0d901340659dc500a1983164467c40ea

Sharing

Copy URL Twitter E-mail

General

Target

0d901340659dc500a1983164467c40ea
Size

257KB
MD5

0d901340659dc500a1983164467c40ea
SHA1

e837a762ffcf56b3348b8d62900563466106d6cd
SHA256

a0b9e65aea584b6f95a823830127b464f2701a60b4ce1018beea976792a7033b
SHA512

856f346e87df638392ec5f51a17b36e95daa3068d9a1738c78e8d50aafc1692ec8adab88dbe399323047bbbcd7031ef46b37dd5d8b870baa8f7673a43fe1d71b
SSDEEP

3072:VIVjFxOdcTITrWhgx/95BF3isM9/yI593skjR8AOuWx+CEWaZVa4TCxhst74YukW:Kjn8ucaOx/P9MN59vj6tuWxy7uxh44jF

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/KidAutoPhongKy4F3.07b_crack/KidHdd.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/KidAutoPhongKy4F3.07b_crack/KidHdd.dll	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/KidAutoPhongKy4F3.07b_crack/KidAutoTinSu.exe
unpack001/KidAutoPhongKy4F3.07b_crack/KidHdd.dll
unpack002/out.upx
unpack001/KidAutoPhongKy4F3.07b_crack/KidHookPr.dll
unpack001/KidAutoPhongKy4F3.07b_crack/Ohm_vn.dll

Files

0d901340659dc500a1983164467c40ea
.rar
KidAutoPhongKy4F3.07b_crack/Config/TNïTiÓuïTh.cfg
KidAutoPhongKy4F3.07b_crack/Config/V«H×nh.cfg
KidAutoPhongKy4F3.07b_crack/KidAutoTinSu.exe
.exe windows:5 windows x86 arch:x86

e1a9a4aa5590a54f9849633c2a744758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

mscoree

CorBindToRuntimeEx

ohm_vn

MessageBoxA

oleaut32

SafeArrayUnlock

Sections

.text
Size: 3KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
KidAutoPhongKy4F3.07b_crack/KidHdd.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

GetBufferSize
GetCylinders
GetHeads
GetIdeDiskInfo
GetModelNumber
GetRevisionNo
GetSectors
GetSerialNumber

Sections

UPX0
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 45KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 245B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KidAutoPhongKy4F3.07b_crack/KidHookPr.dll
.dll windows:5 windows x86 arch:x86

a5e3d6b5153b089e97fbd11429ecc19a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

RegisterWindowMessageA

Exports

Exports

GetLicInfo
GetMsg
SetHook
UnHook

Sections

.text
Size: 26KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
KidAutoPhongKy4F3.07b_crack/Lics/9RXER2ND_VLMP.lic
KidAutoPhongKy4F3.07b_crack/Lics/VoHinh_VLMP.lic
KidAutoPhongKy4F3.07b_crack/Maps/BienKinhDHD.pth
KidAutoPhongKy4F3.07b_crack/Maps/BienKinhHC.pth
KidAutoPhongKy4F3.07b_crack/Maps/BienKinhUT.pth
KidAutoPhongKy4F3.07b_crack/Maps/DaiLyDHD.pth
KidAutoPhongKy4F3.07b_crack/Maps/DaiLyDV.pth
KidAutoPhongKy4F3.07b_crack/Maps/DaiLyUT.pth
KidAutoPhongKy4F3.07b_crack/Maps/DaoHoaDaoUT.pth
KidAutoPhongKy4F3.07b_crack/Maps/DuongChauDHD.pth
KidAutoPhongKy4F3.07b_crack/Maps/DuongChauHC.pth
KidAutoPhongKy4F3.07b_crack/Maps/DuongChauUT.pth
KidAutoPhongKy4F3.07b_crack/Maps/JoinParty.pth
KidAutoPhongKy4F3.07b_crack/Maps/LagPos.pth
KidAutoPhongKy4F3.07b_crack/Maps/LamAnDHD.pth
KidAutoPhongKy4F3.07b_crack/Maps/LamAnDV.pth
KidAutoPhongKy4F3.07b_crack/Maps/LamAnUT.pth
KidAutoPhongKy4F3.07b_crack/Maps/PhongChiKy.pth
KidAutoPhongKy4F3.07b_crack/Maps/PhongKy1.pth
KidAutoPhongKy4F3.07b_crack/Maps/PhongKy2.pth
KidAutoPhongKy4F3.07b_crack/Maps/PhuongTuongDHD.pth
KidAutoPhongKy4F3.07b_crack/Maps/PhuongTuongDV.pth
KidAutoPhongKy4F3.07b_crack/Maps/PhuongTuongUT.pth
KidAutoPhongKy4F3.07b_crack/Maps/ThanhDoDHD.pth
KidAutoPhongKy4F3.07b_crack/Maps/ThanhDoDV.pth
KidAutoPhongKy4F3.07b_crack/Maps/ThanhDoUT.pth
KidAutoPhongKy4F3.07b_crack/Maps/TuongDuongDHD.pth
KidAutoPhongKy4F3.07b_crack/Maps/TuongDuongDV.pth
KidAutoPhongKy4F3.07b_crack/Maps/TuongDuongUT.pth
KidAutoPhongKy4F3.07b_crack/Ohm_vn.dll
.dll windows:4 windows x86 arch:x86

e5860a1ea507f0a524599d8ac0ebf3fa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
CreateFileW
DeviceIoControl
GetCurrentProcess
GetModuleFileNameA
GetModuleHandleA
MapViewOfFile
ReadFile
RtlFillMemory
SetFilePointer
VirtualProtect
VirtualQuery
WriteConsoleA
WriteFile
lstrcmpiA
lstrlenA
lstrlenW

user32

wsprintfA

psapi

GetModuleBaseNameA

Exports

Exports

GetId
GetProcAddress
Inject
LoadLibraryA
MessageBoxA
UnMap
VirtualAlloc
VirtualFree

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 823B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KidAutoPhongKy4F3.07b_crack/Paths/ChayDanhVong.pth
KidAutoPhongKy4F3.07b_crack/Paths/PhongKyPhiaDuoi.pth
KidAutoPhongKy4F3.07b_crack/Paths/PhongKyPhiaDuoi2.pth
KidAutoPhongKy4F3.07b_crack/Paths/PhongKyPhiaTren.pth
KidAutoPhongKy4F3.07b_crack/Paths/PhongKyPhiaTren2.pth
KidAutoPhongKy4F3.07b_crack/Paths/PhongKyPhiaTren3.pth
KidAutoPhongKy4F3.07b_crack/Skill.ini

Sharing

General

Malware Config

Signatures

Files

e1a9a4aa5590a54f9849633c2a744758

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

mscoree

ohm_vn

oleaut32

Sections

.text Size: 3KB - Virtual size: 36KB

.rsrc Size: 26KB - Virtual size: 28KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 80KB

UPX1 Size: 45KB - Virtual size: 48KB

.rsrc Size: 3KB - Virtual size: 4KB

Headers

File Characteristics

Sections

CODE Size: 83KB - Virtual size: 82KB

DATA Size: 2KB - Virtual size: 2KB

BSS Size: - Virtual size: 2KB

.idata Size: 2KB - Virtual size: 2KB

.edata Size: 512B - Virtual size: 245B

.reloc Size: 6KB - Virtual size: 6KB

.rsrc Size: 7KB - Virtual size: 7KB

a5e3d6b5153b089e97fbd11429ecc19a

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 26KB - Virtual size: 80KB

.rsrc Size: 4KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 512B

e5860a1ea507f0a524599d8ac0ebf3fa

Headers

File Characteristics

Imports

kernel32

user32

psapi

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 1024B - Virtual size: 823B

.data Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 230B

.text
Size: 3KB - Virtual size: 36KB

.rsrc
Size: 26KB - Virtual size: 28KB

UPX0
Size: - Virtual size: 80KB

UPX1
Size: 45KB - Virtual size: 48KB

.rsrc
Size: 3KB - Virtual size: 4KB

CODE
Size: 83KB - Virtual size: 82KB

DATA
Size: 2KB - Virtual size: 2KB

BSS
Size: - Virtual size: 2KB

.idata
Size: 2KB - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 245B

.reloc
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 7KB - Virtual size: 7KB

.text
Size: 26KB - Virtual size: 80KB

.rsrc
Size: 4KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 512B

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 1024B - Virtual size: 823B

.data
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 230B