a46e71e46451d45e8aaec3871d0514fab44b9c254e73150df1c5e61d6b37cd73
- SHA256 a46e71e46451d45e8aaec3871d0514fab44b9c254e73150df1c5e61d6b37cd73
Overview
overview
7Static
static
3GoldMinerRA.exe
windows10-2004-x64
7GoldMinerRA.exe
windows11-ltsc_2024-x64
7Keygen.exe
windows10-2004-x64
3Keygen.exe
windows11-ltsc_2024-x64
3ReflexiveArcade.exe
windows10-2004-x64
3ReflexiveArcade.exe
windows11-ltsc_2024-x64
3ReflexiveA...de.dll
windows10-2004-x64
3ReflexiveA...de.dll
windows11-ltsc_2024-x64
3unins000.exe
windows10-2004-x64
7unins000.exe
windows11-ltsc_2024-x64
7Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
GoldMinerRA.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
GoldMinerRA.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
Keygen.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Keygen.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
ReflexiveArcade.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
ReflexiveArcade.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
ReflexiveArcade/ReflexiveArcade.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
ReflexiveArcade/ReflexiveArcade.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
unins000.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
unins000.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target a46e71e46451d45e8aaec3871d0514fab44b9c254e73150df1c5e61d6b37cd73
- Size 3.5MB
- Sample260925-v5f2jasdka
- SHA256 a46e71e46451d45e8aaec3871d0514fab44b9c254e73150df1c5e61d6b37cd73
- MD5 eb4d0b767473b75b5ce4243ca3ae86ba
- SHA1 a6bdfb70591f19c4ed2b6d13f753fa8398809585
- SHA512 d25e3fa1ab47443bb5db75734402c630b641361c27f36484380d78756b6441c7fd7d9e255c062c6aae32597525e0bd857443569431d94f201ff23c8929cec100
- SSDEEP 98304:uP0wmA4gNw6NLfgUhZlR0U5bjO9BjKn3wzgmz:Gir6NLfJhZleUudK3wzgc
- TLSH T16F0633415A7EAA14EBC74676F13C99ED94863780F2F10A5DAA0E86E132FF4C51D2390F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/GoldMinerRA.exe unpack001/Keygen.exe unpack001/ReflexiveArcade.exe unpack001/ReflexiveArcade/ReflexiveArcade.dll unpack001/unins000.exe
File Explorer
-
a46e71e46451d45e8aaec3871d0514fab44b9c254e73150df1c5e61d6b37cd73.zip 3.5MB
-
GoldMinerRA.exe.exe 1.7MB
-
Keygen.exe.exe 110KB
-
ReflexiveArcade.exe.exe 64KB
-
ReflexiveArcade/Application.dat241B
-
ReflexiveArcade/Arcade.dat943KB
-
ReflexiveArcade/Arcade/Cache/Resources/Forms/Purchasing Form/Assets/-Bullet_Point.frm16495B
-
ReflexiveArcade/Arcade/Cache/Resources/Forms/Purchasing Form/Assets/-Purchase_Background.frm16260KB
-
ReflexiveArcade/Arcade/Cache/Resources/Interface/-MouseFinger.seq161KB
-
ReflexiveArcade/Arcade/Cache/Resources/Interface/-MousePointer.seq161KB
-
ReflexiveArcade/Arcade/Cache/Resources/Interface/-MouseText.seq16585B
-
ReflexiveArcade/Arcade/Cache/Resources/Interface/-Window Texture.frm16612B
-
ReflexiveArcade/ReflexiveArcade.dll.dll 948KB
-
return.txt3B
-
status.txt10B
-
unins000.dat1KB
-
unins000.exe.exe 75KB
-
攻略.jpg.jpg 655KB
GoldMinerRA.exe
- SHA256 a6cd0cea8f6f11ae2271a1259e6d1ea7e1988475336d2e1845fafcee14aed6f8
- MD5 784c9d28961f7ec1ffaa00029bacfd9d
- SHA1 e8ce2412ddce654983bca15e1818097cbca5cd01
- SHA512 30ed38c331152d8199db0dfd42b29eea9e3932ad61e97482b2c548bdb7081bb5c4d71b3c66256d8dc7608aa8533767dffca090d2b3db16a1d87f6ca53e37c0f3
- SSDEEP 49152:5JjAm9u8oxzLclHjf/reWn0V/xUfizoqCdpx:rcIzoxzAhj3rdn0VADqCdpx
