Autor
¿Alguna idea para desempaquetar esto o que packer contiene realmente?
Ningun tipo de script me anduvo de EXECryptor.
-> Es una DLL por las dudas
(El tema es que tiene diferentes sections) (Cosa que el comun no lo tiene)
Cheating Death v4.33.4 - (cs 1.6)
RDG Packer Detector v0.7.6 ->
Citar
<<Multiple Protections>>
======================
EXECryptor Deteccion Heuristica
EXECryptor (Compress Code & Data)
EXECryptor v2.1.15
EXECryptor v2.2.x - v2.4.x
======================
EXECryptor Deteccion Heuristica
EXECryptor (Compress Code & Data)
EXECryptor v2.1.15
EXECryptor v2.2.x - v2.4.x
PROTECTiON iD ->
Citar
Scanning -> E:\aaaCheating-Death\Cheating-Death\4.33.4\cd.dll
File Compression State : 0 (Not Compressed)
File Type : 32-Bit Dll (Subsystem : Win GUI / 2), Size : 425984 (068000h) Byte(s) | Machine: 0x14C (I386)
Compilation TimeStamp : 0x43988949 -> Thu 08th Dec 2005 19:28:09 (GMT)
[TimeStamp] 0x43988949 -> Thu 08th Dec 2005 19:28:09 (GMT) | PE Header | - | Offset: 0x00000068 | VA: 0x10000068 | -
[!] Executable uses TLS callbacks (1 total... 0 invalid addresses)
[LoadConfig] CodeIntegrity -> Flags 0xA3F0 | Catalog 0x46 (70) | Catalog Offset 0x2000001 | Reserved 0x46A4A0
[LoadConfig] GuardAddressTakenIatEntryTable 0x8000011 | Count 0x46A558 (4629848)
[LoadConfig] GuardLongJumpTargetTable 0x8000001 | Count 0x46A5F8 (4630008)
[LoadConfig] HybridMetadataPointer 0x8000011 | DynamicValueRelocTable 0x46A66C
[LoadConfig] FailFastIndirectProc 0x8000011 | FailFastPointer 0x46C360
[LoadConfig] UnknownZero1 0x8000011
[File Heuristics] -> Flag #1 : 00000000000000001100001000100011 (0x0000C223)
[Entrypoint Section Entropy] : 7.99 (section #5) "8rca826h" | Size : 0x66B28 (420648) byte(s)
[DllCharacteristics] -> Flag : (0x0000) -> NONE
[SectionCount] 7 (0x7) | ImageSize 0x11F000 (1175552) byte(s)
[ModuleReport] [IAT] Modules -> kernel32.dll | user32.dll
[!] EXE Cryptor v2.2.0 - v2.2.6 detected !
- Scan Took : 0.219 Second(s) [0000000DBh (219) tick(s)] [246 of 580 scan(s) done]
File Compression State : 0 (Not Compressed)
File Type : 32-Bit Dll (Subsystem : Win GUI / 2), Size : 425984 (068000h) Byte(s) | Machine: 0x14C (I386)
Compilation TimeStamp : 0x43988949 -> Thu 08th Dec 2005 19:28:09 (GMT)
[TimeStamp] 0x43988949 -> Thu 08th Dec 2005 19:28:09 (GMT) | PE Header | - | Offset: 0x00000068 | VA: 0x10000068 | -
[!] Executable uses TLS callbacks (1 total... 0 invalid addresses)
[LoadConfig] CodeIntegrity -> Flags 0xA3F0 | Catalog 0x46 (70) | Catalog Offset 0x2000001 | Reserved 0x46A4A0
[LoadConfig] GuardAddressTakenIatEntryTable 0x8000011 | Count 0x46A558 (4629848)
[LoadConfig] GuardLongJumpTargetTable 0x8000001 | Count 0x46A5F8 (4630008)
[LoadConfig] HybridMetadataPointer 0x8000011 | DynamicValueRelocTable 0x46A66C
[LoadConfig] FailFastIndirectProc 0x8000011 | FailFastPointer 0x46C360
[LoadConfig] UnknownZero1 0x8000011
[File Heuristics] -> Flag #1 : 00000000000000001100001000100011 (0x0000C223)
[Entrypoint Section Entropy] : 7.99 (section #5) "8rca826h" | Size : 0x66B28 (420648) byte(s)
[DllCharacteristics] -> Flag : (0x0000) -> NONE
[SectionCount] 7 (0x7) | ImageSize 0x11F000 (1175552) byte(s)
[ModuleReport] [IAT] Modules -> kernel32.dll | user32.dll
[!] EXE Cryptor v2.2.0 - v2.2.6 detected !
- Scan Took : 0.219 Second(s) [0000000DBh (219) tick(s)] [246 of 580 scan(s) done]
En línea
