�p��"����??zIQ[m&d��ƌ�:�-�c��f��gDC�(���L����h7H�5,;o�^���OO�r�7�w�$r�bz��H����C�@��:����6h(��$���̛3��W�5�������'T/^�eBb.ErS��*zh�n�&h���YX�V��3 B�{�9q��q,�W5���4��^��,V�G"4�T���I1�ZMy4� L]�+�q�{���P�`�pd����~���3��Ս��r��љ�х��w0��U�G��m }߄x��UO?���OaԢ��TGʍ�ZJz�E"p�仨�C-���G���H��~+6e&~�]���g�r/ς��B��� :s��8@RL��L�t�o�B䮔�uf�-�3ѷ�����3ܠnhS�B��w>������:(U�y��'U�"��3v#�x���ͫ�!��T*�o �]��Q8 �;��h��w�8�>���AG�YupG�����������c��.��/����<����X! jl0�~�u���*�(, =`������R�ƶi9 *��v��\2��NY�b��"�\���lj��ir����mV^#�����}��v��"eK��7J��������t���0�ܹ3��0-4��b��{\!Y�)^H�ٳ����җ#Ԭ�� ����"�#tdn� ���7a��FRd��[�"j��B@O9 � ��7��W��̞�m �c���f̀CFm�A�ٽ1�w:� H��7�q�c�ƺ��r �Ҿٚ�à�#c�%fW�!����7 Z}�߫⸥;��E.�OT*�������3' �'�D �O��m\�ú?��,L]7υ73������c����1�Ε�:�s��a랸�CDXJ�pJ�b����r��#]pJF���4:g����wg���ҿ\�M0'����|L�z� o@Z^����pT/�e�m� �<Hz�ܠn`��e�������K V�)�n�^m���z���=��E1���� 8���'�&B��R�]�Λ��v���rH��Zg���ˉ��K���7��(��yƐ�\S��Nn�L��&;�稫�<1!�pv�����E�tf��p��ĥ�I}O��S����ӗ�����G8�t�JjX�]ݷ������X����Ƀ-��h�v^k�����2۹4)�!x���P��ϩ���O�eI`���kf�2x����e�4Ge� �0��٣S�I0��O���N@�sZQ��z��D����<��E�l�̂���t�ڠ8���d������c�B����� 7�WR�E�h�#��r59�87D��ץ�_?����T���6g��>��][�8ۺ?a�n��G��b��Ѫ20��M")���F�"[/gx*H�1�F�7;�G��<��P��)�i��� Q�3 W��n���g������s���Z�{��Ѕ3�ht��]�@�<�TY��8��b֊�zCk��× j1H�)U����q��?��?��ȋVwf ���@4����,���ݎ�~�R`���J|�@ǡ�g��k�s�R�@���,sn��^|%��-H�� |j�B�!JH�Io���S�oi�b�o�R�z�u�$����k�$3�er5:qnZ�#ް��1۲�s���h��l`� ��Ըj}��\�+Wl�M�����P��_���`o����g���!"�������,�`�L>ʤjMԄC6�%n�G�3������CdQ�3�>��}�q��g���S���=��� ������ӻ����"��i��'1?'��������e�2�}2>R�U�⣎s�� ����A�)s��~����D^ňڡW��2+Ë #��"�-Ep.<�2_��1��������Y�<<��DL�Q��Eꪬ��K��6J���=���Đ�ţ)����a£ɣ�*<��T�<������EX�S�䍪cr� lh�#B�U;�fڧ��jbJ9�S�gE��i�����2Zozk���\�4 jT-s� ����o2�ZnTe� n�q�M�'%n��G�5�m��=c���.bP�e��&��@��L��Q��]��y~���0�KC�p�����N�БFaT� ��3�o�4��SH�q�*���k���8�N�P�v�(��F��~(������.�a��.��%�2� ;����s����0�<Ѡ�[��c�N%H*� t �\\���t��h�E�]#�V �{1�C�,��&}Q�:l��k����šq4w�J��9�55z�}D�6��"��R�'g�~8R�9��5_���9Ӑn��1鄱N]�ߒ{/�����3П�9S�t8Z�6N� �$����^�'������&��@e��+�:̇/v�9+��.w�)�.�~˝W0�8� `�:2�UA����rx�v�i��7#-R��F��ߺڋo��|_���/��L��J��EY�֢��F+\�����xeˏ��2��l�)c��)J��G��;���I��,0}��ٿ���-��pZ%G ��g �b����i���*L�O����|��6�"�����Đ�G�,����3%k.�7���<��� +J6� ���T��Z���^bE�ͳy�N3H ��BaA�xX�{�����G����;ӖFc��=�:K�F�WQ���7������@"��v\)��!A\x�yOW�^��;�� ��[��%ZЗ��~:g����i-���)�\�G����j:v�Ƹ��[�,ݏ��=��5�_ �m>�#�^m\�q��: ��w�~M/�ȿ��Q�� n����O¦�9�c�~&�<'��?a���1�x\�nj��'�J�{���� ��RB���a�Fk]���RH��=a��gp�]�����|�y�9 l}�ʍ���*��_��� �y�0S1��������B/��n����3��K8F3�9_wn@�P����cO���%k+kN8��}� �yb�^��$(�����|_��p?�%NR����䒍�v��O�TH�ð�{X�Ν��d�Šb�H�#��c�SD���A�WY_� �n'3���|�6�vi�����?&ۑ�X���29��t]�P]��+=�ᔃs��
Static task
static1
General
-
Target
红色警戒2修改大师2.90正式版.exe
-
Size
8.1MB
-
MD5
636a8874adf1b88da63da21ddc82112a
-
SHA1
b8dc3737e91b053d2912a57230d88cd33bebffdd
-
SHA256
0a689341457d6fcf36e5527dd21129f050152e0a442a3f71852685086300732d
-
SHA512
509df5d4b96ca5002040c5dc5269d3ddf12a93f08a600aee6c159d72ea68a169ea6a720445e883e62a6bef8fb98340facd232f853d7b980657954d99e7a7ed46
-
SSDEEP
196608:4OUia+JuyxEf3ZndgoXS7P44TRl6+zS4IlXKe9Qw1Untj:6ia/h/ngoXS7P44TRw++ZKQQw1U
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 红色警戒2修改大师2.90正式版.exe
Files
-
红色警戒2修改大师2.90正式版.exe.exe windows:5 windows x86
Password: 12345678
f252629e3519ca3b9647b5339b06db49
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SendMessageA
gdi32
CreateRoundRectRgn
winmm
waveOutPrepareHeader
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
CoCreateInstance
oleaut32
LHashValOfNameSys
comctl32
ord17
ws2_32
getpeername
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 633KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 222KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lwl0 Size: - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lwl1 Size: 8.1MB - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