- TLSH T17C8533043A0674C6D3C486790FBEE43EC619687E2E26D20A9E12E64EC5735C4A7DE3D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3817904
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CWFR
Size
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
FWFR
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
10KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Keygen.exe
- IMPHASH 0a91a880e12bea2f28c8f38bafef034a
- SHA256 46078d90c49820c757010554a1b308d2189fa3adeb10a80ed02ee07fae1279c3
- MD5 8d3297d01309c82ea054a0b489e93531
- SHA1 47cf6b9631034a8c583cd0c67555d70d88e99ac5
- SHA512 725025a2031b4bd13132241d9e12a35e0a01137fdf0292570e0eb7019b44d039c39352a3c81e6f0c75b98533cbbf36d46b62dc4f6321909197afd6d56c6dfe28
- SSDEEP 3072:2EG/OyzqDxrgPrn9yBbs+qcdUlNBeGCYlHB9PWg3N8L5Ku5B:2v/OyzAkP7isCWNQGCS9PLNa
- TLSH T1ABB302E97E521CE4C6546BF4FC8A2ED197763246A71306391E94F90DE42233B3972C4B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26416
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
user32
DestroyWindow
gdi32
SetBkColor
ole32
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
winmm
waveOutWrite
Name
.text
Size
103KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=21, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=95, version=2179,
count=2, id=93, version=2067,
count=89, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=11, id=93, version=2179,
count=126, id=1, productName=Unmarked objects,
count=8, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
ReflexiveArcade.exe
- IMPHASH 33249c6490d02d76723db709238ee1e0
- SHA256 601c9474ba9c5a0e11b42267e94684408ee6d0bca941b68a1ebc6b029c3f4842
- MD5 4ef5156867b1181ed36c155793f44bb8
- SHA1 3ae133ebb881013cd9c54ea0cb333b478dfd2995
- SHA512 e1143abf5c0936cf0811a6962261762bc6102a2b6982277ea718440ece224e4eade297b04341b8cf63469c1542d1bce3594ac75f4e5ab28421ca70f41b05c334
- SSDEEP 1536:cPvXnGAIpg/aZ/gZLXpEVIHIGYrJkXo3:svXR/zmIIbdkXo3
- TLSH T114539E67FAE046FFD4E540B010E38B7DAF7AD224172119936788CCA4ED571FDEA26241
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13088
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LCMapStringW
LCMapStringA
GetOEMCP
SetEndOfFile
GetCPInfo
FlushFileBuffers
SetStdHandle
HeapReAlloc
VirtualAlloc
HeapAlloc
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
ReadFile
Sleep
CreateFileA
lstrlenA
WriteFile
CloseHandle
GetACP
SetFilePointer
RtlUnwind
DeleteFileA
SetFileAttributesA
FindClose
FindNextFileA
MoveFileA
FindFirstFileA
RemoveDirectoryA
GetProcAddress
FreeLibrary
LoadLibraryA
GetModuleFileNameA
GetLastError
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
LocalAlloc
user32
ReleaseDC
GetForegroundWindow
LoadIconA
LoadCursorA
UpdateWindow
SetWindowPos
PeekMessageA
GetWindowRect
BeginPaint
EndPaint
GetDesktopWindow
MessageBoxA
RegisterClassExA
CreateWindowExA
ShowWindow
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
DestroyWindow
PostMessageA
GetClientRect
GetDC
gdi32
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
DeleteObject
CreateDIBSection
winmm
timeGetTime
advapi32
CryptVerifySignatureA
CryptDestroyHash
CryptImportKey
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
CryptDestroyKey
Name
.text
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=12, version=7291,
count=1, id=11, version=8797,
