Thanks for being careful! I've uploaded all the executables to virustotal to doublecheck.
The sro_client indeed looks fishy to me. I just gave it a scan with Avast and Malwarebytes before and considered it to be clean. 11/66 still could be a false positive. I'll keep you updated.
Edit 0: The entry point is not what it should look like
(For reference: This is what it should look like ->
)
Edit 1: I've logged what it does on startup. Logfile is appended.
Nothing suspicious so far. The detection might come from a packer Joymax used.
Edit 2: Looks more and more like a simple packer. I removed the invalid instructions and unnecessary jumps.
Code:
.pseudo:00C1F000 public start
.pseudo:00C1F000 start proc near
.pseudo:00C1F000
.pseudo:00C1F000 var_54 = dword ptr -54h
.pseudo:00C1F000 var_50 = dword ptr -50h
.pseudo:00C1F000 var_4C = dword ptr -4Ch
.pseudo:00C1F000 arg_C = dword ptr 10h
.pseudo:00C1F000 arg_18 = dword ptr 1Ch
.pseudo:00C1F000 arg_1C = dword ptr 20h
.pseudo:00C1F000 arg_40 = dword ptr 44h
.pseudo:00C1F000 arg_44 = dword ptr 48h
.pseudo:00C1F000
.pseudo:00C1F000 ; FUNCTION CHUNK AT .pseudo:00C1F073 SIZE 00000180 BYTES
.pseudo:00C1F000
.pseudo:00C1F000 mov ebx, 12Eh
.pseudo:00C1F005 jmp loc_C1F073
.pseudo:00C1F073 ; ---------------------------------------------------------------------------
.pseudo:00C1F073 ; START OF FUNCTION CHUNK FOR start
.pseudo:00C1F073 call $+5
.pseudo:00C1F078 pop ebp
.pseudo:00C1F079 sub ebp, 4BE14Dh
.pseudo:00C1F07F lea eax, [ebp+4BE0F2h]
.pseudo:00C1F085 lea ecx, [ebp+4BE194h]
.pseudo:00C1F08B add ecx, ebx
.pseudo:00C1F08D mov [ecx+1], eax
.pseudo:00C1F090 lea eax, [ebp+4BE136h]
.pseudo:00C1F096 lea ecx, [ebp+4BE0FAh]
.pseudo:00C1F09C mov [ecx], eax
.pseudo:00C1F09E mov eax, 145Eh
.pseudo:00C1F0A3 lea ecx, [ebp+4BE0FFh]
.pseudo:00C1F0A9 mov [ecx], eax
.pseudo:00C1F0AB lea ecx, [ebp+4BE194h]
.pseudo:00C1F0B1 lea eax, [ebp+4BF394h]
.pseudo:00C1F0B7 push ecx
.pseudo:00C1F0B8 push eax
.pseudo:00C1F0B9 call sub_C1F034
.pseudo:00C1F0BE popa
.pseudo:00C1F0CA push 2273CBD4h
.pseudo:00C1F0CF push 7FE7F412h
.pseudo:00C1F0D4 mov [esp-1Ch+arg_1C], ebp
.pseudo:00C1F0DC add esp, 4
.pseudo:00C1F0E7 lea ebp, [ebp+ebp*2+2Ah]
.pseudo:00C1F0EE mov ebp, [esp-20h+arg_44]
.pseudo:00C1F0F7 push 1Bh
.pseudo:00C1F0FC pop ebp
.pseudo:00C1F110 pop ebp
.pseudo:00C1F115 mov ebp, [esp+0]
.pseudo:00C1F123 bt bp, dx
.pseudo:00C1F127 pop ebp
.pseudo:00C1F12D lea esp, [esp-1Eh]
.pseudo:00C1F134 lea esp, [esp+edx+1Ah]
.pseudo:00C1F138 sub esp, edx
.pseudo:00C1F13D push ebp
.pseudo:00C1F142 pop dword ptr [esp+0]
.pseudo:00C1F146 mov ebp, esp
// Stolen OEP begins here
.pseudo:00C1F148 push 0FFFFFFFFh
.pseudo:00C1F14A push offset unk_8F3D60
.pseudo:00C1F14F push offset sub_811A08
.pseudo:00C1F154 mov eax, large fs:0
.pseudo:00C1F15F lea esp, [esp-1Eh]
.pseudo:00C1F166 lea esp, [esp+edx+1Ah]
.pseudo:00C1F16A sub esp, edx
.pseudo:00C1F16F push eax
.pseudo:00C1F174 pop dword ptr [esp+0]
.pseudo:00C1F178 mov large fs:0, esp
.pseudo:00C1F17F sub esp, 58h
.pseudo:00C1F187 lea esp, [esp-1Eh]
.pseudo:00C1F18E lea esp, [esp+edx+1Ah]
.pseudo:00C1F192 sub esp, edx
.pseudo:00C1F197 push ebx
.pseudo:00C1F19C pop dword ptr [esp+0]
.pseudo:00C1F1A5 lea esp, [esp-1Eh]
.pseudo:00C1F1AC lea esp, [esp+edx+1Ah]
.pseudo:00C1F1B0 sub esp, edx
.pseudo:00C1F1B5 push esi
.pseudo:00C1F1BA pop [esp+4Ch+var_4C]
.pseudo:00C1F1C3 lea esp, [esp-1Eh]
.pseudo:00C1F1CA lea esp, [esp+edx+1Ah]
.pseudo:00C1F1CE sub esp, edx
.pseudo:00C1F1D3 push edi
.pseudo:00C1F1D8 pop [esp+50h+var_50]
.pseudo:00C1F1DC mov [ebp-18h], esp
// stolen OEP ends somewhere here
.pseudo:00C1F1E8 push offset EntryPoint
.pseudo:00C1F1ED push 0
.pseudo:00C1F1F2 retn
.pseudo:00C1F1F2 ; END OF FUNCTION CHUNK FOR start
.pseudo:00C1F1F2 ; ---------------------------------------------------------------------------
Edit 3: Its really just some kind of packer. The remaining instructions above are a small loader that fixes some addresses for hiding evidence of its existence. The RETN at the end acts as a redirect to the last pushed address (which is not null, its overwritten by the loader). The RETN jumps to the "HideMyEvicence" function and then jumps to the OEP. The instructions before the RETN are, at least what i've been tought, "called" stolen OEP. I will try to put the OEP back in place, lol.
Edit 4: I stole the OEP from Silkroad.exe and pasted it into sro_client.exe. It now works, i've removed all the "malicous" code and renamed the sections to their original names. But still ... some dont like it:
Edit 5: Turns out: With malicious entry point still existing, Avira is happy. Once i delete the EP, Avira is unhappy. Meh. I'm performing a bindiff to v1.005 to check for other changes.
Edit 6: Still no malicious behavior. I have restored the entry point and removed the loader stuff. File is attached.
. I've added what I found on my disk.
