EnbSeries (Altos Recursos)[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

EnbSeries (Altos Recursos).rar
Size

9.5MB
MD5

635d3f34ad2b1ee6b03eb9c515f3222d
SHA1

3e77a529b2ffdd01854e47128e571b7b77fc34b5
SHA256

0efb449707a43992251badee95cdd987783f0ff93b6b7ecd1be0b34e0d526772
SHA512

7c6ce4e28c30319d014c0a29de361c6263bbb34cf01e023a032d67414fbba39a774550a2757208d7654761a494fd2214044085a8c824a9b9073169dafc1f8e18
SSDEEP

196608:XwavzZVYL1Pt2DPTa4eqXHVM4Ciovj2nTSByHMGT5P61iqDp8WHPJkGipik+s5vJ:BZVC2bJHCdv1BGNP611p8UkGi4k5vJ

Score

7^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/EnbSeries (Altos Recursos)/d3d9.dll	acprotect

Files

EnbSeries (Altos Recursos).rar
.rar
EnbSeries (Altos Recursos)/FXAA.dll
.dll windows x86

44fe17a46a544a52e910906fbdf020a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

d3dx9_43

D3DXSaveSurfaceToFileA
D3DXCreateEffectFromFileW

kernel32

TlsFree
ExitProcess
FreeLibrary
GetSystemDirectoryA
GetProcAddress
LoadLibraryA
VirtualProtect
GetCurrentDirectoryA
HeapSize
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
GetLastError
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
HeapFree
CloseHandle
TlsAlloc
TlsGetValue
TlsSetValue
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
Sleep
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteConsoleW
MultiByteToWideChar
SetStdHandle
GetModuleFileNameW
CreateFileA
HeapAlloc
HeapReAlloc
LoadLibraryW
LCMapStringW
GetStringTypeW
IsProcessorFeaturePresent
CreateFileW
SetEndOfFile
GetProcessHeap
ReadFile

user32

GetAsyncKeyState

Exports

Exports

D3DPERF_BeginEvent
D3DPERF_EndEvent
D3DPERF_GetStatus
D3DPERF_QueryRepeatFrame
D3DPERF_SetMarker
D3DPERF_SetOptions
D3DPERF_SetRegion
Direct3DCreate9

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EnbSeries (Altos Recursos)/Fxaa3_11.h
EnbSeries (Altos Recursos)/Imfx/Thumbs.db
EnbSeries (Altos Recursos)/Imfx/explosions.dat
EnbSeries (Altos Recursos)/Imfx/gunflash.dat
EnbSeries (Altos Recursos)/Imfx/imfx.ini
EnbSeries (Altos Recursos)/Imfx/imfx/CBloodSpots.cpp
EnbSeries (Altos Recursos)/Imfx/imfx/CBloodSpots.h
EnbSeries (Altos Recursos)/Imfx/imfx/CColPoint.h
EnbSeries (Altos Recursos)/Imfx/imfx/CImVerts.cpp
EnbSeries (Altos Recursos)/Imfx/imfx/CImVerts.h
EnbSeries (Altos Recursos)/Imfx/imfx/CLensflare.cpp
EnbSeries (Altos Recursos)/Imfx/imfx/CLensflare.h
EnbSeries (Altos Recursos)/Imfx/imfx/CLoader.cpp
EnbSeries (Altos Recursos)/Imfx/imfx/CLoader.h
EnbSeries (Altos Recursos)/Imfx/imfx/CMatrix.h
EnbSeries (Altos Recursos)/Imfx/imfx/CMoonphases.cpp
EnbSeries (Altos Recursos)/Imfx/imfx/CMoonphases.h
EnbSeries (Altos Recursos)/Imfx/imfx/CPlaceable.h
EnbSeries (Altos Recursos)/Imfx/imfx/CProportionalCoronas.cpp
EnbSeries (Altos Recursos)/Imfx/imfx/CProportionalCoronas.h
EnbSeries (Altos Recursos)/Imfx/imfx/CRGBA.h
EnbSeries (Altos Recursos)/Imfx/imfx/CRegisteredCorona.h
EnbSeries (Altos Recursos)/Imfx/imfx/CShadows.h
EnbSeries (Altos Recursos)/Imfx/imfx/CVector.h
EnbSeries (Altos Recursos)/Imfx/imfx/CWaterDrops.cpp
EnbSeries (Altos Recursos)/Imfx/imfx/CWaterDrops.h
EnbSeries (Altos Recursos)/Imfx/imfx/CWorld.h
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/CL.read.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/CL.write.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/CLensflare.obj
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/DllMain.obj
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/cl.command.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/imfx.dll.embed.manifest
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/imfx.dll.embed.manifest.res
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/imfx.dll.intermediate.manifest
.xml
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/imfx.lastbuildstate
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/imfx.log
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/imfx_manifest.rc
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/link-cvtres.read.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/link-cvtres.write.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/link.1988-cvtres.read.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/link.1988-cvtres.write.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/link.1988.read.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/link.1988.write.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/link.5880-cvtres.read.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/link.5880-cvtres.write.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/link.5880.read.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/link.5880.write.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/link.command.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/link.read.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/link.write.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/mt.command.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/mt.read.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/mt.write.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/rc.command.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/rc.read.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/rc.write.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/vc100.idb
EnbSeries (Altos Recursos)/Imfx/imfx/Debug/vc100.pdb
EnbSeries (Altos Recursos)/Imfx/imfx/DllMain.cpp
EnbSeries (Altos Recursos)/Imfx/imfx/Release/CImVerts.obj
EnbSeries (Altos Recursos)/Imfx/imfx/Release/CL.read.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Release/CL.write.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Release/CLensflare.obj
EnbSeries (Altos Recursos)/Imfx/imfx/Release/CLoader.obj
EnbSeries (Altos Recursos)/Imfx/imfx/Release/CMoonphases.obj
EnbSeries (Altos Recursos)/Imfx/imfx/Release/CProportionalCoronas.obj
EnbSeries (Altos Recursos)/Imfx/imfx/Release/CWaterDrops.obj
EnbSeries (Altos Recursos)/Imfx/imfx/Release/DllMain.obj
EnbSeries (Altos Recursos)/Imfx/imfx/Release/cl.command.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Release/imfx.asi.intermediate.manifest
.xml
EnbSeries (Altos Recursos)/Imfx/imfx/Release/imfx.lastbuildstate
EnbSeries (Altos Recursos)/Imfx/imfx/Release/imfx.log
EnbSeries (Altos Recursos)/Imfx/imfx/Release/link.command.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Release/link.read.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Release/link.write.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Release/mt.command.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Release/mt.read.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Release/mt.write.1.tlog
EnbSeries (Altos Recursos)/Imfx/imfx/Release/vc100.pdb
EnbSeries (Altos Recursos)/Imfx/imfx/RenderWare.h
EnbSeries (Altos Recursos)/Imfx/imfx/imfx.vcxproj
EnbSeries (Altos Recursos)/Imfx/imfx/imfx.vcxproj.filters
EnbSeries (Altos Recursos)/Imfx/imfx/imfx.vcxproj.user
EnbSeries (Altos Recursos)/Imfx/lensflare.dat
EnbSeries (Altos Recursos)/Imfx/lensflare/Anamorph.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/Chroma1.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/Chroma2.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/Lighthaze.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/Line.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/NFS1.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/NFS2.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/NFS3.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/NFS4.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/NFSFlare.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/Pentagon1.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/Pentagon2.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/Pentagon3.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/Pentagon4.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/Sphere.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/Sun.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/Sun2.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/Thumbs.db
EnbSeries (Altos Recursos)/Imfx/lensflare/dirtlens.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/enborb0.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/enborb1.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/enborb2.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/enborb3.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/enbsunsprite.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/haze.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/hexagram.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/orb1.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/orb2.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/orb3.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/pentaedge1.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/rainbow.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/rays.png
.png
EnbSeries (Altos Recursos)/Imfx/lensflare/sunglare.png
.png
EnbSeries (Altos Recursos)/Imfx/moon.png
.png
EnbSeries (Altos Recursos)/Imfx/moonphases.dat
EnbSeries (Altos Recursos)/Imfx/screenwater.png
.png
EnbSeries (Altos Recursos)/advanced_plugin_management_example/settings.ini
EnbSeries (Altos Recursos)/cleo/Sun.cs
EnbSeries (Altos Recursos)/d3d9.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

