RF_SCreater_2[.]60[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

RF_SCreater_2.60.rar
Size

3.3MB
MD5

94db5f7a411356e57f486d2d05c75574
SHA1

5233633c9b7ffa302018cbe365303e8d4945b66d
SHA256

ab9bacbe3ce4e72c772acc6b0127342819c026925f5555e289619ac8d862f1f4
SHA512

45066d335a775d349f58cadf354a298e4ea3c28a772417b80193907692a0b225a7bff1cad4fa7e3e5cfbaba56065d1c5d8b63f11fd1e0e46f58da0117444ee53
SSDEEP

98304:aahg11hXxEvlyzgHlFCd+YEvO3QXH+lXdZrXFPWz:aaw168zuFCHE23QXHWuz

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/RF_SCreater_2.60/RF_SCreater.exe	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RF_SCreater_2.60/RF_SCreater.exe

Files

RF_SCreater_2.60.rar
.rar
RF_SCreater_2.60/Admin/17032009-14.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-15.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-16.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-17.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-18.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-19.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-20.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-21.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-22.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-23.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-24.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-25.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-26.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-27.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-28.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-29.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-30.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-31.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-32.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-33.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-34.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-35.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-36.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-37.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-38.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-39.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-40.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-41.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-42.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-43.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-44.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-45.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-46.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-47.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-48.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-49.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-50.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-51.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-52.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-53.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-54.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-55.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-56.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-57.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-58.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-59.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-60.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-61.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-62.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-63.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-64.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-65.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-66.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-67.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-68.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-69.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-70.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-71.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-72.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-73.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-74.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-75.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-76.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-77.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-78.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-79.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-80.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-81.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-82.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-83.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-84.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-85.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-86.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-87.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-88.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-89.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-90.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-91.jpg
.jpg
RF_SCreater_2.60/Admin/17032009-92.jpg
.jpg
RF_SCreater_2.60/Base/FamSort.txt
RF_SCreater_2.60/Base/ManWomO.txt
RF_SCreater_2.60/Base/NameWoman.txt
RF_SCreater_2.60/Base/city.txt
RF_SCreater_2.60/Base/str.txt
RF_SCreater_2.60/FotoF/10.bmp
RF_SCreater_2.60/FotoF/11.jpg
.jpg
RF_SCreater_2.60/FotoF/13.jpg
.jpg
RF_SCreater_2.60/FotoF/14.jpg
.jpg
RF_SCreater_2.60/FotoF/6.jpg
.jpg
RF_SCreater_2.60/FotoF/9.jpg
.jpg
RF_SCreater_2.60/FotoM/01.bmp
RF_SCreater_2.60/FotoM/03.jpg
.jpg
RF_SCreater_2.60/FotoM/04.jpg
.jpg
RF_SCreater_2.60/FotoM/05.jpg
.jpg
RF_SCreater_2.60/FotoM/06.jpg
.jpg
RF_SCreater_2.60/FotoM/07.jpg
.jpg
RF_SCreater_2.60/FotoM/08.jpg
.jpg
RF_SCreater_2.60/FotoM/10.jpg
.jpg
RF_SCreater_2.60/FotoM/11.jpg
.jpg
RF_SCreater_2.60/History/History.txt
RF_SCreater_2.60/RF_SCreater.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 392KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 348KB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

