0a8a481b67e1e5528056e1944f30925a

Sharing

Copy URL Twitter E-mail

General

Target

0a8a481b67e1e5528056e1944f30925a
Size

1.4MB
MD5

0a8a481b67e1e5528056e1944f30925a
SHA1

536b15ae57c9c2aa19c6f6bd15475f9207a45161
SHA256

164a91dfce720464f56cada132348da4df794fee1abe44aeb17c2ea3de641c79
SHA512

feb8ab6aea9c8ad277125ab6fa64253e43d965992e98581edbd533852b2a08955ef932b9956655546b445b07715c2837b151a3fc72a4fbc57b0239b86e1579d9
SSDEEP

24576:VLFmiGENZMOGmPErSM54jtxSJA8RHMK/nxs2lfl5doEFJYv5A1B7b2Q:TXNmmMrR8SL5JlTJYv5Ub2Q

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/zynga-poker-bot/includes/vendor/PSIM/psim.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/zynga-poker-bot/includes/vendor/PSIM/psim.dll	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/zynga-poker-bot/bot.exe
unpack001/zynga-poker-bot/includes/vendor/MD5Hash/MD5Hash.dll
unpack001/zynga-poker-bot/includes/vendor/PSIM/psim.dll
unpack002/out.upx

Files

0a8a481b67e1e5528056e1944f30925a
.rar
zynga-poker-bot/bot.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
zynga-poker-bot/data/action/_README.txt
zynga-poker-bot/data/action/all in/1232923443.txt
zynga-poker-bot/data/action/all in/1667756455.tif
zynga-poker-bot/data/action/all in/2569925060.tif
zynga-poker-bot/data/action/all in/2720133575.tif
zynga-poker-bot/data/action/all in/2946090007.tif
zynga-poker-bot/data/action/all in/322304606.tif
zynga-poker-bot/data/action/all in/537070008.tif
zynga-poker-bot/data/action/all in/701165519.txt
zynga-poker-bot/data/action/call/1061286421.tif
zynga-poker-bot/data/action/call/143456038.tif
zynga-poker-bot/data/action/call/1594618257.tif
zynga-poker-bot/data/action/call/1795421994.tif
zynga-poker-bot/data/action/call/1846920720.tif
zynga-poker-bot/data/action/call/1925052895.tif
zynga-poker-bot/data/action/call/1931343663.tif
zynga-poker-bot/data/action/call/1941370951.tif
zynga-poker-bot/data/action/call/2093600.tif
zynga-poker-bot/data/action/call/2277177920.tif
zynga-poker-bot/data/action/call/2510353000.tif
zynga-poker-bot/data/action/call/2774661153.tif
zynga-poker-bot/data/action/call/2809332022.tif
zynga-poker-bot/data/action/call/2938300794.txt
zynga-poker-bot/data/action/call/3151688333.tif
zynga-poker-bot/data/action/call/3262379438.tif
zynga-poker-bot/data/action/call/3285645987.tif
zynga-poker-bot/data/action/call/3314875140.tif
zynga-poker-bot/data/action/call/3458593427.tif
zynga-poker-bot/data/action/call/3458593427.txt
zynga-poker-bot/data/action/call/3558244401.tif
zynga-poker-bot/data/action/call/3788829168.txt
zynga-poker-bot/data/action/call/3847091096.tif
zynga-poker-bot/data/action/call/3903190810.tif
zynga-poker-bot/data/action/call/4133155455.tif
zynga-poker-bot/data/action/call/55566800.txt
zynga-poker-bot/data/action/call/639961420.tif
zynga-poker-bot/data/action/call/781645117.tif
zynga-poker-bot/data/action/call/946866514.tif
zynga-poker-bot/data/action/call/988607134.tif
zynga-poker-bot/data/action/check/1143217677.tif
zynga-poker-bot/data/action/check/2505579233.tif
zynga-poker-bot/data/action/check/261233733.tif
zynga-poker-bot/data/action/check/27005841.txt
zynga-poker-bot/data/action/check/2929002070.tif
zynga-poker-bot/data/action/check/2987658225.tif
zynga-poker-bot/data/action/check/3399091807.tif
zynga-poker-bot/data/action/check/3399091807.txt
zynga-poker-bot/data/action/check/527832112.txt
zynga-poker-bot/data/action/check/812571713.tif
zynga-poker-bot/data/action/fold/1202652386.txt
zynga-poker-bot/data/action/fold/1409357871.tif
zynga-poker-bot/data/action/fold/1881934938.tif
zynga-poker-bot/data/action/fold/2037254988.tif
zynga-poker-bot/data/action/fold/2066290918.tif
zynga-poker-bot/data/action/fold/2079201356.tif
zynga-poker-bot/data/action/fold/2347501923.tif
zynga-poker-bot/data/action/fold/2351302998.tif
zynga-poker-bot/data/action/fold/2454485882.tif
zynga-poker-bot/data/action/fold/2523822970.tif
zynga-poker-bot/data/action/fold/2576942803.tif
zynga-poker-bot/data/action/fold/2594839581.tif
zynga-poker-bot/data/action/fold/3178628543.tif
zynga-poker-bot/data/action/fold/3284073496.txt
zynga-poker-bot/data/action/fold/358158882.tif
zynga-poker-bot/data/action/fold/3635416885.tif
zynga-poker-bot/data/action/fold/3639673999.tif
zynga-poker-bot/data/action/fold/3712290096.tif
zynga-poker-bot/data/action/fold/4040755622.tif
zynga-poker-bot/data/action/fold/4051316561.tif
zynga-poker-bot/data/action/fold/4072017714.tif
zynga-poker-bot/data/action/fold/547818990.tif
zynga-poker-bot/data/action/fold/66652588.tif
zynga-poker-bot/data/action/fold/66652588.txt
zynga-poker-bot/data/action/fold/89989305.tif
zynga-poker-bot/data/action/raise/128137135.tif
zynga-poker-bot/data/action/raise/1548496091.tif
zynga-poker-bot/data/action/raise/2169251267.txt
zynga-poker-bot/data/action/raise/2368350348.tif
zynga-poker-bot/data/action/raise/2878227491.tif
zynga-poker-bot/data/action/raise/2909510683.tif
zynga-poker-bot/data/action/raise/2917744458.tif
zynga-poker-bot/data/action/raise/2997626590.tif
zynga-poker-bot/data/action/raise/3169855413.tif
zynga-poker-bot/data/action/raise/3170643937.tif
zynga-poker-bot/data/action/raise/3196332594.txt
zynga-poker-bot/data/action/raise/3483248571.tif
zynga-poker-bot/data/action/raise/3483248571.txt
zynga-poker-bot/data/action/raise/3536010186.tif
zynga-poker-bot/data/action/raise/4053609016.tif
zynga-poker-bot/data/action/raise/4192335600.tif
zynga-poker-bot/data/action/raise/453128683.tif
zynga-poker-bot/data/action/winner/2480881913.txt
zynga-poker-bot/data/action/winner/3831776537.tif
zynga-poker-bot/data/action/winner/3831776537.txt
zynga-poker-bot/data/action/winner/3963830354.tif
zynga-poker-bot/data/blind/1060780195.txt
zynga-poker-bot/data/blind/1068906647.txt
zynga-poker-bot/data/blind/107105423.txt
zynga-poker-bot/data/blind/1126188024.txt
zynga-poker-bot/data/blind/1151090813.txt
zynga-poker-bot/data/blind/1172783130.txt
zynga-poker-bot/data/blind/1202208383.txt
zynga-poker-bot/data/blind/1264269484.txt
zynga-poker-bot/data/blind/1436171915.txt
zynga-poker-bot/data/blind/1450001628.txt
zynga-poker-bot/data/blind/1528906732.txt
zynga-poker-bot/data/blind/1550994332.txt
zynga-poker-bot/data/blind/1721388445.txt
zynga-poker-bot/data/blind/1827425159.txt
zynga-poker-bot/data/blind/2052275668.txt
zynga-poker-bot/data/blind/2132557670.txt
zynga-poker-bot/data/blind/2149136925.txt
zynga-poker-bot/data/blind/2170042441.txt
zynga-poker-bot/data/blind/2238070237.txt
zynga-poker-bot/data/blind/2272936040.txt
zynga-poker-bot/data/blind/2438086769.txt
zynga-poker-bot/data/blind/2501459022.txt
zynga-poker-bot/data/blind/2630436558.txt
zynga-poker-bot/data/blind/2676637143.txt
zynga-poker-bot/data/blind/2983937088.txt
zynga-poker-bot/data/blind/3160884297.txt
zynga-poker-bot/data/blind/318521859.txt
zynga-poker-bot/data/blind/3481223569.txt
zynga-poker-bot/data/blind/3619540.txt
zynga-poker-bot/data/blind/3726195424.txt
zynga-poker-bot/data/blind/3816506042.txt
zynga-poker-bot/data/blind/3929684713.txt
zynga-poker-bot/data/blind/4001445445.txt
zynga-poker-bot/data/blind/4085267147.txt
zynga-poker-bot/data/blind/4103681611.txt
zynga-poker-bot/data/blind/495469068.txt
zynga-poker-bot/data/blind/501235837.txt
zynga-poker-bot/data/blind/583087712.txt
zynga-poker-bot/data/blind/614481787.txt
zynga-poker-bot/data/blind/657539206.txt
zynga-poker-bot/data/blind/801849040.txt
zynga-poker-bot/data/blind/856569998.txt
zynga-poker-bot/data/blind/920014258.txt
zynga-poker-bot/data/blind/986988561.txt
zynga-poker-bot/data/bmp/lobby_playnow.bmp
zynga-poker-bot/data/bmp/popup_lottery.bmp
zynga-poker-bot/data/bmp/popup_profile.bmp
zynga-poker-bot/data/bmp/popup_reconnect.bmp
zynga-poker-bot/data/bmp/popup_seattaken.bmp
zynga-poker-bot/data/bmp/popup_terms.bmp
zynga-poker-bot/data/bmp/table_buyin.bmp
zynga-poker-bot/data/card.ini
zynga-poker-bot/data/chat.txt
zynga-poker-bot/data/playturn.ini
zynga-poker-bot/data/suit.ini
zynga-poker-bot/data/table.txt
zynga-poker-bot/data/version.txt
zynga-poker-bot/includes/vendor/MD5Hash/MD5Hash.dll
.dll windows:4 windows x86 arch:x86

9e6419c02a8d43ef94bca768e634cdf7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

AddAtomA
CreateSemaphoreA
FindAtomA
GetAtomNameA
GetLastError
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject

msvcrt

_itoa
_strdup
_strlwr
_strupr
__dllonexit
_assert
_atoi64
_errno
_i64toa
abort
atof
atoi
fclose
fflush
fopen
fread
free
malloc
memcpy
memset
sprintf
strcmp
strcpy
strlen
strncat

Exports

Exports

AU3_FreeVar
AU3_GetPluginDetails
MD5Hash

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 123B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zynga-poker-bot/includes/vendor/MD5Hash/readme.txt
zynga-poker-bot/includes/vendor/PSIM/psim.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Exports

Exports

GetHandState
GetHandStateBrief
RankHand
SimulateHand
SimulateHandMulti

Sections

UPX0
Size: - Virtual size: 652KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 146KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Sections

.text
Size: 351KB - Virtual size: 351KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 376KB - Virtual size: 375KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 170B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zynga-poker-bot/includes/vendor/PSIM/readme.txt
zynga-poker-bot/license.txt
zynga-poker-bot/settings.ini

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

CODE Size: 312KB - Virtual size: 311KB

DATA Size: 4KB - Virtual size: 4KB

BSS Size: - Virtual size: 3KB

.idata Size: 8KB - Virtual size: 7KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 22KB - Virtual size: 22KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

9e6419c02a8d43ef94bca768e634cdf7

Headers

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 23KB

.data Size: 512B - Virtual size: 144B

.rdata Size: 1KB - Virtual size: 1KB

.bss Size: - Virtual size: 16KB

.edata Size: 512B - Virtual size: 123B

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 876B

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 652KB

UPX1 Size: 146KB - Virtual size: 148KB

UPX2 Size: 512B - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 351KB - Virtual size: 351KB

.data Size: 376KB - Virtual size: 375KB

.rdata Size: 12KB - Virtual size: 11KB

.bss Size: - Virtual size: 20KB

.edata Size: 512B - Virtual size: 170B

.idata Size: 2KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 12KB

CODE
Size: 312KB - Virtual size: 311KB

DATA
Size: 4KB - Virtual size: 4KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 8KB - Virtual size: 7KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 22KB - Virtual size: 22KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.text
Size: 24KB - Virtual size: 23KB

.data
Size: 512B - Virtual size: 144B

.rdata
Size: 1KB - Virtual size: 1KB

.bss
Size: - Virtual size: 16KB

.edata
Size: 512B - Virtual size: 123B

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 876B

UPX0
Size: - Virtual size: 652KB

UPX1
Size: 146KB - Virtual size: 148KB

UPX2
Size: 512B - Virtual size: 4KB

.text
Size: 351KB - Virtual size: 351KB

.data
Size: 376KB - Virtual size: 375KB

.rdata
Size: 12KB - Virtual size: 11KB

.bss
Size: - Virtual size: 20KB

.edata
Size: 512B - Virtual size: 170B

.idata
Size: 2KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 12KB