ed3916f3ff250f06bdc69fd257b136c816e7de0aae61982bd762b6a4c616394b

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2018-Dec-29 20:40:55
Detected languages English - United States
CompanyName MrAntiFun.net
FileDescription MrAntiFun Trainer Engine
FileVersion 1.03
InternalName MrAntiFun
LegalCopyright Copyrights MrAntiFun.net © 2013-2019
LegalTrademarks1 MrAntiFun
LegalTrademarks2 MrAntiFun.net
OriginalFilename Trainer.exe
ProductName MrAntiFun Trainer Engine
ProductVersion 1.03

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Contains another PE executable:
  • This program cannot be run in DOS mode.
 Contains domain names:
  • MrAntiFun.net
  • http://mrantifun.net
  • mrantifun.net
Malicious The PE contains functions mostly used by malware. Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Code injection capabilities:
  • OpenProcess
  • VirtualAllocEx
  • WriteProcessMemory
 Memory manipulation functions often used by packers:
  • VirtualAllocEx
  • VirtualProtectEx
  • VirtualProtect
 Manipulates other processes:
  • Process32First
  • Process32Next
  • OpenProcess
  • ReadProcessMemory
  • WriteProcessMemory
Malicious The PE is possibly a dropper. Resource 2005 detected as a PE Executable.
Malicious VirusTotal score: 35/72 (Scanned on 2025-01-28 11:23:45) ALYac: Gen:Variant.Application.Ursu.378848
Antiy-AVL: RiskWare/MSIL.Gamehack
Arcabit: Trojan.Application.Ursu.D5C7E0
BitDefender: Gen:Variant.Application.Ursu.378848
Bkav: W32.AIDetectMalware.CS
CAT-QuickHeal: Trojan.ZpevdoFC.S7082265
CTX: exe.trojan.msil
CrowdStrike: win/grayware_confidence_100% (W)
Cylance: Unsafe
DeepInstinct: MALICIOUS
ESET-NOD32: a variant of MSIL/GameHack.AIM potentially unsafe
Elastic: malicious (moderate confidence)
Emsisoft: Gen:Variant.Application.Ursu.378848 (B)
FireEye: Generic.mg.39ea51f9fe6f04ad
GData: Gen:Variant.Application.Ursu.378848
Google: Detected
Kingsoft: malware.kb.c.996
Lionic: Trojan.Win32.GameHack.4!c
Malwarebytes: GameHack.HackTool.RiskWare.DDS
MaxSecure: Trojan.Malware.74035103.susgen
McAfee: Artemis!39EA51F9FE6F
McAfeeD: ti!ED3916F3FF25
MicroWorld-eScan: Gen:Variant.Application.Ursu.378848
Paloalto: generic.ml
Rising: Trojan.Cloxer!8.F54F (CLOUD)
Sangfor: Trojan.Win32.Ursu.Vmjd
SentinelOne: Static AI - Malicious PE
Skyhigh: BehavesLike.Win32.Generic.bc
Sophos: Generic Reputation PUA (PUA)
Symantec: ML.Attribute.HighConfidence
VIPRE: Gen:Variant.Application.Ursu.378848
Varist: W32/Trojan.GHM.gen!Eldorado
Webroot: W32.Trojan.Gen
Yandex: Trojan.GenAsa!YIUBK4KjtVQ
alibabacloud: Trojan:MSIL/Gamehack.AIM

Hashes

MD5 39ea51f9fe6f04adf64be25da26d6c03
SHA1 344e651d05bb293df3b27bb1fc1202b14c5bd61a
SHA256 ed3916f3ff250f06bdc69fd257b136c816e7de0aae61982bd762b6a4c616394b
SHA3 79a9f6b12feb1ce5eedf54bd3d5e2cd2ca8e4baf730988736c9b1b04833988dc
SSDeep 12288:d5jLjqux1ANozInNcOOjCHieL1GboYhAp03Vng/6Bl5JX5VV9:d1n1A+NnWH7xGbp+0ZFlfX5D9
Imports Hash 8d5b9200d4d17e29858cc416e1b320dd

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 6
TimeDateStamp 2018-Dec-29 20:40:55
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x7600
SizeOfInitializedData 0x1f4bc000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000084BE (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x9000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x1f4c7000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 bc0e3f17b615bd18c6a77cd96e5f155b
SHA1 8f86316d96193ce89f37eea421d5a6152dd481ad
SHA256 93adc8b5cc47b7cd7e37c38e64f1b4b7c22e8394171e18790e21d9faeaac37a1
SHA3 e6af98fdb75cf7c78732c4ede768a4a221ea07964ec4b3781743896c903f9c86
VirtualSize 0x74db
VirtualAddress 0x1000
SizeOfRawData 0x7600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.72959

.rdata

MD5 231527513ee868a3b0e05618456a979f
SHA1 148d774fc5d5e95d1e9dfaac9cfb640a22bc1679
SHA256 ed03a7a675a7f2fd851317ce35c6f8db5d717a992b01b778873c1601b5f8dac1
SHA3 23b1d314336dcb3be266063dc06ab5f1a0739c41679c146c64c83b9a22ca4742
VirtualSize 0x64f9c
VirtualAddress 0x9000
SizeOfRawData 0x65000
PointerToRawData 0x7a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.59872

.data

MD5 b712cd56830392b99eab14904a28fee5
SHA1 94d16797496593a39cd844fd830b842dbedbcf0e
SHA256 4028dd3b616a53ea5892503ece27aadeaaec59516424d795b2c15a261f4c40cd
SHA3 4a168453c399fd02943ed52b1f31e8c84184c4286cec00957f3346a50f91f12b
VirtualSize 0x1f4028c8
VirtualAddress 0x6e000
SizeOfRawData 0x600
PointerToRawData 0x6ca00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.07089

.gfids

MD5 ed26e5d199ed0afad28282fc93ca9142
SHA1 a817aac0a12d95fbb9efab22e8822998835ae91d
SHA256 9f74744046b6012400ffebe19fb7ebd7187ad0644961d1027fecdeb3c2320024
SHA3 7c888ad5430212117a0ce6383ea8b70c26e2e18a237bfc09ca56dc07f4b8ddd1
VirtualSize 0x48
VirtualAddress 0x1f471000
SizeOfRawData 0x200
PointerToRawData 0x6d000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.358411

.rsrc

MD5 63d45bd22e5ae0ca20afbca4e4889ff9
SHA1 8d9e8bf91d89aa4093b0699ce380f9a6724e4a0e
SHA256 ef0e2725ef439ca6421ac2ac3bd60714ffcf5cff7e41a4a29b2c34cc4e893f71
SHA3 4e5529e21a06cc924e55b1705ae46de6a95c5979d03bcbd80773bf17b965e100
VirtualSize 0x53dd0
VirtualAddress 0x1f472000
SizeOfRawData 0x53e00
PointerToRawData 0x6d200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.95276

.reloc

MD5 f1efc429e74ac6197cc82384ffa6755f
SHA1 46c2b3bef4f5c9e9c6fddd0e91e8ecea4bbd3e6f
SHA256 d62e10fe26b5894f76a8a2c2bcf01337a6fff9800cc62241eebbb16987f69ddf
SHA3 8b8c566234ec6f942750381054a08f853ab56c8cc6ef12be059c4f0896d0b571
VirtualSize 0x4a8
VirtualAddress 0x1f4c6000
SizeOfRawData 0x600
PointerToRawData 0xc1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.62646

Imports

KERNEL32.dll CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
Module32First
Module32Next
OpenProcess
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
VirtualAllocEx
GetLastError
VirtualFreeEx
VirtualProtectEx
WriteProcessMemory
VirtualProtect
GetCurrentProcess
Beep
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
Sleep
TerminateProcess
USER32.dll SetWindowsHookExA
CallNextHookEx
WINMM.dll PlaySoundA
VCRUNTIME140.dll memmove
__CxxQueryExceptionSize
__CxxExceptionFilter
__CxxRegisterExceptionObject
_except_handler4_common
memset
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__CxxDetectRethrow
__CxxUnregisterExceptionObject
__FrameUnwindFilter
api-ms-win-crt-string-l1-1-0.dll _stricmp
api-ms-win-crt-runtime-l1-1-0.dll terminate
_controlfp_s
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_c_exit
abort
_seh_filter_exe
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_initialize_narrow_environment
_configure_narrow_argv
_cexit
_set_app_type
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll __p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll _callnewh
malloc
free
_set_new_mode
MSVCP140.dll ?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
mscoree.dll _CorExeMain

Delayed Imports

2005

Type DLL
Language English - United States
Codepage UNKNOWN
Size 0x17400
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.82139
Detected Filetype PE Executable
MD5 306ae00347ae06f9b25b6e1b86da181d
SHA1 dac31bbbdfa4d651fa4b4a68ddd673e9632c0540
SHA256 4140f96946da7baf8454f961c7b8a2aa069c1f4f696db7e24f6a5b08c2166bd2
SHA3 9efbd250815a4af61699eebc936990f28b88e3fa02e6a5ad3906d33e5874a218

2000

Type WAVE
Language English - United States
Codepage UNKNOWN
Size 0x998a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.77992
Detected Filetype WAV Resource Interchange File Format
Detected Filetype (#2) Windows animated cursor
MD5 8ed08c9097db6984f25bd0f923250e41
SHA1 7a73a7256fa589e21aa510aecfc66787f6888216
SHA256 b16c3ce08b9469b095c5c726ce2064571cf73ba4470f2ed87bb33e2b36b7f308
SHA3 de0580b956e1750c4dcc581b28a5196bbb54e349cb9cc79c00defe5f19a22b43

2001

Type WAVE
Language English - United States
Codepage UNKNOWN
Size 0xb8ae
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.82859
Detected Filetype WAV Resource Interchange File Format
Detected Filetype (#2) Windows animated cursor
MD5 0a99c2959767ed466744001c0eb21811
SHA1 796202c7972144a02c87831b6b56da49f6dafb5a
SHA256 53326b9bde2330d1eea2db8cc63d10502bb319c931d2ad3965f55f18b764e2ed
SHA3 fbe3f520baeae1fc570582af478e8fae6fc6532f2292afcc41fb892f6d561dac

2002

Type WAVE
Language English - United States
Codepage UNKNOWN
Size 0xab2e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.75196
Detected Filetype WAV Resource Interchange File Format
Detected Filetype (#2) Windows animated cursor
MD5 0375a358c82360f1a4a6c4d08bdbf994
SHA1 bf58ecad772016fc2805d7ea8bd21a7f749f4ab2
SHA256 135e4627d2fd0d1191d68800d4616cdd31d6064e408b2d024a1c4dd0888543a5
SHA3 6bb5288e2431f6c074cf898477b52e576731783dd783e4f022b50677b2bcbb4d

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x13d55
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.93538
Detected Filetype PNG graphic file
MD5 88f78fa633b7d89515b68b0429825fd8
SHA1 4480c27d82a4ac1f43676254ef45c49595a45133
SHA256 6458223b849613748cf33797badd64143f51958f52ad56329af635fee00d1447
SHA3 9e0f5b030c9ba08415aeabcd70c5ed6cb2a3bac1e77afdf236a374f473640287

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.48253
MD5 3411418d7a91bb9956859e80a5cdd947
SHA1 1670df89f8e084c586fe8268db2f8dfb0cfc2f40
SHA256 b00599d2b84b45b6f43f5ee00f7b2e9aa40d86fd3a2abb6ebff690d82438da22
SHA3 4d30866bbc482f8d27eb701624f37586e7f525f5bc312527437aaf0de2ab3bc8

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.6265
MD5 5501159220a40b373f14c9033418d21d
SHA1 3882995ee41ece800d34e6d2d95fd607fed63805
SHA256 49b88ca532d1e2236255e74b4a61a53afd16a96154789039cac2316ffe2ef8d1
SHA3 f016bfcdd03fafc3def6d68e8e4db945a1e907eebe71598c8af551be64ee45c6

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.15332
MD5 7e78a0408389643f1aead18a64379785
SHA1 65d68bdbbc9b5759670723dcbdf7eb112e7698e5
SHA256 7b34955d867625ec124495ceec310d598949e3c6c24f6d19ff4e6635812ccaa8
SHA3 0cca1c305e1b826e61d109edd28df407d6103a591e0db24a2ce7efa32cc3a342

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.32148
MD5 31cbec3dd1611205a82bca02a3744483
SHA1 d5d3ce84b13be85b4c1d3a56789726c74fc2eb6e
SHA256 9dae0d2b6c87dccb0df6c23538ae51dc88d5679c8c8c4ee97799fe89469c480a
SHA3 4f5ca7d136498089595a4ecf740178be56711389df67f40d7b9c81c69402239a

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.09128
MD5 09265941deb3d32d69155ba8add55059
SHA1 12030176993e7d2222d57fefc1788b77545fddc3
SHA256 d1e134b85b7d4d1a5419f779339bd1713562481c2339aaf37ec1337d2343543b
SHA3 82de862b18ac2ecb5cb051733834efaec1c4b256d2c9f549b36ef6f1588ef9f2

101

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.8213
Detected Filetype Icon file
MD5 673a3275cbebe19450d05290fe158a68
SHA1 2d6d767f8ffa673b7aabadafcd047cf7d92f45ad
SHA256 f9840de5f4e903b49f41bf42487ba73ab4ea710fcd200c3eaecc7068aa29bad4
SHA3 e8156c93d6d2538871fb9f0aa77b20f1a7693b2685280cd27b72adf8b2136fad

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x388
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.33214
MD5 29962a5972a40986ff82e8cdbc31bc2b
SHA1 0918ef0b095677e4ee4dd9ba7a3c41710b2ea309
SHA256 59e6345e9c308704c1f76c379496414ec8e1c3dab46d0689aac002652d272888
SHA3 1d30993731ad2b963167138da2069d8437547513bc7df985930e8de28860ddc4

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags VS_FF_PRERELEASE
VS_FF_PRIVATEBUILD
FileOs (EMPTY)
FileType VFT_APP
Language English - United States
CompanyName MrAntiFun.net
FileDescription MrAntiFun Trainer Engine
FileVersion (#2) 1.03
InternalName MrAntiFun
LegalCopyright Copyrights MrAntiFun.net © 2013-2019
LegalTrademarks1 MrAntiFun
LegalTrademarks2 MrAntiFun.net
OriginalFilename Trainer.exe
ProductName MrAntiFun Trainer Engine
ProductVersion (#2) 1.03
Resource LangID English - United States

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2018-Dec-29 20:40:55
Version 0.0
SizeofData 876
AddressOfRawData 0x6d1c4
PointerToRawData 0x6bbc4

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2018-Dec-29 20:40:55
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x5c
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x46e36c
SEHandlerTable 0x46d1c0
SEHandlerCount 1

RICH Header

XOR Key 0x4fd29f43
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 12
Imports (VS2008 build 21022) 2
Imports (VS2015 UPD3 build 24123) 4
ASM objects (VS2015 UPD3 build 24123) 1
C++ objects (VS2015 UPD3 build 24123) 31
C objects (VS2015 UPD3 build 24123) 13
Imports (65501) 7
Total imports 84
C++ objects (LTCG) (VS2015 UPD3.1 build 24215) 1
C++ objects (VS2015 UPD3.1 build 24215) 1
Resource objects (VS2015 UPD3 build 24210) 1
151 1
Linker (VS2015 UPD3.1 build 24215) 1

Errors

Leave a comment

No comments yet.