Static task
static1
Behavioral task
behavioral1
Sample
2018年全部热门单机游戏及汉化下载.url
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2018年全部热门单机游戏及汉化下载.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Far Cry 4 V1.10 Trainer +13 MrAntiFun.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Far Cry 4 V1.10 Trainer +13 MrAntiFun.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
www.3dmgame.com.url
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
www.3dmgame.com.url
Resource
win10v2004-20231215-en
General
-
Target
0926cbfdacc315a2812822e76614bbd0
-
Size
577KB
-
MD5
0926cbfdacc315a2812822e76614bbd0
-
SHA1
c62bbd31ef358895e8211ee5e059d0ce4d4a9feb
-
SHA256
d145f71a3e5746606f980f7ed619a41bb121e078f4c870af1d0bf7e5fc53661c
-
SHA512
2947f8ec10bdb20ee09317f61ff6af622619daf2f95e6930dee43cff0edc1c8b9ac463e21943f2ec83a47d0597c26eefc68b1f4d8fa944b1f243a3467eaa45ed
-
SSDEEP
12288:sE8h1oKNqo4syIW0FYwGCMJUAJcb6dlh0XyNROR1EHUpl:iN4o4uW2GCM6OOWOyNoy2l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Far Cry 4 V1.10 Trainer +13 MrAntiFun.exe
Files
-
0926cbfdacc315a2812822e76614bbd0.rar
-
2018年全部热门单机游戏及汉化下载.url.url
-
Far Cry 4 V1.10 Trainer +13 MrAntiFun.exe.exe windows:6 windows x64 arch:x64
f88d0a3fbcf37c3023787e224874472c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
Module32First
Module32Next
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
GetLastError
VirtualProtectEx
VirtualProtect
GetCurrentProcess
Beep
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
RtlCaptureContext
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
Sleep
user32
SetWindowsHookExA
CallNextHookEx
shell32
ShellExecuteA
winmm
PlaySoundA
vcruntime140
__CxxUnregisterExceptionObject
__C_specific_handler
__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
__CxxRegisterExceptionObject
__CxxDetectRethrow
memset
memmove
__CxxQueryExceptionSize
__CxxExceptionFilter
_CxxThrowException
__FrameUnwindFilter
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
abort
terminate
_register_onexit_function
_crt_atexit
_cexit
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_initialize_narrow_environment
_configure_narrow_argv
_c_exit
_set_app_type
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_set_new_mode
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
mscoree
_CorExeMain
Sections
.text Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nep Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 429KB - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 500.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 335KB - Virtual size: 335KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
www.3dmgame.com.url.url
-
说明.txt