Programm for the fight (4th edition)

[XBott94]

Here is a programm which I made to simulate an enemy in GURPS. It is only the BETA and it will get some new features in the future. So if you find a bug or something which goes wrong send me a message.

Features:
-basic-attributes
-skills (you can add 12)and skill-rolls
-basic-rolls (HT-rolls,ST-rolls,...)
-modifiers for skill- and basic-rolls
- fp and hp damage function (if you use eg.-1 you will get 1 point of hp/fp back)
-unconscious and dead messages

here is a picture of the programm:
https://www.dropbox.com/s/9hbuu680himxz3p/GURPS.PNG


source code:
https://www.dropbox.com/s/po0w836lkf...Code-GURPS.txt

and the projectfolder:
https://www.dropbox.com/sh/fh7gw97zjldym5e/SJIB-lSM72

Download-Link:
http://adf.ly/GhRfH Dropbox-Link
http://adf.ly/GlWef Mediafire-Link

I hope you will have fun with that programm ;)

[joppeknol]

You're not long on the forum (as far as I can see) and it is an exe without source code. I don't think people should download it, unless someone can vouch that it is safe. I would advise you to include source code so that people can check.

Not that I specifically suspect wrong intentions. It is just that one can better be safe than sorry nowadays (unfortunately)

[jeff_wilson]

reported as Spam+malware or piracy, link leads to "movie downloader" exe

[XBott94]

Originally Posted by jeff_wilson

reported as Spam+malware or piracy, link leads to "movie downloader" exe

you have to hit the skip advertisement button in the upper right corner. zhis page only makes the link shorter and adds some advertising that you have to skip too get the programm.

[jeff_wilson]

There's no limit on link length here.

https://www.dropbox.com/s/lxfi7uf388...Beta%20v.1.exe

is fine.


The file showed clean on my system, ran without an installer, and did not challenge my protections other than the original permission to execute.

[ClayDowling]

I haven't fully reversed it, but a first pass suggests a lot of calls into the crypto api that aren't necessary unless you're trying to conceal communication with a command and control server. Also a lot of calls into the threading API that a normal Delphi program doesn't use. Also a lot of calls into ACL apis, which you would make if you were trying to run a privilege escalation. Which fits with all of the calls for creating and running Nt services that I found.

I wouldn't run it on bare metal, put it in an isolated virtual machine with an air gap. Delphi 7 is a fairly popular tool in the European malware scene. And make sure you don't use that VM for anything else.

I may pass this over to my colleagues who do spend their days reversing malware. Could be a neat new tool. But this thing is almost certainly adding your computer to a botnet, and if you monitor your network traffic there's a good chance that you'll find email going out for boner pills.

[Blind Mapmaker]

Why would anybody with a dropbox account put the actual programme on another site and a screenshot on dropbox? This looks pretty bad. Though I have to say that if this is an attempt to distribute malware it's pretty hilarious. Spending enough time to make a not totally ridiculous game utility and then distributing it under a user name that screams bot net complete with a fake German accent is a pretty entertaining performance.

No offence XBott94, but you could have deflected a lot of suspicion by choosing another user name and not using a link obfuscation site to host your game aid. Trying to get people to download an .exe file in your first post doesn't help. I'm pretty relaxed when it comes to downloading stuff and even I wouldn't touch this with a ten foot pole.

[JCurwen3]

Originally Posted by ClayDowling

I haven't fully reversed it, but a first pass suggests a lot of calls into the crypto api that aren't necessary unless you're trying to conceal communication with a command and control server. Also a lot of calls into the threading API that a normal Delphi program doesn't use. Also a lot of calls into ACL apis, which you would make if you were trying to run a privilege escalation. Which fits with all of the calls for creating and running Nt services that I found.

The crypto API could be used to create better pseudo-random numbers than standard approaches; I use it to generate them myself in a personal program for dice rolls. The other stuff is very suspicious though; can't see why those would be necessary for this sort of program.

[Classic Uncle Sam]

Hmm, not posting all of the source code...

Omission is usually the first step in nefarious deception. Those more savvy in code than I seem to be saying that this is dubious at best.

I say we play it safe and nuke it from orbit. Kill it with fire. Wrath of Mod.

I hope I don't get "sick" from looking at the picture...

I grasp just enough of ClayDowling's assessment to be paranoid.

[jeff_wilson]

Originally Posted by ClayDowling

if you monitor your network traffic there's a good chance that you'll find email going out for boner pills.

Is there an easy way to do this sort of monitoring?