vapeSpuffer[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

vapeSpuffer.rar
Size

35.6MB
MD5

ed2b3fa9d53365b62d3b34f75a6fe175
SHA1

f85246b63e8a17da4c75f146d927676127786977
SHA256

7ef4dafa3a73168eb012354e65fd1b29ebfc6e7533db67f9911467001ce0db83
SHA512

00248a32b2afc2649f289147160b67af4098659f84aac3c3cc887d2b42dc27c49105d94faf881e9eaf5a0d4e027b1c858178c5b5c4c4c298d638308ce7d6f01c
SSDEEP

786432:ZHIccpT/W+Ac/y7mq9dW8YzW0Tkw8EHalm4rjQCTf6eGSzt5:ZHI3W+A0y7zfW8VUk86lmoQWjz3

Score

7^/10

pyinstaller themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/vapeSpuffer/vlite launcher/xdYXWrukLx.exe	themida

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/vapeSpuffer/spuff injector.exe	pyinstaller

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/vapeSpuffer/fix/dmserver.dll
unpack001/vapeSpuffer/hwid necessary case/hwidDevComm.dll
unpack001/vapeSpuffer/spuff injector.exe
unpack001/vapeSpuffer/vlite launcher/xdYXWrukLx.exe

Files

vapeSpuffer.rar
.rar

Password: infected
vapeSpuffer/fix/EasyAntiCheat_x86.dll
.dll windows x86

Password: infected

4af0207ed1bd77aa41345cc0e0b9ace1

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:31:89:c6:4d:e1
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

02/08/2019, 10:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:21:a7:75:88:2b:27:3a:40:f9:a6:d4:c8:a7:62:82:e4:14
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

28/01/2015, 12:03

Not After

28/01/2018, 12:03

Subject

SERIALNUMBER=2585063-4,CN=EasyAntiCheat Oy,O=EasyAntiCheat Oy,STREET=Keilaranta 16,L=Espoo,ST=Uusimaa,C=FI,1.3.6.1.4.1.311.60.2.1.3=#13024649,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:8f:a8:52:c0:cd:bd:a1:1e:f0:c3:32:bf:df:93:74:03
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

17/02/2015, 15:17

Not After

17/02/2018, 15:17

Subject

CN=EasyAntiCheat Oy,O=EasyAntiCheat Oy,L=Espoo,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

28:1c:d1:38:4a:d3:7d:91:37:d4:9f:94:b2:0e:ee:c8:b2:26:e2:2a
Signer

Actual PE Digest

28:1c:d1:38:4a:d3:7d:91:37:d4:9f:94:b2:0e:ee:c8:b2:26:e2:2a

Digest Algorithm

sha1

PE Digest Matches

true

ac:ed:79:38:0b:50:86:6e:54:41:10:4b:2b:85:04:b1:b9:c3:89:fd:70:74:f0:e5:a6:7d:36:a8:f4:40:97:eb
Signer

Actual PE Digest

ac:ed:79:38:0b:50:86:6e:54:41:10:4b:2b:85:04:b1:b9:c3:89:fd:70:74:f0:e5:a6:7d:36:a8:f4:40:97:eb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
FindFirstFileW
SystemTimeToFileTime
GetFileAttributesW
ReadFile
FindClose
GetFileTime
DeleteFileW
GetFileInformationByHandle
GetSystemTime
LoadLibraryW
lstrcmpA
lstrlenA
VirtualFree
VirtualAlloc
VirtualProtect
DebugBreak
WaitForSingleObject
SetEvent
ResetEvent
CreateEventW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
Sleep
GetLastError
CreateThread
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
LocalFree
GetSystemDirectoryW
FileTimeToSystemTime
LocalAlloc
FileTimeToLocalFileTime
OpenProcess
MoveFileExW
WriteFile
GetCommandLineW
GetCurrentProcess
GetBinaryTypeW
IsWow64Process
DuplicateHandle
CreateProcessW
SetDllDirectoryW
CreateDirectoryW
GetModuleFileNameW
GetTempPathW
CloseHandle
CreateFileW
GetFileSize
LoadLibraryA
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
RtlUnwind
HeapFree
HeapReAlloc
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
GetStdHandle
GetFileType
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetProcessHeap
GetTimeZoneInformation
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
ReadConsoleW
SetStdHandle
WriteConsoleW
OutputDebugStringW
SetEnvironmentVariableA
SleepEx
ExpandEnvironmentStringsA
VerSetConditionMask
VerifyVersionInfoW
GlobalFree
SetEndOfFile
GetCurrentDirectoryW
GetFullPathNameW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FindFirstFileExW
ExitThread
GetProcAddress
FreeLibrary

advapi32

CryptCreateHash
CryptAcquireContextW
CryptGenRandom
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptGetHashParam

ws2_32

WSAGetLastError
connect
WSAIoctl
getpeername
__WSAFDIsSet
select
send
ioctlsocket
freeaddrinfo
getaddrinfo
ntohs
getsockname
setsockopt
recv
bind
socket
WSASetLastError
closesocket
getsockopt
WSAStartup
WSACleanup
htons

crypt32

CertFreeCertificateContext

Exports

Exports

ClientAuth_ClientWriteChallengeResponse
ClientAuth_Destroy
ClientAuth_Initialize
CreateClientAuth
CreateGameClient
CreateGameLauncher
CreateHttpsClient
CreateThirdPartyLauncher
GameClient_ConnectionReset
GameClient_Destroy
GameClient_Initialize
GameClient_PollStatus
GameClient_PopNetworkMessage
GameClient_PushNetworkMessage
GameClient_SetMaxAllowedMessageLength
GameClient_ValidateServerHost
GameClient_ValidateServerHostAccountStatus
GameLauncher_Destroy
GameLauncher_GetGameProcessId
GameLauncher_OpenGameProcess
GameLauncher_StartGameA
GameLauncher_StartGameW
ThirdPartyLauncher_Destroy
ThirdPartyLauncher_Initialize
ThirdPartyLauncher_SetServer
_GameClient_SetUserToken@12

Sections

.text
Size: 389KB - Virtual size: 389KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vapeSpuffer/fix/MSDMINE.DLL
.dll regsvr32 windows x86

Password: infected

76394a25d9c7160ff3a718a04df01ab6

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

23/05/2002, 08:00

Not After

25/09/2011, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:05:87:58:00:03:00:00:00:5a
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/01/2005, 23:20

Not After

05/04/2006, 23:30

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

72:15:17:c1:8a:cb:e1:1d:86:35:0b:c3:41:ad:0d:14:dc:44:77:3e
Signer

Actual PE Digest

72:15:17:c1:8a:cb:e1:1d:86:35:0b:c3:41:ad:0d:14:dc:44:77:3e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoUninitialize
CLSIDFromProgID
CoCreateGuid
CoTaskMemRealloc
CreateStreamOnHGlobal
CoGetMalloc
CoInitializeEx
CLSIDFromString
CreatePointerMoniker
StringFromGUID2
CoCreateInstance
CoGetClassObject
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VarSu
VarAdd
VarCyFromI4
VarDateFromI4
VarDiv
VarMul
VarCmp
VarDecFromR8
SafeArrayPutElement
VarR8FromDec
VarCyFromStr
VarDateFromStr
VarR8FromStr
VarR4FromStr
VarI4FromStr
VarFormat
SysFreeString
VariantClear
SetErrorInfo
SysAllocString
VariantInit
LoadTypeLi
RegisterTypeLi
VariantCopy
SysStringByteLen
VariantChangeTypeEx
SafeArrayCreate
SafeArrayPtrOfIndex
SafeArrayDestroy
VariantTimeToSystemTime
SysAllocStringByteLen
SafeArrayGetUBound
VariantChangeType
SafeArrayUnlock
SafeArrayLock
SysStringLen
SystemTimeToVariantTime
GetErrorInfo
SysAllocStringLen

advapi32

RegSetValueExW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegisterEventSourceW
DeregisterEventSource
ReportEventW
RegCreateKeyW

kernel32

UnmapViewOfFile
SetEndOfFile
GetFileSize
MapViewOfFile
CreateFileMappingW
CreateEventW
LoadLibraryExW
DeleteFileW
FindNextFileW
FindFirstFileW
CreateDirectoryW
MoveFileExW
RemoveDirectoryW
FindClose
IsDBCSLeadByte
HeapAlloc
HeapFree
GetLastError
OutputDebugStringW
InitializeCriticalSection
DeleteCriticalSection
GetSystemTime
InterlockedIncrement
InterlockedDecrement
GetUserDefaultLCID
lstrcpyW
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
GetModuleFileNameW
lstrlenW
FreeLibrary
GetProcAddress
LoadLibraryW
DisableThreadLibraryCalls
MultiByteToWideChar
TlsGetValue
RaiseException
lstrlenA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetVersionExW
GetModuleHandleA
GetCurrentThreadId
SystemTimeToTzSpecificLocalTime
TlsFree
GetSystemDefaultLCID
TlsAlloc
GetTimeFormatW
GetDateFormatW
TlsSetValue
CreateDirectoryExW
GetCommandLineA
GetVersionExA
RtlUnwind
HeapReAlloc
IsBadReadPtr
ExitThread
CreateThread
TerminateProcess
GetCurrentProcess
SetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
IsBadWritePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange
SetUnhandledExceptionFilter
HeapSize
GetACP
GetOEMCP
GetCPInfo
LoadLibraryA
IsBadCodePtr
LCMapStringA
LCMapStringW
GetLocaleInfoA
CreateFileA
GetStringTypeW
SetFilePointer
GetTimeZoneInformation
SetStdHandle
FlushFileBuffers
ReadFile
CloseHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetFileInformationByHandle
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalMemoryStatus
CreateFileW
SleepEx
Sleep
GetModuleHandleW
FormatMessageW
LocalFree
FreeResource
LockResource
LoadResource
FindResourceA
SizeofResource
ExitProcess
GetStringTypeA

user32

wsprintfW
LoadStringW
CharNextW

mswstr10

ord2
ord1

wsock32

WSAGetLastError

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

DLLGetMemoryStreamPersistenceWriter
DMGetResourceString
DMStringToVariant
DMVariantToString
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 1000KB - Virtual size: 998KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 176KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vapeSpuffer/fix/dmserver.dll
.dll windows x86

Password: infected

b97119fa75504975a6feb368dc1b93bb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

StartServiceW
SetServiceStatus
ReportEventW
RegCloseKey
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
DeregisterEventSource
RegSetValueExW
RegisterEventSourceW
RegisterServiceCtrlHandlerExW
RegOpenKeyExW
RegQueryValueExW

kernel32

SetUnhandledExceptionFilter
CloseHandle
CreateFileW
SetErrorMode
GetLastError
VerifyVersionInfoW
SetLastError
SetEvent
UnregisterWait
RegisterWaitForSingleObject
WaitForSingleObject
CreateEventW
OutputDebugStringW
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess

msvcrt

wcscmp
_except_handler3
wcslen
malloc
??3@YAXPAX@Z
vsprintf
free
??2@YAPAXI@Z
wcscpy

ntdll

NtDeviceIoControlFile
NtOpenFile
RtlInitUnicodeString
DbgPrintEx
NtOpenEvent
NtClose
VerSetConditionMask

rpcrt4

NdrClientCall2
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingFree
RpcStringFreeW

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

user32

UnregisterDeviceNotification
RegisterDeviceNotificationW
wsprintfW

Exports

Exports

ServiceMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vapeSpuffer/fix/don't touch anything.txt
vapeSpuffer/fix/xrNetServer.dll
.dll windows x86

Password: infected

842b3611d26efa2ce69dea3a4c1822bb

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

60:68:30:6b:b7:0d:d7:0a:ea:94:bb:90:d1:23:9b:e6
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

03/02/2009, 00:00

Not After

26/04/2011, 23:59

Subject

CN=GSC Game World,OU=SECURE APPLICATION DEVELOPMENT,O=GSC Game World,L=Kiev,ST=Kiev,C=UA

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:3c:96:c3:ae:95:6f:74:a6:b7:6b:64:21:6e:e0:6c:48:f8:35:23
Signer

Actual PE Digest

34:3c:96:c3:ae:95:6f:74:a6:b7:6b:64:21:6e:e0:6c:48:f8:35:23

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostbyname
inet_ntoa

kernel32

InterlockedExchange
DisableThreadLibraryCalls
QueryPerformanceCounter
Sleep
SetThreadPriority
GetTickCount
GetCurrentProcessId
GetCurrentThread
WideCharToMultiByte
MultiByteToWideChar
InterlockedCompareExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId

ole32

CoCreateInstance

xrcore

?rtc9_compress@@YAIPAXIPBXI@Z
?rtc9_decompress@@YAIPAXIPBXI@Z
?rtc_csize@@YAII@Z
?w@NET_Packet@@QAEXPBXI@Z
?w_u16@NET_Packet@@QAEXG@Z
?error2string@xrDebug@@QAEPBDJ@Z
?Core@@3VxrCore@@A
?r_begin@NET_Packet@@QAEIAAG@Z
?Leave@xrCriticalSection@@QAEXXZ
?Enter@xrCriticalSection@@QAEXXZ
?Log@@YAXPBDI@Z
?fail@xrDebug@@QAEXPBD0H0AA_N@Z
??1xrCriticalSection@@QAE@XZ
??0xrCriticalSection@@QAE@XZ
?Msg@@YAXPBDZZ
?fail@xrDebug@@QAEXPBDABV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@0H0AA_N@Z
?GetElapsed_ms@CTimer@@QBEIXZ
?Debug@@3VxrDebug@@A
?error@xrDebug@@QAEXJPBD0H0AA_N@Z
?dock@str_container@@QAEPAUstr_value@@PBD@Z
?g_pStringContainer@@3PAVstr_container@@A
?get_path@CLocatorAPI@@QAEPAVFS_Path@@PBD@Z
?mem_free@xrMemory@@QAEXPAX@Z
?Memory@@3VxrMemory@@A
?mem_alloc@xrMemory@@QAEPAXI@Z
?r_line@CInifile@@QBEHPBDHPAPBD1@Z
?line_count@CInifile@@QBEIPBD@Z
?section_exist@CInifile@@QBEHPBD@Z
??1CInifile@@UAE@XZ
??0CInifile@@QAE@PBDHHHIV?$FastDelegate1@PBD_N@fastdelegate@@@Z
?xr_FS@@3PAVCLocatorAPI@@A
?update_path@CLocatorAPI@@QAEPBDAAY0CAI@DPBD1@Z
?w_string@CInifile@@QAEXPBD000@Z
?r_string@CInifile@@QBEPBDABVshared_str@@PBD@Z
?thread_spawn@@YAXP6AXPAX@ZPBDI0@Z

msvcr80

memset
_stricmp
memcpy
memmove
_crt_debugger_hook
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_vsnprintf_s
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_localtime64
_time64
_mktime64
sscanf
fprintf
vsprintf
exit
fopen
fclose
sscanf_s
_except_handler3
strncmp
_purecall
strncpy_s
abort
strchr
strstr
atol
puts
fwrite

Exports

Exports

??0IBannedClient@@QAE@XZ
??0IClient@@QAE@PAVCTimer@@@Z
??0IClientStatistic@@QAE@PAVCTimer@@@Z
??0INetQueue@@QAE@XZ
??0IPureClient@@QAE@PAVCTimer@@@Z
??0IPureServer@@QAE@PAVCTimer@@H@Z
??0MultipacketReciever@@QAE@ABV0@@Z
??0MultipacketReciever@@QAE@XZ
??0MultipacketSender@@QAE@XZ
??0NET_Compressor@@QAE@XZ
??0syncQueue@@QAE@XZ
??1IClient@@UAE@XZ
??1INetQueue@@QAE@XZ
??1IPureClient@@UAE@XZ
??1IPureServer@@UAE@XZ
??1MultipacketReciever@@UAE@XZ
??1MultipacketSender@@UAE@XZ
??1NET_Compressor@@QAE@XZ
??4IBannedClient@@QAEAAV0@ABV0@@Z
??4IClient@@QAEAAV0@ABV0@@Z
??4IClientStatistic@@QAEAAV0@ABV0@@Z
??4INetQueue@@QAEAAV0@ABV0@@Z
??4IPureClient@@QAEAAV0@ABV0@@Z
??4IPureServer@@QAEAAV0@ABV0@@Z
??4IServerStatistic@@QAEAAV0@ABV0@@Z
??4MultipacketReciever@@QAEAAV0@ABV0@@Z
??4MultipacketSender@@QAEAAV0@ABV0@@Z
??4NET_Compressor@@QAEAAV0@ABV0@@Z
??4ip_address@@QAEAAU0@ABU0@@Z
??4syncQueue@@QAEAAV0@ABV0@@Z
??8ip_address@@QBE_NABU0@@Z
??_7IClient@@6B@
??_7IPureClient@@6BMultipacketReciever@@@
??_7IPureClient@@6BMultipacketSender@@@
??_7IPureServer@@6B@
??_7MultipacketReciever@@6B@
??_7MultipacketSender@@6B@
?Assign_ServerType@IPureServer@@UAEXAAY0CAA@D@Z
?BanAddress@IPureServer@@UAEXABUip_address@@I@Z
?BanClient@IPureServer@@UAEXPAVIClient@@I@Z
?BannedList_Load@IPureServer@@IAEXXZ
?BannedList_Save@IPureServer@@IAEXXZ
?BannedTimeTo@IBannedClient@@QBE?AV?$basic_string@DV?$char_traits@D@stlp_std@@V?$xalloc@D@@@stlp_std@@XZ
?BroadcastCID@@3VClientID@@A
?Check_ServerAccess@IPureServer@@UAE_NPAVIClient@@AAY0CAA@D@Z
?Clear@IClientStatistic@@QAEXXZ
?ClearStatistic@IPureClient@@QAEXXZ
?ClearStatistic@IPureServer@@QAEXXZ
?Compress@NET_Compressor@@QAEGPAEABI01@Z
?Connect@IPureClient@@QAEHPBD@Z
?Connect@IPureServer@@UAE?AW4EConnect@1@PBDAAUGameDescriptionData@@@Z
?Create@INetQueue@@QAEPAVNET_Packet@@ABV2@@Z
?Create@INetQueue@@QAEPAVNET_Packet@@XZ
?Decompress@NET_Compressor@@QAEGPAEABI01@Z
?Disconnect@IPureClient@@QAEXXZ
?Disconnect@IPureServer@@UAEXXZ
?DisconnectAddress@IPureServer@@UAE_NABUip_address@@PBD@Z
?DisconnectClient@IPureServer@@UAE_NPAVIClient@@PBD@Z
?DumpNetCompressorStats@@YAX_N@Z
?DumpStats@NET_Compressor@@QAEX_N@Z
?EndProcessQueue@IPureClient@@QAEXXZ
?FlushSendBuffer@MultipacketSender@@QAEXI@Z
?Flush_Clients_Buffers@IPureServer@@UAEXXZ
?Flush_Send_Buffer@IPureClient@@UAEXXZ
?GetBannedClient@IPureServer@@IAEPAVIBannedClient@@ABUip_address@@@Z
?GetBannedListName@IPureServer@@IAEPBDXZ
?GetClientAddress@IPureServer@@IAE_NPAUIDirectPlay8Address@@AAUip_address@@PAK@Z
?GetClientAddress@IPureServer@@QAE_NVClientID@@AAUip_address@@PAK@Z
?GetClientByID@IPureServer@@QAEPAVIClient@@VClientID@@@Z
?GetClientID@IPureClient@@QAEABVClientID@@XZ
?GetClientsCount@IPureServer@@QAEIXZ
?GetConnectOptions@IPureServer@@QBEABVshared_str@@XZ
?GetMsgId2Name@IPureClient@@UAEPBDG@Z
?GetPort@IPureServer@@QAEHXZ
?GetServerAddress@IPureClient@@QAE_NAAUip_address@@PAK@Z
?GetServerClient@IPureServer@@QAEPAVIClient@@XZ
?GetServerInfo@IPureServer@@UAEXPAVCServerInfo@@@Z
?GetStatistic@IPureClient@@QAEAAVIClientStatistic@@XZ
?GetStatistic@IPureServer@@QAEPBVIServerStatistic@@XZ
?HasBandwidth@IPureServer@@QAEHPAVIClient@@@Z
?ID_to_client@IPureServer@@IAEPAVIClient@@VClientID@@_N@Z
?IpList_Load@IPureServer@@IAEXXZ
?IpList_Unload@IPureServer@@IAEXXZ
?IsPlayerIPDenied@IPureServer@@QAE_NI@Z
?Load@IBannedClient@@QAEXAAVCInifile@@ABVshared_str@@@Z
?Lock@INetQueue@@QAEXXZ
?OnCL_Connected@IPureServer@@UAEXPAVIClient@@@Z
?OnCL_Disconnected@IPureServer@@UAEXPAVIClient@@@Z
?OnCL_QueryHost@IPureServer@@UAE_NXZ
?OnConnectRejected@IPureClient@@UAEXXZ
?OnInvalidHost@IPureClient@@UAEXXZ
?OnInvalidPassword@IPureClient@@UAEXXZ
?OnMessage@IPureClient@@UAEXPAXI@Z
?OnMessage@IPureServer@@UAEIAAVNET_Packet@@VClientID@@@Z
?OnSessionFull@IPureClient@@UAEXXZ
?OnSessionTerminate@IPureClient@@UAEXPBD@Z
?Print_Banned_Addreses@IPureServer@@QAEXXZ
?RecievePacket@MultipacketReciever@@QAEXPBXII@Z
?Release@INetQueue@@QAEXXZ
?Retreive@INetQueue@@QAEPAVNET_Packet@@XZ
?Save@IBannedClient@@QAEXAAVCInifile@@@Z
?Send@IPureClient@@UAEXAAVNET_Packet@@II@Z
?SendBroadcast@IPureServer@@UAEXVClientID@@AAVNET_Packet@@I@Z
?SendBroadcast_LL@IPureServer@@QAEXVClientID@@PAXII@Z
?SendPacket@MultipacketSender@@QAEXPBXIII@Z
?SendTo@IPureServer@@QAEXVClientID@@AAVNET_Packet@@II@Z
?SendTo_Buf@IPureServer@@UAEXVClientID@@PAXIII@Z
?SendTo_LL@IPureClient@@MAEXPAXIII@Z
?SendTo_LL@IPureServer@@UAEXVClientID@@PAXIII@Z
?SetClientID@IPureClient@@IAEXABVClientID@@@Z
?StartProcessQueue@IPureClient@@QAEXXZ
?Sync_Average@IPureClient@@IAEXXZ
?Sync_Thread@IPureClient@@IAEXXZ
?TestLoadBEClient@IPureClient@@UAE_NXZ
?UnBanAddress@IPureServer@@UAEXABUip_address@@@Z
?Unlock@INetQueue@@QAEXXZ
?Update@IClientStatistic@@QAEXAAU_DPN_CONNECTION_INFO@@@Z
?UpdateBannedList@IPureServer@@IAEXXZ
?UpdateClientStatistic@IPureServer@@QAEXPAVIClient@@@Z
?UpdateStatistic@IPureClient@@QAEXXZ
?_FlushSendBuffer@MultipacketSender@@AAEXIPAUBuffer@1@@Z
?_Recieve@IPureClient@@EAEXPBXII@Z
?_Recieve@IPureServer@@EAEXPBXII@Z
?_SendTo_LL@IClient@@EAEXPBXIII@Z
?_SendTo_LL@IPureClient@@EAEXPBXIII@Z
?allow_to_include_path@@YA_NABV?$xr_vector@Vshared_str@@V?$xalloc@Vshared_str@@@@@@PBD@Z
?begin@syncQueue@@QAEPAIXZ
?clear@IServerStatistic@@QAEXXZ
?clear@syncQueue@@QAEXXZ
?compressed_size@NET_Compressor@@QAEGABI@Z
?end@syncQueue@@QAEPAIXZ
?fill_auth_check_params@@YAXAAV?$xr_vector@Vshared_str@@V?$xalloc@Vshared_str@@@@@@0@Z
?g_net_compressor_enabled@@3HA
?g_net_compressor_gather_stats@@3HA
?getBPS@IClientStatistic@@QAEIXZ
?getDroppedCount@IClientStatistic@@QAEIXZ
?getMPS_Receive@IClientStatistic@@QAEIXZ
?getMPS_Send@IClientStatistic@@QAEIXZ
?getPeakBPS@IClientStatistic@@QAEIXZ
?getPing@IClientStatistic@@QAEIXZ
?getReceivedPerSec@IClientStatistic@@QAEIXZ
?getRetriedCount@IClientStatistic@@QAEIXZ
?getSendedPerSec@IClientStatistic@@QAEIXZ
?get_net_DescriptionData@IPureClient@@QBEABUGameDescriptionData@@XZ
?net_Handler@IPureClient@@QAEJIPAX@Z
?net_Handler@IPureServer@@QAEJIPAX@Z
?net_HasBandwidth@IPureClient@@QAEHXZ
?net_IsSyncronised@IPureClient@@UAEHXZ
?net_SessionName@IPureClient@@QAEPBDXZ
?net_Syncronize@IPureClient@@QAEXXZ
?net_isCompleted_Connect@IPureClient@@QAEHXZ
?net_isCompleted_Sync@IPureClient@@QAEHXZ
?net_isDisconnected@IPureClient@@QAEHXZ
?net_isFails_Connect@IPureClient@@QAEHXZ
?net_msg_Release@IPureClient@@QAEXXZ
?net_msg_Retreive@IPureClient@@UAEPAVNET_Packet@@XZ
?psNET_ClientPending@@3HA
?psNET_ClientUpdate@@3HA
?psNET_Flags@@3U?$_flags@I@@A
?psNET_GuaranteedPacketMode@@3HA
?psNET_Name@@3PADA
?psNET_ServerPending@@3HA
?psNET_ServerUpdate@@3HA
?psNET_direct_connect@@3HA
?push@syncQueue@@QAEXI@Z
?set@ip_address@@QAEXPBD@Z
?size@syncQueue@@QAEIXZ
?timeServer@IPureClient@@QAEIXZ
?timeServer_Async@IPureClient@@QAEIXZ
?timeServer_Correct@IPureClient@@QAEXII@Z
?timeServer_Delta@IPureClient@@QAEIXZ
?timeServer_UserDelta@IPureClient@@QAEXH@Z
?to_string@ip_address@@QBE?AV?$basic_string@DV?$char_traits@D@stlp_std@@V?$xalloc@D@@@stlp_std@@XZ