count=85, id=10, version=8797,
count=17, id=14, version=7299,
count=11, id=19, version=8034,
count=96, id=1, productName=Unmarked objects,
count=3, id=49, version=8943,
ReflexiveArcade/Application.dat
- SHA256 5da89e4ae6f4f303db41ebaa31e2bef51a4a62c10df8dc5f86dd19a1ce14958e
- MD5 22fbc19bfda1368e9e150e5bcdcfd9a0
- SHA1 348b9b3be5cd433cb4d714bf77ae84cea895d9b4
- SHA512 df41f2595e50200ebe9d10869b109455bbf552b7930f1bad4e24eb159e24c50920e128e06d47c50c688595a3f3657921f5b9688b6e3bbf327d9c6a0f180cfd72
- TLSH T1F2D0A98F5882C47ACB632F32404C429037F2030EE4A4B49CBD72A0F22B6220F2A87502
- MD5 SHA1 SHA512 TLSH
ReflexiveArcade/Arcade.dat
- SHA256 bae7022274128591e52bb71615be965abe97cdcbcd364688ac61a8c80e157be0
- MD5 fd75d4c23fcb82c9ccc98289eecaeb3a
- SHA1 51d56195e0a75497099ca2715c28f431a195cc38
- SHA512 c2a97ba262bfdc5fa9d7eac18bc9f7cd99ecf9352df0dd9a3dabf7f548b22e08267933e8968e070ec7c13416f92296e2206c53cdd1e1bbfee3b239fcb6e37da2
- SSDEEP 24576:h9sG+fIcYrSr3K0ekmpS8H9urEZ1jetGUev7Yg2:UG0wWeNLpJH9uQPCt9ev7Yg2
- TLSH T1D225D053B71D8313C12692FA3E338958BA7EF639689021DE78764895FEF10290C9F65C
- MD5 SHA1 SHA512 SSDEEP TLSH
ReflexiveArcade/Arcade/Cache/Resources/Forms/Purchasing Form/Assets/-Bullet_Point.frm16
- SHA256 b74c814a387e99f0c72ee8069b01f0b30cbf712f323a95f179e26f1b41f1cb7b
- MD5 a26433982b1d5a4c2c1bdffa3f7510c6
- SHA1 fd3367f547bcd4f2e800377baf8d75cb388101eb
- SHA512 2ad5c4112669942fe003eb9a78fef8f7b2eff18d2c2a56db2227bca45b8561cf4d5b6dc12fa05912c93c7b0eacd9858366ebd725d1451e95c1bdeadfdae222a0
- TLSH T169F05C83F4D43503F4915EF6A43C88561E35CF62550EBF4A2307230D974F09549C0A91
- MD5 SHA1 SHA512 TLSH
ReflexiveArcade/Arcade/Cache/Resources/Forms/Purchasing Form/Assets/-Purchase_Background.frm16
- SHA256 db45868b4ad5fad319d345f591f386ecf6b7578e42643fb221c376d4aa37d896
- MD5 d1ad19929b528cf47f13500987699f6e
- SHA1 c3c0bd9ff72d3121bd0b880453490bad881b3724
- SHA512 c9ed9b952522d95a309086489197365971bb985ed9ccf5e25522b9d899c2c29bfd58ef661094cde65173b407c65e93e546b6f7034779d405216ec9851671eb51
- SSDEEP 6144:bN4s7+YjwcX2Y5alBD8H/NAuGgdDPPUI5R9XOSBAbzmmhDUeTvUIIlK2GLVIJG3W:Z4sCYjwcX2Y52BoH/NAuGg5PPUI5R9XD
- TLSH T1F444BCCAF0E5FE78DFB07D7143100934971ACF80361BB937A12675498ABB606799ACD8
- MD5 SHA1 SHA512 SSDEEP TLSH
ReflexiveArcade/Arcade/Cache/Resources/Interface/-MouseFinger.seq16
- SHA256 c035310966b722009c6d1d15817a558dca7242b5c1f6107031a8a4eca4a89a17
- MD5 037a7f19bed8dd3b1f81519f07c32c76
- SHA1 e3c0eeb3bb186fc9bc5d1fa3374a5427624203fb
- SHA512 cc4d0a0635be15d5cccfecde0de523d67b292b4e00dc2c397a08fb9ed92e0a808084e11a761cfcf5eb23b9f16ec29c7edbcb9455eb9d79dd244400e09acbd53a
- TLSH T1E521210A37E68DEBC0C53C33656455EA1714EF5C85297827312C371CE8A9C4A5E076FD
- MD5 SHA1 SHA512 TLSH
ReflexiveArcade/Arcade/Cache/Resources/Interface/-MousePointer.seq16
- SHA256 44d39661aa761ae88dc022d94758fceb2ee0578b09c769487397d79cf41434cb
- MD5 8ed32bca5e79174e1c54177010d465dd
- SHA1 818def500e9b77d8c361f2447763380e24d9ccfa
- SHA512 c58f13af662bb96b49c2db7c4c1e363f4eeb4fa36867c5530ac3d83d0e5241c89a6759079adca1a470f8922c7be2702f3d476f13a61702c0ccdd8b47e7fa75c1
- TLSH T1492114987B30C9D3C0941D7B96C538BE793DCCA671A50B3BB59137A446F9C453D45450
- MD5 SHA1 SHA512 TLSH
ReflexiveArcade/Arcade/Cache/Resources/Interface/-MouseText.seq16
- SHA256 d43b3960cb6212ef98c9e47e3120f6128c96404fb966c4dd24231738e47c4afc
- MD5 91ad4fad2b83e91d954a44f7985400f4
- SHA1 335cd38b57ec1d6eecaa858016462ec262439e00
- SHA512 7da27f68f6b01a1e173b4edbf53f4c00df8089fb952ce89a23dc04c9a466000498b94ece2e3c9df8b94280addc7e4d00bd5405f96f8c23ec9fd4af5c97ae64f4
- TLSH T13CF09A571E37C1E6C0918D33A9E0168C167C01893B901D7F71BE4E3893B2A88DF93403
- MD5 SHA1 SHA512 TLSH
ReflexiveArcade/Arcade/Cache/Resources/Interface/-Window Texture.frm16
- SHA256 892e776dfcaa57b435ba81feb81601b449ab79003701d4ccb87977b501f358a4
- MD5 ddc7b579ea353c341b2f801d89ac159c
- SHA1 1cf21ac7de69bda7e1bdb6393b3f10d0e4d7ed03
- SHA512 082c3e9eb3e9b42211a6a308186792dc81a2261310982c14e1778642c23390aa582ea1a90802f450f305121887bd860a6277ff5f125588480d0619f2146f00f6
- TLSH T142F00296770594B5C00D02300CC7856A359BBD70CBAB0E47BA51333F58357549436901
- MD5 SHA1 SHA512 TLSH
ReflexiveArcade/ReflexiveArcade.dll
- IMPHASH 1a07be9d954d016ba837689c232e4e2c
- SHA256 839ec073f85eede6c7c54fb76cd219b059cf901762976bc8519cac1128fea669
- MD5 5df9b87dff99847624727707a0e587c6
- SHA1 e5c557e21d94f7a74428d07c65608efc667e1ed0
- SHA512 976f37af9f464086fe90bb23a7cd5f61ab12f22b901e0cb21923a3f980a1f084d3861008bbfd8e8ff5ad1e513d0eaf560648bdce6456f6b57f3da78466350724
- SSDEEP 24576:abXC5u9nKIfaCMbWoWlk4HRR+i7sZ8CW5kpEJSbwgilJ+5t6riO8gnOpl4Cjs9t1:8VnKIfaCMbWoWlk4HRR+i7n5+5t+iOLh
- TLSH T16C25BEA2569180F5C5865575243A773ACBFF9312013AC653FFA0CE912E2157AF23B38B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
693028
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
user32
GetActiveWindow
wsprintfA
LoadCursorA
SetCursorPos
MessageBoxA
GetDesktopWindow
ClientToScreen
SetForegroundWindow
ShowWindow
SetCursor
SystemParametersInfoA
ScreenToClient
WindowFromPoint
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
RegisterClipboardFormatA
GetClipboardData
SetTimer
KillTimer
GetCursorPos
GetClientRect
kernel32
SetCurrentDirectoryA
DeviceIoControl
CreateFileA
CloseHandle
GetShortPathNameA
SetPriorityClass
GetCurrentDirectoryA
SizeofResource
LockResource
LoadResource
FindResourceA
GetComputerNameA
GetVersionExA
GetProcAddress
LoadLibraryA
GetLastError
GetModuleFileNameA
OutputDebugStringA
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
SetUnhandledExceptionFilter
GetCurrentProcess
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetOEMCP
GetTickCount
GetTempPathA
CreateProcessA
GetExitCodeProcess
IsBadReadPtr
IsBadWritePtr
MulDiv
CreateMutexA
WaitForSingleObject
ReleaseMutex
FileTimeToDosDateTime
GetSystemTimeAsFileTime
FindClose
FindFirstFileA
GetTempFileNameA
GetFileAttributesA
CreateDirectoryA
FindNextFileA
GetFileTime
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
FileTimeToLocalFileTime
GetPrivateProfileIntA
WritePrivateProfileStringA
GetVersion
SetFileAttributesA
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
ExitProcess
TerminateProcess
IsBadCodePtr
HeapAlloc
HeapFree
GetCommandLineA
DeleteFileA
SetEndOfFile
InterlockedDecrement
InterlockedIncrement
RtlUnwind
HeapReAlloc
GetModuleHandleA
HeapSize
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
FlushFileBuffers
ReadFile
SetFilePointer
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
RaiseException
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
advapi32
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
GetUserNameA
RegEnumValueA
RegEnumKeyExA
