryBalance
QueryLoad
RegisterSubacc
ReportError
SendFile
SendGif
SendImage
SetAuthor
SetMode

Sections

.text
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mxdbl.pc6.0831/冒险伴侣0831/PC6下载.url
.url
mxdbl.pc6.0831/冒险伴侣0831/Partner.dll
.dll windows x86

5994acf964df52e22cad4fb9ce9c3c26

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

PlaySoundA

mfc42

ord4465

msvcrt

__CxxFrameHandler

kernel32

lstrcmpA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetWindowRect

advapi32

OpenProcessToken

ole32

CreateStreamOnHGlobal

olepro32

ord251

imagehlp

MapFileAndCheckSumA

psapi

EmptyWorkingSet

shlwapi

StrToIntA

msvcp60

??0_Lockit@std@@QAE@XZ

Exports

Exports

Install
Uninstall
��C��S{7è��Y$ܠ��DL�#~.��#��`{�\7f{�x�� r��6�ӻ��K�s+E�p�5��2��Ҕ29"�Ya�q��b�=&�'v{K��4k�ݕ[�Sy��b3[1*VS�@"K��,��M:��R��+�^p=m� qƜ>Fφe.I��0]��Q�֕��zE�� y��L�E��٢a��&[�y{�Pr��k�>\�Nxv��o5�>�Xs�ҟ�-BKv��6��z��ob�8Og{҂��T�Igy�ȻϾQl{y��8��4/h��K}�. 1�犰�ݒ�/EH�M{��_�Ck�۩��q��U��9%��$��a�יĐ�;��V�-شJ�O�z��M��s�_��,Ԇ��a_ܽI苔��1'�}��%�԰;�=�@A��ȥT��\@"�겔セm��$x]o'�%��ςAd ��=��!<��e-��2��u8��A�$m�,9K�[��Q�X$Gel@��>�+�H��m�C��;Y9��꫸�ލ��7.��gٛ��E�֒��ޫ$�Pu0�1��I ��M7 te��}V ߥ�b8鸅H��}�wx��>T��4��y�˼�aW��zkv�:l �ty��wn"}?�ڇ��.�ؿ�5Qٰ�^).ģ�� }��z��.Al!��T<fY�n��RМ��k�O�36��_.�Pݪ�� e�)�,�uw&�W� ��I�쏨:P>Ⱦ{Ҹc�a��$T�Ȕ�3�U��`�6�p��F�{9�׏fB�C�J��j�h��[�,��ҿ� [LRƁ`Jg�EA>�^��C�!�T�N�+��q�*�; M�I��RGW��!��J�� @��=�s��$؇�؂H��] rg�M�(��2nb1r�&.��9�Cg �,}�E�qYƪ0Qi��h�L9(��U�:�h��9�}�i�w�h3$ND^oL��ц��!�sgk;zJ�C�n��<E4C4Y OUaS�WO#�WI׻}/� ��#��33��'��"�Q��&ƙ/9��Ų�w��L #��y!A��Xh��+h��E�)��V�-o��07˵G ��<��J��s"��7y�[��l��e�/�n��yi��HlN0��<��8p5�8a�5�'t��ڈ*M1��&,��UR��a5)X.��r�ŕ� <,2<L;�"�� P�~4��`-�o��M�8��Ds�1��m�+��4�$�˫��Z�5ӱty)֜�CH裇�dh��B��6�Y��6�N�gQ��y��lͦ+*`��GDMΦkC��S=�|A��_�-��R�ҲU�6��QĊ�v�R��A�E_|fhO�j��^>�HIV6a3��:A��1�hYČ�[�M@�T~��p�� Q8��R,��Q6��G�@�� ˳+be僀"/��JG��̲�A�Ӏ ɧ ��L��Y��#K�!�9CgV9n��)x�I��d#Q�=��R�_��//�t�Q��?}<7`�=�o�b��e��yk��-օK�= MM��9��f��<8P��Qf�?�^��IjjB;\�L��e-�8ˠ��Jh�m�A��n�� z!A�� ArNI(�,i~�� ;YS�t�%4��W��{��{�m��2�U�V#�kM�H��XY��䈪��D�[�LV�Y��?��%��O��UլR]Ng�fA�m�4�p�H�΀yT~�wD�yGJ�n�T̓��]ŘI��'�0w?��2�(��(L��V��Foa�$�� M�4,L8�h��Am^�oA��14��*�iãU�|I��~(��,{V��(=��5Q��;��+%y1��XD}{@U�\��~��Ⱦ��S��^�;B�A JQ�W��W�v��֚��N84�A ��$^��-I�P��D�ُo�� o��Fy'��_��ԫ�e�q�5��3L��%Px�š9q6%ngI�n׌��젎��fka$_&7'|�z&��@a��0-]��u�wVpB-��Lk7� _�ON@��A�=��,�_��b�Y�X\��6�o1��q{C�[H��J��*��\&K ��8��`��I2�?UzO�sFp�� g��H�5p~,-0�i��kz&$�:m��K�X�|��h$�y�'{��+��3��W��{S��P)BR>�A��̊٤��$�u~��e#8�/��Z�gHm��n�u��Q��zk�T2'�,�q��co�Y��r��ٍ"�tU S1a=��59�j��b#-!ݪ��Wg��'��Щ{4d��+�e�t�r��|�n5�4��y@*�ث� ��쇭��WZ+��gd�j[�B+|<^hPP��\X+>��!�p�u��K*ϴֶZ��D�OMâ#s�W��m�� ~�Z��MS��!$��ߙbv#&�$�h��Y��Cj��B /�|�uC�T��3K��R�L��u8�@��b��x��1��T��CoH{��3+$�@��1l��1��i��Vb��i!��T�Lџ��I��Z��#��#L`�0��/� okB�_+o�-^/�Ê�p8d�[��m��/�AuU{7`?e+�w��pVs~ �$�" ��f��_��,�q��SɡXa��ް��]�H�ow��RG29y\��>��wݵ�/��lه��ìqX��m��0�˫=Q2/H' JT�'q��<.��ю�;�=��2��4S��q� �q��z٥0wę=�� i״j�E@j�p�T2��D4"5��fz[KpŖ��I,�%ۗ :N~C�p��*�nk@��Ж<�G�b��6+9ޣ/8w}��$��6��ԅ�\��Op�e�qB��q�=��<�J1��w̪� K

Sections

.text
Size: - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Install
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 842KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 519KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 997KB - Virtual size: 996KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 926KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
mxdbl.pc6.0831/冒险伴侣0831/bldllw32.dll
.dll windows x86

533e975b270cb98ffcbe1d6b741d2f87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateMutexW
FindResourceA
SetThreadContext
FreeResource
TlsGetValue
MapViewOfFile
UnmapViewOfFile
MoveFileExA
lstrcpynA
FreeLibrary
LoadResource
CreateProcessW
GetCurrentProcess
WaitForSingleObject
SetEvent
GetTickCount
CreateRemoteThread
WriteFile
GetCommandLineA
TlsSetValue
Thread32First
TerminateThread
Sleep
SizeofResource
CreateEventA
CreateSemaphoreA
CreateProcessA
TerminateProcess
Thread32Next
GetSystemDirectoryA
CreateFileW
lstrcatA
GetACP
ExitThread
CreateDirectoryA
SetCurrentDirectoryA
FindFirstFileA
CreateFileA
SetLastError
lstrcmpiA
GetProcAddress
CopyFileA
DisableThreadLibraryCalls
VirtualAllocEx
LoadLibraryA
OpenThread
CreateFileMappingA
LockResource
GetModuleFileNameA
Process32NextW
FindNextFileA
GetModuleHandleA
CreateMutexA
VirtualProtect
GetCurrentDirectoryA
CreateToolhelp32Snapshot
GetCurrentThreadId
TlsAlloc
CloseHandle
GetCurrentProcessId
GetTempPathA
OpenFileMappingA
WriteProcessMemory
TlsFree
ResumeThread
DeleteFileA
CreateThread
lstrcpyA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
GetThreadContext
GetConsoleMode
ExitProcess
GetLastError
GetConsoleCP
SetStdHandle
SetFilePointer
VirtualQuery
HeapAlloc
HeapFree
GetProcessHeap
VirtualFreeEx
GetSystemInfo
GetVersionExA
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
RaiseException
GetCPInfo
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
HeapSize
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
ReadFile

