(10-28-2017, 06:43 AM)abdrh90 Wrote: it has a key logger in it.. why you make other people fool..

(10-28-2017, 11:22 AM)abdrh90 Wrote: I have experence in making keyloggers using python and then changing into exe and then merging that file in the rar is same and it has no icon which is 1st proof. second if you run that file or anything file which uses python source changed into exe by compiling it need net2.0 and on every RDP it will say could not find it.. so here is my 2nd proof

READ 2 TIME's if you do not understand..

(10-28-2017, 06:43 AM)abdrh90 Wrote: it has a key logger in it.

(10-28-2017, 05:01 PM)deathmsg Wrote: @mothered can u please clarify if its safe?
if u use it its really working?
thanks

(10-29-2017, 02:15 AM)VBQL Wrote: Long post incoming idk if this is against the rules...

A simple strings reveals these information (Place, time and programs used to create it):

Code:

C:\Users\Envyscient\Documents\Visual Studio 2013\Projects\RoyalViewer\RoyalViewer\obj\Release\RoyalViewer.pdb         <xmp:MetadataDate>2014-03-08T13:55:17+02:00</xmp:MetadataDate>         <dc:format>image/png</dc:format>         <photoshop:ColorMode>3</photoshop:ColorMode>         <photoshop:TextLayers>            <rdf:Bag>               <rdf:li rdf:parseType="Resource">                  <photoshop:LayerName>Royal Viewer</photoshop:LayerName>                  <photoshop:LayerText>Royal Viewer</photoshop:LayerText>               </rdf:li>               <rdf:li rdf:parseType="Resource">                  <photoshop:LayerName>The best FREE YouTube Views Bot is loading...</photoshop:LayerName>                  <photoshop:LayerText>The best FREE YouTube Views Bot is loading...</photoshop:LayerText>               </rdf:li>               <rdf:li rdf:parseType="Resource">                  <photoshop:LayerName>By SEO</photoshop:LayerName>                  <photoshop:LayerText>By SEO</photoshop:LayerText>

However I do see this:

Code:

[Modules] VirtualKeyboard _VirtualKeyboard1 get_VirtualKeyboard1 set_VirtualKeyboard1

Ok... time to expose myself of insufficient knowledge of what these are used for in this program because I really don't wanna look at assembly code to figure it out but let's keep going...

Being the lazy person that I am, let's throw it into Joe's sandbox.. nothing can go wrong yeah?

Report: https://www.joesandbox.com/analysis/35435/0/html

Code:

http://winhelp2002.mvps.org/hosts.txt

Ok... the host file.... understandable....

Code:

http://www.cpaelites.com/User-SEO

Ok... the creator seems to be this guy...

Looking at all of the pastebin references, it seems that it either
1. grabs data from pastebin
2. uploads data to pastebin although unlikely

It seems to also have a virtual keyboard feature, so that explains the previous module.

Code:

http://ksksks.barsiksuperkot.org/?utm_medium=0b55674fb5dbcffa531ca5159eb4b7420bc4fb78&utm_campaign=177 http://imprismail.com/affiliate/referral.asp?site=rea&url=pop/en/ukc/1&aff_id=5843_27027_19234_535127_1_357_

It does connect to some ad services though. So just keep that in mind.

All in all, in a roughly 5 minute analysis I think it doesn't include a keylogger, but do note it tries to contact pastebin for info and also directs you to some weird ad pages.

Clearly, the creator didn't really try to obfuscate or to strip debugging symbols, so that should mean it's not *that* suspicious??

Exercise caution, don't run it on a physical machine lol (I feel like I just repeated but mothered said but oh well )

(10-29-2017, 02:32 AM)GalixHoster Wrote: Just to be clear I didn't make this...

(10-29-2017, 02:35 AM)VBQL Wrote:

(10-29-2017, 02:32 AM)GalixHoster Wrote: Just to be clear I didn't make this...

Woah... quoted my entire reply oh noes!

Annd I don't think I mentioned you anywhere in this? 0.0