D:\Priston\Projetos\C++\Source Fernando Matoso\Game\src\Release\game.pdb
Behavioral task
behavioral1
Sample
Game.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Game.exe
Resource
win10v2004-20231215-en
General
-
Target
d4b1ae09880d585fdb75dc80b1adf93a
-
Size
3.9MB
-
MD5
d4b1ae09880d585fdb75dc80b1adf93a
-
SHA1
34223d3e107e655a10e782cc68625720a12b7115
-
SHA256
e561bc74a9b342176425ae52ad1824a6778038db4f323a65c70acca4f6efa6e6
-
SHA512
1ff660feb44b8daf37a21c599331d24a78bab1c9db28fd96177bd4e80dc99c5211cc764c57358ffb0b2286289613680109ebb60ec932f304ab4389620be5c413
-
SSDEEP
98304:9lw1ITqomEfaRzoI+ZvyOMdPs7IsDIIPdVXSgxhcnX+QgLL+SU:bw1IsOs0I6yvtsUsDIInXSgxhcnuQgna
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Game.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Game.exe
Files
-
d4b1ae09880d585fdb75dc80b1adf93a.zip
-
Game.exe.exe windows:6 windows x86 arch:x86
4fef939063247da494bec0761c158a74
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
dsound
ord1
kernel32
GetVersionExA
MultiByteToWideChar
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ReleaseDC
gdi32
GetDIBits
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CoInitialize
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
winmm
mixerGetDevCapsA
shlwapi
PathFileExistsA
msvfw32
ICDecompress
avifil32
AVIFileInit
iphlpapi
GetAdaptersInfo
wininet
HttpQueryInfoA
wsock32
bind
imm32
ImmGetDescriptionA
Exports
Exports
��M6���B^�\}���i?g0��X��� r�V'%�/w�� ��_�5��-pH���V}V$</QkdcV�a6�Z����g�"7ʄ�_)z6bwe�y<�!(%�#H��_�е��7�m�릃�q�,�d���+ ��y �W�$��~���^�$Z#��4��&g�Rt��t�qD�u�̓�Z_P���uVnSh��/��w��5п�~�,��Z��1��[����BcX��a�w��ەTqeA!� ��e�O����&!�sccLZ���"�-�4��Q���G`1���RX��������L�F۱����O���� �)�D,dOCۇ��y�jD+@e���"�����~0|'���d���hO���& '���Ε�>��W0�e�6��ޑ;_Z���wrc(SNta}E.I����jjp�b?3��kq�\�U*���_�A�����[���D��܇�AY>���^Fc!E��aM��YDX�^Ͻ��)���<�c�+@"��~oM����.NPg�bY���Yk��z'6hv*�,�Kd�j�� %I������NU~��>���?��"2�� ��� �)d��ؒo��:�Z�{��"RyzLI�V�����F\�W2��q�^ �m[j5a��P2h����=M�l̋L3L��\���5ǞC+��nb��] �v;q>�͒���RJ�5���f-�[O�~ �����F(b�ωi��$��߃Q��*��[Ui��(Y�>���/a��٘f�����x���7���Ȏ�D�[h��u�������!c�vH� i��$ο���0�7�:�28�~0I��U��9M]A����U������u��g�Z<#uc=j���܍:��q�le��ee��8�6���J�3�U���d���c���ف�43�^�,º3�=zӊL&>LT����b��}��?���K ������)����߱��֠b�FL�J�Y�N�X�I�j��Բ ,Ze�4؝>��䪉O��pN� ��� ��{�d��mҿି1X ?��Du"��z�-T��-Y��?���䎀`��E�v�[1 ��C�+��;��Y���=�����,�cI�_v��օ)�P5�,���c�d;~�����e���XoQ��}[��lyq[��T�gӏ:đs�`�(�"O��'��\:?����<�P��BFD0��� �͎D���f���kn��z *��K�����ZcG;蹡<���v3�C����a���Ć�"��Q�u ]°]R/ ,��^�>8��%'�[�%x�K�!�N"j%?��1�kjd�+: S�}��{��u �B�b"�ŅM��Q1��x���g˞�a�H����gȐ�{���A�rչf.��s�{Z�&4�O��,b�sOo���W�D�[H�ݢ�q�(��i��hʏU���c�4��V�:�������FT(DS<���ν���{��`����7�U���K�J�0�%>E�������LKX������_�m ��;$"@��j#�*��O�_2w�9�f���n�$����d��k�=���ڢsɇW]�Ք��"��}U|��.|��!c���%ҭ,�)�>l�pKq�J7�����ޜ�o0��&��T�Y��?���*�����>_��Q��"�&>�*�Ji�#���M�_�҉����1� ��.�O8���r?�j")��HG��,�(�M�(eu��{1�7�.��ĩzMDZEh�l#��l#�\���וٷ�:u(1X��S�bV;;M�z��qU��]���ݖ�:��W%݂��I '�����\�~x����o��=۽���&�j\z�&�Ky�I����2y���Ft��R���ū�>����C��#-�8�َ�w8�F���L��u&+(�W ����-��V��v�d0����/j�Gn�;���4���������m�Q�wd�h�Y !�:]EMNH��S����o�6k��8C�X�A����om?�}� 9�������F���r���~~�/��6ȍK ���]�/:C�NSi�m0���8������!�b�tfB� ����@�B�!�DB9'4��h�-�>��֜T�暔u���8�M@���X�0b/V߾A�Xt��b��ؤ�h ���r�k�������L����x��&9��[]�Ŭ��2̈́��<�|.��m���Ɂ��H�YS��|��v�{������k����J @�� ����:%�y&l�u��^���e2M�����l[:#���n��q�kՍX��<�`ܪ\���Q�\��m�3�^�Ea�v1�O&�?���Ϩ̱���F`�PMa�e��]���w�#�B@c_ �s�.�@�;��*ٍ�������4Rw� Z�������X�����Q�����ck�� 9��(�˺>�S¶�s��H-]��0��!�T����B��C��F�ԗ�]'{�u�o�M�:���vL�X-���'G���(���P�vc&"3Z����VK��p����+2��|�ҏ����hQ2�4dx�u���^c���/I���<_��p�hW< �?���a�mש')K�<���qLA���:��J�A���'~~&lf�P1p&U��z�G�h7�#q/��2���C�����~P`�JO���ܑ�F�N�M���}�#��FJ�@�v�����p����y&�n���(I����j*��&*���mK��t���&��lBa�t��O�_���uDW{�<��+�����=�F�p����������8�N���.d�����¡�M�wM��D���{����,��3Qj�҇Ho/=U,�1�m |�:P��r�|N�!�0��UVde�W��������*���d��\�'�,uo���g�F)x�G{s������FE7���0Dc����2AK�B�g��߂��4R�m�UN'�4���ujP1F�4���[��lVꏺ't�[0�>��:x�.�f��(,��+͒&�F'��w�c���G��U��36䃽Iϓ�`s��O�i_��a�������#s��:��8�1-�b�B�ˆl�П���@����ViA�?�$�-
Sections
.text Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 457KB - Virtual size: 456KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 93.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