D3DPERF_BeginEvent
D3DPERF_EndEvent
D3DPERF_GetStatus
D3DPERF_QueryRepeatFrame
D3DPERF_SetMarker
D3DPERF_SetOptions
D3DPERF_SetRegion
Detoured
Direct3DCreate9
Direct3DCreate9Ex
_TwAddButton@20
_TwAddSeparator@12
_TwAddVarCB@28
_TwAddVarRO@20
_TwAddVarRW@20
_TwCopyCDStringToClientFunc@4
_TwCopyCDStringToLibrary@8
_TwCopyStdStringToClientFunc@4
_TwCopyStdStringToLibrary@8
_TwDefine@4
_TwDefineEnum@12
_TwDefineEnumFromString@8
_TwDefineStruct@24
_TwDeleteAllBars@0
_TwDeleteBar@4
_TwDraw@0
_TwEventWin32@16
_TwEventWin@16
_TwGetBarByIndex@4
_TwGetBarByName@4
_TwGetBarCount@0
_TwGetBarName@4
_TwGetBottomBar@0
_TwGetCurrentWindow@0
_TwGetLastError@0
_TwGetParam@24
_TwGetTopBar@0
_TwHandleErrors@4
_TwInit@8
_TwKeyPressed@8
_TwKeyTest@8
_TwMouseButton@8
_TwMouseMotion@8
_TwMouseWheel@4
_TwNewBar@4
_TwRefreshBar@4
_TwRemoveAllVars@4
_TwRemoveVar@8
_TwSetBottomBar@4
_TwSetCurrentWindow@4
_TwSetParam@24
_TwSetTopBar@4
_TwTerminate@0
_TwWindowExists@4
_TwWindowSize@8

Sections

CODE
Size: - Virtual size: 6.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 712KB - Virtual size: 716KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
EnbSeries (Altos Recursos)/eax.dll
.dll regsvr32 windows x86

10a283f307e6f4139afad8021396dc78

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
lstrlenA
GetModuleFileNameA
InterlockedDecrement
InterlockedIncrement
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
RtlUnwind
GetLastError
WideCharToMultiByte
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetProcAddress
GetModuleHandleA
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
RaiseException
VirtualAlloc
HeapReAlloc
IsBadWritePtr
CloseHandle
SetFilePointer
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
FlushFileBuffers
SetStdHandle
MultiByteToWideChar

user32

GetDesktopWindow

advapi32

RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
RegSetValueA
RegSetValueExA

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
StringFromCLSID

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EAXDirectSoundCreate
EAXDirectSoundCreate8
GetCurrentVersion

Sections

.text
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EnbSeries (Altos Recursos)/effect.txt
EnbSeries (Altos Recursos)/enbanamorphic.bmp
EnbSeries (Altos Recursos)/enbbloom.fx
EnbSeries (Altos Recursos)/enbbloom.fx.ini
EnbSeries (Altos Recursos)/enbeffect.fx
EnbSeries (Altos Recursos)/enbeffectprepass.fx
EnbSeries (Altos Recursos)/enblens.fx
EnbSeries (Altos Recursos)/enblens.fx.ini
EnbSeries (Altos Recursos)/enblensdirt.bmp
EnbSeries (Altos Recursos)/enblensmask.bmp
EnbSeries (Altos Recursos)/enblensmask.png
.png
EnbSeries (Altos Recursos)/enblocal.ini
EnbSeries (Altos Recursos)/enbseries.ini
EnbSeries (Altos Recursos)/flickr.asi
.dll windows x86

9d17a0c6d67f92d036a742b1cd044386

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
GetLastError
HeapSize
GetStringTypeW
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
GetProcAddress
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
LoadLibraryW
WriteFile
GetModuleFileNameW
RtlUnwind
LCMapStringW
MultiByteToWideChar
IsProcessorFeaturePresent

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EnbSeries (Altos Recursos)/imfx.asi
.dll windows x86

15ff70e05311d0ed0de27636f7fbd956

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
GetSystemTimeAsFileTime

msvcr100

_crt_debugger_hook
__clean_type_info_names_internal
__CppXcptFilter
__dllonexit
_lock
_onexit
_except_handler4_common
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
rand
fclose
realloc
fopen
fgets
malloc
free
sscanf
feof
_unlock
_CIsin
_CIcos
_CIatan2

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 978B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EnbSeries (Altos Recursos)/reffix.asi
.dll windows x86

978e49729f99b7b54856e3e252471f63

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileIntA
Sleep
GetPrivateProfileStringA
VirtualProtect
CreateThread
GetCurrentThreadId
DecodePointer
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetLastError
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
HeapFree
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringW
MultiByteToWideChar
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapReAlloc
LoadLibraryW
WriteFile
GetModuleFileNameW
RtlUnwind
IsProcessorFeaturePresent
HeapSize

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EnbSeries (Altos Recursos)/reffix.ini
EnbSeries (Altos Recursos)/sa_widescreenfix_lite.asi
.dll windows x86

b06e2a59042be0003bd8c8e97d0ee0cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
GetLastError
VirtualProtect
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
GetProcAddress
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
LoadLibraryW
WriteFile
GetModuleFileNameW
RtlUnwind
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapSize
IsProcessorFeaturePresent

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EnbSeries (Altos Recursos)/sensfix.asi
.dll windows x86

645e9d888f24522ba390068c8d0667f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetKeyState

kernel32

FlushFileBuffers
InitializeCriticalSection
DisableThreadLibraryCalls
GetFileAttributesA
Sleep
VirtualProtect
GetLastError
HeapFree
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
ExitThread
CloseHandle
ResumeThread
CreateThread
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
HeapAlloc
IsProcessorFeaturePresent
RaiseException
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetFilePointer
ReadFile
HeapSize
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
RtlUnwind
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameW
MultiByteToWideChar
HeapReAlloc
LoadLibraryW
GetLocaleInfoW
WriteConsoleW
SetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CreateFileA
CreateFileW
GetStringTypeW
LCMapStringW
SetEndOfFile
GetProcessHeap
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale

Sections

.text
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EnbSeries (Altos Recursos)/sensfix.ini
EnbSeries (Altos Recursos)/skygrad.asi
.dll windows x86

d656873788ce14bcb3304a210de59b0a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer

msvcr100

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
rand
memcpy
_CIsin
_CIcos
_CItan

Exports

Exports

??G@YA?AVCVector@@ABV0@@Z
?CreateGrainRaster@CPostEffects@@SAXXZ
?CreateShaders@@YAXXZ
?DeleteShaders@@YAXXZ
?FixUpNthSkyPoly@CClouds@@SAXMMMM@Z
?FixUpOneSkyPoly@CClouds@@SAXMMMMMMMM@Z
?HOOK_7010C6_CPostEffects__Close@@YAXXZ
?HOOK_RxD3D9SubmitNoLightBody_12F@@YAXXZ
?InstallAllHooks@@YGXXZ
?RenderSkyPolys@CClouds@@SAXXZ
?SetUpNthSkyPoly@CClouds@@SAXVCVector@@0EEE@Z
?_rwD3D9CustomPixelShader@@3PAXA
?_rwD3D9CustomVertexShader@@3PAXA
?_rwD3D9VSCustomWorldMatrix@@3PAURwMatrixTag@@A
?_rxD3D9PixelShaderConstants@@3PAMA
?g_aPSSkyGradAsm@@3QBIB
?g_aVSSkyGradAsm@@3QBIB
?ms_pGrainRaster8@CPostEffects@@2PAURwRaster@@A
?ms_pPSSkyGrad@CPostEffects@@2PAXA
?ms_pVSSkyGrad@CPostEffects@@2PAXA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 656B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44fe17a46a544a52e910906fbdf020a1

Headers

DLL Characteristics

File Characteristics

Imports

d3dx9_43

kernel32

user32

Exports

Exports

Sections

.text Size: 53KB - Virtual size: 53KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 13KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 4KB - Virtual size: 4KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: - Virtual size: 6.7MB

DATA Size: 712KB - Virtual size: 716KB

.rsrc Size: 3KB - Virtual size: 4KB

10a283f307e6f4139afad8021396dc78

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

Exports

Exports

Sections

.text Size: 136KB - Virtual size: 135KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 20KB - Virtual size: 24KB

.rsrc Size: 4KB - Virtual size: 984B

.reloc Size: 12KB - Virtual size: 8KB

9d17a0c6d67f92d036a742b1cd044386

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 2KB - Virtual size: 1KB

15ff70e05311d0ed0de27636f7fbd956

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcr100

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 1024B - Virtual size: 978B

978e49729f99b7b54856e3e252471f63

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 34KB - Virtual size: 34KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 6KB

.text
Size: 53KB - Virtual size: 53KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 13KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 4KB - Virtual size: 4KB

CODE
Size: - Virtual size: 6.7MB

DATA
Size: 712KB - Virtual size: 716KB

.rsrc
Size: 3KB - Virtual size: 4KB

.text
Size: 136KB - Virtual size: 135KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 20KB - Virtual size: 24KB

.rsrc
Size: 4KB - Virtual size: 984B

.reloc
Size: 12KB - Virtual size: 8KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 1024B - Virtual size: 978B

.text
Size: 34KB - Virtual size: 34KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 46KB - Virtual size: 45KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 115KB - Virtual size: 115KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 1024B - Virtual size: 696B

.reloc
Size: 8KB - Virtual size: 8KB

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 1024B - Virtual size: 656B