user32

CallNextHookEx
wsprintfA
MessageBoxA
SetWindowsHookExA
GetSystemMetrics

iphlpapi

GetAdaptersInfo

psapi

GetMappedFileNameA

netapi32

Netbios

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

Exports

Exports

AhnCreateProcessWithSDK
AhnExportEx
AhnSetInfomation
WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification
_AntiHookCreateRmoterThread@8
_AntiHookCreateRmoterThreadEx@12
_AntiHookGetMainThreadId@0
_AntiHookGetProcAddress@8
_AntiHookGetProcAddressForTable@8
_AntiHookGetSelfModuleByAddress@4
_AntiHookGetSelfModuleHandle@0
_AntiHookSetThreadToMain@0
_AntiHookSetToken@0

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
mxdbl.pc6.0831/冒险伴侣0831/v119无声补丁.zip
.rar
mxdbl.pc6.0831/冒险伴侣0831/使用更新说明.txt
mxdbl.pc6.0831/冒险伴侣0831/冒险伴侣说明新手必看.chm
.chm
mxdbl.pc6.0831/冒险伴侣0831/冒險伴侶.exe
.exe windows x86

a8c434d8f3a61e9143236bc318ece075

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

EnumWindows

gdi32

CopyMetaFileA

msimg32

TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA

advapi32

RegQueryValueExA

shell32

ShellExecuteA

comctl32

ImageList_GetIconSize

shlwapi

SHDeleteKeyA

ole32

ReleaseStgMedium

oleaut32

SafeArrayDestroy

oledlg

ord8

urlmon

URLDownloadToFileA

gdiplus

GdipAlloc

imagehlp

MapFileAndCheckSumA

wininet

InternetCheckConnectionA

ws2_32

shutdown

oleacc

AccessibleObjectFromWindow

imm32

ImmReleaseContext

winmm

PlaySoundA

Exports

Exports

�O�~L�rl��P��aߗ2��'B��璛pV��V��MQ�k�U)@{��Ep��%�i�-J��V�X�|��z�|EK��̷P49\x�ui*��ɦpO��^ʝ�s|_��P��eY^MPMB؈��K%҂{��-�@Ϸ�*p!�l[5V�6�(�Jl��7"G_α-��(��2}�L�r�Mi�V�gF��E^��$��!_��%�+��z��͆��hS��\0t7s��`��]F�#��.��/��9: �W9��+_�t��Y��9h��T�V��Q &��o��I��g �}�C�� S%Z��S��)� ��O0�q�Vmd-��vo?��U� i%6ig�-O�n�p�9_�+И &�j�Q�`4�Nn�Ĥ�/@�d��?�UD��k��5�Q!�S_��m�<��-΂F]��z6�/��E>P r��^��"�Nf��D��2ԛ��~:��]��Z6��L��u��f;��By��YL^Km�Bʠ_�`�B��yl�#�핪lx��R�a ��9�=�'�FV��u��To��L�2��IINFh��JTxW�hB��\w��/m`Лt��d%��6�'��.Τl�]�;<8�MJ��J�Ҋ��W�To�ԑk*�5Lfvq��~�τh"'��6��d5�k5��Uo#WR�5"t�]~�u��2!S�?��bo��+0��YX݈$�D�2A��d�= ��!��&{e��ܮ30\7[77��Qu+��|\ >'��-��D�mo8�O ˵G�<��@�x�U �4&�=�S��ʵ��4$�7+�V�Σ�.|��^u#A� ��v�#K�?ԬI�� ،��N��g�kb�>�{��|��@o�R��?Wz�Nbu �٘'��Q=��d|��&�A��_��]"N��A ��\��y�fO+�vJ럒�j�v�<��kݶZi�Y\��W�Rh_�c�~�Kݻ�w5S�p�}A�xyJ5;�ȃV��8�\g}��e t��x{:jhf��,��&�!将s t�?��ݚ�G�GS��`��aj<��s �.�-�a�� U�[��֜:��hS �s�%z�WMv�wp�~,��Y�D�7,7�)<��Ǡ��G�L]-��f� �K;��^zu�LIA�'��qJG�A��p�)��K�T�6`ʐ�B4�# ��(L�^KH�dX4��Jv S��"zj�Wzfb��i��O=;W,i��T�D�Zq��+�ݕ }��TO��M�is!�X��G��4o�b�r``��=��:l7q ��t|�d�E��ͨS ��!��<�B��l��ﶩ?�Mn��=�T[�J��L,��\;x�ج�4�ok��:]�z6��Y�_>ހ�P�ʒ�:L��0��7�~5�o�u]��M��mR20B�[O��i�� s��Ѕ@�d��7�CC�R�p��䙄�ق�Z��p��[I��#�2w<��2��q/ǣ�Bƣ��Nj�X��K*��4��}!wM(��Se6�z�C��a]cܑ �7�ф�L,�0��h=��G[~��\��{m�k�?��v�œ+�J@��U�uC��G�-��t_[z\��]e��E��$mm&��9`0@6tPu��/��;�=��w��X5Z�!��Ⱥ�*Ұ��4�V� B<��i��4Q��+�면~��6+��an��|Ø]ޤoH6�+�C3��*Ko�Ǳ��\6a��_�7~��B��g��f��fY��̃%�Ay-e��J#�PR15iz/*^m��{N��n��Dt��k��>2�<�q�{US1��C�[[��1��}��?�9S��[)/��3`I�To��er�NIzO��КL;PV}��X�G_�0�E��ܙO��_��8g��d��ؽ�I��(�¹u�Ň��[�Z/�iw��&�8j�N�p�d��h��T�w��f��0!^1��[�`��M��؜��g({�o�נ�:K��AE{��'��>,�:��/�{�Ί�&z��&0�7��9^�Uæ�X`�< ��Ð5{DVP�� e�s�G��כ�«-i0��:��9ŗњ<Pl�Fj��Q��ɠ��+�;"��#Тyp؉l��@||��o~'�Q_f��o ��:��|-�&��aQ,6�d$�txf��vA:�Weh=��_�~�c(O��o�]WB�?��:2��k�A^ɠJ`�/�"%��KpG�`��ÝV��/�O7O��o��ez(��0ΖӶ�q]��b�q��Ӂ�� Ij��T5��+>��p:p�ա�X��.��8�c��7=�[�a�S�>b0db��;\~��3(�ң�-��?�ʺ=pƤ��7v�9-[��G�f�� +>�ZB�<��S��U�)Xg��)1��C,�^�_�Nc��?�eX�TjI*ۗ�EE_�|n? $��Ⱦ��t��m~4��S�'��b<��C�ݮ��B��o��n{��_�D��Bg��E �KÜ��̰P�n�;ˎd2㏶"�wS��&G��4.�,Qf�^~!�;��D{�$@��gQ��N�i��n��f�V��N�Z�X��i貌��/�2gd�fN�h��|�u�~��h�,��tB Z9g��_�� U ��<{�V��S�$n�®.��!,_ ��,!��95�l�Υ��5<\��x�= �kFrj��1��_44��a�g�4_ 1��c��i��/��8��2"!��@��<��#�rw� ��e��C�85f�C��S,�Wpc�וڇ��TG�(��޼'$�eX�H�#��jV��d�w Bε"Q��}OCE�ݓ.��Xb3L��<g�bR�+

