d397b2e532ba4e7388e55bd16be2cea7fb58c4ea8e2d0ec76332c76b00294eb8.rar
- SHA256 d397b2e532ba4e7388e55bd16be2cea7fb58c4ea8e2d0ec76332c76b00294eb8
Behavioral task
behavioral1
Sample
2022年全部热门单机游戏及汉化下载.url
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2022年全部热门单机游戏及汉化下载.url
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Resident Evil 3 v1.0-v20220613 Plus 20 Trainer.exe
Resource
win10v2004-20260129-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Resident Evil 3 v1.0-v20220613 Plus 20 Trainer.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
www.3dmgame.com.url
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral6
Sample
www.3dmgame.com.url
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target d397b2e532ba4e7388e55bd16be2cea7fb58c4ea8e2d0ec76332c76b00294eb8.rar
- Size 709KB
- Sample260321-sdp41sfy8v
- SHA256 d397b2e532ba4e7388e55bd16be2cea7fb58c4ea8e2d0ec76332c76b00294eb8
- MD5 ce4674d1fa716b917350e72e3200dc9f
- SHA1 b9a73cbb26bfc01f51c35fd7e315831df4972e68
- SHA512 d913fd28b65493fd3c52fad1b47a09c6f515464369478f4f20d210d2bdcdc68fcd71d41f3d1336b5a64dcdf87e00e359493de39bb5c5a87722e541cbae241ed9
- SSDEEP 12288:GBBix82kYyVFE7GwDgM8zjhu/qR01hiAFi8E+0GjQUh8XdpnqEoK3GpVx6A:GT52ZGE7GWf8zGqReiecAvh8Xdg63G3N
- TLSH T1CEF423610AD829621FCEADF3ECAA5E10A047025646DF71D23EE16AF5BC05CD0E99B7C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- R77 family
- r77 rootkit payload 1 IoCs
Detects the payload of the r77 rootkit.
resource yara_rule static1/unpack001/Resident Evil 3 v1.0-v20220613 Plus 20 Trainer.exe r77_payload - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Resident Evil 3 v1.0-v20220613 Plus 20 Trainer.exe
File Explorer
-
d397b2e532ba4e7388e55bd16be2cea7fb58c4ea8e2d0ec76332c76b00294eb8.rar.rar 709KB
-
2022年全部热门单机游戏及汉化下载.url.url 147B
-
Resident Evil 3 v1.0-v20220613 Plus 20 Trainer.exe.exe 1.2MB
-
www.3dmgame.com.url122B
-
说明.txt2KB
2022年全部热门单机游戏及汉化下载.url
- SHA256 49d2095c4d0017c5ecefce4aa579485ff1773643c0dc4f6c59d3fec906465003
- MD5 f4f991d2ab8c37612a931518f0e84fe2
- SHA1 bc468d41d0ac8170663be3f2f3004fba4f3e539d
- SHA512 a0fac66c4e6ccd569ce000946d6d8d53fd0649f60f8baa6dc69abbf15c465d0e588f3c4075e957d1d42ce86af3b11a48b6503a58a76e57bdc50898a2cac3f4fd
- TLSH T157C08C6F094681A5C311580650E1FC08E40F79A0ACD1804CA5A4CAAB5C990E2C444A3D
- MD5 SHA1 SHA512 TLSH
Resident Evil 3 v1.0-v20220613 Plus 20 Trainer.exe
- IMPHASH 99dde9683e2c2f1aa87a0ae0b5b0d41c
- SHA256 88a7ce087dc7f012fd1c9ff9f9713463161e91f1505afd82dedd3384cadf1fdf
- MD5 87ff89ecb0eec5e8857eec6a3ce8b6ab
- SHA1 a64768f9e7912e84238f4083199a132b771b7bf9
- SHA512 4ef4b92d7a1618ed3e7ecdf2c46c7845ae6fa34f79558d4655b9c3102f8cd665096bde2edccb6bcf578499c7ca1ee40bff80388f012874c5bfac65be9c599477
- SSDEEP 24576:osIV0SK7h5Yy4rxUMhWpOlZAb6utlJVdeeWIguOL+4nDS2bJ7:oR0V49USWz6ZfjL+4lV7
- TLSH T15055BF5A67A406FDE067A13C89538906E3BA78060B71DADF03A0437E2F677D15E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
r77 rootkit payload
Detects the payload of the r77 rootkit.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
209344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCurrentProcessId
LoadLibraryW
GetProcAddress
WaitNamedPipeW
GetLastError
CreateFileW
ReadFile
WriteFile
GetModuleHandleA
LoadLibraryA
GetPrivateProfileStringW
WritePrivateProfileStringW
GetModuleHandleW
FindResourceW
LoadResource
SizeofResource
LockResource
Sleep
GetModuleFileNameW
LoadLibraryExW
FreeLibrary
MultiByteToWideChar
GetCurrentProcess
IsWow64Process
SetLastError
ResumeThread
WaitForSingleObject
GetFileSizeEx
LocalFree
GetTempPathW
CreateDirectoryW
WriteConsoleW
HeapSize
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetFileAttributesW
CloseHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
WideCharToMultiByte
GetStringTypeW
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
HeapFree
HeapAlloc
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
CompareStringW
LCMapStringW
GetLocaleInfoW
user32
MessageBoxA
MessageBoxW
advapi32
SetEntriesInAclW
ConvertStringSidToSidW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
shell32
SHGetFolderPathW
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
SafeArrayDestroy
mscoree
CorBindToRuntime
CLRCreateInstance
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
winmm
PlaySoundW
Name
.text
Size
369KB
Virtual Size
369KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
738KB
Virtual Size
738KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=185, id=261, version=30795,
count=18, id=260, version=30795,
count=17, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=10, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=91, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=17, id=257, version=30795,
count=191, id=1, productName=Unmarked objects,
count=17, id=265, version=31329,
count=1, id=255, version=31329,
count=1, id=151,
count=1, id=258, version=31329,
www.3dmgame.com.url
- SHA256 03df27e82600098c34c413cc2e45b43638d3ac33666960cfbd913f1c3f9a0b11
- MD5 49cbfed4fa9b3fafdc9d499b6163fa62
- SHA1 28decd9138bd3f7b3ef38bf9e40cd0d6305d1cdb
- SHA512 64e91ed564ef64d7687599012c4728b811fec2661dcb7941374cdd3a8450563073c67c452d97d43545f49182fbda2c26702dd35088723ace21717282d1233627
- TLSH T14BB0129C5B46C09AD371D81A70F0FD09E80EB9F048C2D4DC76D0DD9F2C950D1D54AB2A
- MD5 SHA1 SHA512 TLSH
说明.txt
- SHA256 debc191cdfb1a44b04dd5b79063e48930cb05c34ac664b12c32967170d9e961f
- MD5 11abd170c3259e7582692ec38f4cc7f1
- SHA1 f1f3aaeef909bcc8788612bc1d135ee6d26db41d
- SHA512 dc9c26af6db34fdc80156917e881e148e8f95deb47bad50b8cc09c4e94f7f30823ffb8f8630652cf7107e59fd49571fd7476ea390fe9c784300fb9e1bbeec9a4
- TLSH T16F51E002DE8DB20530A8416026DA94D3D32F55C1822EDF4449D9AFE477D75423DCBFDA
- MD5 SHA1 SHA512 TLSH