d3729d01eb949e880ef434d303fcba02fb5cdb65311b6eef1b729135f4d5cf2e
- SHA256 d3729d01eb949e880ef434d303fcba02fb5cdb65311b6eef1b729135f4d5cf2e
Behavioral task
behavioral1
Sample
2021年全部热门单机游戏及汉化下载.url
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2021年全部热门单机游戏及汉化下载.url
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Rune Factory 4 Special v1.0 Plus 27 Trainer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Rune Factory 4 Special v1.0 Plus 27 Trainer.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
www.3dmgame.com.url
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral6
Sample
www.3dmgame.com.url
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target d3729d01eb949e880ef434d303fcba02fb5cdb65311b6eef1b729135f4d5cf2e
- Size 731KB
- Sample261103-ml7fda1wcs
- SHA256 d3729d01eb949e880ef434d303fcba02fb5cdb65311b6eef1b729135f4d5cf2e
- MD5 81f6ca4adad1274d23f72bf8287cef1c
- SHA1 75de0c81e103c86d46dbf31cf8283f2a6a9176cd
- SHA512 4c066f0adf6df2665577bdfbbbdfab525d5d2514e48316c3b2f02a1c4a9a4a38a442d021de453023696b4c7dc87c111579d83f10f2af76c971f39c9b98a6afb8
- SSDEEP 12288:NMsv1ehIp+z0Ec5CP948Sc0IgJC7nxi1m9scIfTbmXQ0iDRwi1GMgC5mMI:NMKCIEz0f5Cl4/DLC7n0A6N5DRXQMgEc
- TLSH T19DF423B3D199AF1601C5A73331D784B3FB7B386A8E0D68A3C722029C5D91BC468D5B5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- r77 rootkit payload 1 IoCs
Detects the payload of the r77 rootkit.
resource yara_rule static1/unpack001/Rune Factory 4 Special v1.0 Plus 27 Trainer.exe r77_payload - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Rune Factory 4 Special v1.0 Plus 27 Trainer.exe
File Explorer
-
d3729d01eb949e880ef434d303fcba02fb5cdb65311b6eef1b729135f4d5cf2e.rar 731KB
-
2021年全部热门单机游戏及汉化下载.url.url 147B
-
Rune Factory 4 Special v1.0 Plus 27 Trainer.exe.exe 1.2MB
-
www.3dmgame.com.url122B
-
说明.txt3KB
2021年全部热门单机游戏及汉化下载.url
- SHA256 3e545afac96bd9cb6aa3d0fc1a5cdfba8e603d5786ed3dcb5864a86e294d4a8f
- MD5 a93d7159412ef4cbaf20859475050343
- SHA1 e20072374282478e9ebba60be62d36179a870caa
- SHA512 fac0506a7a512ef571990de378fd079de681205d4b6e779948b06cf69e2b1297608301e014c80149377531114b7e88bec7960b16da96b6c60c6b20d402d4505c
- TLSH T16CC08CAE05478195C300140610E2F808A41F79A0ACD1904CA954CAAB9C990E2C044A3A
- MD5 SHA1 SHA512 TLSH
Rune Factory 4 Special v1.0 Plus 27 Trainer.exe
- IMPHASH fadd7dec9cf1a79bb6e47d8ea6f9c1a0
- SHA256 5a0deb0a4f314432dd299ecabf53075fb15e35eab5a03b45214540e60f022a9e
- MD5 c7c3b442be4f7088b065218718ee9190
- SHA1 4075803ddc29160a8b34c360e60a1371d893905d
- SHA512 e48416826b41755a11a49175fb90fc46de4101e52ec0dda1ba52590d81faa1f8689712d53fad230e5267d39b686b2198309362c8873f8c77605f2420a8985cb6
- SSDEEP 24576:3Qzv9YMaBr4oW8aDipRIkDz2fJs+M3dckDScfVDQ/kgbJ7:4aVZWR2/z2fJs+MtNVDQ/kgV7
- TLSH T1F155BE46736404F9E4A79238C9538A06E3B678060771D7DF03A0877A6F677E19E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
r77 rootkit payload
Detects the payload of the r77 rootkit.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
187456
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCurrentProcessId
LoadLibraryW
GetProcAddress
WaitNamedPipeW
GetLastError
CreateFileW
ReadFile
WriteFile
GetModuleHandleA
LoadLibraryA
GetPrivateProfileStringW
WritePrivateProfileStringW
GetModuleHandleW
FindResourceW
LoadResource
SizeofResource
LockResource
Sleep
GetModuleFileNameW
LoadLibraryExW
FreeLibrary
MultiByteToWideChar
GetCurrentProcess
IsWow64Process
SetLastError
ResumeThread
WaitForSingleObject
LocalFree
GetTempPathW
CreateDirectoryW
WriteConsoleW
HeapSize
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetFileAttributesW
CloseHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
WideCharToMultiByte
GetStringTypeW
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
HeapFree
HeapAlloc
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
CompareStringW
LCMapStringW
GetLocaleInfoW
user32
MessageBoxA
MessageBoxW
advapi32
SetEntriesInAclW
ConvertStringSidToSidW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
shell32
SHGetFolderPathW
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
SafeArrayDestroy
mscoree
CorBindToRuntime
CLRCreateInstance
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
winmm
PlaySoundW
Name
.text
Size
334KB
Virtual Size
333KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
121KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
774KB
Virtual Size
773KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26715,
count=18, id=260, version=26715,
count=182, id=261, version=26715,
count=17, id=260, version=30034,
count=10, id=259, version=30034,
count=89, id=261, version=30034,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=17, id=257, version=26715,
count=191, id=1, productName=Unmarked objects,
count=17, id=265, version=30137,
count=1, id=255, productName=VS2019 v16.11.6 build 30137, version=30137,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.11.6 build 30137, version=30137,
www.3dmgame.com.url
- SHA256 03df27e82600098c34c413cc2e45b43638d3ac33666960cfbd913f1c3f9a0b11
- MD5 49cbfed4fa9b3fafdc9d499b6163fa62
- SHA1 28decd9138bd3f7b3ef38bf9e40cd0d6305d1cdb
- SHA512 64e91ed564ef64d7687599012c4728b811fec2661dcb7941374cdd3a8450563073c67c452d97d43545f49182fbda2c26702dd35088723ace21717282d1233627
- TLSH T14BB0129C5B46C09AD371D81A70F0FD09E80EB9F048C2D4DC76D0DD9F2C950D1D54AB2A
- MD5 SHA1 SHA512 TLSH
说明.txt
- SHA256 f2ee0889120b32c1fd48b8295ddff8d82b80dcc7b39263684c97ff5dab048559
- MD5 9795b7cd8b0b95e0167d81d46d491e41
- SHA1 be21f6652e221d51c6ef81847a9d7e20ab9587fe
- SHA512 8ee4cabbd0b386eeec566410f135158864f12fb35d15ae75c1e3664a73023cf8fa2eefe871e1ad89faaeea73f65792ae4e885796207e639dda68bfed3edceb9c
- TLSH T1BF510512EE8DB2407195556426ECA593D35F11C1812EDF8405CEABE973E25823CCEFDE
- MD5 SHA1 SHA512 TLSH