ndGameProtect[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ndGameProtect.dll
Size

746KB
MD5

12b9f50aab857eaffedced529a811b11
SHA1

fe7c3fe89d0279e06e066aa2d7e0d3e67be56ca9
SHA256

2361bd64a1dd8f13ac2cfa35a42daacd9e05b40298aed4de113f6b7b82b842d4
SHA512

c070cfb8c9381456a582d8ffc8c80b9070a08a68f06a0220285d899fbb0e7508d45189ac95ef2231a2c7e97356a58a0dbb62010de4bb1df28e0c3f62b28fa39e
SSDEEP

12288:gMcSjAg/xegdQF3UGOp/lNyjtaL0YeOvR2vCWlWN3YBAYYIQG66gtlId5WqzN29e:gMPjDxnqBrOpbN3+lYIQAgtGnWS2qnxJ

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

ndGameProtect.dll
.dll windows:5 windows x86 arch:x86

2cc0e5776171fb9c83aca4e36bd49d85

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ab:ff:b4:c5:f6:4f:cb:7d:88:18:aa:65:67:a9:0a
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

08/05/2019, 00:00

Not After

23/07/2022, 12:00

Subject

CN=Fujian NetDragon Computer Network Information Technology Co.\,Ltd,O=Fujian NetDragon Computer Network Information Technology Co.\,Ltd,L=Fuzhou,ST=Fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

00:9b:8b:df:c9:4a:2b:ab:93:99:22:dd:fa:fb:84:cc:a7:9d:cb:3a
Signer

Actual PE Digest

00:9b:8b:df:c9:4a:2b:ab:93:99:22:dd:fa:fb:84:cc:a7:9d:cb:3a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\DevOutNew\ndGameProtectV6.0.2.1x64\Release\ndGameProtect.pdb

Imports

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenSCManagerA
CreateServiceA
OpenServiceA
QueryServiceConfigA
ChangeServiceConfigA
StartServiceA
CloseServiceHandle
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
GetUserNameA
RegOpenKeyExA
OpenServiceW

user32

GetForegroundWindow
GetParent
GetWindowThreadProcessId
GetFocus
KillTimer
SetTimer
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetKeyState

ole32

CoUninitialize
CoCreateInstance
CoInitialize

ws2_32

inet_addr
gethostbyname
closesocket
htons
connect
setsockopt
ioctlsocket
select
send
WSAStartup
WSACleanup
recv
socket

wininet

InternetReadFile
InternetOpenA
InternetCloseHandle
HttpSendRequestA
InternetConnectA
HttpOpenRequestA

shell32

SHGetSpecialFolderPathA

shlwapi

StrStrIA

kernel32

GetProcessHeap
SetEndOfFile
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
HeapSize
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RtlUnwind
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
WideCharToMultiByte
LCMapStringA
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RaiseException
lstrlenA
WriteFile
MultiByteToWideChar
lstrcatA
DeleteFileA
GetModuleFileNameA
CreateProcessA
CloseHandle
WaitNamedPipeA
Sleep
CreateFileA
CreateDirectoryA
GetPrivateProfileIntA
WritePrivateProfileStringA
CreateThread
GetCurrentProcess
GetSystemInfo
GetCurrentThreadId
SetEvent
OutputDebugStringA
GetModuleHandleA
FindResourceA
SizeofResource
LoadResource
SetFileAttributesA
GetTickCount
LockResource
LocalAlloc
LocalFree
GetCurrentProcessId
DeviceIoControl
GetLocalTime
GetPrivateProfileStringA
WaitForSingleObject
TerminateThread
GetFileAttributesA
CreateMutexA
GetLastError
ReleaseMutex
GetFileSize
ReadFile
FindFirstFileA
FindClose
GetWindowsDirectoryA
GetVersionExA
IsBadReadPtr
LoadLibraryA
GetProcAddress
FreeLibrary
CreatePipe
TerminateProcess
MoveFileExW
MoveFileExA
CreateToolhelp32Snapshot
Process32First
Process32Next
Module32First
Module32Next
GetLogicalDriveStringsA
QueryDosDeviceA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
VirtualProtect
HeapFree
GetSystemTimeAsFileTime
ExitThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
InterlockedDecrement
GetCommandLineA
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
ExitProcess

Exports

Exports

ChangeDate
CheckCodeDate
EnCodeDate
InstallHookEx
MakeSignCode
NdGetDeviceStateEx
UninstallHookEx

Sections

.text
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 189KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp1
Size: 313KB - Virtual size: 313KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2cc0e5776171fb9c83aca4e36bd49d85

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

01:ab:ff:b4:c5:f6:4f:cb:7d:88:18:aa:65:67:a9:0aCertificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

00:9b:8b:df:c9:4a:2b:ab:93:99:22:dd:fa:fb:84:cc:a7:9d:cb:3aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

user32

ole32

ws2_32

wininet

shell32

shlwapi

kernel32

Exports

Exports

Sections

.text Size: 186KB - Virtual size: 185KB

.rdata Size: 22KB - Virtual size: 22KB

.data Size: 10KB - Virtual size: 20KB

.rsrc Size: 189KB - Virtual size: 188KB

.vmp0 Size: 11KB - Virtual size: 10KB

.vmp1 Size: 313KB - Virtual size: 313KB

.reloc Size: 5KB - Virtual size: 5KB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

01:ab:ff:b4:c5:f6:4f:cb:7d:88:18:aa:65:67:a9:0a
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

00:9b:8b:df:c9:4a:2b:ab:93:99:22:dd:fa:fb:84:cc:a7:9d:cb:3a
Signer

.text
Size: 186KB - Virtual size: 185KB

.rdata
Size: 22KB - Virtual size: 22KB

.data
Size: 10KB - Virtual size: 20KB

.rsrc
Size: 189KB - Virtual size: 188KB

.vmp0
Size: 11KB - Virtual size: 10KB

.vmp1
Size: 313KB - Virtual size: 313KB

.reloc
Size: 5KB - Virtual size: 5KB