heroes-of-might-and-magic-3-platinum-collection-v40-russian-no-cdfixed-exe[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

heroes-of-might-and-magic-3-platinum-collection-v40-russian-no-cdfixed-exe.rar
Size

924KB
MD5

8ed2a8aa55fad106edb4fe7136ec68e1
SHA1

75ba30f0a6a82adb69e3355df8bc578a60772126
SHA256

a3b6c975f91fd07904d0fc7c6e09be2b009295f1839c6674b296f3f5835bc17a
SHA512

f62af045efdb6dc84894e695336e2133d4681cb0d950297938704808d1adc823198da021f1ef9ac6835f325a248f461f90f5132ac116ccbb6522a25bd921743c
SSDEEP

24576:OuHkCZqPyxEerdBWCU0j5L/oR9iCiFwy4nA:OWZaei0aR+wy4nA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Heroes3.exe

Files

heroes-of-might-and-magic-3-platinum-collection-v40-russian-no-cdfixed-exe.rar
.7z

Password: lonebullet
heroes-of-might-and-magic-3-platinum-collection-v40-russian-no-cdfixed-exe.rar
.rar

Password: lonebullet
Heroes3.exe
.exe windows:4 windows x86 arch:x86

Password: lonebullet

8a74a2e659e2bd3bba0cfdfeb00c18b4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

winmm

timeEndPeriod
timeBeginPeriod
mciSendStringA
timeGetTime

mss32

_AIL_pause_stream@8
_AIL_set_stream_loop_count@8
_AIL_stream_position@4
_AIL_sample_status@4
_AIL_stop_sample@4
_AIL_set_sample_volume@8
_AIL_start_sample@4
_AIL_sample_volume@4
_AIL_service_stream@8
_AIL_set_sample_loop_count@8
_AIL_set_sample_file@12
_AIL_init_sample@4
_AIL_set_stream_position@8
_AIL_start_stream@4
_AIL_stream_volume@4
_AIL_stream_status@4
_AIL_serve@0
_AIL_set_stream_volume@8
_AIL_allocate_sample_handle@4
_AIL_waveOutClose@4
_AIL_get_preference@4
_AIL_resume_sample@4
_AIL_open_stream@12
_AIL_close_stream@4
_AIL_end_sample@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_preference@8
_AIL_HWND@0
_AIL_waveOutOpen@16
_AIL_digital_configuration@16

smackw32

_SmackUseMMX@4
_SmackNextFrame@4
_SmackWait@4
_SmackGoto@8
_SmackVolumePan@16
_SmackClose@4
_SmackToBuffer@28
_SmackSoundUseMSS@4
_SmackOpen@12
_SmackDoFrame@4
_SmackToBufferRect@8

ddraw

DirectDrawCreate

wsock32

closesocket
inet_addr
gethostbyname
WSAStartup
socket
htons
htonl
bind
inet_ntoa
gethostname

kernel32

GetCommandLineA
Sleep
SetFilePointer
GetCurrentDirectoryA
GlobalLock
GlobalAlloc
DeleteCriticalSection
CloseHandle
GetLastError
CreateEventA
GetDriveTypeA
GetLogicalDrives
GetDiskFreeSpaceA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
DeleteFileA
GetVersionExA
ReadFile
WaitForSingleObject
SetEvent
GetModuleFileNameA
GetFileTime
CreateFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesA
WriteFile
FindClose
FindFirstFileA
FindNextFileA
GetStartupInfoA
GetModuleHandleA
ResumeThread
ExitThread
TlsSetValue
CreateThread
GetFileType
GetLocalTime
GetSystemTime
LCMapStringA
HeapFree
SetCurrentDirectoryA
SetEnvironmentVariableA
HeapAlloc
HeapReAlloc
GetCurrentProcess
TerminateProcess
ExitProcess
GetFullPathNameA
RtlUnwind
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
RaiseException
OpenFile
_llseek
_lread
_lclose
IsBadReadPtr
GlobalHandle
GlobalUnlock
GlobalFree
GetVersion
LoadLibraryA
GetProcAddress
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
TlsAlloc
SetLastError
TlsGetValue
GetUserDefaultLCID
GetStringTypeA
GetStringTypeW
EnumSystemLocalesA
HeapDestroy
IsValidCodePage
IsValidLocale
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadCodePtr
GetACP
SetEndOfFile
SetStdHandle
HeapCreate
GetOEMCP
GetLocaleInfoW
SetUnhandledExceptionFilter
HeapSize
FlushFileBuffers
SetHandleCount
GetStdHandle
VirtualFree
VirtualAlloc
IsBadWritePtr
GetEnvironmentVariableA
GetTimeZoneInformation
GetLocaleInfoA

