78ae8cc78fe0ef85d5e8fcd01de61f81

Sharing

Copy URL Twitter E-mail

General

Target

78ae8cc78fe0ef85d5e8fcd01de61f81
Size

656KB
MD5

78ae8cc78fe0ef85d5e8fcd01de61f81
SHA1

64aac5fb7a0230faa294b353ae4c89a45930592b
SHA256

230a2b01bc27be9709c5e8e8d255d177b04ec60d8f01c65a2c6ce159c9d31928
SHA512

ac8782a5764eb25a842e3f895f123a20d4c7625ff781ddcd86610e04703422e8b294c3e4cdf176553de70488ddab21812bea5322cbaa49f0ac91e2db66f52a0b
SSDEEP

12288:OVBgvHvf9XAkBk4bEswz/buv/6KsBkh5eXUwRUU45hw31kZlzwFHj:OkPf9XAkK4bwDbu6e0XlU9hOClz0j

Score

7^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/addons/Name_Enabler.dll	acprotect

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/addons/LSS.dll
unpack001/addons/Name_Enabler.dll
unpack001/addons/iLeech.dll
unpack001/addons/revSrvBrowser.dll
unpack001/addons/scripting_helper.dll
unpack001/addons/vac_bypass.dll

Files

78ae8cc78fe0ef85d5e8fcd01de61f81
.rar
Lua/calc.lua
addons/Click for all Hacks ! Hackforums.net.url
.url
addons/LSS.dll
.dll windows:4 windows x86 arch:x86

05d5c5eb125a14856e7f12d4bef041c2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\lss514\src\utils\serverplugin_sample\Release\serverplugin_empty.pdb

Imports

kernel32

GetModuleFileNameA
VirtualQuery
HeapAlloc
GetProcessHeap
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
Sleep
VirtualProtect
CreateThread
SetEnvironmentVariableA
SetEndOfFile
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
SetCurrentDirectoryA
GetCurrentDirectoryA
LCMapStringW
LCMapStringA
GetLastError
GetProcAddress
LoadLibraryA
FormatMessageA
FreeLibrary
GetModuleHandleA
MultiByteToWideChar
WideCharToMultiByte
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
EnterCriticalSection
LeaveCriticalSection
ExitProcess
CreateProcessA
DuplicateHandle
DeleteFileA
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
InterlockedIncrement
InterlockedDecrement
MoveFileA
GetDriveTypeA
GetFullPathNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FatalAppExitA
ReadFile
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetConsoleCtrlHandler
InterlockedExchange
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
GetFileAttributesA
CreateFileA
CreatePipe
GetExitCodeProcess
WaitForSingleObject
GetTimeZoneInformation
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
CreateFileW

user32

GetWindowThreadProcessId
FindWindowA
GetAsyncKeyState

tier0

Msg
g_pMemAlloc
Warning
GetCPUInformation
_AssertValidReadPtr
Error
CommandLine_Tier0
AssertValidStringPtr
_AssertValidWritePtr

vstdlib

GetCVarIF

Exports

Exports

CreateInterface

Sections

.text
Size: 408KB - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
addons/LSS.txt
addons/LSS.vdf
addons/Name_Enabler.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

CreateInterface
cvar
g_pCVar

Sections

code
Size: - Virtual size: 140KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

text
Size: 74KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
addons/Name_Enabler.vdf
addons/iLeech.dll
.dll windows:5 windows x86 arch:x86

2d86d947ab901d6aa167cbd4c1cebe78

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\MyBypass\Orange Box Engine\utils\iLeechV2\Release\cvarhide.pdb

Imports

kernel32

Sleep
GetModuleFileNameA
VirtualQuery
HeapAlloc
GetProcessHeap
WriteConsoleW
GetConsoleOutputCP
MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
GetModuleHandleA
RtlUnwind
GetDriveTypeA
GetLastError
GetFullPathNameA
ExitThread
CloseHandle
ResumeThread
CreateThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCurrentThreadId
GetCommandLineA
GetCurrentDirectoryA
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
ExitProcess
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
CreateFileA
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
LoadLibraryA
SetFilePointer
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
SetEndOfFile
HeapFree
WriteConsoleA

tier0

GetCPUInformation
g_pMemAlloc
Msg
AssertValidStringPtr
_AssertValidWritePtr

Exports

Exports

CreateInterface
cvar
g_pCVar

Sections

.text
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
addons/iLeech.vdf
addons/revSrvBrowser.dll
.dll windows:5 windows x86 arch:x86

11b00b20b406117cd0bc7f9c885014f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Work!\Visual Studio 2005\revSrvBrowser\Release\revSrvBrowser.pdb

Imports

wsock32

recvfrom
ntohl
ioctlsocket
getsockname
setsockopt
bind
socket
closesocket
inet_addr
htonl
ntohs
sendto
htons
gethostbyname

user32

MessageBoxW

kernel32

GetModuleFileNameA
GetProcessHeap
SetEndOfFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
CreateDirectoryW
GetModuleHandleW
VirtualProtect
QueryPerformanceCounter
QueryPerformanceFrequency
GetStdHandle
WaitForSingleObject
Sleep
CreateThread
GetLastError
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
GetFileType
GetCurrentThreadId
GetCommandLineA
GetProcAddress
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
SetHandleCount
GetStartupInfoA
CloseHandle
WriteFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
InitializeCriticalSectionAndSpinCount
RaiseException
MultiByteToWideChar
ReadFile
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
GetModuleHandleA
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA

Exports

Exports

CreateInterface

Sections

.text
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
addons/revSrvBrowser.vdf
addons/scripting_helper.dll
.dll windows:5 windows x86 arch:x86

e86a1c10af4a4f079ee701d0ddf646aa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\mR_Plugin\testscripts\Release\serverplugin_empty.pdb

Imports

kernel32

Sleep
ExitThread
CreateThread
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
CloseHandle
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
GetModuleHandleA
LoadLibraryA
FreeLibrary
RtlUnwind
GetModuleHandleW
ExitProcess
GetCurrentThreadId
GetCommandLineA
GetDriveTypeA
GetLastError
GetFullPathNameA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapAlloc
RaiseException
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
HeapFree
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetConsoleCtrlHandler
InterlockedExchange
InitializeCriticalSectionAndSpinCount
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCurrentDirectoryA
SetCurrentDirectoryA
GetLocaleInfoW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
VirtualAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
SetStdHandle

tier0

g_pMemAlloc
_AssertValidReadPtr
_AssertValidWritePtr
GetCPUInformation
Plat_FloatTime
Warning
CommandLine_Tier0
Msg
AssertValidStringPtr
Error

vstdlib

GetCVarIF
RandomFloat

Exports

Exports

CreateInterface

Sections

.text
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
addons/scripting_helper.vdf
addons/sourcemod/.DS_Store
addons/sourcemod/._.DS_Store
addons/sourcemod/._plugins
addons/sourcemod/plugins/._sourceadmin.smx
addons/sourcemod/plugins/._sourceadminother.smx
addons/sourcemod/plugins/sourceadmin.smx
addons/sourcemod/plugins/sourceadminother.smx
addons/vac_bypass.dll
.dll windows:4 windows x86 arch:x86

470a7015c6f0d6d16be0552b3ba3ab09

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

i:\bypass\utils\serverplugin_sample\Release\serverplugin_empty.pdb

Imports

kernel32

GetModuleFileNameA
VirtualQuery
HeapAlloc
GetProcessHeap
VirtualProtect
CloseHandle
lstrcmpiA
Module32Next
Module32First
CreateToolhelp32Snapshot
GetProcessId
GetCurrentProcess
Sleep
CreateThread
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
GetModuleHandleA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
GetLastError
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA

tier0

GetCPUInformation
Warning
Msg
g_pMemAlloc
AssertValidStringPtr
_AssertValidWritePtr

vstdlib

KeyValuesSystem
RandomFloat

Exports

Exports

CreateInterface
cvar
g_pCVar

Sections

.text
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
addons/vac_bypass.vdf

Sharing

General

Malware Config

Signatures

Files

05d5c5eb125a14856e7f12d4bef041c2

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

tier0

vstdlib

Exports

Exports

Sections

.text Size: 408KB - Virtual size: 404KB

.rdata Size: 88KB - Virtual size: 84KB

.data Size: 8KB - Virtual size: 51KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 20KB - Virtual size: 16KB

Headers

File Characteristics

Exports

Exports

Sections

code Size: - Virtual size: 140KB

text Size: 74KB - Virtual size: 76KB

rsrc Size: 512B - Virtual size: 4KB

2d86d947ab901d6aa167cbd4c1cebe78

Headers

File Characteristics

PDB Paths

Imports

kernel32

tier0

Exports

Exports

Sections

.text Size: 93KB - Virtual size: 93KB

.rdata Size: 42KB - Virtual size: 42KB

.data Size: 8KB - Virtual size: 52KB

.reloc Size: 10KB - Virtual size: 10KB

11b00b20b406117cd0bc7f9c885014f3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wsock32

user32

kernel32

Exports

Exports

Sections

.text Size: 110KB - Virtual size: 109KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 8KB - Virtual size: 36KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 8KB - Virtual size: 7KB

e86a1c10af4a4f079ee701d0ddf646aa

Headers

File Characteristics

PDB Paths

Imports

kernel32

tier0

vstdlib

Exports

Exports

Sections

.text Size: 288KB - Virtual size: 287KB

.rdata Size: 60KB - Virtual size: 59KB

.data Size: 7KB - Virtual size: 51KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 11KB - Virtual size: 11KB

470a7015c6f0d6d16be0552b3ba3ab09

Headers

.text
Size: 408KB - Virtual size: 404KB

.rdata
Size: 88KB - Virtual size: 84KB

.data
Size: 8KB - Virtual size: 51KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 20KB - Virtual size: 16KB

code
Size: - Virtual size: 140KB

text
Size: 74KB - Virtual size: 76KB

rsrc
Size: 512B - Virtual size: 4KB

.text
Size: 93KB - Virtual size: 93KB

.rdata
Size: 42KB - Virtual size: 42KB

.data
Size: 8KB - Virtual size: 52KB

.reloc
Size: 10KB - Virtual size: 10KB

.text
Size: 110KB - Virtual size: 109KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 8KB - Virtual size: 36KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 8KB - Virtual size: 7KB

.text
Size: 288KB - Virtual size: 287KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 7KB - Virtual size: 51KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 11KB - Virtual size: 11KB

.text
Size: 88KB - Virtual size: 85KB

.rdata
Size: 44KB - Virtual size: 42KB

.data
Size: 12KB - Virtual size: 55KB

.reloc
Size: 12KB - Virtual size: 11KB