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vapeSpuffer/hwid necessary case/hwid copier.exe
.exe windows x64

Password: infected

2eabe9054cad5152567f0699947a2c5b

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:e9:cf:f9:3a:fb:c9:3d:cc:6d:80:6e:3c:44:8e:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/11/2016, 00:00

Not After

02/02/2018, 12:00

Subject

CN=Manthe Industries\, LLC,O=Manthe Industries\, LLC,L=Appleton,ST=Wisconsin,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

70:12:40:5c:f9:9a:1e:59:68:72:c9:0c:07:c8:63:ae:9d:5d:78:be
Signer

Actual PE Digest

70:12:40:5c:f9:9a:1e:59:68:72:c9:0c:07:c8:63:ae:9d:5d:78:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

lstrcpy

Sections

Size: 111KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bbnxemju
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ufxmuink
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
vapeSpuffer/hwid necessary case/hwidDevComm.dll
.dll windows x86

Password: infected

5a4778f46500a8da00ab249f3936c090

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

inet_addr
__WSAFDIsSet
accept
bind
listen
closesocket
recv
send
socket
setsockopt
htons
ioctlsocket
inet_ntoa
connect
select
WSACleanup
WSAStartup

kernel32

FileTimeToSystemTime
GetProcessHeap
SetEndOfFile
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
LoadLibraryA
GetModuleHandleA
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
SetCommTimeouts
GetCommTimeouts
PurgeComm
ClearCommError
Sleep
CreateThread
CloseHandle
GetLastError
CreateFileW
SetupComm
CreateEventW
SetCommState
GetCommState
SetCommMask
SetEvent
WaitForSingleObject
WaitCommEvent
CancelIo
GetOverlappedResult
WriteFile
ReadFile
ClearCommBreak
SetCommBreak
GetCommModemStatus
ResetEvent
CreateMutexA
ReleaseMutex
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedCompareExchange
MultiByteToWideChar
GetLocaleInfoA
RtlUnwind
HeapFree
HeapAlloc
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapReAlloc
FindClose
SetEnvironmentVariableA
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
GetCurrentThreadId
GetCommandLineA
LCMapStringA
LCMapStringW
GetCPInfo
GetTimeFormatA
GetDateFormatA
CompareStringA
CompareStringW
GetStringTypeW
GetStdHandle
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
ExitProcess
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
SetFilePointer
FlushFileBuffers
HeapSize
GetTimeZoneInformation
GetACP
GetOEMCP
IsValidCodePage
GetFullPathNameA
GetCurrentDirectoryA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId

Exports

Exports

HwDev_Execute
HwDev_Finish
HwDev_Server

Sections

.text
Size: 300KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vapeSpuffer/install_python.bat
.bat .ps1
vapeSpuffer/python.txt
vapeSpuffer/spuff injector.exe
.exe windows x64

Password: infected

1e92fd54d65284238a0e3b74b2715062

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW

comctl32

ord380

kernel32

IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetCPInfo
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
GetEnvironmentVariableW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW

advapi32

OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

gdi32

SelectObject
DeleteObject
CreateFontIndirectW

Sections

.text
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vapeSpuffer/v4 launcher/2pKPn8W8KA.exe
.exe windows x64

Password: infected

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:64:51:19:e7:90:fc:44:94:2a:ed:d0:dc:7f:b5:35
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

22/02/2023, 00:00

Not After

10/04/2023, 23:59

Subject

CN=Manthe Industries\, LLC,O=Manthe Industries\, LLC,L=Green Bay,ST=Wisconsin,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

83:3e:f9:7b:3c:cb:a8:5c:51:78:a3:35:9e:51:1a:95:15:9a:f2:51
Signer

Actual PE Digest

83:3e:f9:7b:3c:cb:a8:5c:51:78:a3:35:9e:51:1a:95:15:9a:f2:51

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 776KB - Virtual size: 775KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 431KB - Virtual size: 489KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: - Virtual size: 8.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 364B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
vapeSpuffer/vlite launcher/xdYXWrukLx.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 1.4MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 338KB - Virtual size: 979KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 136KB - Virtual size: 489KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 117KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 41KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 8KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 10.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 7.4MB - Virtual size: 7.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

4af0207ed1bd77aa41345cc0e0b9ace1

Code Sign

04:00:00:00:00:01:25:07:1d:f9:afCertificate

Key Usages

04:00:00:00:00:01:31:89:c6:4d:e1Certificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

11:21:a7:75:88:2b:27:3a:40:f9:a6:d4:c8:a7:62:82:e4:14Certificate

Extended Key Usages

Key Usages

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:8f:a8:52:c0:cd:bd:a1:1e:f0:c3:32:bf:df:93:74:03Certificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

28:1c:d1:38:4a:d3:7d:91:37:d4:9f:94:b2:0e:ee:c8:b2:26:e2:2aSigner

ac:ed:79:38:0b:50:86:6e:54:41:10:4b:2b:85:04:b1:b9:c3:89:fd:70:74:f0:e5:a6:7d:36:a8:f4:40:97:ebSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ws2_32

crypt32

Exports

Exports

Sections

.text Size: 389KB - Virtual size: 389KB

.rdata Size: 82KB - Virtual size: 82KB

.data Size: 6KB - Virtual size: 18KB

.rsrc Size: 1024B - Virtual size: 896B

.reloc Size: 18KB - Virtual size: 17KB

Password: infected

76394a25d9c7160ff3a718a04df01ab6

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7eCertificate

Extended Key Usages

Key Usages

61:05:87:58:00:03:00:00:00:5aCertificate

Extended Key Usages

Key Usages

72:15:17:c1:8a:cb:e1:1d:86:35:0b:c3:41:ad:0d:14:dc:44:77:3eSigner

Headers

File Characteristics

Imports

ole32

oleaut32

advapi32

kernel32

user32

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

04:00:00:00:00:01:31:89:c6:4d:e1
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

11:21:a7:75:88:2b:27:3a:40:f9:a6:d4:c8:a7:62:82:e4:14
Certificate

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:8f:a8:52:c0:cd:bd:a1:1e:f0:c3:32:bf:df:93:74:03
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Certificate

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

28:1c:d1:38:4a:d3:7d:91:37:d4:9f:94:b2:0e:ee:c8:b2:26:e2:2a
Signer

ac:ed:79:38:0b:50:86:6e:54:41:10:4b:2b:85:04:b1:b9:c3:89:fd:70:74:f0:e5:a6:7d:36:a8:f4:40:97:eb
Signer

.text
Size: 389KB - Virtual size: 389KB

.rdata
Size: 82KB - Virtual size: 82KB

.data
Size: 6KB - Virtual size: 18KB

.rsrc
Size: 1024B - Virtual size: 896B

.reloc
Size: 18KB - Virtual size: 17KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e
Certificate

61:05:87:58:00:03:00:00:00:5a
Certificate

72:15:17:c1:8a:cb:e1:1d:86:35:0b:c3:41:ad:0d:14:dc:44:77:3e
Signer

.text
Size: 1000KB - Virtual size: 998KB

.data
Size: 72KB - Virtual size: 141KB

.rsrc
Size: 176KB - Virtual size: 173KB

.reloc
Size: 120KB - Virtual size: 119KB

.text
Size: 15KB - Virtual size: 15KB

.data
Size: 512B - Virtual size: 64B

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 1024B - Virtual size: 760B

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

60:68:30:6b:b7:0d:d7:0a:ea:94:bb:90:d1:23:9b:e6
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

34:3c:96:c3:ae:95:6f:74:a6:b7:6b:64:21:6e:e0:6c:48:f8:35:23
Signer

.text
Size: 48KB - Virtual size: 46KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0d:e9:cf:f9:3a:fb:c9:3d:cc:6d:80:6e:3c:44:8e:9d
Certificate