[abdrh90]

it has a key logger in it.. why you make other people fool..

[mothered]

it has a key logger in it.. why you make other people fool..

This Is unsubstantiated.

If you can support your claim with reputable sources, we can then make an Informed decision on the file's contents.

[abdrh90]

I have experence in making keyloggers using python and then changing into exe and then merging that file in the rar is same and it has no icon which is 1st proof. second if you run that file or anything file which uses python source changed into exe by compiling it need net2.0 and on every RDP it will say could not find it.. so here is my 2nd proof

READ 2 TIME's if you do not understand..

[mothered]

I have experence in making keyloggers using python and then changing into exe and then merging that file in the rar is same and it has no icon which is 1st proof. second if you run that file or anything file which uses python source changed into exe by compiling it need net2.0 and on every RDP it will say could not find it.. so here is my 2nd proof

READ 2 TIME's if you do not understand..

Your reply Is unintelligible and not relative to the file In question. You've simply provided an analogy based on generality with no specific validity to both the file contributed, and what was asked of you.

You've mentioned:

it has a key logger in it.

Solidify your above statement with proof of Infection pertaining to the OP's file.
Period.

[deathmsg]

@mothered can u please clarify if its safe?
if u use it its really working?
thanks

[mothered]

@mothered can u please clarify if its safe?
if u use it its really working?
thanks

I've yet to test It.

I suggest running It In a VM and/or Sandboxie.

[VBQL]

Long post incoming idk if this is against the rules...

A simple strings reveals these information (Place, time and programs used to create it):

Code:

C:\Users\Envyscient\Documents\Visual Studio 2013\Projects\RoyalViewer\RoyalViewer\obj\Release\RoyalViewer.pdb <xmp:MetadataDate>2014-03-08T13:55:17+02:00</xmp:MetadataDate> <dc:format>image/png</dc:format> <photoshop:ColorMode>3</photoshop:ColorMode> <photoshop:TextLayers> <rdf:Bag> <rdf:li rdf:parseType="Resource"> <photoshop:LayerName>Royal Viewer</photoshop:LayerName> <photoshop:LayerText>Royal Viewer</photoshop:LayerText> </rdf:li> <rdf:li rdf:parseType="Resource"> <photoshop:LayerName>The best FREE YouTube Views Bot is loading...</photoshop:LayerName> <photoshop:LayerText>The best FREE YouTube Views Bot is loading...</photoshop:LayerText> </rdf:li> <rdf:li rdf:parseType="Resource"> <photoshop:LayerName>By SEO</photoshop:LayerName> <photoshop:LayerText>By SEO</photoshop:LayerText>

However I do see this:

Code:

[Modules] VirtualKeyboard _VirtualKeyboard1 get_VirtualKeyboard1 set_VirtualKeyboard1

Ok... time to expose myself of insufficient knowledge of what these are used for in this program because I really don't wanna look at assembly code to figure it out but let's keep going...

Being the lazy person that I am, let's throw it into Joe's sandbox.. nothing can go wrong yeah?

Report: https://www.joesandbox.com/analysis/35435/0/html

Code:

http://winhelp2002.mvps.org/hosts.txt

Ok... the host file.... understandable....

Code:

http://www.cpaelites.com/User-SEO

Ok... the creator seems to be this guy...

Looking at all of the pastebin references, it seems that it either
1. grabs data from pastebin
2. uploads data to pastebin although unlikely

It seems to also have a virtual keyboard feature, so that explains the previous module.

Code:

http://ksksks.barsiksuperkot.org/?utm_medium=0b55674fb5dbcffa531ca5159eb4b7420bc4fb78&utm_campaign=177 http://imprismail.com/affiliate/referral.asp?site=rea&url=pop/en/ukc/1&aff_id=5843_27027_19234_535127_1_357_

It does connect to some ad services though. So just keep that in mind.

All in all, in a roughly 5 minute analysis I think it doesn't include a keylogger, but do note it tries to contact pastebin for info and also directs you to some weird ad pages.

Clearly, the creator didn't really try to obfuscate or to strip debugging symbols, so that should mean it's not *that* suspicious??

Exercise caution, don't run it on a physical machine lol (I feel like I just repeated but mothered said but oh well )

[GalixHoster]

Long post incoming idk if this is against the rules...

A simple strings reveals these information (Place, time and programs used to create it):

Code:

C:\Users\Envyscient\Documents\Visual Studio 2013\Projects\RoyalViewer\RoyalViewer\obj\Release\RoyalViewer.pdb         <xmp:MetadataDate>2014-03-08T13:55:17+02:00</xmp:MetadataDate>         <dc:format>image/png</dc:format>         <photoshop:ColorMode>3</photoshop:ColorMode>         <photoshop:TextLayers>            <rdf:Bag>               <rdf:li rdf:parseType="Resource">                  <photoshop:LayerName>Royal Viewer</photoshop:LayerName>                  <photoshop:LayerText>Royal Viewer</photoshop:LayerText>               </rdf:li>               <rdf:li rdf:parseType="Resource">                  <photoshop:LayerName>The best FREE YouTube Views Bot is loading...</photoshop:LayerName>                  <photoshop:LayerText>The best FREE YouTube Views Bot is loading...</photoshop:LayerText>               </rdf:li>               <rdf:li rdf:parseType="Resource">                  <photoshop:LayerName>By SEO</photoshop:LayerName>                  <photoshop:LayerText>By SEO</photoshop:LayerText>

However I do see this:

Code:

[Modules] VirtualKeyboard _VirtualKeyboard1 get_VirtualKeyboard1 set_VirtualKeyboard1

Ok... time to expose myself of insufficient knowledge of what these are used for in this program because I really don't wanna look at assembly code to figure it out but let's keep going...

Being the lazy person that I am, let's throw it into Joe's sandbox.. nothing can go wrong yeah?

Report: https://www.joesandbox.com/analysis/35435/0/html

Code:

http://winhelp2002.mvps.org/hosts.txt

Ok... the host file.... understandable....

Code:

http://www.cpaelites.com/User-SEO

Ok... the creator seems to be this guy...

Looking at all of the pastebin references, it seems that it either
1. grabs data from pastebin
2. uploads data to pastebin although unlikely

It seems to also have a virtual keyboard feature, so that explains the previous module.

Code:

http://ksksks.barsiksuperkot.org/?utm_medium=0b55674fb5dbcffa531ca5159eb4b7420bc4fb78&utm_campaign=177 http://imprismail.com/affiliate/referral.asp?site=rea&url=pop/en/ukc/1&aff_id=5843_27027_19234_535127_1_357_

It does connect to some ad services though. So just keep that in mind.

All in all, in a roughly 5 minute analysis I think it doesn't include a keylogger, but do note it tries to contact pastebin for info and also directs you to some weird ad pages.

Clearly, the creator didn't really try to obfuscate or to strip debugging symbols, so that should mean it's not *that* suspicious??

Exercise caution, don't run it on a physical machine lol (I feel like I just repeated but mothered said but oh well )

Just to be clear I didn't make this...

[VBQL]

Just to be clear I didn't make this...

Woah... quoted my entire reply oh noes!

Annd I don't think I mentioned you anywhere in this? 0.0

[GalixHoster]

Just to be clear I didn't make this...

Woah... quoted my entire reply oh noes!

Annd I don't think I mentioned you anywhere in this? 0.0

I didn't say you did. I was just making it clear.