Detecting CD-COPS String in CDCOPS.DLL

Open Flashfire42 opened this issue 3 years ago • 2 comments

In 2 of the 3 samples I have been able to examine so far of the CDCOPS.DLL this string is at the same offset every time in the third sample it is off by 1 but the string is still there. The files are all NEEXE according to virustotal which may make things more difficult to parse. If I get further info on the dll I will update this issue. They are also reportably all 16bit windows applications

Mar 09 '22 23:03 Flashfire42

If you can provide samples, this would be helpful. Otherwise, check latest to see if it's taken care of already.

Jul 11 '22 22:07 mnadareski

I can confirm that this check is now present and functional.

Dec 14 '22 18:12 TheRogueArchivist