poly
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

AyTkACT
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
RF_SCreater_2.60/Textures/chunky_spinach.jpg
.jpg
RF_SCreater_2.60/Textures/electric_nebula.jpg
.jpg
RF_SCreater_2.60/Textures/fusion_fire.jpg
.jpg
RF_SCreater_2.60/bs/default.ScM
.jpg
RF_SCreater_2.60/bs/mainf.ttf
RF_SCreater_2.60/gfont/All1.bmp
RF_SCreater_2.60/gfont/all42_rf.bmp
RF_SCreater_2.60/gfont/all42_rf.lnt
RF_SCreater_2.60/img/base_sh1.jpg
.jpg
RF_SCreater_2.60/img/but.bmp
RF_SCreater_2.60/img/but2.bmp
RF_SCreater_2.60/img/close.bmp
RF_SCreater_2.60/img/close2.bmp
RF_SCreater_2.60/img/etalon1.bmp
RF_SCreater_2.60/img/mask.bmp
RF_SCreater_2.60/img/pixl1.bmp
RF_SCreater_2.60/img/pixl2.bmp
RF_SCreater_2.60/img/sel0.bmp
RF_SCreater_2.60/img/sel1.bmp
RF_SCreater_2.60/map/ASPHALT2.JPG
.jpg
RF_SCreater_2.60/map/BALMORAL.JPG
.jpg
RF_SCreater_2.60/map/BMPSPHER.jpg
.jpg
RF_SCreater_2.60/map/CHRMWARP.jpg
.jpg
RF_SCreater_2.60/map/CHROMBLU.JPG
.jpg
RF_SCreater_2.60/map/CLNGRNDM.jpg
.jpg
RF_SCreater_2.60/map/FUNKYLIZ.jpg
.jpg
RF_SCreater_2.60/map/GALVPLAT.jpg
.jpg
RF_SCreater_2.60/map/GILAMONS.jpg
.jpg
RF_SCreater_2.60/map/MARBTEA2.jpg
.jpg
RF_SCreater_2.60/map/Purple Pastels.jpg
.jpg
RF_SCreater_2.60/map/Stucco 2.jpg
.jpg
RF_SCreater_2.60/map/b.jpg
.jpg
RF_SCreater_2.60/map/g.jpg
.jpg
RF_SCreater_2.60/map/lw.jpg
.jpg
RF_SCreater_2.60/map/lw2.jpg
.jpg
RF_SCreater_2.60/map/r.jpg
.jpg
RF_SCreater_2.60/map/w.jpg
.jpg
RF_SCreater_2.60/simpl/10g.eff
RF_SCreater_2.60/simpl/11g.eff
RF_SCreater_2.60/simpl/1g.eff
RF_SCreater_2.60/simpl/2g.eff
RF_SCreater_2.60/simpl/3g.eff
RF_SCreater_2.60/simpl/5g.eff
RF_SCreater_2.60/simpl/6g.eff
RF_SCreater_2.60/simpl/7g.eff
RF_SCreater_2.60/simpl/8g.eff
RF_SCreater_2.60/simpl/9g.eff
RF_SCreater_2.60/simpl/listtoload.txt
RF_SCreater_2.60/simpl/name.eff
RF_SCreater_2.60/sysm/del2.jpg
.jpg
RF_SCreater_2.60/sysm/delall.jpg
.jpg
RF_SCreater_2.60/sysm/delall2.jpg
.jpg
RF_SCreater_2.60/sysm/eff.jpg
.jpg
RF_SCreater_2.60/sysm/new.jpg
.jpg
RF_SCreater_2.60/sysm/ok2.jpg
.jpg
RF_SCreater_2.60/sysm/open.jpg
.jpg
RF_SCreater_2.60/sysm/open2.jpg
.jpg
RF_SCreater_2.60/sysm/rub.jpg
.jpg
RF_SCreater_2.60/sysm/save.jpg
.jpg
RF_SCreater_2.60/sysm/wait.jpg
.jpg
RF_SCreater_2.60/zlang/Page.jpg
.jpg
RF_SCreater_2.60/zlang/Page2.jpg
.jpg
RF_SCreater_2.60/zlang/add.jpg
.jpg
RF_SCreater_2.60/zlang/casual.jpg
.jpg
RF_SCreater_2.60/zlang/data.jpg
.jpg
RF_SCreater_2.60/zlang/en/Casual.jpg
.jpg
RF_SCreater_2.60/zlang/en/Page.jpg
.jpg
RF_SCreater_2.60/zlang/en/Template.jpg
.jpg
RF_SCreater_2.60/zlang/en/add.jpg
.jpg
RF_SCreater_2.60/zlang/en/data.jpg
.jpg
RF_SCreater_2.60/zlang/en/lang.ini
RF_SCreater_2.60/zlang/en/m11.m
RF_SCreater_2.60/zlang/en/m12.m
RF_SCreater_2.60/zlang/en/m3.m
RF_SCreater_2.60/zlang/en/m4.m
RF_SCreater_2.60/zlang/en/m4u.m
RF_SCreater_2.60/zlang/en/marker.jpg
.jpg
RF_SCreater_2.60/zlang/en/onoff.jpg
.jpg
RF_SCreater_2.60/zlang/en/reset.jpg
.jpg
RF_SCreater_2.60/zlang/en/save.jpg
.jpg
RF_SCreater_2.60/zlang/foto.jpg
.jpg
RF_SCreater_2.60/zlang/lang.ini
RF_SCreater_2.60/zlang/m11.m
RF_SCreater_2.60/zlang/m12.m
RF_SCreater_2.60/zlang/m3.m
RF_SCreater_2.60/zlang/m4.m
RF_SCreater_2.60/zlang/marker.jpg
.jpg
RF_SCreater_2.60/zlang/onoff.jpg
.jpg
RF_SCreater_2.60/zlang/reset.jpg
.jpg
RF_SCreater_2.60/zlang/save.jpg
.jpg
RF_SCreater_2.60/zlang/template.jpg
.jpg

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

Size: 392KB - Virtual size: 1.1MB

Size: 5KB - Virtual size: 16KB

Size: - Virtual size: 72KB

Size: 8KB - Virtual size: 12KB

Size: - Virtual size: 4KB

Size: 512B - Virtual size: 4KB

Size: - Virtual size: 76KB

.rsrc Size: 348KB - Virtual size: 2.1MB

.idata Size: 3KB - Virtual size: 12KB

poly Size: 4KB - Virtual size: 8KB

AyTkACT Size: 6KB - Virtual size: 8KB

.adata Size: - Virtual size: 4KB

.rsrc
Size: 348KB - Virtual size: 2.1MB

.idata
Size: 3KB - Virtual size: 12KB

poly
Size: 4KB - Virtual size: 8KB

AyTkACT
Size: 6KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB