GD_Hack-20230503T024749Z-001[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

GD_Hack-20230503T024749Z-001.zip
Size

4.2MB
MD5

684f6fdca136345a38070a22090571ef
SHA1

25985a70ad2fc372d63aebbdff27857431dcd2c6
SHA256

c0fd393aacc9edc89f4a2f44ffdae64baa7d186936b92ea9a996051403ead641
SHA512

8785add7ae00d539ff69d9dba1b4df74790c0f7575cdc1930045a4c3411c4dd42d1a84d087d8b825ab0c0e2ccb26b0560149ec353a0f3fade6a69019558ed570
SSDEEP

98304:4oaNMkB7VDIJq34TEoX3ERasfaQQuQTD/B15uMaFNURYJN4xesU:4lMsh8J0dBfg5D/B1QMaERYJmosU

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/GD_Hack/ToastedMarshmellow.dll
unpack001/GD_Hack/pthreadVCE2.dll
unpack001/GD_Hack/pthreadVCE2.dll.bak

Files

GD_Hack-20230503T024749Z-001.zip
.zip
GD_Hack/D3DCompiler_43.dll
.dll windows x86

6ba7b0e4e74a8eea96dca4fffc88b859

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

a0:dc:fd:f1:04:c6:f9:25:f4:de:ed:83:b3:1b:1c:9e:4a:d1:be:fb
Signer

Actual PE Digest

a0:dc:fd:f1:04:c6:f9:25:f4:de:ed:83:b3:1b:1c:9e:4a:d1:be:fb

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

22/05/2010, 03:19
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

??1type_info@@UAE@XZ
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
_initterm
_XcptFilter
_CxxThrowException
memset
memcpy
isxdigit
atof
setlocale
_strdup
_mbstrlen
modf
isalnum
_isnan
ceil
_finite
strrchr
_clearfp
_controlfp
_strnicmp
_fpclass
_purecall
strncmp
isspace
strstr
getenv
_stricmp
memmove
qsort
isalpha
toupper
atoi
isdigit
tolower
free
malloc
??2@YAPAXI@Z
??3@YAXPAX@Z
strchr
_vsnprintf
_errno
__CxxFrameHandler
floor
_CIfmod
_CItanh
_CItan
_CIsinh
_CIsin
_CIlog
_CIpow
_CIexp
_CIsqrt
_CIcosh
_CIcos
_CIatan2
_CIatan
_CIasin
_CIacos

gdi32

DeleteObject

kernel32

UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
UnmapViewOfFile
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
VirtualFree
GetLastError
SetUnhandledExceptionFilter
WideCharToMultiByte
GetFullPathNameA
HeapCreate
OutputDebugStringA
LoadLibraryA
GetModuleHandleA
lstrcmpiA
TlsFree
TlsGetValue
HeapDestroy
TlsSetValue
InterlockedExchange
TlsAlloc
Sleep
InterlockedCompareExchange
FreeLibrary
GetSystemInfo
GetProcAddress
VirtualAlloc
GetProcessHeap
HeapFree
HeapAlloc
DisableThreadLibraryCalls
MultiByteToWideChar
GetVersion

Exports

Exports

D3DAssemble
D3DCompile
D3DCompressShaders
D3DCreateBlob
D3DDecompressShaders
D3DDisassemble
D3DDisassemble10Effect
D3DGetBlobPart
D3DGetDebugInfo
D3DGetInputAndOutputSignatureBlob
D3DGetInputSignatureBlob
D3DGetOutputSignatureBlob
D3DPreprocess
D3DReflect
D3DReturnFailure1
D3DStripShader
DebugSetMute

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
GD_Hack/GDHM-mod/bypass.json
GD_Hack/GDHM-mod/core.json
GD_Hack/GDHM-mod/creator.json
GD_Hack/GDHM-mod/global.json
GD_Hack/GDHM-mod/player.json
GD_Hack/ToastedMarshmellow.dll
.dll windows x86

f710d33d2e46d8186c61e489f2c327c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

getsockopt
freeaddrinfo
ioctlsocket
getnameinfo
setsockopt
WSAGetLastError
WSACleanup
ntohs
socket
bind
getsockname
htons
WSASetLastError
WSAIoctl
recv
htonl
listen
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
recvfrom
sendto
gethostname
ntohl
send
accept
getpeername
getaddrinfo
WSASocketW
shutdown
select
closesocket
__WSAFDIsSet
connect
WSAStartup

advapi32

CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
RegCreateKeyExW
RegSetValueExW
RegCloseKey
CryptAcquireContextA
CryptCreateHash
RegQueryValueExW
RegOpenKeyExW
CryptHashData

kernel32

GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
QueryPerformanceFrequency
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
GetModuleHandleW
VirtualFree
VirtualAlloc
VirtualQuery
HeapCreate
HeapFree
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
FlushInstructionCache
SetThreadContext
OpenThread
ReadFile
GetFileSizeEx
WriteProcessMemory
GetModuleFileNameW
WaitForSingleObject
GetExitCodeThread
K32GetModuleInformation
LoadLibraryExW
CreateDirectoryW
FindFirstFileExW
GetFullPathNameW
FindNextFileW
FindClose
GetLastError
GetLogicalDriveStringsA
GetCurrentThread
SetLastError
OutputDebugStringA
GetEnvironmentVariableW
GetWriteWatch
CreateFileW
LocalFree
IsDebuggerPresent
CheckRemoteDebuggerPresent
ReleaseSemaphore
SetThreadPriority
WriteFile
GetFileInformationByHandle
CreateFileA
SetEvent
ResetEvent
SetFilePointerEx
GetProcessHeap
CreateSemaphoreW
SizeofResource
UnmapViewOfFile
LockResource
LoadResource
LoadLibraryW
CreateFileMappingW
MapViewOfFile
VirtualProtect
FreeLibraryAndExitThread
WaitForSingleObjectEx
GetSystemFirmwareTable
FormatMessageA
WriteConsoleA
GetStdHandle
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetProcAddress
CreateThread
LoadLibraryA
GetCurrentThreadId
GetModuleHandleExW
GetModuleHandleA
ReadProcessMemory
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetSystemDirectoryA
GetTickCount
MoveFileExA
GetEnvironmentVariableA
GetFileType
PeekNamedPipe
WaitForMultipleObjects
FormatMessageW
VerifyVersionInfoA
RaiseException
DecodePointer
lstrlenW
WaitNamedPipeW
InitializeCriticalSection
TryEnterCriticalSection
ReleaseMutex
FreeEnvironmentStringsW
TlsGetValue
TlsSetValue
RtlCaptureContext
GetCurrentDirectoryW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetTempPathW
GetCommandLineW
FlushFileBuffers
TerminateProcess
TlsAlloc
CreateMutexA
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
GetFileAttributesW
MultiByteToWideChar
GetFileAttributesExW
SetEndOfFile
AreFileApisANSI
GetFileInformationByHandleEx
EncodePointer
LCMapStringEx
FindResourceW
GetCurrentProcess
DeleteFileW
GetCurrentProcessId
GetFileAttributesA
GetConsoleMode
Sleep
GetProcessId
GetDynamicTimeZoneInformation
ReadConsoleW
WriteConsoleW
GetSystemTimeAsFileTime
ExitProcess
CreateEventW
HeapSize
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleOutputCP
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
TlsFree
InterlockedFlushSList
RtlUnwind
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetCPInfo
CompareStringEx

shell32

ShellExecuteW
ShellExecuteA

user32

FindWindowExW
MoveWindow
GetWindowTextW
GetWindowThreadProcessId
EnumWindows
DefWindowProcW
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
GetKeyState
ScreenToClient
GetCapture
ClientToScreen
IsChild
LoadCursorW
SetCapture
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetWindowRect
SetWindowPos
GetSystemMetrics
WindowFromDC
ClipCursor
SetWindowLongW
EnumDisplaySettingsA
GetDesktopWindow
MessageBoxA
CallWindowProcW
SetWindowLongA
GetForegroundWindow
GetCursorInfo
SetCursor
DrawIconEx