user32

SetCapture
PostMessageA
LoadMenuA
ReleaseCapture
ShowWindow
IsIconic
CheckMenuItem
ClientToScreen
OffsetRect
MessageBoxA
SetForegroundWindow
PeekMessageA
BeginPaint
GetClientRect
EndPaint
AdjustWindowRectEx
MoveWindow
GetDC
ReleaseDC
SetWindowLongA
GetForegroundWindow
MessageBeep
GetWindowThreadProcessId
GetCursorPos
ScreenToClient
UnionRect
IsRectEmpty
ShowCursor
wsprintfA
IntersectRect
GetMenuItemCount
GetMenuItemID
GetSubMenu
EnableMenuItem
DrawMenuBar
EndDialog
DialogBoxParamA
GetDesktopWindow
WinHelpA
GetMessageA
TranslateMessage
DispatchMessageA
DestroyMenu
GetWindowLongA
GetWindowRect
DestroyWindow
PostQuitMessage
DefWindowProcA
LoadIconA
RegisterClassA
AdjustWindowRect
CreateWindowExA
LoadCursorA
SetCursor
SetMenu
GetKeyState

gdi32

CreateCompatibleDC
SelectObject
DeleteDC
DeleteObject
GetDeviceCaps
GdiSetBatchLimit

advapi32

RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyA

shell32

ShellExecuteA

ole32

CoInitialize
CoCreateInstance

binkw32

_BinkNextFrame@4
_BinkGoto@12
_BinkDoFrame@4
_BinkGetSummary@8
_BinkWait@4
_BinkCopyToBuffer@28
_BinkDDSurfaceType@4
_BinkPause@8
_BinkClose@4
_BinkOpen@8
_BinkGetRects@8
_BinkSetSoundSystem@8
_BinkOpenMiles@4

ifc20

?reset@CImmMouse@@MAEXXZ
?SwitchToAbsoluteMode@CImmMouse@@UAEHH@Z
?ChangeScreenResolution@CImmMouse@@UAEHHKK@Z
?GetDevice@CImmMouse@@UAEPAUIFeelitDevice@@XZ
?GetAPI@CImmMouse@@UAEPAUIFeelit@@XZ
?LoadProjectFromMemory@CImmProject@@QAEHPAXPAVCImmDevice@@@Z
?Initialize@CImmMouse@@QAEHPAX0K@Z
??0CImmMouse@@QAE@XZ
?m_dwErrHandlingFlags@CIFCErrors@@0KA
??1CImmMouse@@UAE@XZ
??1CImmProject@@QAE@XZ
?Close@CImmProject@@QAEXXZ
?SetRect@CImmEnclosure@@QAEHPBUtagRECT@@@Z
?Start@CImmCompoundEffect@@QAEHKK@Z
?CreateEffect@CImmProject@@QAEPAVCImmCompoundEffect@@PBDPAVCImmDevice@@K@Z
?DestroyEffect@CImmProject@@QAEXPAVCImmCompoundEffect@@@Z
?Start@CImmEnclosure@@UAEHK@Z
?Stop@CImmEnclosure@@UAEHXZ
?Start@CImmEffect@@UAEHKKH@Z
?InitializeFromProject@CImmEffect@@UAEHAAVCImmProject@@PBDPAVCImmDevice@@K@Z
?Initialize@CImmEnclosure@@UAEHPAVCImmDevice@@ABUFEELIT_EFFECT@@K@Z
?GetIsCompatibleGUID@CImmEnclosure@@UAEHAAU_GUID@@@Z
?Initialize@CImmEnclosure@@QAEHPAVCImmDevice@@PBUtagRECT@@JJKKKKKKPAVCImmEffect@@JK@Z
??0CImmEnclosure@@QAE@XZ
??1CImmEnclosure@@UAE@XZ
?prepare_device@CImmMouse@@MAEHXZ

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 216KB - Virtual size: 325KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: lonebullet

Password: lonebullet

Password: lonebullet

8a74a2e659e2bd3bba0cfdfeb00c18b4

Headers

File Characteristics

Imports

version

winmm

mss32

smackw32

ddraw

wsock32

kernel32

user32

gdi32

advapi32

shell32

ole32

binkw32

ifc20

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 144KB - Virtual size: 140KB

.data Size: 216KB - Virtual size: 325KB

.rsrc Size: 36KB - Virtual size: 33KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 144KB - Virtual size: 140KB

.data
Size: 216KB - Virtual size: 325KB

.rsrc
Size: 36KB - Virtual size: 33KB