Architecture |
IMAGE_FILE_MACHINE_I386
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
Compilation Date | 2005-Nov-28 05:16:06 |
Detected languages |
English - United States
Korean - Korea |
CompanyName | WebZen |
FileDescription | main |
FileVersion | 1, 1, 46, 0 |
InternalName | main |
LegalCopyright | Copyright ⓒ 2002 |
OriginalFilename | main.exe |
ProductName | WebZen mu main |
ProductVersion | 1, 0, 0, 1 |
Info | Interesting strings found in the binary: |
Contains domain names:
|
Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
Suspicious | This PE is packed with VMProtect |
Unusual section name found: .vmp0
Unusual section name found: .vmp1 The number of imports reported in the RICH header is inconsistent. |
Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
Malicious | VirusTotal score: 11/72 (Scanned on 2024-12-02 01:50:06) |
Antiy-AVL:
Trojan/Win32.Wacatac
Cylance: Unsafe Elastic: malicious (moderate confidence) FireEye: Generic.mg.004b061900843397 Gridinsoft: Trojan.Win32.Gen.vb!n Malwarebytes: Malware.AI.4235417436 MaxSecure: Trojan.Malware.300983.susgen McAfeeD: ti!C2BAFCBB3D2A Skyhigh: BehavesLike.Win32.Backdoor.tc Sophos: Generic ML PUA (PUA) Trapmine: suspicious.low.ml.score |
e_magic | MZ |
---|---|
e_cblp | 0x90 |
e_cp | 0x3 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0 |
e_maxalloc | 0xffff |
e_ss | 0 |
e_sp | 0xb8 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0 |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0x110 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_I386
|
NumberofSections | 7 |
TimeDateStamp | 2005-Nov-28 05:16:06 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xe0 |
Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Magic | PE32 |
---|---|
LinkerVersion | 6.0 |
SizeOfCode | 0x179000 |
SizeOfInitializedData | 0x4000 |
SizeOfUninitializedData | 0 |
AddressOfEntryPoint | 0x07B55698 (Section: .vmp1) |
BaseOfCode | 0x1000 |
BaseOfData | 0x2a7000 |
ImageBase | 0x400000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x1000 |
OperatingSystemVersion | 5.0 |
ImageVersion | 0.0 |
SubsystemVersion | 5.0 |
Win32VersionValue | 0 |
SizeOfImage | 0x7b5a000 |
SizeOfHeaders | 0x1000 |
Checksum | 0x18d72a |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
SizeofStackReserve | 0x100000 |
SizeofStackCommit | 0x1000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
IMM32.dll |
ImmGetCompositionStringA
ImmGetCompositionWindow ImmSetCompositionWindow ImmGetDefaultIMEWnd ImmSetConversionStatus ImmGetContext ImmGetDescriptionA ImmGetIMEFileNameA ImmGetConversionStatus ImmReleaseContext |
---|---|
DSOUND.dll |
#1
#2 |
OPENGL32.dll |
glColor3f
glEnd glVertex3fv glTexCoord2f glBegin glColor3fv glGetIntegerv glGetString glFogf glFogfv glEnable glDisable glClearColor glTexImage2D glBindTexture glVertex3f glDepthMask glPolygonMode glFrontFace glStencilFunc glColorMask glVertex2f glDepthFunc glStencilOp glTexEnvf glPixelStorei glTexParameteri glDeleteTextures glIsTexture glColor4ub glLoadIdentity glMatrixMode glPopMatrix glClear glAlphaFunc glTranslatef glRotatef glPushMatrix wglDeleteContext wglGetProcAddress wglMakeCurrent wglCreateContext glScalef glGenTextures glTexEnvi glReadPixels glGetFloatv glBlendFunc glViewport glFogi glFlush glColor4f |
GLU32.dll |
gluOrtho2D
gluPerspective |
WINMM.dll |
mmioOpenA
mmioAscend mmioClose mmioDescend mmioRead timeEndPeriod timeGetDevCaps timeBeginPeriod timeGetTime mmioWrite |
KERNEL32.dll |
ReleaseMutex
