This one is attack_normal.exe (the actual BMax exe) which is the second main part that spielerrei.exe splits into.
So, once the file has hatched nothing is detected by any major antivir products. There is only a tiny chance of detection with the original spielerrei.exe.
File attack_normal.exe received on 12.17.2008 14:22:36 (CET)
Current status: finished
Result: 0/38 (0.00%)
Compact Compact
Print results Print results
Antivirus Version Last Update Result
AhnLab-V3 2008.12.17.3 2008.12.17 -
AntiVir 7.9.0.45 2008.12.17 -
Authentium 5.1.0.4 2008.12.17 -
Avast 4.8.1281.0 2008.12.16 -
AVG 8.0.0.199 2008.12.17 -
BitDefender 7.2 2008.12.17 -
CAT-QuickHeal 10.00 2008.12.17 -
ClamAV 0.94.1 2008.12.17 -
Comodo 771 2008.12.17 -
DrWeb 4.44.0.09170 2008.12.17 -
eSafe 7.0.17.0 2008.12.16 -
eTrust-Vet 31.6.6265 2008.12.17 -
Ewido 4.0 2008.12.17 -
F-Prot 4.4.4.56 2008.12.17 -
F-Secure 8.0.14332.0 2008.12.17 -
Fortinet 3.117.0.0 2008.12.17 -
GData 19 2008.12.17 -
Ikarus T3.1.1.45.0 2008.12.17 -
K7AntiVirus 7.10.555 2008.12.16 -
Kaspersky 7.0.0.125 2008.12.17 -
McAfee 5466 2008.12.16 -
McAfee+Artemis 5466 2008.12.16 -
Microsoft 1.4205 2008.12.17 -
NOD32 3698 2008.12.17 -
Norman 5.80.02 2008.12.16 -
Panda 9.0.0.4 2008.12.17 -
PCTools 4.4.2.0 2008.12.17 -
Prevx1 V2 2008.12.17 -
Rising 21.08.22.00 2008.12.17 -
SecureWeb-Gateway 6.7.6 2008.12.17 -
Sophos 4.37.0 2008.12.17 -
Sunbelt 3.2.1801.2 2008.12.11 -
Symantec 10 2008.12.17 -
TheHacker 6.3.1.4.189 2008.12.16 -
TrendMicro 8.700.0.1004 2008.12.17 -
VBA32 3.12.8.10 2008.12.16 -
ViRobot 2008.12.17.1523 2008.12.17 -
VirusBuster 4.5.11.0 2008.12.16 -
Additional information
File size: 892416 bytes
MD5...: 6ec4ad0dad2f490e81bbadfc90271297
SHA1..: 094b3556ebecce0a7f313b066922c6b6479d97fb
SHA256: 9424e3b908e42b259345938eff08c8b2c668d2ab2090e11d15123cdfacf91700
SHA512: 65ccb58214b16e6bad978dbb48cadb05a94e390aa843b7c998cccdd81f379bd2
44303674948ec07225138a2b1bd049defd4c546d7cb89f6f1c23a37135fe7da7
ssdeep: 12288:Adxif4k5Y1sfyT7d4SnYVwuPnFwPDPNAPFmNxZTPxPnF58p+DikV9qZH:R
Q11sqRnYV7PnGPDP+IPxPn
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.1%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x4012b0
timedatestamp.....: 0x4845abfa (Tue Jun 03 20:39:22 2008)
machinetype.......: 0x14c (I386)
( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x6f24 0x7000 6.32 d34dad9562f62f4897b6d5b990179bc3
code 0x8000 0x4425b 0x44400 5.93 7cff53c852345c29e2c5474f285df2e9
.data 0x4d000 0x420 0x600 1.38 8b963ae54e68d179ff9f4820d0e96505
data 0x4e000 0x8c1cc 0x8c200 5.36 2cac7c8d0a102f6314cb5c12e9cf3902
.rdata 0xdb000 0x450 0x600 4.38 93967891752a961c68a426b4e2b1384e
.bss 0xdc000 0x83e0 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.idata 0xe5000 0x17a0 0x1800 5.01 5da952257b849095ddfabcdebdebc3fc
( 11 imports )
> COMCTL32.DLL: _TrackMouseEvent
> COMDLG32.DLL: GetOpenFileNameA, GetSaveFileNameA
> GDI32.dll: BitBlt, ChoosePixelFormat, SetPixelFormat, SwapBuffers
> KERNEL32.dll: AddAtomA, CloseHandle, CreateProcessA, CreateThread, ExitProcess, FindAtomA, GetAtomNameA, GetCurrentThreadId, GetExitCodeProcess, GetFileAttributesA, GetFullPathNameA, GetLastError, GetModuleFileNameA, GetModuleHandleA, GetProcAddress, LoadLibraryA, SetUnhandledExceptionFilter, Sleep, WaitForSingleObject
> msvcrt.dll: _chdir, _chmod, _getcwd, _mkdir, _putenv, _rmdir, _stat
> msvcrt.dll: __getmainargs, __mb_cur_max, __p__environ, __p__fmode, __set_app_type, _assert, _cexit, _errno, _findclose, _findfirst, _findnext, _fullpath, _iob, _isctype, _onexit, _pctype, _setmode, abort, acos, asin, atexit, atof, ceil, cosh, exit, fclose, fflush, fgets, floor, fmod, fopen, fprintf, fputs, fread, free, fseek, ftell, fwrite, localtime, log10, malloc, memcpy, memmove, memset, pow, printf, remove, rename, signal, sinh, sprintf, strchr, strcmp, strcpy, strftime, strlen, strrchr, tan, tanh, time, toupper
> OPENGL32.DLL: glAlphaFunc, glBegin, glBindTexture, glBitmap, glBlendFunc, glClear, glClearColor, glColor4ubv, glDeleteTextures, glDisable, glDrawPixels, glEnable, glEnd, glGenTextures, glGetDoublev, glGetIntegerv, glGetTexLevelParameteriv, glLineWidth, glLoadIdentity, glLoadMatrixd, glMatrixMode, glOrtho, glPixelStorei, glPopAttrib, glPushAttrib, glRasterPos2i, glReadPixels, glScissor, glTexCoord2f, glTexImage2D, glTexParameteri, glTexSubImage2D, glVertex2f, glVertex2i, glViewport, wglCreateContext, wglDeleteContext, wglGetCurrentContext, wglGetProcAddress, wglMakeCurrent, wglShareLists
> SHELL32.DLL: SHBrowseForFolderA, SHGetPathFromIDListA, ShellExecuteA
> USER32.dll: AdjustWindowRect, AdjustWindowRectEx, CallNextHookEx, ChangeDisplaySettingsA, ClientToScreen, CreateWindowExA, DefWindowProcA, DestroyWindow, DispatchMessageA, EnumDisplaySettingsA, GetActiveWindow, GetClientRect, GetCursorPos, GetDC, GetFocus, GetForegroundWindow, GetKeyState, GetParent, GetWindowLongA, IsDialogMessageA, IsIconic, LoadCursorA, MessageBoxA, MsgWaitForMultipleObjects, PeekMessageA, PostThreadMessageA, RegisterClassA, ReleaseCapture, ScreenToClient, SendMessageA, SetCapture, SetCursorPos, SetFocus, SetWindowsHookExA, ShowCursor, ShowWindow, TranslateMessage, ValidateRect
> WINMM.DLL: timeBeginPeriod, timeEndPeriod, timeGetTime
> WSOCK32.DLL: WSACleanup, WSAStartup, __WSAFDIsSet, accept, bind, closesocket, connect, gethostbyaddr, gethostbyname, getpeername, getsockname, getsockopt, htonl, htons, listen, ntohl, ntohs, recv, recvfrom, select, send, sendto, setsockopt, shutdown, socket
( 0 exports )
Current status: finished
Result: 0/38 (0.00%)
Compact Compact
Print results Print results
Antivirus Version Last Update Result
AhnLab-V3 2008.12.17.3 2008.12.17 -
AntiVir 7.9.0.45 2008.12.17 -
Authentium 5.1.0.4 2008.12.17 -
Avast 4.8.1281.0 2008.12.16 -
AVG 8.0.0.199 2008.12.17 -
BitDefender 7.2 2008.12.17 -
CAT-QuickHeal 10.00 2008.12.17 -
ClamAV 0.94.1 2008.12.17 -
Comodo 771 2008.12.17 -
DrWeb 4.44.0.09170 2008.12.17 -
eSafe 7.0.17.0 2008.12.16 -
eTrust-Vet 31.6.6265 2008.12.17 -
Ewido 4.0 2008.12.17 -
F-Prot 4.4.4.56 2008.12.17 -
F-Secure 8.0.14332.0 2008.12.17 -
Fortinet 3.117.0.0 2008.12.17 -
GData 19 2008.12.17 -
Ikarus T3.1.1.45.0 2008.12.17 -
K7AntiVirus 7.10.555 2008.12.16 -
Kaspersky 7.0.0.125 2008.12.17 -
McAfee 5466 2008.12.16 -
McAfee+Artemis 5466 2008.12.16 -
Microsoft 1.4205 2008.12.17 -
NOD32 3698 2008.12.17 -
Norman 5.80.02 2008.12.16 -
Panda 9.0.0.4 2008.12.17 -
PCTools 4.4.2.0 2008.12.17 -
Prevx1 V2 2008.12.17 -
Rising 21.08.22.00 2008.12.17 -
SecureWeb-Gateway 6.7.6 2008.12.17 -
Sophos 4.37.0 2008.12.17 -
Sunbelt 3.2.1801.2 2008.12.11 -
Symantec 10 2008.12.17 -
TheHacker 6.3.1.4.189 2008.12.16 -
TrendMicro 8.700.0.1004 2008.12.17 -
VBA32 3.12.8.10 2008.12.16 -
ViRobot 2008.12.17.1523 2008.12.17 -
VirusBuster 4.5.11.0 2008.12.16 -
Additional information
File size: 892416 bytes
MD5...: 6ec4ad0dad2f490e81bbadfc90271297
SHA1..: 094b3556ebecce0a7f313b066922c6b6479d97fb
SHA256: 9424e3b908e42b259345938eff08c8b2c668d2ab2090e11d15123cdfacf91700
SHA512: 65ccb58214b16e6bad978dbb48cadb05a94e390aa843b7c998cccdd81f379bd2
44303674948ec07225138a2b1bd049defd4c546d7cb89f6f1c23a37135fe7da7
ssdeep: 12288:Adxif4k5Y1sfyT7d4SnYVwuPnFwPDPNAPFmNxZTPxPnF58p+DikV9qZH:R
Q11sqRnYV7PnGPDP+IPxPn
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.1%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x4012b0
timedatestamp.....: 0x4845abfa (Tue Jun 03 20:39:22 2008)
machinetype.......: 0x14c (I386)
( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x6f24 0x7000 6.32 d34dad9562f62f4897b6d5b990179bc3
code 0x8000 0x4425b 0x44400 5.93 7cff53c852345c29e2c5474f285df2e9
.data 0x4d000 0x420 0x600 1.38 8b963ae54e68d179ff9f4820d0e96505
data 0x4e000 0x8c1cc 0x8c200 5.36 2cac7c8d0a102f6314cb5c12e9cf3902
.rdata 0xdb000 0x450 0x600 4.38 93967891752a961c68a426b4e2b1384e
.bss 0xdc000 0x83e0 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.idata 0xe5000 0x17a0 0x1800 5.01 5da952257b849095ddfabcdebdebc3fc
( 11 imports )
> COMCTL32.DLL: _TrackMouseEvent
> COMDLG32.DLL: GetOpenFileNameA, GetSaveFileNameA
> GDI32.dll: BitBlt, ChoosePixelFormat, SetPixelFormat, SwapBuffers
> KERNEL32.dll: AddAtomA, CloseHandle, CreateProcessA, CreateThread, ExitProcess, FindAtomA, GetAtomNameA, GetCurrentThreadId, GetExitCodeProcess, GetFileAttributesA, GetFullPathNameA, GetLastError, GetModuleFileNameA, GetModuleHandleA, GetProcAddress, LoadLibraryA, SetUnhandledExceptionFilter, Sleep, WaitForSingleObject
> msvcrt.dll: _chdir, _chmod, _getcwd, _mkdir, _putenv, _rmdir, _stat
> msvcrt.dll: __getmainargs, __mb_cur_max, __p__environ, __p__fmode, __set_app_type, _assert, _cexit, _errno, _findclose, _findfirst, _findnext, _fullpath, _iob, _isctype, _onexit, _pctype, _setmode, abort, acos, asin, atexit, atof, ceil, cosh, exit, fclose, fflush, fgets, floor, fmod, fopen, fprintf, fputs, fread, free, fseek, ftell, fwrite, localtime, log10, malloc, memcpy, memmove, memset, pow, printf, remove, rename, signal, sinh, sprintf, strchr, strcmp, strcpy, strftime, strlen, strrchr, tan, tanh, time, toupper
> OPENGL32.DLL: glAlphaFunc, glBegin, glBindTexture, glBitmap, glBlendFunc, glClear, glClearColor, glColor4ubv, glDeleteTextures, glDisable, glDrawPixels, glEnable, glEnd, glGenTextures, glGetDoublev, glGetIntegerv, glGetTexLevelParameteriv, glLineWidth, glLoadIdentity, glLoadMatrixd, glMatrixMode, glOrtho, glPixelStorei, glPopAttrib, glPushAttrib, glRasterPos2i, glReadPixels, glScissor, glTexCoord2f, glTexImage2D, glTexParameteri, glTexSubImage2D, glVertex2f, glVertex2i, glViewport, wglCreateContext, wglDeleteContext, wglGetCurrentContext, wglGetProcAddress, wglMakeCurrent, wglShareLists
> SHELL32.DLL: SHBrowseForFolderA, SHGetPathFromIDListA, ShellExecuteA
> USER32.dll: AdjustWindowRect, AdjustWindowRectEx, CallNextHookEx, ChangeDisplaySettingsA, ClientToScreen, CreateWindowExA, DefWindowProcA, DestroyWindow, DispatchMessageA, EnumDisplaySettingsA, GetActiveWindow, GetClientRect, GetCursorPos, GetDC, GetFocus, GetForegroundWindow, GetKeyState, GetParent, GetWindowLongA, IsDialogMessageA, IsIconic, LoadCursorA, MessageBoxA, MsgWaitForMultipleObjects, PeekMessageA, PostThreadMessageA, RegisterClassA, ReleaseCapture, ScreenToClient, SendMessageA, SetCapture, SetCursorPos, SetFocus, SetWindowsHookExA, ShowCursor, ShowWindow, TranslateMessage, ValidateRect
> WINMM.DLL: timeBeginPeriod, timeEndPeriod, timeGetTime
> WSOCK32.DLL: WSACleanup, WSAStartup, __WSAFDIsSet, accept, bind, closesocket, connect, gethostbyaddr, gethostbyname, getpeername, getsockname, getsockopt, htonl, htons, listen, ntohl, ntohs, recv, recvfrom, select, send, sendto, setsockopt, shutdown, socket
( 0 exports )
So, once the file has hatched nothing is detected by any major antivir products. There is only a tiny chance of detection with the original spielerrei.exe.