Sections

.text
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
mxdbl.pc6.0831/冒险伴侣0831/更新内容.txt
mxdbl.pc6.0831/冒险伴侣0831/游戏修改器下载说明.txt
mxdbl.pc6.0831/冒险伴侣0831/炎术士-灭绝之焰全屏设置图.jpg
.jpg
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/埃德尔斯坦/埃德尔斯坦副本1.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/埃德尔斯坦/埃德尔斯坦副本2.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/埃德尔斯坦/埃德尔斯坦副本3.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/埃德尔斯坦/埃德尔斯坦副本4.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/射手村/射手村副本1.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/射手村/射手村副本2.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/射手村/射手村副本3.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/射手村/射手村副本4.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/时间神殿/dynlog.txt
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/时间神殿/时间神殿副本1.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/时间神殿/时间神殿副本2.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/时间神殿/时间神殿副本3.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/武陵/武陵副本1.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/武陵/武陵副本2.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/武陵/武陵副本3.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/武陵/武陵副本4.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/武陵/武陵副本5.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/玛加提亚/玛加提亚副本1.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/玛加提亚/玛加提亚副本2.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/玛加提亚/玛加提亚副本3.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/玛加提亚/玛加提亚副本4.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/玩具城/玩具城副本1.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/玩具城/玩具城副本2.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/玩具城/玩具城副本3.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/玩具城/玩具城副本4.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/神木村/神木村副本1.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/神木村/神木村副本2.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/神木村/神木村副本3.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/阿里安特/阿里安特副本1.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/阿里安特/阿里安特副本2.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/阿里安特/阿里安特副本3.ini
mxdbl.pc6.0831/冒险伴侣0831/神之子副本/阿里安特/阿里安特副本4.ini

Sharing

General

Malware Config

Signatures

Files

32f3282581436269b3a75b6675fe3e08

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

11:21:df:76:75:aa:a0:8d:1b:49:a8:3a:48:0f:14:85:5d:24Certificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

0a:cb:02:c2:58:99:4a:96:e8:84:d8:9a:93:74:4a:43:00:5d:7d:13Signer

Signature Validations

Verification

06-08-2014 05:52 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 415KB

.ndata Size: - Virtual size: 612KB

.rsrc Size: 22KB - Virtual size: 22KB

.reloc Size: 4KB - Virtual size: 3KB

62c7ad5bf3b942835d292e08266e5025

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

ole32

oleaut32

gdi32

gdiplus

Exports

Exports

Sections

.text Size: 194KB - Virtual size: 193KB

.rdata Size: 41KB - Virtual size: 41KB

.data Size: 9KB - Virtual size: 17KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 16KB - Virtual size: 16KB

5994acf964df52e22cad4fb9ce9c3c26

Headers

File Characteristics

Imports

winmm

mfc42

msvcrt

kernel32

user32

advapi32

ole32

olepro32

imagehlp

psapi

shlwapi

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

11:21:df:76:75:aa:a0:8d:1b:49:a8:3a:48:0f:14:85:5d:24
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

0a:cb:02:c2:58:99:4a:96:e8:84:d8:9a:93:74:4a:43:00:5d:7d:13
Signer

06-08-2014 05:52
Valid: false

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 415KB

.ndata
Size: - Virtual size: 612KB

.rsrc
Size: 22KB - Virtual size: 22KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 194KB - Virtual size: 193KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 9KB - Virtual size: 17KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 16KB - Virtual size: 16KB

.text
Size: - Virtual size: 123KB

.Install
Size: - Virtual size: 1KB

.data
Size: - Virtual size: 842KB

.vmp0
Size: - Virtual size: 519KB

.tls
Size: 512B - Virtual size: 24B

.vmp1
Size: 997KB - Virtual size: 996KB

.reloc
Size: 512B - Virtual size: 248B

.rsrc
Size: 1KB - Virtual size: 926KB

.text
Size: 56KB - Virtual size: 55KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 7KB - Virtual size: 18KB

.vmp0
Size: 332KB - Virtual size: 331KB

.reloc
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 232KB - Virtual size: 232KB

.text
Size: - Virtual size: 1.2MB

.rdata
Size: - Virtual size: 290KB

.data
Size: - Virtual size: 54KB

.vmp0
Size: - Virtual size: 2.8MB

.tls
Size: 512B - Virtual size: 24B

.vmp1
Size: 3.7MB - Virtual size: 3.7MB

.reloc
Size: 512B - Virtual size: 388B

.rsrc
Size: 68KB - Virtual size: 68KB