CreateMutexA TerminateThread CreateThread OpenMutexA EnterCriticalSection LeaveCriticalSection lstrcatA GetComputerNameA lstrcmpA ExitProcess VirtualAlloc VirtualFree VirtualProtect LoadLibraryExA GetTempFileNameA GetTempPathA HeapFree GetProcessHeap HeapAlloc GetFileInformationByHandle DuplicateHandle GetCurrentThreadId GetTickCount Sleep lstrlenA CloseHandle WriteFile SetFilePointer CreateFileA DeleteFileA ReadFile GetLocalTime GetSystemDirectoryA lstrcmpiA GetVersionExA QueryPerformanceCounter SetProcessAffinityMask SetThreadPriority SetPriorityClass GetProcessAffinityMask GetThreadPriority GetPriorityClass GetCurrentThread GetCurrentProcess QueryPerformanceFrequency OutputDebugStringA SetStdHandle GetProcAddress LoadLibraryA GlobalMemoryStatus GlobalUnlock GlobalLock GetCommandLineA GetFileSize GetLastError GetPrivateProfileStringA GetCurrentDirectoryA CopyFileA SetFileAttributesA Process32Next TerminateProcess OpenProcess Process32First CreateToolhelp32Snapshot WinExec FindFirstFileA FindClose GetModuleFileNameA GetFileAttributesA MoveFileExA IsBadReadPtr OpenEventA WaitForSingleObject CreateEventA CreateProcessA WaitForMultipleObjects GetExitCodeProcess GetModuleHandleA ResetEvent ResumeThread SetEndOfFile DeleteCriticalSection InitializeCriticalSection SetEvent WideCharToMultiByte CreateFileMappingA UnmapViewOfFile MapViewOfFile FindNextFileA RemoveDirectoryA CreateDirectoryA GetThreadContext lstrcpynA GetCurrentProcessId Module32First Module32Next SetUnhandledExceptionFilter IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID SetHandleCount GetFileType GetEnvironmentVariableA HeapDestroy IsValidLocale HeapCreate IsBadWritePtr UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW IsBadCodePtr GetStringTypeA GetStringTypeW CompareStringA CompareStringW SetEnvironmentVariableA SetConsoleCtrlHandler GetLocaleInfoW CreatePipe GetStdHandle PeekNamedPipe FlushFileBuffers lstrcpyA InterlockedExchange RtlUnwind InterlockedDecrement InterlockedIncrement GetTimeZoneInformation GetSystemTime GetStartupInfoA GetVersion GetSystemTimeAsFileTime RaiseException TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP FatalAppExitA MultiByteToWideChar LCMapStringA LCMapStringW FreeLibrary |
USER32.dll |
GetKeyboardLayoutNameA
wvsprintfA SendMessageA RegisterHotKey GetWindowRect SetWindowPos CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetDesktopWindow MessageBoxA UnregisterHotKey GetFocus SetWindowLongA CloseClipboard GetClipboardData OpenClipboard CallWindowProcA GetWindowLongA GetCaretPos GetWindowTextA SetWindowTextA ShowWindow ReleaseDC GetDC GetKeyboardLayout PostMessageA SetFocus IsWindowVisible GetScrollPos SetScrollPos FindWindowA ShowCursor ChangeDisplaySettingsA SystemParametersInfoA DefWindowProcA PostQuitMessage EndPaint BeginPaint DestroyWindow RegisterClassA LoadCursorA LoadIconA SetForegroundWindow IsIconic DispatchMessageA TranslateMessage GetMessageA PeekMessageA UpdateWindow EnumDisplaySettingsA SetCursorPos CreateWindowExA GetAsyncKeyState SetRect OffsetRect PtInRect GetDoubleClickTime ScreenToClient GetCursorPos IntersectRect wsprintfA SetTimer |
GDI32.dll |
GetTextExtentPoint32A
GetTextExtentPointA SelectObject SwapBuffers DeleteDC TextOutA BitBlt GetStockObject SetBkColor SetPixelFormat ChoosePixelFormat CreateFontA SetTextColor CreateCompatibleDC DeleteObject CreateDIBSection SetBkMode |
ADVAPI32.dll |
CryptReleaseContext
RegDeleteKeyA CryptGetHashParam CryptDeriveKey CryptDecrypt CryptImportKey CryptCreateHash CryptHashData CryptVerifySignatureA CryptDestroyHash CryptDestroyKey InitializeSecurityDescriptor GetUserNameA RegDeleteValueA RegEnumValueA CryptAcquireContextA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegQueryValueExA SetSecurityDescriptorDacl RegCloseKey |
SHELL32.dll |
ShellExecuteA
|
ole32.dll |
CoUninitialize
CoCreateInstance CoInitialize |
WS2_32.dll |
connect
setsockopt socket shutdown recv WSASend WSAStartup WSACleanup send WSAGetLastError gethostbyname inet_addr htons WSAAsyncSelect closesocket |
VERSION.dll |
VerQueryValueA
GetFileVersionInfoSizeA GetFileVersionInfoA |
wzAudio.dll |
wzAudioStop
wzAudioPlay wzAudioDestroy wzAudioOption wzAudioCreate |
KERNEL32.dll (#2) |
ReleaseMutex
CreateMutexA TerminateThread CreateThread OpenMutexA EnterCriticalSection LeaveCriticalSection lstrcatA GetComputerNameA lstrcmpA ExitProcess VirtualAlloc VirtualFree VirtualProtect LoadLibraryExA GetTempFileNameA GetTempPathA HeapFree GetProcessHeap HeapAlloc GetFileInformationByHandle DuplicateHandle GetCurrentThreadId GetTickCount Sleep lstrlenA CloseHandle WriteFile SetFilePointer CreateFileA DeleteFileA ReadFile GetLocalTime GetSystemDirectoryA lstrcmpiA GetVersionExA QueryPerformanceCounter SetProcessAffinityMask SetThreadPriority SetPriorityClass GetProcessAffinityMask GetThreadPriority GetPriorityClass GetCurrentThread GetCurrentProcess QueryPerformanceFrequency OutputDebugStringA SetStdHandle GetProcAddress LoadLibraryA GlobalMemoryStatus GlobalUnlock GlobalLock GetCommandLineA GetFileSize GetLastError GetPrivateProfileStringA GetCurrentDirectoryA CopyFileA SetFileAttributesA Process32Next TerminateProcess OpenProcess Process32First CreateToolhelp32Snapshot WinExec FindFirstFileA FindClose GetModuleFileNameA GetFileAttributesA MoveFileExA IsBadReadPtr OpenEventA WaitForSingleObject CreateEventA CreateProcessA WaitForMultipleObjects GetExitCodeProcess GetModuleHandleA ResetEvent ResumeThread SetEndOfFile DeleteCriticalSection InitializeCriticalSection SetEvent WideCharToMultiByte CreateFileMappingA UnmapViewOfFile MapViewOfFile FindNextFileA RemoveDirectoryA CreateDirectoryA GetThreadContext lstrcpynA GetCurrentProcessId Module32First Module32Next SetUnhandledExceptionFilter IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID SetHandleCount GetFileType GetEnvironmentVariableA HeapDestroy IsValidLocale HeapCreate IsBadWritePtr UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW IsBadCodePtr GetStringTypeA GetStringTypeW CompareStringA CompareStringW SetEnvironmentVariableA SetConsoleCtrlHandler GetLocaleInfoW CreatePipe GetStdHandle PeekNamedPipe FlushFileBuffers lstrcpyA InterlockedExchange RtlUnwind InterlockedDecrement InterlockedIncrement GetTimeZoneInformation GetSystemTime GetStartupInfoA GetVersion GetSystemTimeAsFileTime RaiseException TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP FatalAppExitA MultiByteToWideChar LCMapStringA LCMapStringW FreeLibrary |
ADVAPI32.dll (#2) |
CryptReleaseContext
RegDeleteKeyA CryptGetHashParam CryptDeriveKey CryptDecrypt CryptImportKey CryptCreateHash CryptHashData CryptVerifySignatureA CryptDestroyHash CryptDestroyKey InitializeSecurityDescriptor GetUserNameA RegDeleteValueA RegEnumValueA CryptAcquireContextA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegQueryValueExA SetSecurityDescriptorDacl RegCloseKey |
Signature | 0xfeef04bd |
---|---|
StructVersion | 0x10000 |
FileVersion | 1.1.46.0 |
ProductVersion | 1.0.0.1 |
FileFlags | (EMPTY) |
FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
FileType |
VFT_APP
|
Language | Korean - Korea |
CompanyName | WebZen |
FileDescription | main |
FileVersion (#2) | 1, 1, 46, 0 |
InternalName | main |
LegalCopyright | Copyright ⓒ 2002 |
OriginalFilename | main.exe |
ProductName | WebZen mu main |
ProductVersion (#2) | 1, 0, 0, 1 |
Resource LangID | Korean - Korea |
---|
XOR Key | 0x79b181e5 |
---|---|
Unmarked objects | 0 |
Linker (VC++ 6.0 SP5 imp/exp build 8447) | 2 |
12 (7291) | 4 |
14 (7299) | 38 |
C objects (VS98 SP6 build 8804) | 161 |
C++ objects (8047) | 3 |
C objects (VC++ 6.0 SP5 build 8804) | 1 |
C++ objects (VC++ 6.0 SP5 build 8804) | 10 |
C objects (VS98 build 8168) | 44 |
C++ objects (9178) | 1 |
Imports (9210) | 2 |
Total imports | 357 |
19 (8034) | 25 |
C++ objects (VS98 SP6 build 8804) | 139 |
Resource objects (VS98 SP6 cvtres build 1736) | 1 |