E:\Nova pasta\Source Sparta\Source HG3\Game\Release\game.pdb
Behavioral task
behavioral1
Sample
d5226e2cef30bb2aa8ce56e50a271994.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d5226e2cef30bb2aa8ce56e50a271994.exe
Resource
win10v2004-20231215-en
General
-
Target
d5226e2cef30bb2aa8ce56e50a271994
-
Size
3.2MB
-
MD5
d5226e2cef30bb2aa8ce56e50a271994
-
SHA1
b84234ea5c1336370cdc14133e6e5a52fd750978
-
SHA256
d64439a5b6970b45587e5b19a0c54237dbf5d6db1c4975b50f8b1376aa0797d6
-
SHA512
a2f0250cdae09f99657567d5869dd880c79fe0f5b23b7da6249ddbb1047d5e6d1a6a6f17d7029c0addaf20b480e3ea84384b17d7c42455286fb5dfdbd3074c21
-
SSDEEP
49152:frAlXdWolLyNsMdM5+zOxwH9kZsuLvHbfEEV9nKk1rRr+k2Ja5Prd1qr8wAj+L9/:25DWms0DV9nKkFRqOx1qr8wAjgwE
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d5226e2cef30bb2aa8ce56e50a271994
Files
-
d5226e2cef30bb2aa8ce56e50a271994.exe windows:6 windows x86 arch:x86
21dd115566205faeebe99f7c2491688d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
dsound
ord1
kernel32
GetVersionExA
EncodePointer
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
gdi32
RemoveFontResourceA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
CoUninitialize
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateFontA
winmm
mmioSeek
shlwapi
PathFileExistsA
ws2_32
inet_ntoa
imm32
ImmGetCompositionStringA
rpcrt4
UuidCreateSequential
wininet
InternetOpenUrlA
Exports
Exports
SetExtChangeZip
S���ů��in���.��~#�'���Rv��ʙp���������vϵ��&qa��+̿��V Ƹh���tm!,K�`���H��R�!�ͭ�b����E0o��/9��ٵ36�E��g#ò=_a-|J�pGK���`T�{���QO7%�$p��<ϔ.0[Q{Yr�6/�#r5��uD4����JJ?5�Sן%.�O�̒g=fnk�X�+/�29l�3���ur`��\���_���H�QХ�<Ǵ�d�>$�"�?7��N*j8Z3A-��0�S�`{�@ՋN�pQ�9 B�\��@T��*��o7@�ծ(u�8UJ���}������t�� �/�p��PztY?"�ӛŇ/*v�g/��b��a��g!]N��r�� ���>��j��1��DH���FSRr�3�T�E���H�3������V4����BF����%ĵ���������� 4��7y�U���A��|��<����4�ż�D�o=(i ��)��g���3\%E�XPԟ�y��[@� ��x��$t0t2*ٛb������tk�,6~��"l����Fdm�c����/S����;fvԹ��}�<E�����f��XJ/dZ��|Ѩ�K24֯7�G8�M�X<)`�䭒��\����FK�lo�K���h G��R�� ��妻��%П��`�ǁ�Q����Ը�w_4�|� 1���E���9_@���J̍���~4_���YZv�7����1��R[�2�Xڀ�dR,zщ:A^_��j� ��:^a���u��h�i5!�p�� �������®�����ݧ�VA��C�������`�i��4-�՚�HI�[#5z߰�oЋ��b3������3�� $�:"�+�:8AO8��b)J�hx;|!T��߃��T��V��*D�����뎚�������-��Ns�C�ՙ�RQ���l\�Cn�g�p�M�,��MP��kr�ݕCN ����w̴� ��/���D3t@�-�lN�,�1�����$}A、��E���t'�+��9�=���R��w6JA�/��q��}L��f���v�VY� d��n�䇃;"�y�ȡ��| ��Ì����Xkw��'f��y�*��xfP�䞛p1z�a�E�<lGxA,4+��w�v����QāIy�}(�̇��ǫ����%���D�֊4x�d��4ʒ�����?���� #Oхr��5�����AV9���b\�ޗvf�X�����:��q-/� 9��� ����l��-��n��$�0���్��+-��t�(�d���y'��o�þ/=�"�bs3�ò��!�e<C�?k�&S�;����O�S*����6��>K�:���si�t��l���85�O�bBks�ܖ�haA�o���^(�ŭ(_�*�T��#��%�0o��r����L�ўy`&���c���0��֭Xx�'� 9�e_V`C~����^vl����Q<�>J�$��u4�(���դa�6��g`/G�k1�l������}�A� �2�SY>��HY4;�f�7f�u��@�� c�mX��R��!�>} ���尫S���[�������0��3g�{`UC�z���!u!��ґ����O��|/m�Z)��3��j���w:�-�Rؓ#��V��V����ɪ6K�7����Y��t�P���l������$yt�n �� �f��k��_���?�����E�VfzMb�����̆���V6a��oaT��:�P5R��o:��"��K����xC�P$�E����l�m��*K9�Y�ǦM�q!�l�����T�ړ5�;Ji�)�| -I��k��1�����ܣϗ�h�hʆB1P�7��D��M���:iQ̒^������>�������[�&���g6�����<"��ؠN�5��>F�X�p����T���)�tulP�(2~��L�`�ó�q�Oؕ�s1���H��<</�����ϴ!v�ڋ�@���hgb ��}��_����]��L_\�G�RH[5�n�3��\��S�W;D�hNF�~�8<����?L��g��a8�7�gc���U|�I|�YP������>r� ZbR��w���W�ƫ��B(�k�{�)����Q�s��� ��w���(P|��� WZ��`rU�� `uqąO,�g��V·$uF��Uc���.��{�%����ۆb��Lʈb�b4�������I�K!vP �Vdp2|�ǫ&J����!~�a�G���kNU����持����҄�50�i٤�LU� ��[ة �����j� ]�JH\�#�W������8�Էk��)����L+���E ���o�@d2�w��a��05^���Z�>1? �i�6��w��CE��B{�ZI��0�� ��r^?�~/��� �J��}��=N�T$���$�1@��g��S~�J�#֞+�{������_�'�J@�-�D�U�������1��t�Lp��B���P~�2ᤶ3�yuߛ����+o�p�\�n~G�OC�Q|*���bK����_E UJ�����.�k�*����`��2�s���Khl�J��鐅G}��Χ��6`�C�v�2�l���D��/:/�ň����\\i'�\l�R0�������i m6�t���M�J4|_�CC�|�����h-K��ˋHY�f��Q'0 Z�p �:>���q�;�̺�m��?�f L��@:��bX�P:�lb;��q�!�x��Ve��^0x8�'V$�t+9Ag(|ө�����j���/س��[�2Tb����4[�}Z��BDc�c9�!A���'���d�-$nV"�a�f��t���e����A��yS�$=�g���}f!�O8M���3�D��X[*o��S�4FI�T� � ����2u0��>vݷ�y(�C�+t�g��.���l��ݖ���{mr���>-�{���b��T�/�F�!�s�+�9w/�[N�=��>���e��$�VA��<�}�<L?���$ ��R�3�r �62�� ��y�a�Q S�+�7(�8w/��;F5�g�0�e��s�PJ,�G�$��+
UnZipData
UnZipDataToDirectory
UnZipDataToFile
UnZipFile
ZipData
ZipFile
_CloseD3d@0
_InitD3D@4
_smPlayD3D@24
Sections
.text Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 422KB - Virtual size: 421KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 60.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