MultiHack_v1[.]8[.]5_4[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

MultiHack_v1.8.5_4.rar
Size

3.6MB
MD5

88500153060ccb84c31599b17f9ea2b3
SHA1

acb22d3a1734ba1bddf92c918064e92f80d37056
SHA256

7633ab7872ef04d7b43e504faee385487447f4fa27a1cd19b0222fa1fe377d36
SHA512

0a132c1e153f9d974079ee8b3abd62e43f41bc077d2eacf60f43120505661327088e5fc52b8db23f301f5978334e0444ad019a92747c00c7485f1319bd857de9
SSDEEP

98304:T3d8QdzqlHqJjt6GXI4N+Dhs1XO0166OhznF:T3a/5YwYN+Dy1L66WznF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Multihack_kamer.mix

Files

MultiHack_v1.8.5_4.rar
.rar
-
Multihack_kamer.mix
.dll windows:5 windows x86 arch:x86

c3c589f54bf51898bc13e6925e875f51

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\KaMeR\ForKamerqqq\Release\Multihack_kamer.pdb

Imports

kernel32

DisableThreadLibraryCalls
CreateThread
FlushInstructionCache
DeleteFileA
VirtualProtect
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
SetLastError

msvcr90

_initterm_e
_initterm
_decode_pointer
_encoded_null
__CxxFrameHandler3
memcpy
__CxxRegisterExceptionObject
__CxxExceptionFilter
_amsg_exit
__CxxDetectRethrow
__CxxQueryExceptionSize
_cexit
??2@YAPAXI@Z
__FrameUnwindFilter
free
_malloc_crt
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
__CxxUnregisterExceptionObject
_encode_pointer
??3@YAXPAX@Z
_except_handler4_common

user32

MessageBoxA

msvcm90

?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z

msvcp90

??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ

python22

PyInt_FromLong
PyObject_Call
PyString_FromString
PyObject_GetAttrString
PyRun_SimpleString
PyImport_ImportModule
PyString_AsString
PyTuple_GetItem
PyInt_AsLong
PyTuple_New
PyTuple_SetItem

mscoree

_CorDllMain

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 344KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
readme.txt

Sharing

General

Malware Config

Signatures

Files

c3c589f54bf51898bc13e6925e875f51

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcr90

user32

msvcm90

msvcp90

python22

mscoree

Sections

.text Size: 55KB - Virtual size: 55KB

.rdata Size: 344KB - Virtual size: 344KB

.data Size: 5KB - Virtual size: 23KB

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 55KB - Virtual size: 55KB

.rdata
Size: 344KB - Virtual size: 344KB

.data
Size: 5KB - Virtual size: 23KB

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 4KB - Virtual size: 3KB