opengl32

glColorPointer
glTexImage2D
glGetTexEnviv
glTexCoordPointer
glTexParameteri
glLoadIdentity
glBlendFunc
glDrawElements
glDisableClientState
glScissor
glEnable
glVertexPointer
glGenTextures
glBindTexture
glPolygonMode
glPopAttrib
glEnableClientState
glViewport
glPopMatrix
glDisable
glPushMatrix
glShadeModel
glPixelStorei
glOrtho
glPushAttrib
glGetIntegerv
wglGetCurrentContext
wglCreateContext
wglMakeCurrent
glTexEnvi
glMatrixMode

winmm

sndPlaySoundW

libcocos2d

?scheduleOnce@CCNode@cocos2d@@QAEXP8CCObject@2@AEXM@ZM@Z
??0CCPoint@cocos2d@@QAE@ABV01@@Z
?resizeWindow@CCEGLView@cocos2d@@QAEXHH@Z
?centerWindow@CCEGLView@cocos2d@@QAEXXZ
?showCursor@CCEGLView@cocos2d@@QAEX_N@Z
?sharedOpenGLView@CCEGLView@cocos2d@@SAPAV12@XZ
?setDispatchEvents@CCTouchDispatcher@cocos2d@@QAEX_N@Z
??4CCPoint@cocos2d@@QAEAAV01@ABV01@@Z
??HCCPoint@cocos2d@@QBE?AV01@ABV01@@Z
??GCCPoint@cocos2d@@QBE?AV01@ABV01@@Z
??DCCPoint@cocos2d@@QBE?AV01@M@Z
??KCCPoint@cocos2d@@QBE?AV01@M@Z
?create@CCEaseBackOut@cocos2d@@SAPAV12@PAVCCActionInterval@2@@Z
?create@CCEaseElasticOut@cocos2d@@SAPAV12@PAVCCActionInterval@2@@Z
?create@CCSpawn@cocos2d@@SAPAV12@PAVCCFiniteTimeAction@2@ZZ
?create@CCMoveBy@cocos2d@@SAPAV12@MABVCCPoint@2@@Z
??0CCSize@cocos2d@@QAE@ABV01@@Z
?objectAtIndex@CCArray@cocos2d@@QAEPAVCCObject@2@I@Z
?create@CCEaseExponentialOut@cocos2d@@SAPAV12@PAVCCActionInterval@2@@Z
?create@CCSequence@cocos2d@@SAPAV12@PAVCCFiniteTimeAction@2@ZZ
?create@CCDelayTime@cocos2d@@SAPAV12@M@Z
?create@CCEaseBackInOut@cocos2d@@SAPAV12@PAVCCActionInterval@2@@Z
?create@CCRotateTo@cocos2d@@SAPAV12@MM@Z
?sharedDirector@CCDirector@cocos2d@@SAPAV12@XZ
?create@CCEaseIn@cocos2d@@SAPAV12@PAVCCActionInterval@2@M@Z
?create@CCEaseOut@cocos2d@@SAPAV12@PAVCCActionInterval@2@M@Z
?create@CCLabelBMFont@cocos2d@@SAPAV12@PBD0@Z
?create@CCScaleTo@cocos2d@@SAPAV12@MM@Z
??0CCRect@cocos2d@@QAE@MMMM@Z
??0CCSize@cocos2d@@QAE@MM@Z
?runAction@CCNode@cocos2d@@QAEPAVCCAction@2@PAV32@@Z
??0CCPoint@cocos2d@@QAE@MM@Z

imm32

ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext

d3dcompiler_43

D3DCompile

gdi32

AddFontResourceW

ole32

CoCreateInstance
CoTaskMemFree
PropVariantClear
CoInitializeEx
CoUninitialize

mfplat

MFCreateAsyncResult
MFShutdown
MFStartup
MFCreateMediaType
MFCreateSample
MFCreateAttributes
MFCreateMemoryBuffer

mfreadwrite

MFCreateSinkWriterFromURL

d3d11

D3D11CreateDevice

wldap32

ord27
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord301
ord200
ord30
ord79
ord35
ord143
ord32
ord33
ord26

normaliz

IdnToAscii

crypt32

CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateChain
CertOpenStore

Exports

Exports

?main_unload@@YAXXZ

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 364KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
GD_Hack/licenses/LICENSE_CappucinoSDK.txt
GD_Hack/licenses/LICENSE_Kazmath.txt
GD_Hack/licenses/LICENSE_bada_pthread.txt
GD_Hack/licenses/LICENSE_cocos2d-x.txt
GD_Hack/licenses/LICENSE_cocosdenshion.txt
GD_Hack/licenses/LICENSE_cpp-httplib.txt
GD_Hack/licenses/LICENSE_curl.txt
GD_Hack/licenses/LICENSE_detours.txt
GD_Hack/licenses/LICENSE_discord-rpc.txt
GD_Hack/licenses/LICENSE_gdrpc.txt
GD_Hack/licenses/LICENSE_imgui.txt
GD_Hack/licenses/LICENSE_jsoncpp.txt
GD_Hack/licenses/LICENSE_jsonhpp.txt
GD_Hack/licenses/LICENSE_kiero.txt
GD_Hack/licenses/LICENSE_libmem.txt
GD_Hack/licenses/LICENSE_minhook.txt
GD_Hack/licenses/LICENSE_openssl.txt
GD_Hack/licenses/LICENSE_spdlog.txt
GD_Hack/licenses/LICENSE_toml11.txt
GD_Hack/licenses/LICENSE_zlib.txt
GD_Hack/pthreadVCE2.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

pthreadCancelableTimedWait
pthreadCancelableWait
pthread_attr_destroy
pthread_attr_getdetachstate
pthread_attr_getinheritsched
pthread_attr_getschedparam
pthread_attr_getschedpolicy
pthread_attr_getscope
pthread_attr_getstackaddr
pthread_attr_getstacksize
pthread_attr_init
pthread_attr_setdetachstate
pthread_attr_setinheritsched
pthread_attr_setschedparam
pthread_attr_setschedpolicy
pthread_attr_setscope
pthread_attr_setstackaddr
pthread_attr_setstacksize
pthread_barrier_destroy
pthread_barrier_init
pthread_barrier_wait
pthread_barrierattr_destroy
pthread_barrierattr_getpshared
pthread_barrierattr_init
pthread_barrierattr_setpshared
pthread_cancel
pthread_cond_broadcast
pthread_cond_destroy
pthread_cond_init
pthread_cond_signal
pthread_cond_timedwait
pthread_cond_wait
pthread_condattr_destroy
pthread_condattr_getpshared
pthread_condattr_init
pthread_condattr_setpshared
pthread_create
pthread_delay_np
pthread_detach
pthread_equal
pthread_exit
pthread_getconcurrency
pthread_getschedparam
pthread_getspecific
pthread_getw32threadhandle_np
pthread_join
pthread_key_create
pthread_key_delete
pthread_kill
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_timedlock
pthread_mutex_trylock
pthread_mutex_unlock
pthread_mutexattr_destroy
pthread_mutexattr_getkind_np
pthread_mutexattr_getpshared
pthread_mutexattr_gettype
pthread_mutexattr_init
pthread_mutexattr_setkind_np
pthread_mutexattr_setpshared
pthread_mutexattr_settype
pthread_num_processors_np
pthread_once
pthread_rwlock_destroy
pthread_rwlock_init
pthread_rwlock_rdlock
pthread_rwlock_timedrdlock
pthread_rwlock_timedwrlock
pthread_rwlock_tryrdlock
pthread_rwlock_trywrlock
pthread_rwlock_unlock
pthread_rwlock_wrlock
pthread_rwlockattr_destroy
pthread_rwlockattr_getpshared
pthread_rwlockattr_init
pthread_rwlockattr_setpshared
pthread_self
pthread_setcancelstate
pthread_setcanceltype
pthread_setconcurrency
pthread_setschedparam
pthread_setspecific
pthread_spin_destroy
pthread_spin_init
pthread_spin_lock
pthread_spin_trylock
pthread_spin_unlock
pthread_testcancel
pthread_timechange_handler_np
pthread_win32_process_attach_np
pthread_win32_process_detach_np
pthread_win32_test_features_np
pthread_win32_thread_attach_np
pthread_win32_thread_detach_np
ptw32_get_exception_services_code
ptw32_pop_cleanup
ptw32_push_cleanup
sched_get_priority_max
sched_get_priority_min
sched_getscheduler
sched_setscheduler
sched_yield
sem_close
sem_destroy
sem_getvalue
sem_init
sem_open
sem_post
sem_post_multiple
sem_timedwait
sem_trywait
sem_unlink
sem_wait

Sections

.text
Size: 44KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.tmdll
Size: 160B - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
GD_Hack/pthreadVCE2.dll.bak
.dll windows x86

3cb670276d26003b3e60cc547afc3c3e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

calloc
_onexit
__dllonexit
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
??3@YAXPAX@Z
_ftime
_beginthreadex
malloc
exit
_errno
_CxxThrowException
__CxxFrameHandler
_endthreadex
?set_terminate@@YAP6AXXZP6AXXZ@Z
?terminate@@YAXXZ
free

wsock32

WSAGetLastError
WSASetLastError

kernel32

TlsGetValue
CloseHandle
SetLastError
CreateSemaphoreA
GetCurrentProcessId
OpenProcess
SetThreadPriority
LoadLibraryA
WaitForMultipleObjects
GetCurrentThreadId
GetCurrentThread
DuplicateHandle
GetThreadPriority
InterlockedExchangeAdd
CreateEventA
FreeLibrary
GetProcAddress
SuspendThread
ResumeThread
TlsFree
ReleaseSemaphore
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TlsAlloc
TlsSetValue
SetEvent
GetProcessAffinityMask
GetCurrentProcess
GetLastError
Sleep
WaitForSingleObject
SetThreadContext
InterlockedDecrement
ResetEvent
GetThreadContext

Exports

Exports

pthreadCancelableTimedWait
pthreadCancelableWait
pthread_attr_destroy
pthread_attr_getdetachstate
pthread_attr_getinheritsched
pthread_attr_getschedparam
pthread_attr_getschedpolicy
pthread_attr_getscope
pthread_attr_getstackaddr
pthread_attr_getstacksize
pthread_attr_init
pthread_attr_setdetachstate
pthread_attr_setinheritsched
pthread_attr_setschedparam
pthread_attr_setschedpolicy
pthread_attr_setscope
pthread_attr_setstackaddr
pthread_attr_setstacksize
pthread_barrier_destroy
pthread_barrier_init
pthread_barrier_wait
pthread_barrierattr_destroy
pthread_barrierattr_getpshared
pthread_barrierattr_init
pthread_barrierattr_setpshared
pthread_cancel
pthread_cond_broadcast
pthread_cond_destroy
pthread_cond_init
pthread_cond_signal
pthread_cond_timedwait
pthread_cond_wait
pthread_condattr_destroy
pthread_condattr_getpshared
pthread_condattr_init
pthread_condattr_setpshared
pthread_create
pthread_delay_np
pthread_detach
pthread_equal
pthread_exit
pthread_getconcurrency
pthread_getschedparam
pthread_getspecific
pthread_getw32threadhandle_np
pthread_join
pthread_key_create
pthread_key_delete
pthread_kill
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_timedlock
pthread_mutex_trylock
pthread_mutex_unlock
pthread_mutexattr_destroy
pthread_mutexattr_getkind_np
pthread_mutexattr_getpshared
pthread_mutexattr_gettype
pthread_mutexattr_init
pthread_mutexattr_setkind_np
pthread_mutexattr_setpshared
pthread_mutexattr_settype
pthread_num_processors_np
pthread_once
pthread_rwlock_destroy
pthread_rwlock_init
pthread_rwlock_rdlock
pthread_rwlock_timedrdlock
pthread_rwlock_timedwrlock
pthread_rwlock_tryrdlock
pthread_rwlock_trywrlock
pthread_rwlock_unlock
pthread_rwlock_wrlock
pthread_rwlockattr_destroy
pthread_rwlockattr_getpshared
pthread_rwlockattr_init
pthread_rwlockattr_setpshared
pthread_self
pthread_setcancelstate
pthread_setcanceltype
pthread_setconcurrency
pthread_setschedparam
pthread_setspecific
pthread_spin_destroy
pthread_spin_init
pthread_spin_lock
pthread_spin_trylock
pthread_spin_unlock
pthread_testcancel
pthread_timechange_handler_np
pthread_win32_process_attach_np
pthread_win32_process_detach_np
pthread_win32_test_features_np
pthread_win32_thread_attach_np
pthread_win32_thread_detach_np
ptw32_get_exception_services_code
ptw32_pop_cleanup
ptw32_push_cleanup
sched_get_priority_max
sched_get_priority_min
sched_getscheduler
sched_setscheduler
sched_yield
sem_close
sem_destroy
sem_getvalue
sem_init
sem_open
sem_post
sem_post_multiple
sem_timedwait
sem_trywait
sem_unlink
sem_wait

