93069a3b82e253e12843f128109c46b7c5578789f13deb36145e53b26c21bb6f[.]zip[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

93069a3b82e253e12843f128109c46b7c5578789f13deb36145e53b26c21bb6f.zip.zip
Size

4.3MB
MD5

a140d6c60ebc2ff5785aca6d2ddfd7c3
SHA1

6212d991ba654452e4a36a8bba46da4aceb3c76e
SHA256

f119a3f9586228e34d1dba19e138c4a205afbe6a66b484236972816ac89bdf3c
SHA512

7435f08708e9a93c8d08036c33f7200a594b7d2d19a1042686556cf7725ea580da4f5a87ead9251848e8aabc5a2088112012b1fc2f79ed4af71585cf7cb5f207
SSDEEP

98304:/jHBolkty43cr2ar0UySklkVttIGL+naAf2mBNc:/Wlfkcr240iKknWgAXBi

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack006/main.exe	vmprotect

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack005/Main.dll
unpack006/main.exe

Files

93069a3b82e253e12843f128109c46b7c5578789f13deb36145e53b26c21bb6f.zip.zip
.zip

Password: infected
93069a3b82e253e12843f128109c46b7c5578789f13deb36145e53b26c21bb6f.zip
.zip
Data/GamesWteam/DashBoard.Premium.zip
.zip
DashBoard.Premium
Data/GamesWteam/GamesWteam.Premium.zip
.zip
GamesWteam.Premium
ListaPatch.txt
Main.dll.zip
.zip
Main.dll
.dll windows:6 windows x86

09d29b524c7b6866d2a46f5efeec517f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
GetModuleHandleA
lstrlenA
GetCurrentThreadId
GetCurrentThread
WritePrivateProfileStringA
GetPrivateProfileIntA
VirtualProtect
GetPrivateProfileStringA
CreateFileA
GetFileSize
LoadLibraryA
GetProcAddress
OpenMutexA
CreateMutexA
GetModuleFileNameA
CreateToolhelp32Snapshot
Process32Next
FindResourceA
SizeofResource
LoadResource
LockResource
FreeResource
DeviceIoControl
WriteConsoleW
SetEndOfFile
HeapReAlloc
HeapSize
GetStringTypeW
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetFileSizeEx
SetProcessWorkingSetSize
GetCurrentProcess
Sleep
ExitProcess
GetTickCount
MultiByteToWideChar
SetThreadPriority
GetModuleFileNameW
lstrlenW
WaitNamedPipeW
GetCurrentProcessId
CloseHandle
GetLastError
CreateFileW
PeekNamedPipe
GetCPInfo
WideCharToMultiByte
GetFileType
GetStdHandle
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
GetConsoleMode
HeapFree
HeapAlloc
GetTimeZoneInformation
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InterlockedFlushSList
RaiseException
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
SetLastError
VirtualQuery
VirtualFree
VirtualAlloc
FlushInstructionCache
SetThreadContext
DecodePointer
GetThreadContext
WriteFile
ReadFile
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
WaitForSingleObjectEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleW
InterlockedCompareExchange
SuspendThread
ResumeThread

user32

GetAsyncKeyState
MapVirtualKeyA
SetWindowPos
GetKeyState
wsprintfA
ShowCursor
MessageBoxA
LoadImageA
SendMessageA
SetWindowsHookExA
GetForegroundWindow
CallNextHookEx
GetKeyboardLayout
GetKeyboardState
GetDC
FindWindowA
VkKeyScanA
keybd_event
ToAsciiEx

gdi32

GetTextExtentPointA
GetTextExtentPoint32A
SelectObject
CreateFontA

advapi32

RegCloseKey
RegSetValueExW
RegSetValueExA
RegOpenKeyA
RegCreateKeyExW

ole32

CoInitialize

ws2_32

socket
htons
inet_addr
gethostbyname
connect
closesocket
getpeername
ntohs

winmm

mmioClose
mmioOpenA
mmioDescend
mmioRead
mmioAscend
timeGetTime

opengl32

glEnd
glVertex4fv
glTexCoord2fv
glBegin
glLoadIdentity
glPushMatrix
glPopMatrix
glMatrixMode
glColor4fv
glCallLists
glRasterPos2f
glListBase
glGetFloatv
wglUseFontBitmapsA
glGenLists
glHint
glFogi
glClearColor
glDisable
glFogf
glFogfv
glEnable
glTexParameteri
glGetIntegerv
glColor3f
glColor4f

dsound

ord1

Exports

Exports

EntryProc
XGetAccountLevel
XGetBaseExperience
XGetCoin1
XGetCoin2
XGetCoin3
XGetExperience
XGetMasterExperience
XGetMasterNextExperience
XGetMasterReset
XGetNextExperience
XGetReset

