aura[.]lol cracked[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
aura.lol cracked.rar
Size 550KB
Sample260827-me35dashkc
SHA256 7d985233323111ecbde1549ce6137cda1d129ed7fd0aef926b6c579112c0c566
MD5 2e33299a64fa65ea648f53a81cc76b96
SHA1 d49c4855da44758d31c9a352616168eaed5fd7fb
SHA512 f9e36505121721d3ccd7edc299148f602690eb180c70f8c09a355109d7fb06cd25b6810a0fbcd866a526988adf808e5dd956add3dc4bbc5679200094add05d21
SSDEEP 12288:niMpJrWzrdg0zPmZGsvegoOYIuGWhtopEyPI3KoJwzGR7glGEF:niMpJercvNoOYIP6ep3zoJ1glGa
TLSH
T14AC423DB68BA7348A5DBD27BBB424BE6910A87D7F568D03B075CCB6600067C6FB1814C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/aura.lol cracked/Mapper.exe
unpack001/aura.lol cracked/aura.loader.exe
unpack001/aura.lol cracked/aura.lol cracked by dwmxs.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/aura.lol cracked/BeDaisy.sys

File Explorer

aura.lol cracked.rar

.rar 550KB
aura.lol cracked/BeDaisy.sys

.sys 19KB
aura.lol cracked/Mapper.exe

.exe 150KB
aura.lol cracked/aura.loader.exe

.exe 13KB
aura.lol cracked/aura.lol cracked by dwmxs.exe

.exe 1.6MB

aura.lol cracked.rar

SHA256 7d985233323111ecbde1549ce6137cda1d129ed7fd0aef926b6c579112c0c566
MD5 2e33299a64fa65ea648f53a81cc76b96
SHA1 d49c4855da44758d31c9a352616168eaed5fd7fb
SHA512 f9e36505121721d3ccd7edc299148f602690eb180c70f8c09a355109d7fb06cd25b6810a0fbcd866a526988adf808e5dd956add3dc4bbc5679200094add05d21
SSDEEP 12288:niMpJrWzrdg0zPmZGsvegoOYIuGWhtopEyPI3KoJwzGR7glGEF:niMpJercvNoOYIP6ep3zoJ1glGa
TLSH
T14AC423DB68BA7348A5DBD27BBB424BE6910A87D7F568D03B075CCB6600067C6FB1814C
MD5 SHA1 SHA512 SSDEEP TLSH

aura.lol cracked/BeDaisy.sys

IMPHASH 3803ac984b44d93e5b67a787365cd79f
SHA256 66604c370dd1a6ca8e5cc641024df8b3711171803677d210192d20c7aef4399d
MD5 8572f5c0ab214077e2de6b2bd0dcc8a8
SHA1 8963e25a5b31f107d491fdfde0285739552e9016
SHA512 660e838eabb48baeefc0e9df9086882e28da43268c9471e628789c4cb6a47bac01badfae94797acedbc6bafa700373cb7ecee2a65c938c1ca86c94866060c63f
SSDEEP 384:euregI48Iq1qhvYoP6MUMv5g5M/b0475aAJo/W:eSUi/UMvTJaAe/W
TLSH
T10D923DC3A39C58D5F31DC17B86661A27D2B1BC24275377DF0252C02A1797BE8763AB41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3d:e2:7b:3d:ec:f1:44:f0:70:1a:bf:b0:90:17:6e:9c:3a:82:26:9d:f3:43:d1:4f:3e:56:87:3f:6e:cb:3e:18

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TestCodeSign

Chains

Aug 26, 2026

CN=TestCodeSign

Minor OS version

Major OS version

Entry point

5216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Desktop\driver and inj\bin\Release\KernelDriver.pdb

aura.lol cracked/Mapper.exe

IMPHASH fe1529edef766e6c0d25b8ae1722ece5
SHA256 c2cab125d36caba39e6ff0ae83c68397e22317eff2944a6ed69d2236024a76c4
MD5 4c4e7925a787c82a817b040f009b6a61
SHA1 4f6e989829b07f2d3077bcb0ea6f8f09b8ac1b16
SHA512 c4f15fa3ed4510b5950f366c17e17ceacc4c7220c48f4e838dd07897ab566e624856bc893d53f65bac1d2f1f66759a89831555007816e70b24e80e2c08d74d0c
SSDEEP 3072:QQeuLZ8OB7/Us7sMDcFS0DzbskwBmJTQSaMm5/6YJvg8V:QgNpBDUs7ncFSQ31JWlj2M
TLSH
T1FAE32A1797A9106EF1B7D6B9CAB24A11EB717C550B74D2CF135048BA0F227D0BA3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\xavier\Downloads\kdmapper-master (2)\kdmapper-master\x64\Release\kdmapper_Release.pdb

kernel32

CloseHandle GetProcAddress GetCurrentProcessId CreateToolhelp32Snapshot Process32NextW Process32FirstW GetModuleHandleA GetTempPathW FormatMessageA GetLocaleInfoEx GetCurrentThreadId CreateFileW VirtualAlloc DeviceIoControl SetUnhandledExceptionFilter VirtualFree FindClose FindFirstFileW GetFileAttributesExW AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead LocalFree

user32

GetShellWindow GetWindowThreadProcessId

advapi32

RegCloseKey RegDeleteTreeW RegCreateKeyW RegOpenKeyW RegSetKeyValueW

msvcp140

?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

ntdll

NtLoadDriver NtUnloadDriver NtQuerySystemInformation RtlAdjustPrivilege RtlInitUnicodeString

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memcmp _CxxThrowException __std_terminate wcsstr __std_exception_copy __std_exception_destroy memset __current_exception_context __current_exception __C_specific_handler memmove

api-ms-win-crt-stdio-l1-1-0

_fseeki64 fread fsetpos ungetc _get_stream_buffer_pointers fputc setvbuf fgetpos fwrite _set_fmode __p__commode fgetc fflush fclose

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment _invoke_watson __p___wargv _get_initial_wide_environment _initterm _configure_wide_argv terminate _c_exit _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table __p___argc abort _register_thread_local_exe_atexit_callback _initterm_e _exit exit _set_app_type

api-ms-win-crt-filesystem-l1-1-0

_wremove _unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

_stricmp _wcsicmp

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

aura.lol cracked/aura.loader.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 74c2c3a204c9bdf82d08dcc123013290e545892bf94a906cd149a2e6098992cf
MD5 a4a9900b5def1d50ddc3019499bf0576
SHA1 25c0ae34d4faddfe1630fff834584d45e380ddff
SHA512 5e86fda325c619a29c49f07efb47f2dffc3a0a83054baa4e8e227ba9034c8fd09ed3b876528bb21e3b63ddb38013e48ba63c1f5a292e0b4538c0868865a83186
SSDEEP 96:DaOld4pS2w1lWZPLwu31HYv4Y709hgSkngljd1Z6mht5bOVLNoLJmLJILENKzgHN:nbKUKPLHlHQ4YI9hJrjwTNYgHVs+
TLSH
T1CC52BD1932EB4600F17A973F89B3F105D73F75A289368E4A42BD01861BEF6415EE2F52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

aura.lol cracked/aura.lol cracked by dwmxs.exe

IMPHASH 9428c7b76e41de467e818ce4e8559d50
SHA256 071ec0ddd6ccaf4063c61101925a81dcd881f1816268c90c9aff8aec7189c0b9
MD5 5a6ce7457ebe53e088252c0c310c9219
SHA1 d4ff52dd770c2abd9ac745d27c7f8b1c2f2b0bdc
SHA512 16da79182801031a99ca628668a41fe7f143a3c5de813df6192215fa711f15221fcf6b5e819faef9ff0636c98635890f71a8a4408221253c26b2096abadf0255
SSDEEP 12288:DVLS2qw3FtTeo9ZnWc/KQqEccoKWFe5zndZFvPvPh0YuujmNZht:RGw3F5eojnWc//ccoKWFe5zndvPXIt
TLSH
T1BB751846E6A649E1C476D134A0E2F23BFA753C78813593136BD97E332BF1F60A95A340
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

742704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

kernel32

FindClose FindFirstFileA FindNextFileA GetVolumeInformationA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle GetLastError Sleep GetCurrentProcess ExitProcess CreateThread GetCurrentThread GetThreadContext OpenProcess GetTickCount VirtualAlloc VirtualFree VirtualQueryEx GetModuleHandleA GetModuleHandleW GetProcAddress WinExec SetConsoleTextAttribute GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW Process32First Process32Next CreateDirectoryA ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId CreateFileW GetStdHandle QueryPerformanceFrequency QueryPerformanceCounter GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetSystemTimeAsFileTime InitializeSListHead

user32

SetWindowLongA FindWindowA GetWindow GetWindowLongA OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetActiveWindow GetKeyState GetCapture SetCapture ReleaseCapture GetClientRect SetCursorPos SetCursor GetCursorPos ClientToScreen ScreenToClient LoadCursorA TranslateMessage DispatchMessageA PeekMessageA DefWindowProcA PostQuitMessage RegisterClassA UnregisterClassA CreateWindowExA DestroyWindow ShowWindow SetWindowPos SetWindowDisplayAffinity GetWindowRect SetForegroundWindow GetForegroundWindow UpdateWindow GetSystemMetrics SendInput GetAsyncKeyState

gdi32

GetStockObject

advapi32

RegCloseKey RegSetValueExA RegOpenKeyExA GetCurrentHwProfileA

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z _Query_perf_counter _Query_perf_frequency _Mtx_init_in_situ _Mtx_destroy_in_situ _Mtx_lock _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z ??Bid@locale@std@@QEAA_KXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?is@?$ctype@D@std@@QEBA_NFD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?rdstate@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ??1_Lockit@std@@QEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Xbad_function_call@std@@YAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ?_Xlength_error@std@@YAXPEBD@Z ?width@ios_base@std@@QEAA_J_J@Z

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

d3d9

Direct3DCreate9Ex

winmm

PlaySoundA

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpOpen WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpQueryDataAvailable

vcruntime140

__std_terminate __current_exception_context __current_exception __C_specific_handler strrchr strchr _purecall memcmp memset memmove memcpy memchr strstr _CxxThrowException __std_exception_destroy __std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _initialize_onexit_table _get_initial_narrow_environment _initterm _initterm_e _exit _initialize_narrow_environment _configure_narrow_argv __p___argv _c_exit _register_thread_local_exe_atexit_callback terminate _errno system _invalid_parameter_noinfo_noreturn exit __p___argc

api-ms-win-crt-string-l1-1-0

isprint strncmp strlen strcmp _wcsicmp _stricmp strncpy wcsncpy_s

api-ms-win-crt-stdio-l1-1-0

fseek fread __acrt_iob_func ftell fwrite __stdio_common_vfprintf __stdio_common_vsprintf __p__commode __stdio_common_vsscanf _set_fmode ungetc setvbuf _get_stream_buffer_pointers _fseeki64 _wfopen fsetpos fputc fgetpos fgetc ferror fclose feof fopen_s fflush

api-ms-win-crt-heap-l1-1-0

malloc _callnewh _set_new_mode realloc free

api-ms-win-crt-utility-l1-1-0

abs rand qsort _lrotl

api-ms-win-crt-math-l1-1-0

atan2f pow cosf ceilf _dsign _dtest tanf fabs ldexp fmaxf fminf roundf powf floorf sqrtf _fdtest acosf fmodf sinf sqrt __setusermatherr

api-ms-win-crt-convert-l1-1-0

strtoll strtol strtod strtoull atof strtoul

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file remove

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

Name

.text

Size

738KB

Virtual Size

737KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

833KB

Virtual Size

832KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rcal

Size

512B

Virtual Size

75B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

aura.lol cracked.rar

aura.lol cracked/BeDaisy.sys

PE Signature issue

ntoskrnl.exe

generic

aura.lol cracked/Mapper.exe

kernel32

user32

advapi32

msvcp140

ntdll

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic

aura.lol cracked/aura.loader.exe

mscoree

dotnet

aura.lol cracked/aura.lol cracked by dwmxs.exe

dwmapi

kernel32

user32

gdi32

advapi32

msvcp140

imm32

d3d9

winmm

winhttp

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic