3e15a5502b4706bde1c1a9d4f5a8fbc4

Sharing

Copy URL Twitter E-mail

General

Target

3e15a5502b4706bde1c1a9d4f5a8fbc4
Size

498KB
MD5

3e15a5502b4706bde1c1a9d4f5a8fbc4
SHA1

70f96934db2ecdd56bdbcc9f0dbec28f616ab377
SHA256

a963ed1620dfce978e588c48e63edcc330eeedd008cf189aa7df85c5c67b68fc
SHA512

c8eae4b0e02bd56f89e9ba43f142c27c68e70230c068b47bd8b5d4e833771132235a56ea0b7196671f65a2976fa22546c1f4f494cc65e4fcc8ff9304e7684b2e
SSDEEP

12288:fsMKq1n27nUWJ7PlYVnfI/qEwnIvwv4afzSSFkB/tBK2ht:kMKq1UnUWhN0tEtvwvrS9B1BVt

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/MPQMaster1.3.1build42/Lang_CHS.dll	acprotect
static1/unpack001/MPQMaster1.3.1build42/Lang_RUS.dll	acprotect
static1/unpack001/MPQMaster1.3.1build42/MpqLib.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/MPQMaster1.3.1build42/Lang_CHS.dll	upx
static1/unpack001/MPQMaster1.3.1build42/Lang_RUS.dll	upx

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MPQMaster1.3.1build42/Lang_CHS.dll
unpack002/out.upx
unpack001/MPQMaster1.3.1build42/Lang_RUS.dll
unpack003/out.upx
unpack001/MPQMaster1.3.1build42/MPQMaster.exe
unpack001/MPQMaster1.3.1build42/MpqLib.dll

Files

3e15a5502b4706bde1c1a9d4f5a8fbc4
.zip
MPQMaster1.3.1build42/LangAPI/LangAPI.pas
MPQMaster1.3.1build42/LangAPI/Lang_ENU.dpr
MPQMaster1.3.1build42/Lang_CHS.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

Language

Sections

UPX0
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 834B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
MPQMaster1.3.1build42/Lang_RUS.dll
.dll windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

Language

Sections

UPX0
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
MPQMaster1.3.1build42/Listfiles/Diablo I.txt
MPQMaster1.3.1build42/Listfiles/Diablo II.txt
MPQMaster1.3.1build42/Listfiles/Hellfire.txt
MPQMaster1.3.1build42/Listfiles/Lords of Magic.txt
MPQMaster1.3.1build42/Listfiles/Starcraft.txt
MPQMaster1.3.1build42/Listfiles/Warcraft II BNE.txt
MPQMaster1.3.1build42/Listfiles/Warcraft III.txt
MPQMaster1.3.1build42/MPQMaster.exe
.exe windows:4 windows x86 arch:x86

652244639b1d25bff12480d557f0da0b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

gdi32

SetTextColor

user32

CreateWindowExA

shell32

ShellExecuteA

comdlg32

GetSaveFileNameA

ole32

CoTaskMemFree

comctl32

ImageList_GetIconSize

mpqlib

C7

Sections

CODE
Size: 47KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
MPQMaster1.3.1build42/MPQMaster.ini
MPQMaster1.3.1build42/MPQMaster下载 1.31.42绿色中文版_魔兽改图工具 - pc6下载站.url
.url
MPQMaster1.3.1build42/MpqLib.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Exports

Exports

A1
A2
A3
A4
A5
A6
A7
A8
A9
B1
B2
B3
B4
B5
B6
B7
B8
B9
C1
C2
C3
C4
C5
C6
C7
C8
___CPPdebugHook

Sections

CODE
Size: - Virtual size: 128KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
MPQMaster1.3.1build42/history.txt
MPQMaster1.3.1build42/readme.txt
MPQMaster1.3.1build42/使用更新说明.txt

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 36KB

UPX1 Size: 9KB - Virtual size: 12KB

.rsrc Size: 1KB - Virtual size: 4KB

Headers

File Characteristics

Sections

CODE Size: 16KB - Virtual size: 15KB

DATA Size: 512B - Virtual size: 176B

BSS Size: - Virtual size: 2KB

.idata Size: 1024B - Virtual size: 834B

.edata Size: 512B - Virtual size: 72B

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 40KB

UPX1 Size: 11KB - Virtual size: 12KB

.rsrc Size: 1KB - Virtual size: 4KB

Headers

File Characteristics

Sections

CODE Size: 17KB - Virtual size: 16KB

DATA Size: 512B - Virtual size: 200B

BSS Size: - Virtual size: 1KB

.idata Size: 1KB - Virtual size: 1KB

.edata Size: 512B - Virtual size: 72B

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

652244639b1d25bff12480d557f0da0b

Headers

File Characteristics

Imports

kernel32

oleaut32

gdi32

user32

shell32

comdlg32

ole32

comctl32

mpqlib

Sections

CODE Size: 47KB - Virtual size: 156KB

.rsrc Size: 15KB - Virtual size: 16KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: - Virtual size: 128KB

DATA Size: 76KB - Virtual size: 76KB

.rsrc Size: 1024B - Virtual size: 4KB

UPX0
Size: - Virtual size: 36KB

UPX1
Size: 9KB - Virtual size: 12KB

.rsrc
Size: 1KB - Virtual size: 4KB

CODE
Size: 16KB - Virtual size: 15KB

DATA
Size: 512B - Virtual size: 176B

BSS
Size: - Virtual size: 2KB

.idata
Size: 1024B - Virtual size: 834B

.edata
Size: 512B - Virtual size: 72B

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

UPX0
Size: - Virtual size: 40KB

UPX1
Size: 11KB - Virtual size: 12KB

.rsrc
Size: 1KB - Virtual size: 4KB

CODE
Size: 17KB - Virtual size: 16KB

DATA
Size: 512B - Virtual size: 200B

BSS
Size: - Virtual size: 1KB

.idata
Size: 1KB - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 72B

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

CODE
Size: 47KB - Virtual size: 156KB

.rsrc
Size: 15KB - Virtual size: 16KB

CODE
Size: - Virtual size: 128KB

DATA
Size: 76KB - Virtual size: 76KB

.rsrc
Size: 1024B - Virtual size: 4KB