Sections

.text
Size: 793KB - Virtual size: 793KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.1MB - Virtual size: 7.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 368KB - Virtual size: 368KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
main.exe.zip
.zip
main.exe
.exe windows:5 windows x86

42f6a1c1e283820f732d935bfc1b78a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmGetContext
ImmSetCompositionWindow
ImmGetCompositionWindow
ImmGetOpenStatus
ImmGetDefaultIMEWnd
ImmGetIMEFileNameA
ImmGetDescriptionA
ImmSetOpenStatus
ImmGetCompositionStringA
ImmSetConversionStatus
ImmGetConversionStatus
ImmReleaseContext

dsound

ord1
ord2

opengl32

glColor4f
glDisable
glEnd
glVertex2f
glTexCoord2f
glBegin
glColor3f
glTexImage2D
glBindTexture
glFlush
glClear
glPopMatrix
glAlphaFunc
glDepthFunc
glTranslatef
glRotatef
glLoadIdentity
glPushMatrix
glMatrixMode
wglDeleteContext
wglMakeCurrent
glGetString
wglCreateContext
glClearColor
glVertex3f
glNormal3f
glVertex3fv
glColor3fv
glDeleteTextures
glTexParameteri
glGenTextures
glTexEnvf
glDepthMask
glPolygonMode
glFrontFace
glStencilFunc
glColorMask
glStencilOp
glScalef
glColor4ub
glEnable
glGetFloatv
glReadPixels
glBlendFunc
glViewport
glFogfv
glFogf
glFogi
glTexEnvi
glGetIntegerv
glColor3ub

glu32

gluPerspective
gluOrtho2D

winmm

timeKillEvent
timeSetEvent
timeGetDevCaps
timeBeginPeriod
mmioWrite
mmioOpenA
mmioDescend
mmioRead
mmioAscend
mmioClose
timeGetTime
timeEndPeriod

ws2_32

getservbyport
gethostbyaddr
getservbyname
htonl
listen
WSASetLastError
connect
gethostname
setsockopt
socket
shutdown
recv
closesocket
WSAStartup
bind
htons
inet_addr
__WSAFDIsSet
select
getpeername
getsockname
inet_ntoa
ntohs
ioctlsocket
accept
WSASend
WSAAsyncSelect
sendto
WSAGetLastError
send
WSACleanup
gethostbyname

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

wzaudio

wzAudioCreate
wzAudioOption
wzAudioDestroy
wzAudioGetStreamOffsetRange
wzAudioPlay
wzAudioStop

kernel32

InterlockedCompareExchange
RtlUnwind
UnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetTickCount
IsBadReadPtr
lstrlenA
GlobalUnlock
GlobalLock
CreateFileA
GetCommandLineA
CloseHandle
ExitProcess
ReadFile
GetFileSize
GetLastError
GetPrivateProfileStringA
GetCurrentDirectoryA
DeleteFileA
CopyFileA
SetFileAttributesA
Process32Next
TerminateProcess
OpenProcess
Process32First
CreateToolhelp32Snapshot
WinExec
Sleep
FindClose
FindFirstFileA
GetLocalTime
GetCurrentThreadId
SetFilePointer
SystemTimeToFileTime
LocalFileTimeToFileTime
CreateDirectoryA
GetFileAttributesA
SetFileTime
WriteFile
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
WritePrivateProfileStringA
GetSystemDirectoryA
lstrcmpiA
GetVersionExA
SetProcessAffinityMask
SetThreadPriority
SetPriorityClass
GetProcessAffinityMask
GetThreadPriority
GetPriorityClass
GetCurrentThread
GetCurrentProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalMemoryStatus
SetConsoleMode
GetStdHandle
AllocConsole
FreeConsole
SetConsoleTitleA
GetConsoleTitleA
SetLastError
SetConsoleCursorPosition
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
ReadConsoleOutputA
GetCurrentProcessId
SetUnhandledExceptionFilter
GetExitCodeThread
WaitForSingleObject
CreateThread
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedExchange
CompareStringA
CompareStringW
GetThreadContext
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
lstrcpynA
Module32Next
Module32First
GetModuleFileNameA
RemoveDirectoryA
FindNextFileA
GetFullPathNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
IsBadStringPtrA
OpenFileMappingA
IsBadWritePtr
SetEvent
SetEndOfFile
GetModuleHandleA
CreateMutexA
ResumeThread
ResetEvent
GetExitCodeProcess
WaitForMultipleObjects
CreateProcessA
CreateEventA
OpenEventA
OpenMutexA
MoveFileExA
lstrcatA
TerminateThread
ReleaseMutex
GetComputerNameA
lstrcmpA
GetModuleFileNameW
VirtualProtect
VirtualQuery
VirtualAlloc
VirtualFree
LoadLibraryExA
GetTempFileNameA
GetTempPathA
HeapFree
GetProcessHeap
HeapAlloc
GetFileInformationByHandle
DuplicateHandle
SetStdHandle
CreatePipe
PeekNamedPipe
lstrcpyA
GetFileAttributesW
CreateDirectoryW
DeleteFileW
lstrlenW
CreateFileW
SetFileAttributesW
GetFileSizeEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetTimeZoneInformation
GetStartupInfoA
MoveFileA
ExitThread
GetCPInfo
LCMapStringA
LCMapStringW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
HeapCreate
HeapDestroy
FatalAppExitA
HeapReAlloc
GetACP
GetOEMCP
EnterCriticalSection
InterlockedIncrement
IsValidCodePage
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
InterlockedDecrement
IsValidLocale
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
FlushFileBuffers
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
LocalFree
CompareFileTime
FileTimeToDosDateTime
GetSystemTime
FormatMessageA
GetFullPathNameW
GetCurrentDirectoryW
GetTempPathW
MoveFileW
CopyFileW
SetCurrentDirectoryW
SetCurrentDirectoryA
RemoveDirectoryW
GetFileTime
FindFirstFileW
FindNextFileW
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA

user32

ChangeDisplaySettingsA
FindWindowA
SystemParametersInfoA
DefWindowProcA
ReleaseCapture
ReleaseDC
ShowCursor
KillTimer
IntersectRect
wsprintfA
SetTimer
SetScrollPos
GetScrollPos
SetCapture
SetFocus
PostMessageW
CreateWindowExW
ShowWindow
GetDC
PostQuitMessage
SendMessageW
SetWindowTextW
GetWindowTextW
GetWindowTextA
GetCaretPos
GetWindowLongW
SendMessageA
CallWindowProcW
OpenClipboard
GetClipboardData
CloseClipboard
SetWindowLongW
DestroyWindow
SetRect
GetActiveWindow
GetCursorPos
ScreenToClient
GetDoubleClickTime
EndPaint
BeginPaint
CreateWindowExA
RegisterClassA
LoadCursorA
LoadIconA
SetForegroundWindow
GetSystemMetrics
AdjustWindowRect
IsIconic
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
UpdateWindow
EnumDisplaySettingsA
GetDesktopWindow
SetWindowsHookExA
UnhookWindowsHookEx
CharUpperW
CharUpperA
CharLowerW
CharLowerA
GetWindowThreadProcessId
GetClassNameA
GetSystemMenu
DrawMenuBar
RemoveMenu
EnumChildWindows
SetWindowPos
GetKeyboardLayoutNameA
wvsprintfA
GetAsyncKeyState
PtInRect
OffsetRect
MessageBoxA
PostMessageA
SetCursorPos
UnregisterHotKey
RegisterHotKey
GetWindowRect
IsWindowVisible
CallNextHookEx
GetFocus
GetKeyboardLayout

gdi32

CreateCompatibleDC
SelectObject
DeleteObject
CreateDIBSection
DeleteDC
SetTextColor
SetBkColor
SwapBuffers
GetStockObject
SetPixelFormat
ChoosePixelFormat
GetTextExtentPoint32W
TextOutW
CreateFontA

advapi32

CryptGetUserKey
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegDeleteKeyA
RegOpenKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegDeleteValueA
RegCreateKeyA
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptAcquireContextA
CryptGenKey
CryptExportKey
CryptGetProvParam
CryptEnumProvidersA
CryptAcquireContextW
RegSetValueExW
CryptGenRandom
RegEnumValueA
CryptDestroyHash
CryptVerifySignatureA
CryptHashData
CryptCreateHash
CryptDecrypt
CryptDeriveKey
CryptGetHashParam
GetUserNameA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

ShellExecuteA

ole32

CoUninitialize
CoCreateInstance
CoInitialize

dbghelp

SymCleanup
SymGetLineFromAddr64
SymFromAddr
StackWalk64
SymInitialize
SymSetOptions
MiniDumpWriteDump

iphlpapi

GetAdaptersInfo

wininet

InternetCloseHandle
FtpPutFileA
FtpCreateDirectoryA
InternetOpenUrlA
InternetConnectA
InternetOpenA
InternetReadFile
InternetOpenW
InternetConnectW
HttpQueryInfoW
HttpSendRequestA
HttpOpenRequestW
InternetQueryDataAvailable
FtpOpenFileW
FtpFindFirstFileW

crypt32

CertNameToStrA
PFXExportCertStoreEx
CertDeleteCertificateFromStore
CertSaveStore
CertAddCertificateContextToStore
CertSetCertificateContextProperty
CertAddEncodedCertificateToStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateStore
CryptEncodeObject
CryptSignMessage
CertOpenStore
CryptDecryptMessage
CertCloseStore
CryptMsgOpenToDecode
CryptMsgUpdate
CryptMsgClose
CryptMsgGetParam
CertGetSubjectCertificateFromStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CryptMsgControl
CryptDecodeObject
CertGetIntendedKeyUsage
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertGetCertificateChain
CertCreateCertificateChainEngine
CertCreateCertificateContext
CryptAcquireCertificatePrivateKey
CertVerifyRevocation

urlmon

URLDownloadToFileW
URLDownloadToFileA

Sections

.text
Size: - Virtual size: 9.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 138.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 653KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
main.premium.zip
.zip
main.premium

Sharing

General

Malware Config

Signatures

Files

Password: infected

09d29b524c7b6866d2a46f5efeec517f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

ws2_32

winmm

opengl32

dsound

Exports

Exports

Sections

.text Size: 793KB - Virtual size: 793KB

.rdata Size: 82KB - Virtual size: 81KB

.data Size: 4.1MB - Virtual size: 7.7MB

.rsrc Size: 368KB - Virtual size: 368KB

.reloc Size: 58KB - Virtual size: 58KB

42f6a1c1e283820f732d935bfc1b78a0

Headers

DLL Characteristics

File Characteristics

Imports

imm32

dsound

opengl32

glu32

winmm

ws2_32

version

wzaudio

kernel32

user32

gdi32

advapi32

shell32

ole32

dbghelp

iphlpapi

wininet

crypt32

urlmon

Sections

.text Size: - Virtual size: 9.1MB

.rdata Size: - Virtual size: 1.2MB

.data Size: - Virtual size: 138.1MB

.vmp0 Size: - Virtual size: 653KB

.vmp1 Size: 3.4MB - Virtual size: 3.4MB

.reloc Size: 512B - Virtual size: 228B

.rsrc Size: 9KB - Virtual size: 8KB

.text
Size: 793KB - Virtual size: 793KB

.rdata
Size: 82KB - Virtual size: 81KB

.data
Size: 4.1MB - Virtual size: 7.7MB

.rsrc
Size: 368KB - Virtual size: 368KB

.reloc
Size: 58KB - Virtual size: 58KB

.text
Size: - Virtual size: 9.1MB

.rdata
Size: - Virtual size: 1.2MB

.data
Size: - Virtual size: 138.1MB

.vmp0
Size: - Virtual size: 653KB

.vmp1
Size: 3.4MB - Virtual size: 3.4MB

.reloc
Size: 512B - Virtual size: 228B

.rsrc
Size: 9KB - Virtual size: 8KB