C&C Generals Zero Hour Contra009 v1[.]04 Plus +22 Trainer[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

C&C Generals Zero Hour Contra009 v1.04 Plus +22 Trainer.exe
Size

1.1MB
MD5

d1d09940ce597fc448a5ad9db6fc617f
SHA1

f1f85033fa3e6cfa08ef744d6e2d201b43cadfde
SHA256

af57071d8c1d84366e9e8671b6f855e204de8b737ed62cb92cbf410587e74edf
SHA512

2e2b836a1a67fd1c773f6ddb7dd35ed3d5d13c650be698ad022e67fd6770984711418e0efdcae7990df6c361af58fd0fe6507c12fe74d1d0117b8de4a287c6fd
SSDEEP

24576:RCSpeflT7/QYwrYYJZ8/RK/3wwHQvzzwKsvM:RCSOT7/QgRK/3w5AKm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
C&C Generals Zero Hour Contra009 v1.04 Plus +22 Trainer.exe

Files

C&C Generals Zero Hour Contra009 v1.04 Plus +22 Trainer.exe
.exe windows:5 windows x64 arch:x64

15006372021a18ee31abab31a337ae86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAllocEx
VirtualFreeEx
VirtualProtectEx
VirtualQueryEx
SetProcessWorkingSetSize
OpenProcess
GetCurrentProcessId
ReadProcessMemory
WriteProcessMemory
Sleep
CloseHandle
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
LocalFree

ole32

CoInitializeEx

oleaut32

SafeArrayCreateVector
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate

msvcp110

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Getcoll
_Strcoll
_Strxfrm
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
??Bid@locale@std@@QEAA_KXZ
??0facet@locale@std@@IEAA@_K@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
_Xtime_get_ticks
??0_Pad@std@@QEAA@XZ
??1_Pad@std@@QEAA@XZ
?_Launch@_Pad@std@@QEAAXPEAU_Thrd_imp_t@@@Z
?_Release@_Pad@std@@QEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??_7_Facet_base@std@@6B@
??_7facet@locale@std@@6B@
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z

mscoree

CLRCreateInstance

msvcr110

??2@YAPEAX_K@Z
??3@YAXPEAX@Z
strtol
free
realloc
memmove
strchr
_purecall
??0bad_cast@std@@QEAA@PEBD@Z
??0bad_cast@std@@QEAA@AEBV01@@Z
??0exception@std@@QEAA@AEBV01@@Z
??1bad_cast@std@@UEAA@XZ
_CxxThrowException
__CxxFrameHandler3
memcmp
memcpy
memset
_lock
_unlock
_calloc_crt
__dllonexit
__C_specific_handler
_onexit
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_wcmdln
_fmode
_commode
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCapturePreviousContext
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crtSetUnhandledExceptionFilter
?terminate@@YAXXZ

Exports

Exports

Sections

qlbwi
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

pmaujn
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

rocxh
Size: 978KB - Virtual size: 979KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

skdygt
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

vfezk
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

pnaujo
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15006372021a18ee31abab31a337ae86

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

oleaut32

msvcp110

mscoree

msvcr110

Exports

Exports

Sections

qlbwi Size: 62KB - Virtual size: 62KB

pmaujn Size: 21KB - Virtual size: 21KB

rocxh Size: 978KB - Virtual size: 979KB

skdygt Size: 4KB - Virtual size: 4KB

vfezk Size: 16KB - Virtual size: 16KB

pnaujo Size: 2KB - Virtual size: 1KB

qlbwi
Size: 62KB - Virtual size: 62KB

pmaujn
Size: 21KB - Virtual size: 21KB

rocxh
Size: 978KB - Virtual size: 979KB

skdygt
Size: 4KB - Virtual size: 4KB

vfezk
Size: 16KB - Virtual size: 16KB

pnaujo
Size: 2KB - Virtual size: 1KB