Steem[.]SSE[.]4[.]1[.]2[.]Win32[.]D3D[.]R16[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Steem.SSE.4.1.2.Win32.D3D.R16.zip
Size

2.4MB
MD5

5ea33683b36a0b6260977c11f751499e
SHA1

eb2e2d0f4f878baf653d1631a0af30c1d5114a6c
SHA256

d1962a976995a1533d44f7b4c43af745947c55bdd3ae67b56db31df8ed617088
SHA512

93737aac57a36e83fbe87069428f7678f4efa855b7c323908e946860058aaf59b31c85f30cd4b12c0ccdd9839ddaca1d0f3d42e1344c4266ecf8e4f9f3f0f0b9
SSDEEP

49152:9JsI4z5BH02bZPGBBCJUNZywHghKV/Fq3RY3At4g/oKzH:9b2bZPGjCJUNZvHgcRFwRYOJoI

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/Steem.SSE.4.1.2.Win32.D3D/plugins32/d3d9sweetfx.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Steem.SSE.4.1.2.Win32.D3D/plugins32/d3d9sweetfx.dll	upx

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Steem.SSE.4.1.2.Win32.D3D/Steem32D3D.exe
unpack001/Steem.SSE.4.1.2.Win32.D3D/plugins32/ArchiveAccess.dll
unpack001/Steem.SSE.4.1.2.Win32.D3D/plugins32/CAPSImg.dll
unpack001/Steem.SSE.4.1.2.Win32.D3D/plugins32/d3d9sweetfx.dll
unpack006/out.upx
unpack001/Steem.SSE.4.1.2.Win32.D3D/plugins32/pasti.dll
unpack001/Steem.SSE.4.1.2.Win32.D3D/plugins32/unzipd32.dll

Files

Steem.SSE.4.1.2.Win32.D3D.R16.zip
.zip

Password: infected
Steem.SSE.4.1.2.Win32.D3D/ACSI/MEGAFILE 60.img
Steem.SSE.4.1.2.Win32.D3D/ACSI/SH204.img
Steem.SSE.4.1.2.Win32.D3D/ACSI/readme.txt
Steem.SSE.4.1.2.Win32.D3D/DriveSound/Basic/drive_click.wav
Steem.SSE.4.1.2.Win32.D3D/DriveSound/Basic/drive_seek.wav
Steem.SSE.4.1.2.Win32.D3D/DriveSound/Basic/drive_spin.wav
Steem.SSE.4.1.2.Win32.D3D/DriveSound/Basic/drive_startup.wav
Steem.SSE.4.1.2.Win32.D3D/DriveSound/Epson SMD-480L/drive_click.wav
Steem.SSE.4.1.2.Win32.D3D/DriveSound/Epson SMD-480L/drive_seek.wav
Steem.SSE.4.1.2.Win32.D3D/DriveSound/Epson SMD-480L/drive_spin.wav
Steem.SSE.4.1.2.Win32.D3D/DriveSound/Epson SMD-480L/drive_startup.wav
Steem.SSE.4.1.2.Win32.D3D/DriveSound/Epson SMD-480L/readme.txt
Steem.SSE.4.1.2.Win32.D3D/PRG/DESKTOP.INF
Steem.SSE.4.1.2.Win32.D3D/PRG/DISK_IMG.PRG
Steem.SSE.4.1.2.Win32.D3D/PRG/note.txt
Steem.SSE.4.1.2.Win32.D3D/Steem SSE 4.1.2.rtf
.rtf
Steem.SSE.4.1.2.Win32.D3D/Steem32D3D.exe
.exe windows:5 windows x86 arch:x86

Password: infected

5310c8f23ffbc98e2ab144dedb93ae60

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Emu\ST\SSE\svn\branches\v4.1.2 Releases\windows-build\VS2008\Steem-D3D-Release\Steem.pdb

Imports

winmm

midiInAddBuffer
midiOutGetDevCapsA
midiInGetNumDevs
midiInGetDevCapsA
timeGetTime
midiOutOpen
midiOutGetVolume
midiOutUnprepareHeader
midiOutShortMsg
midiOutPrepareHeader
midiOutLongMsg
timeEndPeriod
timeBeginPeriod
timeGetDevCaps
midiInClose
midiInReset
midiInStop
midiInStart
midiInGetID
midiOutGetNumDevs
midiInPrepareHeader
midiInUnprepareHeader
midiInOpen
midiOutClose
midiOutReset
midiOutSetVolume
midiOutGetID
timeSetEvent

comctl32

ImageList_EndDrag
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_BeginDrag
ImageList_GetIconSize
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Create
ord17

kernel32

FlushFileBuffers
FindFirstFileA
FindClose
FindNextFileA
MoveFileA
FindResourceA
LoadResource
SizeofResource
LockResource
Sleep
GetDriveTypeA
CompareFileTime
GetEnvironmentVariableA
GetExitCodeProcess
CopyFileA
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
LocalAlloc
LocalLock
LocalUnlock
LocalFree
SetPriorityClass
GlobalLock
GlobalUnlock
GetSystemTimeAsFileTime
SetFileTime
DosDateTimeToFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetDiskFreeSpaceA
RemoveDirectoryA
GetModuleFileNameA
InitializeCriticalSection
SetErrorMode
GetTempPathA
QueryPerformanceFrequency
GetVersionExA
DeleteCriticalSection
CreateMutexA
SwitchToThread
EnumDateFormatsA
FileTimeToSystemTime
TerminateThread
CreateThread
SetFilePointer
ReadFile
GetFileSize
InterlockedIncrement
InterlockedDecrement
GetTickCount
GetSystemTimes
GetProcessTimes
MultiByteToWideChar
GlobalAlloc
lstrcpyA
CreateEventA
PurgeComm
SetCommTimeouts
ResetEvent
WaitForSingleObject
GetOverlappedResult
SetCommBreak
ClearCommBreak
GetCommState
SetCommState
GetCommModemStatus
EscapeCommFunction
GetCurrentThreadId
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
LoadLibraryA
GetLastError
GetProcAddress
FreeLibrary
WideCharToMultiByte
GetTempFileNameA
DeleteFileA
SetFileAttributesA
lstrlenA
GetFileAttributesA
CreateDirectoryA
GetUserDefaultLangID
SetCurrentDirectoryA
IsDebuggerPresent
CloseHandle
CreateFileA
WriteFile
GetModuleHandleW
GetModuleHandleA
GetCurrentProcess

user32

GetUpdateRgn
MapVirtualKeyExA
EnableMenuItem
MessageBoxIndirectA
GetMenu
GetWindow
SendInput
FrameRect
GetWindowDC
AdjustWindowRectEx
PostQuitMessage
FindWindowA
GetKeyboardLayout
VkKeyScanExA
mouse_event
GetCaretPos
DrawEdge
DrawFocusRect
LoadBitmapA
DrawTextA
GrayStringA
ValidateRect
DrawStateA
GetCapture
GetIconInfo
GetClipboardData
SetActiveWindow
MessageBoxA
GetActiveWindow
IsClipboardFormatAvailable
UnhookWindowsHookEx
UnregisterHotKey
SystemParametersInfoA
RegisterHotKey
SetWindowsHookExA
CallNextHookEx
ClipCursor
SetCursorPos
GetClassInfoA
GetWindowTextA
SetClipboardViewer
CreateMenu
GetMenuItemCount
GetSystemMenu
GetDesktopWindow
DestroyIcon
LoadImageA
TranslateMessage
ShowScrollBar
GetScrollInfo
GetScrollPos
SetScrollInfo
SetScrollPos
GetWindowTextLengthA
CreateIconIndirect
GetSysColorBrush
GetMessageA
MoveWindow
SetMenu
GetSystemMetrics
MonitorFromWindow
OffsetRect
ChangeClipboardChain
SetClipboardData
EmptyClipboard
OpenClipboard
ShowCursor
ChildWindowFromPoint
SendMessageW
SetParent
IsWindow
GetForegroundWindow
DrawIconEx
IsZoomed
InsertMenuA
IsDialogMessageA
SetClassLongA
GetClassLongA
ShowWindow
SetForegroundWindow
OpenIcon
IsIconic
DispatchMessageA
PeekMessageA
ReleaseCapture
RemovePropA
CallWindowProcA
GetPropA
GetWindowRect
ClientToScreen
SetCursor
SetCapture
DestroyMenu
TrackPopupMenu
AppendMenuA
CreatePopupMenu
ScreenToClient
GetCursorPos
DestroyWindow
SetWindowLongA
SetPropA
CreateWindowExA
UpdateWindow
DefWindowProcA
SetWindowWord
EndPaint
GetWindowWord
FillRect
GetFocus
GetSysColor
IsWindowEnabled
BeginPaint
GetClientRect
GetParent
GetDlgCtrlID
KillTimer
InvalidateRect
GetWindowLongA
SetTimer
UnregisterClassA
RegisterClassA
LoadCursorA
ToAscii
GetKeyState
GetAsyncKeyState
CheckMenuRadioItem
SetWindowTextA
SendMessageA
EnableWindow
GetDlgItem
PostMessageA
SendDlgItemMessageA
SetFocus
SetWindowPlacement
GetWindowPlacement
SetWindowPos
CheckMenuItem
ReleaseDC
GetDC
CloseClipboard
EqualRect
GetMonitorInfoA

gdi32

GetCurrentObject
Rectangle
CreateFontIndirectA
CreateFontA
GetTextColor
GetBkMode
AnimatePalette
GetPixel
GetDeviceCaps
BitBlt
GetBitmapBits
SetPixel
LineTo
GetObjectA
CreateCompatibleBitmap
DeleteDC
StretchBlt
SetStretchBltMode
SetSystemPaletteUse
SelectPalette
CreateRectRgn
GetRegionData
Ellipse
CreateBitmap
SetROP2
MoveToEx
CreateCompatibleDC
CreatePen
SetBitmapBits
TextOutA
GetStockObject
SetTextColor
SetBkMode
DeleteObject
CreateSolidBrush
SelectObject
GetTextExtentPoint32A

comdlg32

GetOpenFileNameA
GetSaveFileNameA

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegDeleteKeyA

shell32

DragFinish
DragQueryFileA
ShellExecuteExA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA
SHFileOperationA
SHBrowseForFolderA

ole32

CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize

msvcr90

perror
fflush
srand
__argv
__argc
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
strtol
islower
memmove
ftell
feof
_fflush_nolock
fprintf
_localtime64
_time64
isalpha
isdigit
strchr
calloc
_purecall
_flsbuf
_filbuf
strncmp
_fseek_nolock
strstr
toupper
_strtime
_strdate
_vsnprintf
rand
longjmp
printf
_fseeki64
malloc
strncpy
strrchr
_fseeki64_nolock
fclose
fopen
_fread_nolock
_fwrite_nolock
free
sprintf
atoi
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_crt_debugger_hook
fread
fseek
fwrite
_ftelli64
_stat64i32
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
__set_app_type
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
_unlock
_itoa
_strupr
_stricmp
_access
_hypot
_ultoa
_strlwr
memset
memcpy
__CxxFrameHandler3
__libm_sse2_sin
__libm_sse2_cos
__libm_sse2_pow
_CIpow
__libm_sse2_log10
_CxxThrowException
_CIfmod
_setjmp3
__p__fmode
__CxxLongjmpUnwind

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateSprite
D3DXSaveSurfaceToFileA
D3DXLoadSurfaceFromFileA

psapi

GetModuleInformation
EnumProcessModules

Sections

.text
Size: 922KB - Virtual size: 921KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 385KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 280KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Steem.SSE.4.1.2.Win32.D3D/Tos102UK_cloud.img
Steem.SSE.4.1.2.Win32.D3D/cartridge/CART_IMG.PRG
Steem.SSE.4.1.2.Win32.D3D/cartridge/MV16_SSE.stc
Steem.SSE.4.1.2.Win32.D3D/cartridge/Replay16_SSE.stc
Steem.SSE.4.1.2.Win32.D3D/doc/Bugs.rtf
.rtf
Steem.SSE.4.1.2.Win32.D3D/doc/FAQ (SSE).rtf
.rtf
Steem.SSE.4.1.2.Win32.D3D/doc/Hints.rtf
.rtf
Steem.SSE.4.1.2.Win32.D3D/doc/STG specification.txt
Steem.SSE.4.1.2.Win32.D3D/doc/STW specification.txt
Steem.SSE.4.1.2.Win32.D3D/doc/STW v2 specification.txt
.vbs
Steem.SSE.4.1.2.Win32.D3D/doc/Steem SSE Manual.rtf
.rtf
Steem.SSE.4.1.2.Win32.D3D/doc/cart image howto.txt
Steem.SSE.4.1.2.Win32.D3D/doc/disk image howto.txt
Steem.SSE.4.1.2.Win32.D3D/doc/disk image list.txt
Steem.SSE.4.1.2.Win32.D3D/doc/faq.txt
Steem.SSE.4.1.2.Win32.D3D/doc/gpl-3.0.txt
Steem.SSE.4.1.2.Win32.D3D/doc/links.rtf
.rtf
Steem.SSE.4.1.2.Win32.D3D/doc/readme.txt
Steem.SSE.4.1.2.Win32.D3D/doc/steem sse linux readme.txt
Steem.SSE.4.1.2.Win32.D3D/keyboard/ST UK KBD.gif
.gif
Steem.SSE.4.1.2.Win32.D3D/keyboard/ST keys.png
.png

Password: infected
Steem.SSE.4.1.2.Win32.D3D/keyboard/keyboard_DE_DETOS.ini
Steem.SSE.4.1.2.Win32.D3D/keyboard/keyboard_DE_GAME.ini
Steem.SSE.4.1.2.Win32.D3D/keyboard/keyboard_DE_UKTOS.ini
Steem.SSE.4.1.2.Win32.D3D/keyboard/keyboard_FR_FRTOS.ini
Steem.SSE.4.1.2.Win32.D3D/keyboard/keyboard_FR_GAME.ini
Steem.SSE.4.1.2.Win32.D3D/keyboard/keyboard_FR_UKTOS.ini
Steem.SSE.4.1.2.Win32.D3D/keyboard/keyboard_UK_USTOS.ini
Steem.SSE.4.1.2.Win32.D3D/keyboard/keyboard_US_UKTOS.ini
Steem.SSE.4.1.2.Win32.D3D/patches/Alcatraz.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Archipelagos SCP STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Archipelagos STX STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/BIG Demo.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Battle Hawks 1942 STX STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Carrier Command SCP.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Carrier Command STX.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Celica GT Rally STX STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Chess Player 2150 FR STX STE.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Chrono Quest.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Corporation Megademo.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Cougar Force STX STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Cricket Captain T100.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Cricket Captain T102.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Cricket Captain T162.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Cuddly Demo - Spreadpoint.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Cuddly Demo STE.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Delirious4 STE.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Dragons Breath STX STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Dynabusters+.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Elite STX.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Explora II FR.stp
Steem.SSE.4.1.2.Win32.D3D/patches/F15 II STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Flood STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Formula One Grand Prix.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Galactic Empire STX STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Gauntlet III STE.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Gauntlet III STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Goldrunner.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Grand Monster Slam.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Great Courts STX.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Guild of Thieves STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Gunship SCP STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Gunship STX.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Heroquest STX.stp
Steem.SSE.4.1.2.Win32.D3D/patches/International 3D Tennis.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Jinxter STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Jupiter's Masterdrive STX.stp
Steem.SSE.4.1.2.Win32.D3D/patches/KCD001 STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Killerball.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Leviathan STX.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Lin Wu's Challenge.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Live and Let Die.stp
Steem.SSE.4.1.2.Win32.D3D/patches/MP_GolfDepr.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Masterblazer SCP.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Miami Vice STE.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Miami Vice STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Monkey Island.stp
Steem.SSE.4.1.2.Win32.D3D/patches/NVDI5 install.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Nightdawn.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Panic.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Populous II-TRSI intro.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Powerdrome STX STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Prohibition STX 1.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Prohibition STX 2.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Prohibition STX 3.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Psygnosis Games.stp
Steem.SSE.4.1.2.Win32.D3D/patches/RVF Honda STX.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Rainbow Islands (Automation).stp
Steem.SSE.4.1.2.Win32.D3D/patches/Rainbow Warrior.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Rambo III (Automation).stp
Steem.SSE.4.1.2.Win32.D3D/patches/SoWatt Demo.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Starglider 2 STX.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Substation.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Super Monaco GP (Superior).stp
Steem.SSE.4.1.2.Win32.D3D/patches/TeenageMutantHeroTurtles.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Trauma.stp
Steem.SSE.4.1.2.Win32.D3D/patches/UMS STX STF.stp
Steem.SSE.4.1.2.Win32.D3D/patches/Warzone (D-Bug).stp
Steem.SSE.4.1.2.Win32.D3D/patches/Yogi's Great Escape.stp
Steem.SSE.4.1.2.Win32.D3D/patches/risky_woods_eoa stx STF.stp
Steem.SSE.4.1.2.Win32.D3D/plugins32/ArchiveAccess.dll
.dll windows:5 windows x86 arch:x86

Password: infected

610b9e5477d137cf333fc8e65ebe682a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

CharPrevExA
CharLowerW
CharUpperW

kernel32

GetFileTime
GetFileAttributesW
CreateFileW
CloseHandle
ReadFile
SetFilePointerEx
WriteFile
SetFilePointer
LocalFileTimeToFileTime
FileTimeToLocalFileTime
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
GetTickCount
MultiByteToWideChar
WideCharToMultiByte
SetFileAttributesW
DeleteFileW
GetTempPathW
GetTempFileNameW
GetLastError
FileTimeToSystemTime
GetSystemInfo
GetProcAddress
GetModuleHandleW
DosDateTimeToFileTime
FileTimeToDosDateTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetConsoleMode
GetStdHandle
VirtualAlloc
VirtualFree
GetFileSize
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
GetVersionExW
RaiseException
HeapFree
HeapReAlloc
HeapAlloc
ExitThread
CreateThread
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
Sleep
HeapSize
ExitProcess
GetConsoleCP
FlushFileBuffers
HeapCreate
HeapDestroy
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
LoadLibraryA
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
WaitForSingleObject
RtlUnwind

oleaut32

SysAllocString
SysAllocStringByteLen
VariantClear
VariantCopy
SysFreeString

Exports

Exports

aaAddFile
aaCloseArchive
aaCreateArchiveFile
aaDetermineArchiveType
aaExtract
aaExtractAll
aaExtractMultiple
aaGetFileCount
aaGetFileInfo
aaGetOwner
aaOpenArchive
aaOpenArchiveFile
aaSetOwner

Sections

.text
Size: 459KB - Virtual size: 459KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Steem.SSE.4.1.2.Win32.D3D/plugins32/CAPSImg.dll
.dll windows:5 windows x86 arch:x86

Password: infected

74b2558b2ede1a76aa1344c6f497382b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\WORK\SPStudio_Dev\Release\CAPSImg.pdb

Imports

kernel32

EncodePointer
DecodePointer
ReadFile
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
HeapFree
HeapAlloc
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
CloseHandle
SetFilePointerEx
GetConsoleMode
ReadConsoleW
WriteFile
GetConsoleCP
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetProcAddress
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetProcessHeap
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapSize
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
FlushFileBuffers
WriteConsoleW
LoadLibraryExW
OutputDebugStringW
GetStringTypeW
HeapReAlloc
CreateFileW
SetEndOfFile

Exports

Exports

CAPSAddImage
CAPSExit
CAPSFdcEmulate
CAPSFdcGetInfo
CAPSFdcInit
CAPSFdcInvalidateTrack
CAPSFdcRead
CAPSFdcReset
CAPSFdcWrite
CAPSFormatDataToMFM
CAPSGetDebugRequest
CAPSGetImageInfo
CAPSGetImageType
CAPSGetImageTypeMemory
CAPSGetInfo
CAPSGetPlatformName
CAPSGetVersionInfo
CAPSInit
CAPSLoadImage
CAPSLockImage
CAPSLockImageMemory
CAPSLockTrack
CAPSRemImage
CAPSSetRevolution
CAPSUnlockAllTracks
CAPSUnlockImage
CAPSUnlockTrack

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Steem.SSE.4.1.2.Win32.D3D/plugins32/Steem_settings.txt
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX readme.txt
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/AdvancedCRT.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/Bloom.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/Border.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/CRT.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/Cartoon.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/Curves.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/DPX.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/Dither.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/FXAA.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/FXAA_DX11.fx
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/FXAA_DX9.fx
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/HDR.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/LiftGammaGain.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/LumaSharpen.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/Main.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/Monochrome.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/SMAA.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/SMAA_DX11.fx
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/SMAA_DX9.fx
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/Sepia.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/Splitscreen.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/TVLevels.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/Technicolor.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/Tonemap.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/Vibrance.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX/Shaders/Vignette.h
Steem.SSE.4.1.2.Win32.D3D/plugins32/SweetFX_preset.txt
Steem.SSE.4.1.2.Win32.D3D/plugins32/d3d9.fx
Steem.SSE.4.1.2.Win32.D3D/plugins32/d3d9sweetfx.dll
.dll windows:5 windows x86 arch:x86

Password: infected

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

D3DPERF_BeginEvent
D3DPERF_EndEvent
D3DPERF_GetStatus
D3DPERF_QueryRepeatFrame
D3DPERF_SetMarker
D3DPERF_SetOptions
D3DPERF_SetRegion
Direct3DCreate9

Sections

UPX0
Size: - Virtual size: 188KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 57KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Steem.SSE.4.1.2.Win32.D3D/plugins32/injector.ini
Steem.SSE.4.1.2.Win32.D3D/plugins32/pasti.dll
.dll windows:5 windows x86 arch:x86

Password: infected

ad15fa3d443cea50686a9fe39df31070

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

comctl32

PropertySheetA

kernel32

GetFileSize
CreateFileA
SetEndOfFile
SetFilePointer
CloseHandle
GetProcessHeap
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetTickCount
HeapSize
HeapAlloc
GetLastError
HeapReAlloc
HeapFree
GetCurrentThreadId
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
MultiByteToWideChar
ReadFile
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
RtlUnwind
VirtualFree
VirtualAlloc
HeapCreate
HeapDestroy
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
InitializeCriticalSectionAndSpinCount
LoadLibraryA

user32

GetDlgItemTextA
GetDlgItemInt
GetWindowLongA
SetWindowLongA
IsDlgButtonChecked
SendDlgItemMessageA
GetDlgItem
CheckDlgButton
DialogBoxParamA
EndDialog
SetDlgItemTextA
SetDlgItemInt
wsprintfA
SendMessageA
MessageBoxA

comdlg32

GetOpenFileNameA

Exports

Exports

pastiBreakpoint
pastiConfig
pastiDlgBreakpoint
pastiDlgConfig
pastiDlgFileProps
pastiDlgStatus
pastiEject
pastiExtra
pastiGetBootSector
pastiGetConfig
pastiGetFileExtensions
pastiGetLastError
pastiHwReset
pastiImgLoad
pastiInit
pastiIo
pastiLoadConfig
pastiLoadState
pastiPeek
pastiSaveConfig
pastiSaveImg
pastiSaveState
pastiWritePorta

Sections

.text
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Steem.SSE.4.1.2.Win32.D3D/plugins32/unrar.dll
.dll windows:5 windows x86 arch:x86

Password: infected

ff840ac27f415ddd3b9178f3d3318fbe

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:95:3f:a5:4d:d1:2d:d9:ca:6b:94:8c:17:bf:d6:7c
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/06/2013, 00:00

Not After

13/06/2015, 23:59

Subject

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Schumannstr. 17,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

aa:5a:5f:24:06:d2:5c:dc:e0:28:8e:61:ec:c0:9a:44:11:aa:67:7f
Signer

Actual PE Digest

aa:5a:5f:24:06:d2:5c:dc:e0:28:8e:61:ec:c0:9a:44:11:aa:67:7f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\WinRAR\rar\build\unrardll32\Release\unrar.pdb

Imports

kernel32

CreateHardLinkW
SetFileTime
DeleteFileW
RemoveDirectoryW
DeviceIoControl
CreateDirectoryW
CreateFileW
MoveFileW
GetShortPathNameW
GetLongPathNameW
WriteFile
SetFilePointer
SetEndOfFile
ReadFile
FlushFileBuffers
GetFileAttributesW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcessId
GetModuleHandleW
SetThreadPriority
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateThread
WaitForSingleObject
GetProcessAffinityMask
CreateEventW
CreateSemaphoreW
ReleaseSemaphore
ResetEvent
SetEvent
SystemTimeToFileTime
GetSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
LocalFileTimeToFileTime
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
IsDBCSLeadByte
GetCPInfo
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
GetLocaleInfoA
CloseHandle
Sleep
SetLastError
GetLastError
AreFileApisANSI
GetStdHandle
GetFileType
GetConsoleMode
GetStringTypeW
RtlUnwind
HeapFree
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
RaiseException
ExitProcess
GetCurrentThreadId
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetStartupInfoA
SetStdHandle
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapSize
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetConsoleCP
GetStringTypeA

user32

CharUpperW
CharLowerW
CharToOemBuffW
CharToOemA
OemToCharBuffA
OemToCharA

advapi32

SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

Exports

Exports

RARCloseArchive
RARGetDllVersion
RAROpenArchive
RAROpenArchiveEx
RARProcessFile
RARProcessFileW
RARReadHeader
RARReadHeaderEx
RARSetCallback
RARSetChangeVolProc
RARSetPassword
RARSetProcessDataProc

Sections

.text
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Steem.SSE.4.1.2.Win32.D3D/plugins32/unzipd32.dll
.dll windows:1 windows x86 arch:x86

Password: infected

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

CloseZipFile
GetFirstInZip
GetNextInZip
GetSupportedMethods
GetUnzipDllVersion
UnzipTestIntegrity
isZip
unzipfile
unzipfiletomemory

Sections

CODE
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 275B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Steem.SSE.4.1.2.Win32.D3D/startup.jpg
.jpg

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

5310c8f23ffbc98e2ab144dedb93ae60

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winmm

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

msvcr90

d3d9

d3dx9_43

psapi

Sections

.text Size: 922KB - Virtual size: 921KB

.rdata Size: 104KB - Virtual size: 104KB

.data Size: 9KB - Virtual size: 385KB

.rsrc Size: 280KB - Virtual size: 280KB

Password: infected

Password: infected

610b9e5477d137cf333fc8e65ebe682a

Headers

File Characteristics

Imports

user32

kernel32

oleaut32

Exports

Exports

Sections

.text Size: 459KB - Virtual size: 459KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 16KB - Virtual size: 42KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 28KB - Virtual size: 27KB

Password: infected

74b2558b2ede1a76aa1344c6f497382b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 108KB - Virtual size: 107KB

.rdata Size: 29KB - Virtual size: 28KB

.data Size: 6KB - Virtual size: 20KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 6KB - Virtual size: 6KB

Password: infected

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 188KB

UPX1 Size: 57KB - Virtual size: 60KB

.rsrc Size: 1KB - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 30KB - Virtual size: 29KB

.rdata Size: 190KB - Virtual size: 190KB

.text
Size: 922KB - Virtual size: 921KB

.rdata
Size: 104KB - Virtual size: 104KB

.data
Size: 9KB - Virtual size: 385KB

.rsrc
Size: 280KB - Virtual size: 280KB

.text
Size: 459KB - Virtual size: 459KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 16KB - Virtual size: 42KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 28KB - Virtual size: 27KB

.text
Size: 108KB - Virtual size: 107KB

.rdata
Size: 29KB - Virtual size: 28KB

.data
Size: 6KB - Virtual size: 20KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 6KB - Virtual size: 6KB

UPX0
Size: - Virtual size: 188KB

UPX1
Size: 57KB - Virtual size: 60KB

.rsrc
Size: 1KB - Virtual size: 4KB

.text
Size: 30KB - Virtual size: 29KB

.rdata
Size: 190KB - Virtual size: 190KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 84KB - Virtual size: 83KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 6KB - Virtual size: 35KB

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 9KB - Virtual size: 8KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

75:95:3f:a5:4d:d1:2d:d9:ca:6b:94:8c:17:bf:d6:7c
Certificate

aa:5a:5f:24:06:d2:5c:dc:e0:28:8e:61:ec:c0:9a:44:11:aa:67:7f
Signer

.text
Size: 173KB - Virtual size: 173KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 6KB - Virtual size: 37KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 9KB - Virtual size: 9KB

CODE
Size: 38KB - Virtual size: 38KB

DATA
Size: 3KB - Virtual size: 2KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 1KB - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 275B

.reloc
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 3KB - Virtual size: 3KB