70fea8fc72febc359c4c020dc4d56a17f72c50acd9c09a510bbb1167d9c6cd79

Sharing

Copy URL Twitter E-mail

General

Target

70fea8fc72febc359c4c020dc4d56a17f72c50acd9c09a510bbb1167d9c6cd79
Size

3.8MB
MD5

4a765585664146d6f3e81a7b5b664866
SHA1

eb7b7d6ffae62a1d650252be9370ce172596e3f7
SHA256

70fea8fc72febc359c4c020dc4d56a17f72c50acd9c09a510bbb1167d9c6cd79
SHA512

fbc0ac017e0347ac1f80b7ed166ab323e551f438fb42f08c75359d551df735d0bf162f0c773c108e197b89bedd32868909c5ae63d3952431a2529e1172f7d755
SSDEEP

98304:gHwzWWzu0wB3S2CPEqf+LLi1up7i8/Qbx71FJ8Lenths:gHwzWW83zCPzf+LzfQbF1FCKnt6

Score

N/A

Malware Config

Signatures

Files

70fea8fc72febc359c4c020dc4d56a17f72c50acd9c09a510bbb1167d9c6cd79
.rar
3DMGAME.ini
iw6sp64_ship.exe
.exe windows x64

119fff86056d8234d3c2bfae716a9497

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

steam_api64

SteamUserStats
SteamUtils
SteamUser
SteamAPI_Init
SteamAPI_Shutdown
SteamApps
SteamNetworking
SteamRemoteStorage
SteamAPI_RunCallbacks
SteamAPI_UnregisterCallback
SteamAPI_GetSteamInstallPath
SteamAPI_RestartAppIfNecessary
SteamMatchmaking
SteamFriends
SteamAPI_RegisterCallResult
SteamAPI_RegisterCallback
SteamAPI_UnregisterCallResult

bink2w64

BinkSetMemory
BinkOpenXAudio2
BinkSetSoundSystem
BinkSetError
BinkSetSoundTrack
BinkGetRealtime
BinkControlBackgroundIO
BinkSetSpeakerVolumes
BinkGetKeyFrame
BinkGoto
BinkPause
BinkClose
BinkWait
BinkNextFrame
BinkDoFrame
BinkRegisterFrameBuffers
BinkGetFrameBuffersInfo
BinkOpen
BinkGetError
BinkSetIOSize

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory

powrprof

CallNtPowerInformation

kernel32

GetVersion
SetEndOfFile
GetCurrentDirectoryW
GetFullPathNameW
CreateFileW
WriteConsoleW
GetFileAttributesExW
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetVersionExW
FlushConsoleInputBuffer
InitializeCriticalSectionAndSpinCount
FreeLibrary
GetProcAddress
LoadLibraryA
SetDllDirectoryA
ReleaseMutex
WaitForSingleObject
GetCurrentThreadId
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetSystemInfo
ReadFileEx
GetLastError
SleepEx
CloseHandle
DuplicateHandle
RaiseException
SetEvent
ResetEvent
CreateEventA
GetCurrentProcess
CreateThread
GetCurrentThread
SetThreadPriority
GetThreadPriority
SuspendThread
ResumeThread
GetProcessAffinityMask
SetThreadAffinityMask
CreateEventExA
WaitForMultipleObjects
GetFileAttributesA
VirtualAlloc
VirtualFree
CreateMutexA
CreateFileA
GetCurrentDirectoryA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetModuleFileNameA
GetModuleHandleA
GetVersionExA
GlobalMemoryStatus
SetProcessAffinityMask
ReadFile
SetErrorMode
GetCurrentProcessId
SetPriorityClass
OpenProcess
FormatMessageA
GetLocaleInfoA
GetUserDefaultLCID
CreateToolhelp32Snapshot
Module32First
Module32Next
MultiByteToWideChar
GetSystemTime
SystemTimeToFileTime
MulDiv
SetThreadExecutionState
GlobalMemoryStatusEx
LocalFree
HeapSize
GetModuleFileNameW
GetStdHandle
GetProcessHeap
SetLastError
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
IsProcessorFeaturePresent
IsDebuggerPresent
PeekNamedPipe
GetFileType
GetFileInformationByHandle
FileTimeToLocalFileTime
RtlPcToFileHeader
GetCommandLineA
RtlCaptureContext
HeapReAlloc
RtlLookupFunctionEntry
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindNextFileA
FindFirstFileExA
FindClose
WideCharToMultiByte
GetSystemTimeAsFileTime
RtlUnwindEx
GetTempPathA
CreateProcessA
AreFileApisANSI
GetModuleHandleExW
ExitProcess
DecodePointer
EncodePointer
HeapAlloc
HeapFree
GetTickCount
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
LoadLibraryExW
SetConsoleCtrlHandler
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointer
SetFilePointerEx
GetExitCodeProcess
CreatePipe
DeleteFileW
MoveFileExW
GetTimeZoneInformation
CreateDirectoryW
DeleteCriticalSection
WriteFile
ReadConsoleInputA
SetConsoleMode
DeleteFileA
FindFirstFileExW
GetDriveTypeW
LoadLibraryW
OutputDebugStringW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEnvironmentVariableW
SetEnvironmentVariableA

user32

GetMonitorInfoA
MonitorFromWindow
SystemParametersInfoA
MapVirtualKeyA
MoveWindow
RegisterWindowMessageA
SetWindowLongPtrA
SetWindowTextA
CloseWindow
CallWindowProcA
SendMessageW
LoadImageA
AdjustWindowRect
UpdateWindow
SetWindowPos
DestroyWindow
CreateWindowExA
RegisterClassA
DefWindowProcA
SendMessageA
MessageBoxW
IsWindow
AdjustWindowRectEx
MonitorFromPoint
LoadIconA
LoadCursorA
MessageBoxA
GetActiveWindow
EnumDisplayMonitors
ShowWindow
RegisterClassExA
PeekMessageA
DispatchMessageA
TranslateMessage
GetMessageA
LoadStringA
ScreenToClient
GetCursorPos
SetCursorPos
ShowCursor
GetForegroundWindow
SetFocus
PostMessageA
GetSystemMetrics
ChangeDisplaySettingsA
EnumThreadWindows
GetDesktopWindow
SetWindowLongA
GetWindowLongA
GetWindowTextA
ReleaseDC
GetDC
PostQuitMessage
ClientToScreen
ClipCursor
GetWindowRect
GetClientRect
GetUserObjectInformationW
GetProcessWindowStation

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
GetObjectW
BitBlt
CreateDCW
DeleteObject
DeleteDC
CreateFontA
CreateSolidBrush
SetDeviceGammaRamp
GetDeviceCaps
GetBitmapBits

advapi32

RegQueryInfoKeyA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegQueryValueExA
CryptAcquireContextA
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptReleaseContext

shell32

ShellExecuteA

ole32

CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitializeEx

xinput1_3

ord2
ord3
ord4

ws2_32

sendto
recvfrom
connect
gethostbyname
inet_addr
WSAGetLastError
socket
shutdown
setsockopt
gethostname
select
recv
ntohl
htons
ioctlsocket
closesocket
bind
__WSAFDIsSet
inet_ntoa
ntohs
send
WSASetLastError
getsockname

psapi

GetModuleBaseNameA
EnumProcessModulesEx

Sections

.text
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.interpr
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 245KB - Virtual size: 99.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 334KB - Virtual size: 334KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 97B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vybruss
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
steam_api.dll
.dll windows x86

f4a0119c4fecdb9bc63993c51488830d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxA

shell32

SHGetSpecialFolderPathA

Exports

Exports

GetHSteamPipe
GetHSteamUser
SteamAPI_GetHSteamPipe
SteamAPI_GetHSteamUser
SteamAPI_GetSteamInstallPath
SteamAPI_Init
SteamAPI_InitSafe
SteamAPI_IsSteamRunning
SteamAPI_RegisterCallResult
SteamAPI_RegisterCallback
SteamAPI_RestartApp
SteamAPI_RestartAppIfNecessary
SteamAPI_RunCallbacks
SteamAPI_SetBreakpadAppID
SteamAPI_SetMiniDumpComment
SteamAPI_SetTryCatchCallbacks
SteamAPI_Shutdown
SteamAPI_UnregisterCallResult
SteamAPI_UnregisterCallback
SteamAPI_UseBreakpadCrashHandler
SteamAPI_WriteMiniDump
SteamApps
SteamClient
SteamContentServer
SteamContentServerUtils
SteamContentServer_Init
SteamContentServer_RunCallbacks
SteamContentServer_Shutdown
SteamFriends
SteamGameServer
SteamGameServerNetworking
SteamGameServerStats
SteamGameServerUtils
SteamGameServer_BSecure
SteamGameServer_GetHSteamPipe
SteamGameServer_GetHSteamUser
SteamGameServer_GetIPCCallCount
SteamGameServer_GetSteamID
SteamGameServer_Init
SteamGameServer_InitSafe
SteamGameServer_RunCallbacks
SteamGameServer_Shutdown
SteamHTTP
SteamMasterServerUpdater
SteamMatchmaking
SteamMatchmakingServers
SteamNetworking
SteamRemoteStorage
SteamScreenshots
SteamUser
SteamUserStats
SteamUtils
Steam_GetHSteamUserCurrent
Steam_RegisterInterfaceFuncs
Steam_RunCallbacks
g_pSteamClientGameServer

Sections

.text
Size: - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.3dmgame
Size: - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.3dmgame
Size: 239KB - Virtual size: 238KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 434B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
steam_api64.dll
.dll windows x64

e1a1d39c05fa111f1e9b84a70c74bc0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
CreateDirectoryA
ReadFile
DeleteFileA
GetFileAttributesA
GetFileSize
GetFileTime
FindNextFileA
FindFirstFileA
GetTickCount
GetPrivateProfileStructA
WritePrivateProfileStructA
GetModuleFileNameA
GetPrivateProfileStringA
LoadLibraryA
GetCurrentDirectoryA
CreateFileW
WriteConsoleW
SetStdHandle
LoadLibraryW
GetSystemTimeAsFileTime
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
EncodePointer
DecodePointer
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapAlloc
GetLastError
HeapFree
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
TerminateProcess
GetCurrentProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
Sleep
HeapSize
GetProcAddress
GetModuleHandleW
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeW
HeapReAlloc
FlushFileBuffers

user32

MessageBoxA

shell32

SHGetSpecialFolderPathA

Exports

Exports

GetHSteamPipe
GetHSteamUser
SteamAPI_GetHSteamPipe
SteamAPI_GetHSteamUser
SteamAPI_GetSteamInstallPath
SteamAPI_Init
SteamAPI_InitSafe
SteamAPI_IsSteamRunning
SteamAPI_RegisterCallResult
SteamAPI_RegisterCallback
SteamAPI_RestartApp
SteamAPI_RestartAppIfNecessary
SteamAPI_RunCallbacks
SteamAPI_SetBreakpadAppID
SteamAPI_SetMiniDumpComment
SteamAPI_SetTryCatchCallbacks
SteamAPI_Shutdown
SteamAPI_UnregisterCallResult
SteamAPI_UnregisterCallback
SteamAPI_UseBreakpadCrashHandler
SteamAPI_WriteMiniDump
SteamApps
SteamClient
SteamContentServer
SteamContentServerUtils
SteamContentServer_Init
SteamContentServer_RunCallbacks
SteamContentServer_Shutdown
SteamFriends
SteamGameServer
SteamGameServerNetworking
SteamGameServerStats
SteamGameServerUtils
SteamGameServer_BSecure
SteamGameServer_GetHSteamPipe
SteamGameServer_GetHSteamUser
SteamGameServer_GetIPCCallCount
SteamGameServer_GetSteamID
SteamGameServer_Init
SteamGameServer_InitSafe
SteamGameServer_RunCallbacks
SteamGameServer_Shutdown
SteamHTTP
SteamMasterServerUpdater
SteamMatchmaking
SteamMatchmakingServers
SteamNetworking
SteamRemoteStorage
SteamScreenshots
SteamUser
SteamUserStats
SteamUtils
Steam_GetHSteamUserCurrent
Steam_RegisterInterfaceFuncs
Steam_RunCallbacks
g_pSteamClientGameServer

Sections

.text
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
说明.txt

Sharing

General

Malware Config

Signatures

Files

119fff86056d8234d3c2bfae716a9497

Headers

DLL Characteristics

File Characteristics

Imports

winmm

steam_api64

bink2w64

d3d11

dxgi

powrprof

kernel32

user32

gdi32

advapi32

shell32

ole32

xinput1_3

ws2_32

psapi

Sections

.text Size: 6.9MB - Virtual size: 6.9MB

.interpr Size: 48KB - Virtual size: 47KB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 245KB - Virtual size: 99.4MB

.pdata Size: 334KB - Virtual size: 334KB

.tls Size: 512B - Virtual size: 97B

_RDATA Size: 3KB - Virtual size: 3KB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

vybruss Size: - Virtual size: 4KB

f4a0119c4fecdb9bc63993c51488830d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

Exports

Exports

Sections

.text Size: - Virtual size: 99KB

.rdata Size: - Virtual size: 30KB

.data Size: - Virtual size: 17KB

.3dmgame Size: - Virtual size: 125KB

.3dmgame Size: 239KB - Virtual size: 238KB

.reloc Size: 512B - Virtual size: 180B

.rsrc Size: 512B - Virtual size: 434B

e1a1d39c05fa111f1e9b84a70c74bc0c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

Exports

Exports

Sections

.text Size: 147KB - Virtual size: 146KB

.rdata Size: 89KB - Virtual size: 89KB

.data Size: 9KB - Virtual size: 20KB

.pdata Size: 17KB - Virtual size: 16KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 6.9MB - Virtual size: 6.9MB

.interpr
Size: 48KB - Virtual size: 47KB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 245KB - Virtual size: 99.4MB

.pdata
Size: 334KB - Virtual size: 334KB

.tls
Size: 512B - Virtual size: 97B

_RDATA
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

vybruss
Size: - Virtual size: 4KB

.text
Size: - Virtual size: 99KB

.rdata
Size: - Virtual size: 30KB

.data
Size: - Virtual size: 17KB

.3dmgame
Size: - Virtual size: 125KB

.3dmgame
Size: 239KB - Virtual size: 238KB

.reloc
Size: 512B - Virtual size: 180B

.rsrc
Size: 512B - Virtual size: 434B

.text
Size: 147KB - Virtual size: 146KB

.rdata
Size: 89KB - Virtual size: 89KB

.data
Size: 9KB - Virtual size: 20KB

.pdata
Size: 17KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 4KB - Virtual size: 3KB