��W_�q7(��%,ف����[�u���� e�,�|����W�O)y6,����f��'�M�ܗ%3"eV����������qoO./����*vr%ߖ�EW�YJ���R�H�O�E�_L���U�k�=(ۚ� �"sp�����A���#܋��Q��H^�$R�~�YA�tg��v8K?�S�w�.���:".H���>�S���A��n��k{W���d� ����˳���V"�� ��p;{/ɏ�`x���U��~��D��������o�����J���3T�?����'�GG()j�TOu�x9��)����6Ve.�~m7�d�5�l�s�z<H��X^s��;�w�CHJ�qI(������X�cyZ�^��-�ӂФb���e_|Q���`�<)�ǃf�x���aP�������'z�o07=&o�M<ۙ�@����rkR;jܳ� @\Ւ;)@;� �����E�-qB��cm����P�Y���s��:؝���H2z��������M*(�%�9�fZ8_Fa���Y��7YLl����_{�NKi1V� b�?�B��$Kz`��On�.&Y��T��p�Oѱ��N�� 1Ρ�!�!({{ђ�קHA"K$Is�q%�b4�u����#�r:9�&�g�3�% 4k2�A�ԩR�6}4�O����'V��=%`܌n2v���h}��gJ1�LH0Sr�;ڤ�Ü�����o�l|���9A��6�ت&�A���g����"@�j�.ov`�vg�R|�q եD����EPB���VGX��\�h��k\;f~f��< .P�[���\]ut<Is|��D+;�`;\��/ K��]���U/��B]*c잡��a�[J:ѯf�T�Kn�;.�9�C���`_�p�����){I��^5J�HU�a-�V�`L�4�b%�����k�5_�~���S�a��$���K�ABY��6v<�� �&���5[�/�.{�����"p{�:tP93:G{T(<�8B��$X������j�1?��b?X�4�A�9�i�ǯ���[��.�(�at��i���Β��̔����Ʊ�l���)�f�[�r67go��<�����O; R8ۜ�g��gK~�7��J��'�m_����"4�\�H$���k���@�kd(vă\7�̪��'��p����2��]L8j'ƻ�� Ϟ�㪘��$�z`�U�k-P�A"Mwl�hx3���S��,�c�������, ������^�h&5q�[�n��s���@���}�X���+���<��I�`�Ƴ�@/��κ0��9¢�'.���l��KE�W%�t���M���n�hȒ��-�N>��7�Iݩk���3���}��K�b��/����o� %�2���C�J�@�g6S#>#ɕHcV������=}�Z�o6�!�~.sK�]�Vĭ�T ��X�f��d��M�4�;�nO��H������}���$N1i.� �[Z���^�!)S�_`7����חe���xh���oCt��lK��?�����g��:�ک�C,mUc"���M�u�h�����^μ�����L��:K����e�[8�Q~Z��E.����O*2�9��(8��|:d�Ž��B�=Z���КٺJ�����t��M���"y����F$e�n�^{l2�X��3�s�g�O��%�6��r+P����7�v�[��^9�8=ܕ��S���_���t�؍�p����r�aѴ�R��&e����BH� ��IJ���;�:�S����MY[=�ɬ���E&{T� ۾-���������J �T��..n$l�s~���z���+X�m���R��W���N���-X���Cd��s�r/vU]����0�tz,Cq�EDO����:?7�NON�ڰ�2F���pX��>�����̃�:�<'��6CHK����M:_�%@��=�Q��7 ��/9q��d�2�p^ה�i(+����qn���Bˣ``�\H���(�\��/a�]��d�s%%��F���fn����.q� ��"�yͳ���?�RqIK��� �]�c� �N��z��B��c6��_��A�8D������瑫>$�Z�̜�Qq�q�d >�5�9�0��Ά��dU�LkE���V0/*��{9���[�>4�� ��6/���p��%���~ {@�L�Ə���|�(����+�pG��6��3V���W��J�(Gё@]�#Y���#/�\��;����Z���H��l���}�^EK�,Ek?���;�1��<��[���5�n�^�G<D�; ܷ���g��� �7��L�q��k� ]����2 �; ��*FJ����VӰ��o,G݄,;Y�C���h�����hi�gU�����دZ�!�2$M��1+`<�#E@������Q��/0-J�ϔ䙞��Gݬ͕�.,~��e�"�Z�@I�>�Ôc�j��/�.,W(�d�5b��֘�� ���s�s�TT'"ng[�0��q����N��vR3��=���ds������NR��x��=��5U��>��� 82��Pժ��d�^��|����=�E�hw��*1A�(o?����B�B ���^�_S��&�{H��)��ZN��**cd�k�7ހ����<�i�k"��ğ�1�9��rP�£p��0����1��$���>%�����S����G�L�9���H�qׇ�9zIa~��>2��jPh�]8��g�����Je�k������;�y�2� �Q!<>$�mw7��9J��d�=s�\}��y��� ��I�WV*�lth����g���hP��ѫ�*~�ۚYH�4�k�����9�B�M�s���9&��Ʉ�^��R��ۘ��GΓ�����H�ΫEдWN�wI�kS��� �B��Y��b������bY6͋T��X��B� �m�v/(q�d�_�O�� \�D������usA@����Ω����1O�U��2����W��@����A��]�:�Vh,r#Km�J/V��)U�~��i�1:�n3L�N2���Y( �h
Static task
static1
Behavioral task
behavioral1
Sample
Battlefield.3.Crack-ALI213/bf3.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Battlefield.3.Crack-ALI213/bf3.exe
Resource
win10v2004-20231222-en
General
-
Target
77af2c90ee45630dcf57c6ea52e8dc22
-
Size
10.7MB
-
MD5
77af2c90ee45630dcf57c6ea52e8dc22
-
SHA1
8b424fdeb08b23478163d935b7fc3e915def8671
-
SHA256
7270f288780043e1c59cc724c7c3e73fb7ab2b7897381ba99dab349bcf1aecac
-
SHA512
2bf6c77d844b9a3f66df529291fee2bc30a2d4c0c1dd7a69520cd482ae7e67c3de79198def7273d7a94405971c47818a4d4155b3c3a7f977a381fa5e043bccda
-
SSDEEP
196608:nbMx+wMZQMK3/D/RiD/OrlA/BufiutDLBNohD1U7XpOmmThM7yH/hWQ:nNQMMNXlA/UB1V6N67X8/h3t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Battlefield.3.Crack-ALI213/bf3.exe
Files
-
77af2c90ee45630dcf57c6ea52e8dc22.rar
-
Battlefield.3.Crack-ALI213/ALI213.txt
-
Battlefield.3.Crack-ALI213/bf3.exe.exe windows:5 windows x86 arch:x86
0701a95d0270c7edcb43b610395b5001
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PeekMessageA
gdi32
ExtEscape
winmm
waveInReset
advapi32
RegGetValueA
urlmon
URLOpenBlockingStreamA
wtsapi32
WTSUnRegisterSessionNotification
shell32
ShellExecuteA
oleaut32
SysFreeString
msvcp90
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
msvcr90
_CIcosh
bcrypt
BCryptGenRandom
dxgi
CreateDXGIFactory1
dwmapi
ord102
dinput8
DirectInput8Create
ws2_32
gethostbyname
dbghelp
SymGetModuleInfo64
psapi
GetModuleBaseNameA
iphlpapi
GetAdaptersAddresses
dsound
ord9
d3d11
D3D11CreateDevice
xinput9_1_0
XInputSetState
d3dcompiler_43
D3DReflect
ole32
CoSetProxyBlanket
d3dx11_43
D3DX11SaveTextureToMemory
comdlg32
GetSaveFileNameW
Exports
Exports
Sections
.text Size: - Virtual size: 26.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ctr Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
typeinfo Size: - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fieldinf Size: - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 208KB - Virtual size: 256KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ALI2130 Size: - Virtual size: 557KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ALI2131 Size: 10.2MB - Virtual size: 10.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE