37f6edefab4c6869d2017ff4668fb75a

Sharing

Copy URL Twitter E-mail

General

Target

37f6edefab4c6869d2017ff4668fb75a
Size

1.5MB
MD5

37f6edefab4c6869d2017ff4668fb75a
SHA1

767d124e30a21bef199e3800c299ffbc205bc617
SHA256

919527d0a9d1f1ac101a1250a421d506f0c324ff4c71e65627d93f51ce32d243
SHA512

0046b7d993e6e13159b778398f03ff0ad6d095556fb130007e3d817463fea1ec16efa474f5576db531343f7c0a48fbbd9c6a7b4673e792564c5e52cf3d061a29
SSDEEP

24576:yWDPhQUQr5+LU++sqZwg63XMcsF2TbYqxnf/RZAGBnk/KPMb8Ife1:ymheiOwL3XMcNbYqxnh5BnkNTS

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/sg自编三国游戏9.16/三国.exe
unpack001/sg自编三国游戏9.16/战斗/drHook.dll
unpack001/sg自编三国游戏9.16/战斗/地图.exe

Files

37f6edefab4c6869d2017ff4668fb75a
.rar
sg自编三国游戏9.16/Form1.frm
.vbs
sg自编三国游戏9.16/Form1.frx
sg自编三国游戏9.16/Form1.log
sg自编三国游戏9.16/Form2.frm
sg自编三国游戏9.16/MSSCCPRJ.SCC
sg自编三国游戏9.16/Module1.bas
.vbs
sg自编三国游戏9.16/Thumbs.db
sg自编三国游戏9.16/dib.ctx
sg自编三国游戏9.16/map.txt
sg自编三国游戏9.16/map2.txt
sg自编三国游戏9.16/music.bas
sg自编三国游戏9.16/music/1.mid
sg自编三国游戏9.16/music/2.mid
sg自编三国游戏9.16/music/3.mid
sg自编三国游戏9.16/pict1map.txt
sg自编三国游戏9.16/test.frm
sg自编三国游戏9.16/test.frx
sg自编三国游戏9.16/test.log
sg自编三国游戏9.16/text2.vbw
sg自编三国游戏9.16/zfc.bmp
sg自编三国游戏9.16/zfc.txt
sg自编三国游戏9.16/三国.exe
.exe windows:4 windows x86 arch:x86

6536a98afba24311d9574dfbcffc8d15

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
__vbaVarTstGt
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaStrVarMove
ord589
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
ord698
__vbaRaiseEvent
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
__vbaVargVarCopy
_adj_fdiv_m32
__vbaVarTstLe
__vbaAryDestruct
__vbaVarForInit
ord593
ord300
ord594
ord301
__vbaObjSet
ord595
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord306
ord520
__vbaBoolVar
ord307
__vbaFPFix
ord309
__vbaVarTstLt
__vbaFpR8
__vbaBoolVarNull
_CIsin
__vbaVarCmpGt
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaGet3
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
ord560
__vbaI2I4
DllFunctionCall
__vbaVarOr
__vbaCastObjVar
__vbaLbound
__vbaRedimPreserve
_adj_fpatan
__vbaR4Var
__vbaLateIdCallLd
__vbaRedim
EVENT_SINK_Release
__vbaUI1I2
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
__vbaVarCmpLe
__vbaFPException
ord717
__vbaGetOwner3
__vbaUbound
__vbaStrVarVal
__vbaVarCat
ord534
ord535
__vbaI2Var
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaVarCmpLt
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord100
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaStrToAnsi
__vbaVarDup
ord613
ord614
__vbaFpI2
__vbaVarTstGe
__vbaVarCopy
__vbaFpI4
ord617
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
__vbaLateIdSt
_CItan
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaR8FixI2
__vbaFreeObj
__vbaFreeStr
ord581

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
sg自编三国游戏9.16/三国.vbp
sg自编三国游戏9.16/三国.vbw
sg自编三国游戏9.16/三国启动.vbg
sg自编三国游戏9.16/下载说明.htm
.html .js polyglot
sg自编三国游戏9.16/函数.bas
.vbs
sg自编三国游戏9.16/地图.frm
.vbs
sg自编三国游戏9.16/地图.frx
sg自编三国游戏9.16/地图.vbp
sg自编三国游戏9.16/地图.vbw
sg自编三国游戏9.16/城市.ctl
.vbs
sg自编三国游戏9.16/城市.ctx
sg自编三国游戏9.16/城市.vbw
sg自编三国游戏9.16/将领.cls
sg自编三国游戏9.16/将领.ctl
sg自编三国游戏9.16/将领.ctx
sg自编三国游戏9.16/将领.vbp
sg自编三国游戏9.16/将领.vbw
sg自编三国游戏9.16/将领2.vbp
sg自编三国游戏9.16/将领2.vbw
sg自编三国游戏9.16/工程dib.vbw
sg自编三国游戏9.16/战斗/3.BMP
sg自编三国游戏9.16/战斗/41.BMP
sg自编三国游戏9.16/战斗/MSSCCPRJ.SCC
sg自编三国游戏9.16/战斗/Thumbs.db
sg自编三国游戏9.16/战斗/YUN.bmp
sg自编三国游戏9.16/战斗/drHook.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

CreateKeyboardHook
DestroyKeyboardHook

Sections

CODE
Size: 359KB - Virtual size: 358KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 110B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
sg自编三国游戏9.16/战斗/map.txt
sg自编三国游戏9.16/战斗/map2.txt
sg自编三国游戏9.16/战斗/pict1map.txt
sg自编三国游戏9.16/战斗/zfc.bmp
sg自编三国游戏9.16/战斗/中城.bmp
sg自编三国游戏9.16/战斗/地图.exe
.exe windows:4 windows x86 arch:x86

d5ebb5192f0175102943c53f992ba0ce

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarTstGt
_CIcos
_adj_fptan
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
ord593
ord300
ord301
__vbaObjSet
ord595
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord306
ord307
__vbaFPFix
ord309
__vbaVarTstLt
__vbaBoolVarNull
_CIsin
__vbaVarCmpGt
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaGet3
__vbaAryConstruct2
__vbaI2I4
DllFunctionCall
__vbaVarOr
__vbaLbound
_adj_fpatan
__vbaR4Var
__vbaRedim
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
ord608
__vbaFPException
__vbaStrVarVal
__vbaUbound
__vbaGetOwner3
__vbaI2Var
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarCmpLt
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord100
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaFpI2
ord614
__vbaFpI4
_CIatan
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
__vbaR8FixI2

Sections

.text
Size: 176KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
sg自编三国游戏9.16/战斗/地图.frm
.vbs
sg自编三国游戏9.16/战斗/地图.frx
sg自编三国游戏9.16/战斗/地图.vbp
sg自编三国游戏9.16/战斗/地图.vbw
sg自编三国游戏9.16/战斗/城墙.bmp
sg自编三国游戏9.16/战斗/大城.bmp
sg自编三国游戏9.16/战斗/小型城.bmp
sg自编三国游戏9.16/战斗/尖头.ico
sg自编三国游戏9.16/战斗/新建文本文档.txt
sg自编三国游戏9.16/战斗/部队.cls
sg自编三国游戏9.16/战斗/部队种类.cls
sg自编三国游戏9.16/新云软件.url
.url
sg自编三国游戏9.16/新建文本文档.txt
sg自编三国游戏9.16/画地图/3.BMP
sg自编三国游戏9.16/画地图/41.BMP
sg自编三国游戏9.16/画地图/Thumbs.db
sg自编三国游戏9.16/画地图/YUN.bmp
sg自编三国游戏9.16/画地图/map.txt
sg自编三国游戏9.16/画地图/map2.txt
sg自编三国游戏9.16/画地图/pict1map.txt
sg自编三国游戏9.16/画地图/zfc.bmp
sg自编三国游戏9.16/画地图/中城.bmp
sg自编三国游戏9.16/画地图/地图.frm
.vbs
sg自编三国游戏9.16/画地图/地图.frx
sg自编三国游戏9.16/画地图/地图.vbp
sg自编三国游戏9.16/画地图/地图.vbw
sg自编三国游戏9.16/画地图/城墙.bmp
sg自编三国游戏9.16/画地图/大城.bmp
sg自编三国游戏9.16/画地图/小型城.bmp
sg自编三国游戏9.16/画地图/新建文本文档.txt
sg自编三国游戏9.16/说明.txt
sg自编三国游戏9.16/部队.cls
sg自编三国游戏9.16/部队种类.cls

Sharing

General

Malware Config

Signatures

Files

6536a98afba24311d9574dfbcffc8d15

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 2KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 359KB - Virtual size: 358KB

DATA Size: 5KB - Virtual size: 4KB

BSS Size: - Virtual size: 4KB

.idata Size: 8KB - Virtual size: 7KB

.edata Size: 512B - Virtual size: 110B

.reloc Size: 27KB - Virtual size: 26KB

.rsrc Size: 28KB - Virtual size: 28KB

d5ebb5192f0175102943c53f992ba0ce

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 176KB - Virtual size: 174KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 2KB

CODE
Size: 359KB - Virtual size: 358KB

DATA
Size: 5KB - Virtual size: 4KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 8KB - Virtual size: 7KB

.edata
Size: 512B - Virtual size: 110B

.reloc
Size: 27KB - Virtual size: 26KB

.rsrc
Size: 28KB - Virtual size: 28KB

.text
Size: 176KB - Virtual size: 174KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 2KB