86380946408c4522d90553305afe07da
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2006-Sep-20 03:34:51 |
| Detected languages |
English - United States
|
| CompanyName | Blizzard Entertainment |
| FileDescription | World of Warcraft |
| FileVersion | 1, 12, 1, 5875 |
| InternalName | World of Warcraft |
| LegalCopyright | Copyright © 2004 |
| OriginalFilename | WoW.exe |
| ProductName | World of Warcraft |
| ProductVersion | Version 1.12 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ v6.0 DLL
Microsoft Visual C++ 6.0 - 8.0 MASM/TASM - sig1(h) Microsoft Visual C++ Microsoft Visual C++ v6.0 |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .tdata
Section .tdata is both writable and executable. |
| Malicious | The PE contains functions mostly used by malware. |
Can access the registry:
|
| Malicious | VirusTotal score: 3/72 (Scanned on 2024-11-20 22:13:11) |
Bkav:
W32.AIDetectMalware
TrendMicro: TROJ_RENOS.BHAM TrendMicro-HouseCall: TROJ_RENOS.BHAM |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x110 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 6 |
| TimeDateStamp | 2006-Sep-20 03:34:51 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x3fe000 |
| SizeOfInitializedData | 0x507000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00001000 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x3ff000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x926000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.sxdata
.rsrc
.tdata
Imports
| KERNEL32.dll |
CloseHandle
ResumeThread SetThreadAffinityMask GetSystemInfo GetComputerNameA GlobalMemoryStatus CreateEventA DeleteFileA GetTempPathA GetThreadPriority SetThreadPriority ReadFile FlushFileBuffers SetFilePointer GetFileSize GetFileTime SetFileTime SetEndOfFile FindClose DuplicateHandle SuspendThread CreateIoCompletionPort QueryPerformanceFrequency GetQueuedCompletionStatus QueryPerformanceCounter WaitForSingleObject SetEvent TerminateThread PostQueuedCompletionStatus WaitForMultipleObjects CreateFileA GetSystemDirectoryA Beep IsBadReadPtr GetCurrentProcessId CreateThread GetProcessHeap GetExitCodeProcess FindFirstFileA GetFileAttributesA CreateDirectoryA FormatMessageA SetUnhandledExceptionFilter OutputDebugStringA UnmapViewOfFile FreeResource SizeofResource LockResource LoadResource FindResourceA MapViewOfFile CreateFileMappingA GetDiskFreeSpaceA FileTimeToSystemTime GetDriveTypeA ResetEvent CreateSemaphoreA ReleaseSemaphore CreateMutexA OpenMutexA ReleaseMutex FindNextFileA lstrcpynA MulDiv GetFileInformationByHandle PeekNamedPipe GetFullPathNameA GetCurrentDirectoryA SetCurrentDirectoryA SetStdHandle IsBadCodePtr GetWindowsDirectoryA FreeLibrary InterlockedExchange SetEnvironmentVariableA CompareStringA GetTimeZoneInformation GetUserDefaultLCID EnumSystemLocalesA GetLocaleInfoA IsValidLocale Sleep GetStringTypeA LCMapStringA InterlockedIncrement InterlockedDecrement LoadLibraryA IsBadWritePtr VirtualAlloc GetOEMCP GetACP RaiseException SetConsoleCtrlHandler FatalAppExitA LeaveCriticalSection EnterCriticalSection InitializeCriticalSection HeapSize HeapAlloc HeapReAlloc WriteFile RtlUnwind HeapFree VirtualFree HeapCreate HeapDestroy GetVersionExA FileTimeToLocalFileTime GetLocalTime GetTickCount CompareFileTime GetSystemTime SystemTimeToFileTime FlushInstructionCache VirtualQuery GetVolumeInformationA GetEnvironmentVariableA GetCurrentThread GetLastError TlsGetValue SetLastError GetModuleHandleA IsProcessorFeaturePresent LocalFree GlobalUnlock GlobalLock GlobalFree GlobalAlloc VirtualProtect TlsFree TlsAlloc TlsSetValue GetCurrentThreadId DeleteCriticalSection GetFileType GetStdHandle SetHandleCount GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA UnhandledExceptionFilter GetCurrentProcess TerminateProcess ExitProcess GetVersion GetCommandLineA GetStartupInfoA InterlockedCompareExchange |
|---|---|
| ADVAPI32.dll |
GetUserNameA
FreeSid SetSecurityInfo AddAccessAllowedAce AddAccessDeniedAce InitializeAcl GetTokenInformation OpenProcessToken AllocateAndInitializeSid RegQueryValueExA RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegDeleteKeyA RegQueryInfoKeyA RegDeleteValueA RegFlushKey RegEnumKeyExA RegOpenKeyA RegCloseKey |
| COMCTL32.dll |
ImageList_DragEnter
ImageList_GetImageCount ImageList_Add ImageList_Replace ImageList_Destroy ImageList_Create _TrackMouseEvent InitCommonControlsEx ImageList_DragMove ImageList_BeginDrag ImageList_DragLeave ImageList_EndDrag ImageList_DragShowNolock |
| USER32.dll |
SetMenu
CreateDialogIndirectParamA SetMenuItemInfoA InsertMenuItemA GetMenuItemCount DeleteMenu GetFocus GetMenu SetTimer KillTimer IsWindowEnabled GetParent SetWindowPos CreateWindowExA IsDialogMessageA GetWindow IsWindowVisible InvalidateRect LoadImageA GetWindowInfo SetWindowTextA DestroyAcceleratorTable SetClipboardData EmptyClipboard GetWindowTextA GetWindowTextLengthA ReleaseDC GetDC GetSysColorBrush GetSysColor GetClassLongA CloseClipboard OpenClipboard DrawTextA FillRect SetScrollInfo SetScrollPos GetScrollInfo LoadCursorA SetCursor ShowCursor DestroyIcon SetClassLongA CreateAcceleratorTableA TrackPopupMenu DrawMenuBar FrameRect DrawIconEx InvertRect LoadBitmapA wsprintfA LoadStringA IsWindow MessageBoxA WaitForInputIdle MapWindowPoints GetSystemMetrics MonitorFromRect GetMonitorInfoA BeginPaint EndPaint RegisterClassExA UnregisterClassA ChangeDisplaySettingsExA ClipCursor EnumDisplaySettingsA EnumDisplayDevicesA GetKeyState MessageBeep WindowFromPoint SetWindowPlacement GetWindowPlacement GetForegroundWindow BringWindowToTop GetMenuItemInfoA DestroyMenu CreatePopupMenu CreateMenu TranslateAcceleratorA DestroyWindow PostMessageA ShowWindow IsZoomed PostQuitMessage SetFocus SendMessageA MoveWindow ReleaseCapture SetCapture MapVirtualKeyA DefWindowProcA SendInput GetAsyncKeyState GetClientRect GetCursorPos ScreenToClient SystemParametersInfoA ClientToScreen SetCursorPos IsIconic GetWindowRect AdjustWindowRectEx PeekMessageA GetMessageA TranslateMessage DispatchMessageA GetKeyboardLayout GetActiveWindow SetParent |
| SHELL32.dll |
FindExecutableA
ShellExecuteA |
| WSOCK32.dll |
WSACleanup
bind connect gethostbyname inet_ntoa WSAStartup recvfrom getpeername htons accept getsockname listen setsockopt socket WSAGetLastError closesocket select send __WSAFDIsSet recv ioctlsocket ntohs inet_addr ntohl gethostname getsockopt sendto |
| OPENGL32.dll |
glGetError
glLineWidth glDrawElements glDrawArrays glTexSubImage2D glTexEnvfv glTexEnviv glHint glMaterialfv glMaterialf glAlphaFunc glFogi glFogf glFogfv glDepthFunc glPointSize glTexGenfv glLightModelfv glLightModeli glColorMaterial glPixelStorei glClipPlane glLoadMatrixf glLoadIdentity glPolygonMode glLightfv glLightf glViewport glDepthRange glScissor glColor4fv glVertexPointer glNormalPointer glColorPointer glTexCoordPointer glDepthMask glColorMask glTexGeni glTexEnvi glTexEnvf glEnableClientState glDisableClientState glPolygonOffset glMatrixMode glBlendFunc glCullFace glFinish wglSwapLayerBuffers glClearColor glClear glGetString glTexParameteri glEnable glBindTexture glDeleteTextures glDisable glTexImage2D glGetIntegerv glGetFloatv glReadPixels wglGetCurrentDC glGenTextures glCopyTexImage2D glCopyTexSubImage2D wglGetProcAddress wglCreateContext wglDeleteContext wglMakeCurrent wglGetCurrentContext |
| GDI32.dll |
SetBkMode
CombineRgn CreateRectRgnIndirect DescribePixelFormat GetPixelFormat SetPixelFormat SetDeviceGammaRamp GetDeviceGammaRamp ChoosePixelFormat OffsetViewportOrgEx SetViewportOrgEx SelectClipRgn CreateRectRgn CreateFontIndirectA GetObjectA FillRgn CreateDIBSection DeleteDC BitBlt CreateCompatibleDC SetPixel SetTextColor SetBkColor CreateDIBitmap DeleteObject SelectObject GetTextExtentPoint32A GetStockObject TextOutA GdiFlush LineTo GetBkColor CreateSolidBrush SetMapMode MoveToEx CreatePen |
| IMM32.dll |
ImmSetConversionStatus
ImmAssociateContext ImmGetCandidateListA ImmNotifyIME ImmGetCompositionStringA ImmGetContext ImmGetConversionStatus ImmReleaseContext ImmAssociateContextEx |
| DivxDecoder.dll |
UnInitializeDivxDecoder
InitializeDivxDecoder SetOutputFormat DivxDecode |
| WINMM.dll |
joyGetPosEx
joyGetDevCapsA joyGetNumDevs |
| fmod.dll |
_FSOUND_GetMaxChannels@0
_FSOUND_GetMixer@0 _FSOUND_GetDriverName@4 _FSOUND_GetDriver@0 _FSOUND_GetOutput@0 _FSOUND_GetNumHWChannels@12 _FSOUND_File_SetCallbacks@20 _FSOUND_GetError@0 _FSOUND_SetMemorySystem@20 _FSOUND_SetMaxHardwareChannels@4 _FSOUND_SetMinHardwareChannels@4 _FSOUND_SetHWND@4 _FSOUND_SetBufferSize@4 _FSOUND_SetMixer@4 _FSOUND_GetDriverCaps@8 _FSOUND_SetDriver@4 _FSOUND_GetNumDrivers@0 _FSOUND_SetOutput@4 _FSOUND_GetVersion@0 _FSOUND_SetMute@8 _FSOUND_Close@0 _FSOUND_StopSound@4 _FSOUND_Update@0 _FSOUND_3D_Listener_GetAttributes@32 _FSOUND_3D_SetAttributes@12 _FSOUND_Stream_PlayEx@16 _FSOUND_Stream_SetLoopCount@8 _FSOUND_IsPlaying@4 _FSOUND_SetReserved@8 _FSOUND_Stream_GetLengthMs@4 _FSOUND_Stream_SetTime@8 _FSOUND_Reverb_SetChannelProperties@8 _FSOUND_SetVolume@8 _FSOUND_SetFrequency@8 _FSOUND_Sample_SetMinMaxDistance@12 _FSOUND_Stream_GetSample@4 _FSOUND_3D_Listener_SetAttributes@32 _FSOUND_Reverb_SetProperties@4 _FSOUND_Reverb_GetProperties@4 _FSOUND_GetCPUUsage@0 _FSOUND_SetSFXMasterVolume@4 _FSOUND_SetPaused@8 _FSOUND_GetOutputRate@0 _FSOUND_3D_SetDistanceFactor@4 _FSOUND_3D_SetDopplerFactor@4 _FSOUND_3D_SetRolloffFactor@4 _FSOUND_Stream_GetTime@4 _FSOUND_Stream_Stop@4 _FSOUND_Stream_Close@4 _FSOUND_Stream_Open@16 _FSOUND_Stream_SetEndCallback@12 _FSOUND_Stream_Play@8 _FSOUND_Init@12 |
| WININET.dll |
InternetReadFileExA
HttpQueryInfoA InternetSetOptionA InternetSetStatusCallback HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA InternetCrackUrlA InternetCloseHandle |
Delayed Imports
10
119
1
2
3
4
5
6
7
8
9
BLIZZARDCURSOR.CUR
BLIZZARDICON.ICO
1 (#2)
BLIZZARDKEY
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.12.1.5875 |
| ProductVersion | 1.12.0.0 |
| FileFlags |
VS_FF_PRERELEASE
|
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| CompanyName | Blizzard Entertainment |
| FileDescription | World of Warcraft |
| FileVersion (#2) | 1, 12, 1, 5875 |
| InternalName | World of Warcraft |
| LegalCopyright | Copyright © 2004 |
| OriginalFilename | WoW.exe |
| ProductName | World of Warcraft |
| ProductVersion (#2) | Version 1.12 |
| Resource LangID | English - United States |
|---|
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0x589b3c6e |
|---|---|
| Unmarked objects | 0 |
| 48 (9044) | 61 |
| C objects (VS2003 (.NET) build 3077) | 1 |
| Linker (VC++ 6.0 SP5 imp/exp build 8447) | 4 |
| C++ objects (VS2003 (.NET) build 4035) | 24 |
| 18 (8444) | 6 |
| Total imports | 503 |
| Imports (9210) | 23 |
| 39 (9162) | 43 |
| C objects (9178) | 45 |
| C++ objects (8047) | 7 |
| C objects (8047) | 177 |
| 14 (7299) | 46 |
| 49 (9044) | 611 |
| Resource objects (VS98 SP6 cvtres build 1736) | 1 |
Errors
[!] Error: Could not read PDB file information of invalid magic number.