Cracked GTA V FitGirl[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Cracked GTA V FitGirl.zip
Size

2.2MB
MD5

1d88c80d51337e76114b3f9462f88fe3
SHA1

730d49068a7a23c6b5f50e09c607c8142d61dcfd
SHA256

74cbe5324005b8e21052bbafe8d98276e78fdd2d199c73ef105cbdb569b141cf
SHA512

ef057f1a86b2c256bdfc4fba4ee9310e9b7c226ece7f594ab29514ff21ad9d8c6ccc56e0366f1e9039b6ebff4a50d07054bcad88db15d737dd711d8d168f039c
SSDEEP

49152:Z+pV4ZN8Wu15Lw8Xhcfek7/GXowIOpLeK1xD3VWIXEDY:ZGV+8Wu1pZ6j4oaLeK1F3MrDY

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Cracked GTA V FitGirl/PlayGTAV.exe
unpack001/Cracked GTA V FitGirl/bink2w64.dll
unpack001/Cracked GTA V FitGirl/launc.dll
unpack001/Cracked GTA V FitGirl/socialclub.dll

Files

Cracked GTA V FitGirl.zip
.zip
Cracked GTA V FitGirl/PlayGTAV.exe
.exe windows:6 windows x64 arch:x64

c55198784993b18b0e531e0e55f5fd30

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCommandLineA
ReadFile
WriteFile
CloseHandle
WaitForSingleObject
CreateProcessA
CreateNamedPipeA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CreateFileW

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cracked GTA V FitGirl/bink2w64.dll
.dll windows:5 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

BinkBufferBlit
BinkBufferCheckWinPos
BinkBufferClear
BinkBufferClose
BinkBufferGetDescription
BinkBufferGetError
BinkBufferLock
BinkBufferOpen
BinkBufferSetDirectDraw
BinkBufferSetHWND
BinkBufferSetOffset
BinkBufferSetResolution
BinkBufferSetScale
BinkBufferUnlock
BinkCheckCursor
BinkClose
BinkCloseTrack
BinkControlBackgroundIO
BinkControlPlatformFeatures
BinkCopyToBuffer
BinkCopyToBufferRect
BinkDDSurfaceType
BinkDX8SurfaceType
BinkDX9SurfaceType
BinkDoFrame
BinkDoFrameAsync
BinkDoFrameAsyncMulti
BinkDoFrameAsyncWait
BinkDoFramePlane
BinkFreeGlobals
BinkGetError
BinkGetFrameBuffersInfo
BinkGetGPUDataBuffersInfo
BinkGetKeyFrame
BinkGetPalette
BinkGetPlatformInfo
BinkGetRealtime
BinkGetRects
BinkGetSummary
BinkGetTrackData
BinkGetTrackID
BinkGetTrackMaxSize
BinkGetTrackType
BinkGoto
BinkIsSoftwareCursor
BinkLogoAddress
BinkNextFrame
BinkOpen
BinkOpenDirectSound
BinkOpenMiles
BinkOpenTrack
BinkOpenWaveOut
BinkOpenWithOptions
BinkOpenXAudio2
BinkPause
BinkRegisterFrameBuffers
BinkRegisterGPUDataBuffers
BinkRequestStopAsyncThread
BinkRestoreCursor
BinkService
BinkSetError
BinkSetFileOffset
BinkSetFrameRate
BinkSetIO
BinkSetIOSize
BinkSetMemory
BinkSetPan
BinkSetSimulate
BinkSetSoundOnOff
BinkSetSoundSystem
BinkSetSoundSystem2
BinkSetSoundTrack
BinkSetSpeakerVolumes
BinkSetVideoOnOff
BinkSetVolume
BinkSetWillLoop
BinkShouldSkip
BinkStartAsyncThread
BinkUseTelemetry
BinkUseTmLite
BinkWait
BinkWaitStopAsyncThread
RADTimerRead

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK16
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKP8
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK
Size: 234KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RADCODE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKBSS
Size: - Virtual size: 104KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

BINKDATA
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BINKCONS
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

RADDATA
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RADCONST
Size: 512B - Virtual size: 150B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Cracked GTA V FitGirl/launc.dll
.dll windows:6 windows x64 arch:x64

61b600bbe9dc564b84bc868e3bd45e1b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

user32

MessageBoxA

kernel32

IsProcessorFeaturePresent
WriteConsoleW
GetCommandLineA
GetFileAttributesA
GetFileAttributesW
CloseHandle
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThread
CreateProcessA
OpenProcess
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExW
LocalAlloc
LocalFree
lstrcmpA
lstrcpyA
CreateToolhelp32Snapshot
Process32First
Process32Next
K32EnumProcessModules
K32GetModuleFileNameExA
GetEnvironmentVariableA
GetEnvironmentVariableW
GetLastError
SetLastError
WaitForSingleObject
ExitProcess
GetExitCodeProcess
ResumeThread
CreateProcessW
VirtualAllocEx
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
IsWow64Process
GetCurrentThreadId
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
DebugBreak
GetFileSize
SetFilePointer
WriteFile
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CreateFileW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode

Exports

Exports

launc

Sections

.text
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cracked GTA V FitGirl/orig_socialclub.dll
.dll windows:5 windows x86 arch:x86

90d36b01527a3fb6f0874bae2f8de4bf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

10/06/2015, 13:46

Not After

10/11/2030, 14:16

Subject

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e4:9e:47:11:1f:ec:98:cd:00:00:00:00:55:66:2b:3e
Certificate

Issuer

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

09/03/2017, 22:04

Not After

20/03/2020, 22:34

Subject

CN=Rockstar Games\, Inc.,OU=Rockstar Games,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

56:33:5c:0d:f0:9e:d8:18:da:11:c2:ba:b0:54:ac:ae:c0:f2:5b:95
Signer

Actual PE Digest

56:33:5c:0d:f0:9e:d8:18:da:11:c2:ba:b0:54:ac:ae:c0:f2:5b:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ResetEvent
UnmapViewOfFile
CreateFileMappingW
InterlockedExchangeAdd
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ConnectNamedPipe
CreateNamedPipeW
CancelIo
RegisterWaitForSingleObject
WaitForMultipleObjects
GetCurrentThreadId
GetVersionExW
GetCurrentDirectoryW
GetFileAttributesExW
GetComputerNameW
GetVolumeInformationA
GetEnvironmentVariableA
WideCharToMultiByte
GetModuleHandleExW
GetModuleFileNameW
CopyFileW
LocalFileTimeToFileTime
SystemTimeToFileTime
MapViewOfFile
SetEnvironmentVariableA
LoadLibraryW
OutputDebugStringW
LoadLibraryExW
WriteConsoleW
SetStdHandle
ReadConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
GetFileType
GetStdHandle
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
FlushFileBuffers
AreFileApisANSI
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
Sleep
MultiByteToWideChar
RtlCaptureStackBackTrace
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect
HeapAlloc
HeapFree
GetProcessHeap
GetProcessAffinityMask
GetCurrentProcess
GetCurrentProcessId
SetUnhandledExceptionFilter
CreateThread
GetCurrentThread
SetThreadPriority
SetThreadPriorityBoost
GetLastError
ResumeThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CloseHandle
GetLocalTime
CreateEventA
CreateSemaphoreA
GetModuleHandleA
OutputDebugStringA
CreateDirectoryA
CreateFileA
QueryPerformanceCounter
QueryPerformanceFrequency
ExitProcess
TerminateProcess
WriteFile
ReadFile
SetEndOfFile
SetFilePointerEx
FindClose
SetFileTime
CreateDirectoryW
RemoveDirectoryW
CreateFileW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
MoveFileExW
LocalFree
InitializeCriticalSection
SetLastError
SetFilePointer
GetTickCount
CreateMutexW
CreateProcessW
InterlockedExchange
InterlockedCompareExchange
IsDebuggerPresent
RaiseException
CreateEventW
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
GetStringTypeW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCommandLineA
RtlUnwind
HeapReAlloc
HeapSize
GetConsoleCP
GetConsoleMode
GetCPInfo
UnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
UnregisterWaitEx

advapi32

OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegOpenKeyExA
RegSetValueExA
ConvertSidToStringSidW

shell32

ShellExecuteA
SHCreateDirectoryExW
SHGetFolderPathW
SHGetFolderPathA

dbghelp

MiniDumpWriteDump

wininet

InternetGetConnectedState

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

ws2_32

ioctlsocket
accept
connect
getpeername
getsockname
freeaddrinfo
getaddrinfo
shutdown
htons
inet_addr
listen
recv
closesocket
bind
sendto
select
recvfrom
getsockopt
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
gethostname
send
setsockopt
socket
gethostbyname

rpcrt4

UuidCreateSequential

xinput1_3

ord2

dinput8

DirectInput8Create

user32

PeekMessageW
DispatchMessageW
TranslateMessage
UnregisterClassW
RegisterClassExW
CreateWindowExW
CallMsgFilterW
GetQueueStatus
PostMessageW
WaitMessage
MsgWaitForMultipleObjectsEx
SetTimer
DefWindowProcW
MessageBoxA
DestroyWindow
PostQuitMessage
UpdateWindow
GetClientRect
GetCursorInfo
MessageBoxW
wsprintfW
SetWindowLongW
CallWindowProcW
ShowCursor
SetCursor
LoadCursorW
SendMessageW
GetAsyncKeyState
GetCapture
SetCapture
ReleaseCapture
GetForegroundWindow
SetCursorPos
GetCursorPos
ClientToScreen
ScreenToClient
PtInRect
GetParent
KillTimer
SetWindowPos

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 290KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cracked GTA V FitGirl/socialclub.dll
.dll windows:6 windows x64 arch:x64

a4ff076a036e9deb06c78e7c70789902

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

shell32

SHGetFolderPathW

kernel32

GetExitCodeThread
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
CreateDirectoryW
CreateFileW
GetFileAttributesW
GetCurrentProcess
GetCurrentThread
CreateProcessA
GetModuleFileNameW
GetModuleHandleA
K32GetModuleInformation
GetEnvironmentVariableA
GetEnvironmentVariableW
CloseHandle
GetLastError
SetLastError
WaitForSingleObject
ExitProcess
TerminateProcess
GetExitCodeProcess
ResumeThread
CreateProcessW
OpenProcess
VirtualAllocEx
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
IsWow64Process
GetCurrentThreadId
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
DebugBreak
GetFileSize
SetFilePointer
WriteFile
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExA
LoadLibraryExW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemInfo
VirtualLock
VirtualUnlock
GetProcessWorkingSetSize
LoadLibraryA
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceFrequency
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
RtlPcToFileHeader
RaiseException
QueueUserWorkItem
GetModuleHandleExW
IsProcessorFeaturePresent
WaitForSingleObjectEx
Sleep
SwitchToThread
RtlUnwind
GetNativeSystemInfo
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
GetEnvironmentStringsW
RtlUnwindEx
ReadFile
ExitThread
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW

Exports

Exports

getInterface

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 692KB - Virtual size: 691KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c55198784993b18b0e531e0e55f5fd30

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 48KB - Virtual size: 48KB

.rdata Size: 37KB - Virtual size: 37KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 4KB - Virtual size: 3KB

_RDATA Size: 512B - Virtual size: 148B

.reloc Size: 2KB - Virtual size: 1KB

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 55KB

BINK16 Size: 2KB - Virtual size: 2KB

BINK32 Size: 3KB - Virtual size: 2KB

BINKP8 Size: 3KB - Virtual size: 2KB

BINK Size: 234KB - Virtual size: 233KB

RADCODE Size: 2KB - Virtual size: 1KB

BINKBSS Size: - Virtual size: 104KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 21KB - Virtual size: 25KB

.pdata Size: 9KB - Virtual size: 9KB

BINKDATA Size: 12KB - Virtual size: 11KB

BINKCONS Size: 30KB - Virtual size: 29KB

RADDATA Size: 512B - Virtual size: 44B

RADCONST Size: 512B - Virtual size: 150B

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 4KB - Virtual size: 4KB

61b600bbe9dc564b84bc868e3bd45e1b

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

Exports

Exports

Sections

.text Size: 148KB - Virtual size: 147KB

.rdata Size: 49KB - Virtual size: 49KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 8KB - Virtual size: 8KB

.detourc Size: 26KB - Virtual size: 26KB

.detourd Size: 512B - Virtual size: 72B

_RDATA Size: 512B - Virtual size: 148B

.reloc Size: 5KB - Virtual size: 4KB

90d36b01527a3fb6f0874bae2f8de4bf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

43:c1:0b:1c:00:00:00:00:51:d3:73:daCertificate

Extended Key Usages

Key Usages

e4:9e:47:11:1f:ec:98:cd:00:00:00:00:55:66:2b:3eCertificate

Extended Key Usages

Key Usages

56:33:5c:0d:f0:9e:d8:18:da:11:c2:ba:b0:54:ac:ae:c0:f2:5b:95Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

.text
Size: 48KB - Virtual size: 48KB

.rdata
Size: 37KB - Virtual size: 37KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 4KB - Virtual size: 3KB

_RDATA
Size: 512B - Virtual size: 148B

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 56KB - Virtual size: 55KB

BINK16
Size: 2KB - Virtual size: 2KB

BINK32
Size: 3KB - Virtual size: 2KB

BINKP8
Size: 3KB - Virtual size: 2KB

BINK
Size: 234KB - Virtual size: 233KB

RADCODE
Size: 2KB - Virtual size: 1KB

BINKBSS
Size: - Virtual size: 104KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 21KB - Virtual size: 25KB

.pdata
Size: 9KB - Virtual size: 9KB

BINKDATA
Size: 12KB - Virtual size: 11KB

BINKCONS
Size: 30KB - Virtual size: 29KB

RADDATA
Size: 512B - Virtual size: 44B

RADCONST
Size: 512B - Virtual size: 150B

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 148KB - Virtual size: 147KB

.rdata
Size: 49KB - Virtual size: 49KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 8KB - Virtual size: 8KB

.detourc
Size: 26KB - Virtual size: 26KB

.detourd
Size: 512B - Virtual size: 72B

_RDATA
Size: 512B - Virtual size: 148B

.reloc
Size: 5KB - Virtual size: 4KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

e4:9e:47:11:1f:ec:98:cd:00:00:00:00:55:66:2b:3e
Certificate

56:33:5c:0d:f0:9e:d8:18:da:11:c2:ba:b0:54:ac:ae:c0:f2:5b:95
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 290KB - Virtual size: 289KB

.data
Size: 49KB - Virtual size: 2.9MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 112KB - Virtual size: 112KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 692KB - Virtual size: 691KB

.data
Size: 42KB - Virtual size: 85KB

.pdata
Size: 75KB - Virtual size: 74KB

.detourc
Size: 26KB - Virtual size: 26KB

.detourd
Size: 512B - Virtual size: 72B

_RDATA
Size: 512B - Virtual size: 148B

.reloc
Size: 18KB - Virtual size: 17KB