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ba7b0e4e74a8eea96dca4fffc88b859

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:cf:3e:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:05:a2:30:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

a0:dc:fd:f1:04:c6:f9:25:f4:de:ed:83:b3:1b:1c:9e:4a:d1:be:fbSigner

Signature Validations

Verification

22/05/2010, 03:19 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

gdi32

kernel32

Exports

Exports

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.data Size: 16KB - Virtual size: 31KB

.rsrc Size: 1024B - Virtual size: 968B

.reloc Size: 56KB - Virtual size: 55KB

f710d33d2e46d8186c61e489f2c327c3

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

advapi32

kernel32

shell32

user32

opengl32

winmm

libcocos2d

imm32

d3dcompiler_43

gdi32

ole32

mfplat

mfreadwrite

d3d11

wldap32

normaliz

crypt32

Exports

Exports

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 364KB - Virtual size: 364KB

.data Size: 34KB - Virtual size: 292KB

.detourc Size: 4KB - Virtual size: 4KB

.detourd Size: 512B - Virtual size: 12B

.rsrc Size: 3.0MB - Virtual size: 3.0MB

.reloc Size: 83KB - Virtual size: 83KB

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 48KB

.rdata Size: 5KB - Virtual size: 8KB

.data Size: 1KB - Virtual size: 4KB

.idata Size: 1KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 4KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:05:a2:30:00:00:00:00:00:08
Certificate

a0:dc:fd:f1:04:c6:f9:25:f4:de:ed:83:b3:1b:1c:9e:4a:d1:be:fb
Signer

22/05/2010, 03:19
Valid: false

.text
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 16KB - Virtual size: 31KB

.rsrc
Size: 1024B - Virtual size: 968B

.reloc
Size: 56KB - Virtual size: 55KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 364KB - Virtual size: 364KB

.data
Size: 34KB - Virtual size: 292KB

.detourc
Size: 4KB - Virtual size: 4KB

.detourd
Size: 512B - Virtual size: 12B

.rsrc
Size: 3.0MB - Virtual size: 3.0MB

.reloc
Size: 83KB - Virtual size: 83KB

.text
Size: 44KB - Virtual size: 48KB

.rdata
Size: 5KB - Virtual size: 8KB

.data
Size: 1KB - Virtual size: 4KB

.idata
Size: 1KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 1KB - Virtual size: 4KB

.tmdll
Size: 160B - Virtual size: 76KB

.text
Size: 48KB - Virtual size: 44KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 2KB