asd[.]rar | Triage

Resubmissions

02-09-2023 08:52

230902-kszm1abh95 9

02-09-2023 08:49

230902-krc3lsbh93 7

Sharing

Copy URL

Twitter E-mail

General

Target

asd.rar
Size

54.2MB
MD5

b720bd455b680369f1785c6ef5c740e4
SHA1

c4bdc054e8a5f4397769abf353f50ee28643f0df
SHA256

8cf55ce3290810687fa5521e8b01768838f57222e0badd3c72749457845893d5
SHA512

7265ebd4d3e9ab2ecdc1297a65dfac1ea1ba0d6ef40c36be482d8009bb6921e1b610476c804d753b55249a883754924a302359ef929a61a956ca3987b299fa64
SSDEEP

1572864:j2FG33im5JizaCAismgyWMruEet1pzMg/uRYVzbucpd:6InHMsmgwQPpz7ifcj

Score

7^/10

themida pyinstaller

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/lite/taskhostw.exe	themida

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/server/lean_server.exe	pyinstaller

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/lite/Kangaroo Patcher.exe
unpack001/lite/Kangaroo.dll
unpack001/lite/taskhostw.exe
unpack001/server/lean_server.exe

Files

asd.rar
.rar
lite/Kangaroo Patcher.exe
.exe windows x64

67a310fbaf312beb92b18448f0a7f56f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WriteProcessMemory
ResumeThread
GetModuleHandleA
Sleep
CloseHandle
GetProcAddress
VirtualAllocEx
CreateRemoteThread
CreateProcessA
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW

vcruntime140

__current_exception
__current_exception_context
__C_specific_handler
memset

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__p__commode
_set_fmode
__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_cexit
__p___argv
terminate
__p___argc
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_initterm
_set_app_type
_seh_filter_exe
_exit
exit
_crt_atexit
_initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lite/Kangaroo.dll
.dll windows x64

7d226bb099de7142bef97f5b7d4f7689

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

WriteProcessMemory
GetCurrentProcess
GetModuleHandleA
LoadLibraryA
AllocConsole
CloseHandle
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetModuleHandleW
GetProcAddress
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
RaiseException
MultiByteToWideChar
IsDebuggerPresent
FreeLibrary
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetLastError
GetProcessHeap

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__std_type_info_destroy_list
_CxxThrowException
__C_specific_handler_noexcept
memset
memcpy
__std_exception_copy
__std_exception_destroy
__vcrt_GetModuleFileNameW
__C_specific_handler
__vcrt_LoadLibraryExW
memmove

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_cexit
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-string-l1-1-0

strcat_s
strcpy_s

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lite/readme.txt
lite/taskhostw.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 1.4MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 376KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 136KB - Virtual size: 489KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 120KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 28KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 8KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
server/Dump0
.zip
server/Dump1
.zip
server/Dump2
.zip
server/assets/blatant.png
.png
server/assets/check.png
.png
server/assets/circle.png
.png
server/assets/circle2.png
.png
server/assets/combat.png
.png
server/assets/copy.png
.png
server/assets/creeper.png
.png
server/assets/cross.png
.png
server/assets/delete.png
.png
server/assets/di_hit.png
.png
server/assets/di_pot.png
.png
server/assets/di_target.png
.png
server/assets/dots.png
.png
server/assets/download.png
.png
server/assets/duel info.png
.png
server/assets/ex.png
.png
server/assets/exo.png
.png
server/assets/export.png
.png
server/assets/favorite.png
.png
server/assets/fire.png
.png
server/assets/friends.png
.png
server/assets/gui.png
.png
server/assets/icon4.png
.png
server/assets/import.png
.png
server/assets/info.png
.png
server/assets/macros.png
.png
server/assets/magnify.png
.png
server/assets/other.png
.png
server/assets/peace.png
.png
server/assets/pin.png
.png
server/assets/profiles.png
.png
server/assets/radar.png
.png
server/assets/rearview.png
.png
server/assets/render.png
.png
server/assets/search.png
.png
server/assets/settings.png
.png
server/assets/sync.png
.png
server/assets/target info.png
.png
server/assets/text gui.png
.png
server/assets/toggleback.png
.png
server/assets/toggleback2.png
.png
server/assets/togglefront.png
.png
server/assets/upload.png
.png
server/assets/user.png
.png
server/assets/utility.png
.png
server/assets/v4.png
.png
server/assets/vapelogo.png
.png
server/assets/vapelogosmall.png
.png
server/assets/world.png
.png
server/cert.pem
server/key.pem
server/lean_server.exe
.exe windows x64

d170e2e5adcfc4c271f2eb78a565305e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
GetStartupInfoW
FreeLibrary
LoadLibraryExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
CreateProcessW
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RaiseException
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW

advapi32

ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

Sections

.text
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
server/mappings/1.12/fields.csv
server/mappings/1.12/fields_cache.json
server/mappings/1.12/joined.srg
server/mappings/1.12/methods.csv
server/mappings/1.12/methods_cache.json
server/mappings/1.7.10/fields.csv
server/mappings/1.7.10/fields_cache.json
server/mappings/1.7.10/joined.srg
server/mappings/1.7.10/methods.csv
server/mappings/1.7.10/methods_cache.json
server/mappings/1.8.9/fields.csv
server/mappings/1.8.9/fields_cache.json
server/mappings/1.8.9/joined.srg
server/mappings/1.8.9/methods.csv
server/mappings/1.8.9/methods_cache.json
server/mappings/lunar/fields.csv
server/mappings/lunar/fields_cache.json
server/mappings/lunar/joined.srg
server/mappings/lunar/methods.csv
server/mappings/lunar/methods_cache.json
server/settings/v4/eff8e7ca506627fe15dda5e0e512fcaad70b6d520f37cc76597fdb4f2d83a1a3.json
server/strings.txt

Resubmissions

Sharing

General

Malware Config

Signatures

Files

67a310fbaf312beb92b18448f0a7f56f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 396B

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 512B - Virtual size: 44B

7d226bb099de7142bef97f5b7d4f7689

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 1KB - Virtual size: 2KB

.pdata Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 168B

Headers

DLL Characteristics

File Characteristics

Sections

Size: 1.4MB - Virtual size: 3.6MB

Size: 376KB - Virtual size: 1.2MB

Size: 136KB - Virtual size: 489KB

Size: 120KB - Virtual size: 223KB

Size: 28KB - Virtual size: 35KB

Size: 8KB - Virtual size: 36KB

.idata Size: 1024B - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 7KB - Virtual size: 7KB

.themida Size: - Virtual size: 6.4MB

.boot Size: 4.5MB - Virtual size: 4.5MB

.reloc Size: 16B - Virtual size: 4KB

d170e2e5adcfc4c271f2eb78a565305e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Sections

.text Size: 141KB - Virtual size: 141KB

.rdata Size: 69KB - Virtual size: 69KB

.data Size: 3KB - Virtual size: 64KB

.pdata Size: 8KB - Virtual size: 7KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 38KB - Virtual size: 37KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 396B

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 512B - Virtual size: 44B

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 1KB - Virtual size: 2KB

.pdata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 168B

.idata
Size: 1024B - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 7KB - Virtual size: 7KB

.themida
Size: - Virtual size: 6.4MB

.boot
Size: 4.5MB - Virtual size: 4.5MB

.reloc
Size: 16B - Virtual size: 4KB

.text
Size: 141KB - Virtual size: 141KB

.rdata
Size: 69KB - Virtual size: 69KB

.data
Size: 3KB - Virtual size: 64KB

.pdata
Size: 8KB - Virtual size: 7KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 38KB - Virtual size: 37KB

.reloc
Size: 2KB - Virtual size: 1KB