5509296563f63c7caef837db1efd73e5
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2010-Apr-24 01:30:06 |
| Detected languages |
Chinese - PRC
Chinese - Taiwan English - United Kingdom English - United States French - France German - Germany Korean - Korea Process Default Language Russian - Russia Spanish - Mexico Spanish - Spain (Traditional sort) |
| Debug artifacts |
D:\BuildServer\WoW\5\work\WoW-code\trunk\WoW\Bin\Wow.pdb
|
| CompanyName | Blizzard Entertainment |
| FileDescription | World of Warcraft Retail |
| FileVersion | 4, 0, 0, 11927 |
| InternalName | World of Warcraft |
| LegalCopyright | Copyright © 2004 |
| OriginalFilename | WoW.exe |
| ProductName | World of Warcraft |
| ProductVersion | Version 4.0 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ v6.0 DLL
Microsoft Visual C++ 6.0 - 8.0 Microsoft Visual C++ Microsoft Visual C++ v6.0 |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 Microsoft's Cryptography API |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .zdata
Section .zdata is both writable and executable. |
| Malicious | The PE contains functions mostly used by malware. |
Functions which can be used for anti-debugging purposes:
|
| Info | The PE is digitally signed. |
Signer: Blizzard Entertainment
Issuer: Thawte Code Signing CA |
| Safe | VirusTotal score: 0/42 (Scanned on 2010-08-25 00:23:28) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x128 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 7 |
| TimeDateStamp | 2010-Apr-24 01:30:06 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 9.0 |
| SizeOfCode | 0x5ee000 |
| SizeOfInitializedData | 0x1b0400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00001270 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x5ef000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x9fb000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x7a09f5 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x16e360 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.zdata
.tls
.rsrc
.reloc
Imports
| KERNEL32.dll |
GetConsoleMode
GetConsoleCP SetFilePointer MulDiv OpenFile OpenFileMappingA CreateFileMappingA MapViewOfFile UnmapViewOfFile GetSystemDirectoryA DeviceIoControl GetLocaleInfoA GetDateFormatA GetTimeFormatA GetStringTypeA LCMapStringA HeapReAlloc VirtualAlloc HeapAlloc InitializeCriticalSectionAndSpinCount LoadLibraryA InterlockedExchange FreeLibrary EnterCriticalSection GetTimeZoneInformation RaiseException HeapSize VirtualQuery RtlUnwind GetOEMCP GetACP GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter HeapFree VirtualFree HeapCreate GetCurrentThread InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue DeleteCriticalSection GetFileType SetHandleCount GetLastError GetEnvironmentStrings FreeEnvironmentStringsA SetStdHandle WriteConsoleA GetConsoleOutputCP CreateFileA CloseHandle FlushFileBuffers CompareStringA SetEnvironmentVariableA LeaveCriticalSection GetModuleFileNameA GetStdHandle GetDriveTypeA ExitThread GetFullPathNameA OpenThread SuspendThread GetThreadContext Thread32First Thread32Next lstrcpynA IsBadReadPtr ReleaseMutex CreateMutexA SetProcessAffinityMask OutputDebugStringA GetVersion GetExitCodeProcess GetProcessHeap WaitForMultipleObjectsEx WriteFileEx ReadFileEx CancelIo IsBadWritePtr LocalFree GetQueuedCompletionStatus CreateIoCompletionPort GlobalAlloc GlobalFree GlobalLock GlobalUnlock VirtualProtect FlushInstructionCache GetLocalTime FormatMessageA GetWindowsDirectoryA GetCommandLineW GetPriorityClass SetPriorityClass GetProcessAffinityMask GlobalMemoryStatusEx WriteFile ExitProcess SetFileTime SetFileAttributesA SetEndOfFile RemoveDirectoryA CreateDirectoryA GetShortPathNameA GetDiskFreeSpaceExA Sleep GetModuleHandleA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoA GetCommandLineA CreateEventA SetEvent ResetEvent WaitForMultipleObjects GetOverlappedResult ReadDirectoryChangesW GetVersionExA WaitForSingleObject InitializeCriticalSection CreateSemaphoreA ReleaseSemaphore GlobalMemoryStatus ResumeThread TerminateThread SetThreadPriority GetThreadPriority SignalObjectAndWait FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime GetSystemInfo QueryPerformanceFrequency GetDiskFreeSpaceA CreateThread GetFileAttributesExA GetFileSize SetCurrentDirectoryA GetCurrentDirectoryA GetFileAttributesA MoveFileA DeleteFileA OpenEventA GetComputerNameA GetTempPathA SetThreadAffinityMask CreateToolhelp32Snapshot WaitForSingleObjectEx CreateProcessA DuplicateHandle ReadFile FindClose FindNextFileA FindFirstFileA |
|---|---|
| DivxDecoder.dll |
UnInitializeDivxDecoder
DivxDecode SetOutputFormat InitializeDivxDecoder |
| OPENGL32.dll |
glGetFloatv
glGetIntegerv glGetError glDisable glDeleteTextures glTexImage2D glBindTexture glGenTextures glEnable glTexParameteri glReadPixels wglGetProcAddress wglDeleteContext wglMakeCurrent wglCreateContext wglGetCurrentContext glTexEnviv glColorMask glDepthMask glDepthRange glViewport glPolygonMode glClipPlane glCopyTexSubImage2D glCopyTexImage2D wglGetCurrentDC glTexSubImage2D glPixelStorei glCullFace glBlendFunc glMatrixMode glPolygonOffset glDisableClientState glHint glTexGeni glTexEnvi glTexEnvf glTexEnvfv glGetString glScissor glTexCoordPointer glColorPointer glNormalPointer glVertexPointer glLightf glLightfv glLightModelfv glMaterialfv glColor4fv glLoadMatrixf glLoadIdentity glFogf glFogi glColorMaterial glLightModeli glTexGenfv glPointSize glFrontFace glDepthFunc glFogfv glAlphaFunc glMaterialf glClear glClearColor wglSwapLayerBuffers glFinish glDrawArrays glDrawElements glLineWidth glEnableClientState |
| d3d9.dll |
D3DPERF_SetOptions
|
| IMM32.dll |
ImmGetContext
ImmGetCandidateListA ImmNotifyIME ImmAssociateContextEx ImmSetConversionStatus ImmAssociateContext ImmGetCompositionStringA ImmGetConversionStatus ImmReleaseContext |
| WININET.dll |
HttpQueryInfoA
InternetSetOptionA InternetConnectA InternetReadFileExA InternetOpenA HttpOpenRequestA InternetSetCookieA HttpSendRequestA InternetCloseHandle InternetSetStatusCallback InternetSetStatusCallbackA InternetCrackUrlA |
| WS2_32.dll |
#15
#12 #108 #103 #6 #9 #21 #3 #111 #16 #5 #19 #23 #7 #10 #1 #4 #52 #11 #13 #2 #8 #115 #116 WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect #18 #151 #20 #17 |
| DINPUT8.dll |
DirectInput8Create
|
| SETUPAPI.dll |
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiGetDeviceRegistryPropertyA |
| HID.DLL |
HidD_SetFeature
HidD_GetPreparsedData HidD_GetAttributes HidP_GetCaps HidD_GetProductString HidD_GetSerialNumberString HidD_FreePreparsedData HidD_GetHidGuid |
| USER32.dll |
SystemParametersInfoA
UnhookWindowsHookEx SendInput SetCapture ReleaseCapture MoveWindow SendMessageA GetWindowPlacement SetFocus PostQuitMessage IsZoomed DispatchMessageA TranslateMessage MapVirtualKeyA PeekMessageA IsIconic PostMessageA GetParent IsWindowVisible CloseClipboard OpenClipboard GetForegroundWindow MessageBeep GetKeyState FillRect SetWindowsHookExA IsDialogMessageA TranslateAcceleratorA GetKeyboardLayout SetClipboardData EmptyClipboard LoadStringA MessageBoxA IsWindow wsprintfA SetCursor GetCursorPos ScreenToClient GetClientRect LoadImageA LoadCursorA MapWindowPoints BeginPaint EndPaint AdjustWindowRectEx GetSystemMetrics ShowWindow ChangeDisplaySettingsExA SetWindowPos GetWindowRect ClipCursor DefWindowProcA RegisterClassExA CreateWindowExA GetDC ReleaseDC DestroyWindow UnregisterClassA EnumDisplaySettingsA EnumDisplayDevicesA MonitorFromPoint GetMonitorInfoA MsgWaitForMultipleObjects WaitForInputIdle SetTimer KillTimer GetActiveWindow CallNextHookEx GetAsyncKeyState ClientToScreen VkKeyScanA GetDesktopWindow CharLowerBuffA LoadBitmapA DrawTextExA InvertRect GetMessageA |
| GDI32.dll |
DescribePixelFormat
SetPixelFormat SetDeviceGammaRamp GetPixelFormat DeleteObject SetBkColor SetTextColor SetBkMode GetDeviceGammaRamp DeleteDC StretchBlt BitBlt CreateCompatibleDC OffsetViewportOrgEx SetViewportOrgEx SelectClipRgn CreateRectRgn Rectangle CreateFontIndirectA GetObjectA SetMapMode GdiFlush CreateDIBSection ChoosePixelFormat TranslateCharsetInfo GetStockObject CreateBitmap CreateSolidBrush SelectObject |
| ADVAPI32.dll |
RegOpenKeyA
RegCreateKeyExA RegSetValueExA RegFlushKey RegQueryValueExA RegOpenKeyExA RegCloseKey CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameA AllocateAndInitializeSid OpenProcessToken GetTokenInformation InitializeAcl AddAccessDeniedAce AddAccessAllowedAce SetSecurityInfo FreeSid ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumKeyA |
| SHELL32.dll |
FindExecutableA
ShellExecuteA |
| WINMM.dll |
waveOutOpen
waveOutUnprepareHeader waveOutWrite waveOutReset waveOutClose waveInAddBuffer waveInPrepareHeader waveInUnprepareHeader waveInGetDevCapsA waveInStart waveInOpen waveInClose waveInReset waveOutPrepareHeader waveOutGetDevCapsA timeKillEvent timeSetEvent mciSendCommandA timeGetTime waveOutGetNumDevs waveInGetNumDevs waveOutGetPosition |
| VERSION.dll |
VerQueryValueA
GetFileVersionInfoSizeA GetFileVersionInfoA |
| MSACM32.dll |
acmStreamConvert
acmStreamOpen acmFormatSuggest acmStreamUnprepareHeader acmStreamPrepareHeader acmStreamSize |
| ole32.dll |
PropVariantClear
CoCreateInstance CoTaskMemFree CoUninitialize CLSIDFromString CoInitialize |
Delayed Imports
BLIZZARDCOMPONENT
__GDF_THUMBNAIL
__GDF_XML
__GDF_XML (#2)
__GDF_XML (#3)
__GDF_XML (#4)
__GDF_XML (#5)
__GDF_XML (#6)
__GDF_XML (#7)
__GDF_XML (#8)
__GDF_XML (#9)
__GDF_XML (#10)
__GDF_XML (#11)
5
119
1
1 (#2)
2
2 (#2)
3
3 (#2)
4
4 (#2)
BLIZZARDCURSOR.CUR
BLIZZARDICON.ICO
101
1 (#3)
1 (#4)
BLIZZARDKEY
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 4.0.0.11927 |
| ProductVersion | 4.0.0.0 |
| FileFlags |
VS_FF_PRERELEASE
|
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| CompanyName | Blizzard Entertainment |
| FileDescription | World of Warcraft Retail |
| FileVersion (#2) | 4, 0, 0, 11927 |
| InternalName | World of Warcraft |
| LegalCopyright | Copyright © 2004 |
| OriginalFilename | WoW.exe |
| ProductName | World of Warcraft |
| ProductVersion (#2) | Version 4.0 |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2010-Apr-24 01:30:06 |
| Version | 0.0 |
| SizeofData | 81 |
| AddressOfRawData | 0x6868d8 |
| PointerToRawData | 0x685cd8 |
| Referenced File | D:\BuildServer\WoW\5\work\WoW-code\trunk\WoW\Bin\Wow.pdb |
TLS Callbacks
| StartAddressOfRawData | 0xd75000 |
|---|---|
| EndAddressOfRawData | 0xd75018 |
| AddressOfIndex | 0xcd8460 |
| AddressOfCallbacks | 0x9f0664 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks | (EMPTY) |
Load Configuration
RICH Header
| XOR Key | 0x8eda6b03 |
|---|---|
| Unmarked objects | 0 |
| Linker (VC++ 6.0 SP5 imp/exp build 8447) | 2 |
| Unmarked objects (#2) | 18 |
| C++ objects (VS2012 build 50727 / VS2005 build 50727) | 1 |
| Imports (VS2003 (.NET) build 4035) | 2 |
| C objects (VS2003 (.NET) build 4035) | 1 |
| ASM objects (VS2003 (.NET) build 3077) | 1 |
| Imports (VS2012 build 50727 / VS2005 build 50727) | 33 |
| Total imports | 558 |
| 126 (VS2012 build 50727 / VS2005 build 50727) | 34 |
| C objects (VS2012 build 50727 / VS2005 build 50727) | 57 |
| ASM objects (VS2008 SP1 build 30729) | 70 |
| C objects (VS2008 SP1 build 30729) | 300 |
| C++ objects (VS2008 SP1 build 30729) | 1145 |
| Linker (VS2008 build 21022) | 1 |
| 151 | 1 |
| Resource objects (VS2008 SP1 build 30729) | 1 |