RegCreateKeyA
netapi32
Netbios
gdi32
DeleteObject
shell32
ShellExecuteA
radll_DrawNextFrameIntoBuffer
radll_EnterMenuSession
radll_GetDLLVersionAsInt
radll_GetDLLVersionAsString
radll_GetLastErrorInformation
radll_GetNumberOfRectsToUpdate
radll_GetUpdateRect
radll_GetValueAsFloat
radll_GetValueAsInt
radll_GetValueAsString
radll_HandleWindowsMessage
radll_HasTheProductBeenPurchased
radll_Initialize
radll_IsASystemUpdateRequired
radll_IsTheMenuSessionComplete
radll_SetPalette
radll_ShutDown
Name
.text
Size
728KB
Virtual Size
726KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
80KB
Virtual Size
705KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
56KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=4, id=12, version=7291,
count=42, id=14, version=7299,
count=8, id=11, version=8797,
count=147, id=10, version=8797,
count=6, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=32, id=48, version=8943,
count=15, id=19, version=8034,
count=168, id=1, productName=Unmarked objects,
count=212, id=49, version=8943,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
return.txt
- SHA256 27d719c754aacd492a6dc8a1b76619355abcf5ef473cbec02018d3c57ebbf0d5
- MD5 20f07591c6fcb220ffe637cda29bb3f6
- SHA1 f333160e6b20ba37686da89bbe5fab728a7d3d24
- SHA512 54ce0077f3cc6696f89c98bfba4f10ca1641a6d5648db52afb54843c088b59df8d9c4185b767206d07a3aca65c357d044ca37dd6368e82b7b8c5d00d6e5ff918
- MD5 SHA1 SHA512
status.txt
- SHA256 63f178abcb3513aeb6271b934a6b2705fa1fa82e6f3195b9eff721476445155c
- MD5 988dc9c732a2f24f8a5c114b57b1bde5
- SHA1 992abdd5b4f641064f312661e2945fe802ba45f7
- SHA512 de323189f5952732b596b505ee4527a070d5e9b92d90fab8c6c4ac867b457952803a78810bfe4cbbf24b8a34a047c6f4e89398be331dfcad909864c6db0af312
- MD5 SHA1 SHA512
unins000.dat
- SHA256 71c907b2a176bc9807246aa119b97328155e39291554269ee40e15963ee37bfc
- MD5 f1f26eb7911a0e928bd556895270d22a
- SHA1 d947a01de0c0d097cfaf8628c3ff5b41f9b02a44
- SHA512 9f32310abd2c524ea42e50d53f8b561c48b4c4842498af241aabb6aa6edb3c434b8b440109253f47244bf4e708f12899b616727c0b6198ed525bd566e5a3553e
- TLSH T10A3142C054789162ECA13673CBC79BACB58FA727E1ED9A27105C0186D87E778CC1C8C2
- MD5 SHA1 SHA512 TLSH
unins000.exe
- SHA256 bce9ca64313ae3f10372a95d373d1e5c8b2c545b75fdb5eddc3c8391ff4b02a4
- MD5 bf15ce70e055955fafd81a18ec1c0771
- SHA1 2e744b01a4a96b82f1c298304d497a26d75c5b91
- SHA512 de507c23a3331008af2efceb74b7ceecb7083bb83413515b9c4b9c02f42e3647f81fad4c6925a1ed82c60aa5796083a4cc28319a97f781864730ffe677e8d038
- SSDEEP 1536:42fqNGLKnpFU+t7Chv3H2OsQREX+d84K/G/OdSeK2Rr:YGL2vhChvH2fQVm4K/G/OdS3C
- TLSH T1D4737D13FAC04572D162CABC5D6A9194E776BD341E38401AB9DE0ECD9A2E2C3C61F397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
50664
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
680B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
攻略.jpg
- SHA256 7a8fee2f64913bb88925a7e8d46696a2d56efb15716bc02d105a28ce521eb644
- MD5 36b17126146b52185496b6b4ff38bc05
- SHA1 10ef138da623ba6d4d1ebca04609bb9955b953fa
- SHA512 2c9cf33974264028e2ca83524baf2bf46ab78054c237ba25fd4ba2772292769032a617c48003c34e0ea72e3e217c1e8e2e8e3b3a9b3bb1c07fe2df94924bcac2
- SSDEEP 12288:xQVgFsBgcUQ6Zmh9yM5abSyHruLDxQREIcJX6ePBk4ve:CIsBeAg2KrurUeRm
- TLSH T1F7E412EE9B167A0F70495064446BBB3BF44E8B60B7DD12262DDF1CA07DB04287F5846E
- MD5 SHA1 SHA512 SSDEEP TLSH