Architecture |
IMAGE_FILE_MACHINE_I386
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
Compilation Date | 2006-Aug-28 09:11:33 |
Detected languages |
Korean - Korea
|
CompanyName | WebZen |
FileDescription | main |
FileVersion | 1, 2, 44, 0 |
InternalName | main |
LegalCopyright | Copyright ⓒ 2002 |
OriginalFilename | main.exe |
ProductName | WebZen mu main |
ProductVersion | 1, 0, 0, 1 |
Info | Interesting strings found in the binary: |
Contains domain names:
|
Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
Suspicious | This PE is packed with VMProtect |
Unusual section name found: .vmp0
Unusual section name found: .vmp1 The number of imports reported in the RICH header is inconsistent. |
Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
Malicious | VirusTotal score: 11/71 (Scanned on 2024-11-25 03:18:18) |
Antiy-AVL:
Trojan/Win32.Agent
Cylance: Unsafe Cynet: Malicious (score: 100) FireEye: Generic.mg.89a04541291f8d17 Gridinsoft: Trojan.Win32.Gen.vb!n Malwarebytes: Malware.AI.4275489363 MaxSecure: Trojan.Malware.300983.susgen McAfee: Artemis!89A04541291F McAfeeD: ti!63ED37CA142A Sophos: Generic ML PUA (PUA) Trapmine: malicious.moderate.ml.score |
e_magic | MZ |
---|---|
e_cblp | 0x90 |
e_cp | 0x3 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0 |
e_maxalloc | 0xffff |
e_ss | 0 |
e_sp | 0xb8 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0 |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0x108 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_I386
|
NumberofSections | 7 |
TimeDateStamp | 2006-Aug-28 09:11:33 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xe0 |
Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Magic | PE32 |
---|---|
LinkerVersion | 6.0 |
SizeOfCode | 0x187000 |
SizeOfInitializedData | 0x4000 |
SizeOfUninitializedData | 0 |
AddressOfEntryPoint | 0x07C123DE (Section: .vmp1) |
BaseOfCode | 0x1000 |
BaseOfData | 0x2e8000 |
ImageBase | 0x400000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x1000 |
OperatingSystemVersion | 5.0 |
ImageVersion | 0.0 |
SubsystemVersion | 5.0 |
Win32VersionValue | 0 |
SizeOfImage | 0x7c17000 |
SizeOfHeaders | 0x1000 |
Checksum | 0 |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
SizeofStackReserve | 0x100000 |
SizeofStackCommit | 0x1000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
IMM32.dll |
ImmGetCompositionStringA
ImmGetCompositionWindow ImmSetCompositionWindow ImmGetDefaultIMEWnd ImmSetConversionStatus ImmGetContext ImmGetDescriptionA ImmGetIMEFileNameA ImmGetConversionStatus ImmReleaseContext |
---|---|
DSOUND.dll |
#1
#2 |
OPENGL32.dll |
glColor3f
glEnd glVertex3fv glTexCoord2f glBegin glColor3fv glGetIntegerv glGetString glAlphaFunc glFogf glFogfv glEnable glDisable glClearColor glTexImage2D glBindTexture glVertex3f glDepthMask glPolygonMode glFrontFace glStencilFunc glColorMask glVertex2f glDepthFunc glStencilOp glTexEnvf glPixelStorei glTexParameteri glDeleteTextures glIsTexture glColor4ub glLoadIdentity glMatrixMode glPopMatrix glClear glTranslatef glRotatef glPushMatrix wglDeleteContext wglMakeCurrent wglCreateContext glScalef glGenTextures glTexEnvi glReadPixels glGetFloatv glBlendFunc glViewport glFogi glFlush glColor4f |
GLU32.dll |
gluOrtho2D
gluPerspective |
WINMM.dll |
mmioAscend
mmioOpenA mmioClose timeGetTime mmioDescend mmioRead timeGetDevCaps timeBeginPeriod mmioWrite timeEndPeriod |
KERNEL32.dll |
TerminateThread
CreateThread OpenMutexA EnterCriticalSection LeaveCriticalSection lstrcatA OpenEventA WaitForSingleObject ReleaseMutex GetComputerNameA lstrcmpA ExitProcess VirtualAlloc VirtualFree VirtualProtect LoadLibraryExA GetTempFileNameA GetTempPathA HeapFree GetProcessHeap HeapAlloc GetFileInformationByHandle GetCurrentThreadId GetTickCount Sleep lstrlenA CloseHandle WriteFile SetFilePointer CreateFileA DeleteFileA ReadFile GetLocalTime GetSystemDirectoryA lstrcmpiA GetVersionExA QueryPerformanceCounter SetProcessAffinityMask SetThreadPriority SetPriorityClass GetProcessAffinityMask GetThreadPriority GetPriorityClass GetCurrentThread GetCurrentProcess QueryPerformanceFrequency OutputDebugStringA FlushFileBuffers GetProcAddress LoadLibraryA GlobalMemoryStatus GlobalUnlock GlobalLock GetCommandLineA GetFileSize GetLastError GetPrivateProfileStringA GetCurrentDirectoryA CopyFileA SetFileAttributesA Process32Next TerminateProcess OpenProcess Process32First CreateToolhelp32Snapshot WinExec FindFirstFileA FindClose CreateMutexA GetModuleFileNameA GetFileAttributesA MoveFileA IsBadReadPtr CreateEventA CreateProcessA WaitForMultipleObjects GetExitCodeProcess GetModuleHandleA ResetEvent ResumeThread SetEndOfFile DeleteCriticalSection InitializeCriticalSection SetEvent WideCharToMultiByte CreateFileMappingA UnmapViewOfFile MapViewOfFile FindNextFileA RemoveDirectoryA CreateDirectoryA GetThreadContext lstrcpynA GetCurrentProcessId Module32First Module32Next SetUnhandledExceptionFilter IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID SetHandleCount GetFileType UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings LCMapStringW GetEnvironmentStringsW GetEnvironmentVariableA HeapDestroy HeapCreate IsBadWritePtr IsBadCodePtr GetStringTypeA GetStringTypeW CompareStringA CompareStringW SetEnvironmentVariableA SetConsoleCtrlHandler GetLocaleInfoW DuplicateHandle SetStdHandle CreatePipe GetStdHandle PeekNamedPipe lstrcpyA InterlockedExchange RtlUnwind InterlockedDecrement InterlockedIncrement GetTimeZoneInformation GetSystemTime GetStartupInfoA GetVersion GetSystemTimeAsFileTime RaiseException TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP FatalAppExitA MultiByteToWideChar LCMapStringA FreeLibrary |
USER32.dll |
GetFocus
UnregisterHotKey RegisterHotKey GetAsyncKeyState GetKeyboardLayout GetKeyboardLayoutNameA GetClipboardData SendMessageA wsprintfA GetWindowRect SetWindowPos CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetDesktopWindow MessageBoxA OpenClipboard CallWindowProcA GetWindowLongA GetCaretPos GetWindowTextA SetWindowTextA ShowWindow ReleaseDC GetDC SetWindowLongA PostMessageA SetFocus IsWindowVisible GetScrollPos SetScrollPos SetTimer ShowCursor ChangeDisplaySettingsA SystemParametersInfoA ReleaseCapture SetCapture DefWindowProcA PostQuitMessage EndPaint BeginPaint DestroyWindow RegisterClassA LoadCursorA LoadIconA SetForegroundWindow GetSystemMetrics AdjustWindowRect IsIconic DispatchMessageA TranslateMessage CreateWindowExA CloseClipboard GetMessageA PeekMessageA UpdateWindow EnumDisplaySettingsA SetCursorPos SetRect OffsetRect PtInRect GetDoubleClickTime ScreenToClient GetCursorPos GetActiveWindow IntersectRect wvsprintfA FindWindowA |
GDI32.dll |
ChoosePixelFormat
CreateFontA SetBkMode SwapBuffers SelectObject SetPixelFormat TextOutA SetTextColor DeleteObject DeleteDC CreateDIBSection CreateCompatibleDC SetBkColor GetTextExtentPoint32A GetStockObject GetTextExtentPointA BitBlt |
ADVAPI32.dll |
CryptReleaseContext
RegDeleteKeyA CryptGetHashParam CryptDeriveKey CryptDecrypt CryptImportKey CryptCreateHash CryptHashData CryptVerifySignatureA CryptDestroyHash CryptDestroyKey InitializeSecurityDescriptor GetUserNameA RegDeleteValueA RegEnumValueA CryptAcquireContextA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegQueryValueExA SetSecurityDescriptorDacl RegCloseKey |
SHELL32.dll |
ShellExecuteA
|
ole32.dll |
CoUninitialize
CoCreateInstance CoInitialize |
WS2_32.dll |
gethostbyname
WSAAsyncSelect setsockopt socket shutdown recv WSASend WSAStartup WSACleanup send WSAGetLastError inet_addr htons connect closesocket |
VERSION.dll |
VerQueryValueA
GetFileVersionInfoSizeA GetFileVersionInfoA |
wzAudio.dll |
wzAudioStop
wzAudioPlay wzAudioGetStreamOffsetRange wzAudioDestroy wzAudioOption wzAudioCreate |
KERNEL32.dll (#2) |
TerminateThread
CreateThread OpenMutexA EnterCriticalSection LeaveCriticalSection lstrcatA OpenEventA WaitForSingleObject ReleaseMutex GetComputerNameA lstrcmpA ExitProcess VirtualAlloc VirtualFree VirtualProtect LoadLibraryExA GetTempFileNameA GetTempPathA HeapFree GetProcessHeap HeapAlloc GetFileInformationByHandle GetCurrentThreadId GetTickCount Sleep lstrlenA CloseHandle WriteFile SetFilePointer CreateFileA DeleteFileA ReadFile GetLocalTime GetSystemDirectoryA lstrcmpiA GetVersionExA QueryPerformanceCounter SetProcessAffinityMask SetThreadPriority SetPriorityClass GetProcessAffinityMask GetThreadPriority GetPriorityClass GetCurrentThread GetCurrentProcess QueryPerformanceFrequency OutputDebugStringA FlushFileBuffers GetProcAddress LoadLibraryA GlobalMemoryStatus GlobalUnlock GlobalLock GetCommandLineA GetFileSize GetLastError GetPrivateProfileStringA GetCurrentDirectoryA CopyFileA SetFileAttributesA Process32Next TerminateProcess OpenProcess Process32First CreateToolhelp32Snapshot WinExec FindFirstFileA FindClose CreateMutexA GetModuleFileNameA GetFileAttributesA MoveFileA IsBadReadPtr CreateEventA CreateProcessA WaitForMultipleObjects GetExitCodeProcess GetModuleHandleA ResetEvent ResumeThread SetEndOfFile DeleteCriticalSection InitializeCriticalSection SetEvent WideCharToMultiByte CreateFileMappingA UnmapViewOfFile MapViewOfFile FindNextFileA RemoveDirectoryA CreateDirectoryA GetThreadContext lstrcpynA GetCurrentProcessId Module32First Module32Next SetUnhandledExceptionFilter IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID SetHandleCount GetFileType UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings LCMapStringW GetEnvironmentStringsW GetEnvironmentVariableA HeapDestroy HeapCreate IsBadWritePtr IsBadCodePtr GetStringTypeA GetStringTypeW CompareStringA CompareStringW SetEnvironmentVariableA SetConsoleCtrlHandler GetLocaleInfoW DuplicateHandle SetStdHandle CreatePipe GetStdHandle PeekNamedPipe lstrcpyA InterlockedExchange RtlUnwind InterlockedDecrement InterlockedIncrement GetTimeZoneInformation GetSystemTime GetStartupInfoA GetVersion GetSystemTimeAsFileTime RaiseException TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP FatalAppExitA MultiByteToWideChar LCMapStringA FreeLibrary |
ADVAPI32.dll (#2) |
CryptReleaseContext
RegDeleteKeyA CryptGetHashParam CryptDeriveKey CryptDecrypt CryptImportKey CryptCreateHash CryptHashData CryptVerifySignatureA CryptDestroyHash CryptDestroyKey InitializeSecurityDescriptor GetUserNameA RegDeleteValueA RegEnumValueA CryptAcquireContextA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegQueryValueExA SetSecurityDescriptorDacl RegCloseKey |
Signature | 0xfeef04bd |
---|---|
StructVersion | 0x10000 |
FileVersion | 1.2.44.0 |
ProductVersion | 1.0.0.1 |
FileFlags | (EMPTY) |
FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
FileType |
VFT_APP
|
Language | Korean - Korea |
CompanyName | WebZen |
FileDescription | main |
FileVersion (#2) | 1, 2, 44, 0 |
InternalName | main |
LegalCopyright | Copyright ⓒ 2002 |
OriginalFilename | main.exe |
ProductName | WebZen mu main |
ProductVersion (#2) | 1, 0, 0, 1 |
Resource LangID | Korean - Korea |
---|
XOR Key | 0xe810f6a3 |
---|---|
Unmarked objects | 0 |
Linker (VC++ 6.0 SP5 imp/exp build 8447) | 2 |
12 (7291) | 4 |
14 (7299) | 39 |
C objects (VS98 SP6 build 8804) | 163 |
C++ objects (8047) | 3 |
C++ objects (VC++ 6.0 SP5 build 8804) | 10 |
C objects (VS98 build 8168) | 44 |
C++ objects (9178) | 1 |
Imports (9210) | 2 |
Total imports | 362 |
19 (8034) | 25 |
C++ objects (VS98 SP6 build 8804) | 157 |
Resource objects (VS98 SP6 cvtres build 1736) | 1 |