Manalyze report for 89a04541291f8d179300c0935d245e11

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2006-Aug-28 09:11:33
Detected languages	Korean - Korea
CompanyName	WebZen
FileDescription	main
FileVersion	`1, 2, 44, 0`
InternalName	main
LegalCopyright	Copyright ⓒ 2002
OriginalFilename	main.exe
ProductName	WebZen mu main
ProductVersion	`1, 0, 0, 1`

Plugin Output

Info	Interesting strings found in the binary:	`Contains domain names: crl.symauth.com http://pki-crl.symauth.com http://pki-crl.symauth.com/ca_219679623e6b4fa507d638cbeba72ecb/LatestCRL.crl07 http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.crl0 http://pki-ocsp.symauth.com0 pki-crl.symauth.com symauth.com`
Info	Libraries used to perform cryptographic operations:	`Microsoft's Cryptography API`
Suspicious	This PE is packed with VMProtect	`Unusual section name found: .vmp0` `Unusual section name found: .vmp1` `The number of imports reported in the RICH header is inconsistent.`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryExA GetProcAddress LoadLibraryA` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot FindWindowA` `Code injection capabilities (PowerLoader): GetWindowLongA FindWindowA` `Can access the registry: RegisterHotKey RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey` `Possibly launches other programs: WinExec CreateProcessA ShellExecuteA` `Uses Microsoft's cryptographic API: CryptReleaseContext CryptGetHashParam CryptDeriveKey CryptDecrypt CryptImportKey CryptCreateHash CryptHashData CryptVerifySignatureA CryptDestroyHash CryptDestroyKey CryptAcquireContextA` `Can create temporary files: GetTempPathA CreateFileA` `Uses functions commonly found in keyloggers: GetAsyncKeyState CallNextHookEx` `Memory manipulation functions often used by packers: VirtualAlloc VirtualProtect` `Leverages the raw socket API to access the Internet: gethostbyname WSAAsyncSelect setsockopt socket shutdown recv WSASend WSAStartup WSACleanup send WSAGetLastError inet_addr htons connect closesocket` `Interacts with services: OpenSCManagerW EnumServicesStatusExW OpenServiceW QueryServiceConfigW` `Manipulates other processes: Process32Next OpenProcess Process32First` `Can take screenshots: GetDC FindWindowA CreateCompatibleDC BitBlt` `Reads the contents of the clipboard: GetClipboardData`
Malicious	VirusTotal score: 11/71 (Scanned on 2024-11-25 03:18:18)	`Antiy-AVL: Trojan/Win32.Agent` `Cylance: Unsafe` `Cynet: Malicious (score: 100)` `FireEye: Generic.mg.89a04541291f8d17` `Gridinsoft: Trojan.Win32.Gen.vb!n` `Malwarebytes: Malware.AI.4275489363` `MaxSecure: Trojan.Malware.300983.susgen` `McAfee: Artemis!89A04541291F` `McAfeeD: ti!63ED37CA142A` `Sophos: Generic ML PUA (PUA)` `Trapmine: malicious.moderate.ml.score`

Hashes

MD5	`89a04541291f8d179300c0935d245e11`
SHA1	`7cbceee35c914bead88d5238da91a39ea452985f`
SHA256	`63ed37ca142a006f952b70b595d7463c0c1b863ff79a19509fe53ba894135afc`
SHA3	`2378312e0981afc1fef144e90f550900f35086391c09140d23956f1e46d193af`
SSDeep	`49152:DAylXp519f0/StoDK2fX0l1ESEmYZiAcPG:DAylX/P0atlCSCZi`
Imports Hash	`a8a75b24c273fc6d86c2b9a6d7080e15`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x108`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`7`
TimeDateStamp	2006-Aug-28 09:11:33
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`6.0`
SizeOfCode	`0x187000`
SizeOfInitializedData	`0x4000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x07C123DE (Section: .vmp1)`
BaseOfCode	`0x1000`
BaseOfData	`0x2e8000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x1000`
OperatingSystemVersion	`5.0`
ImageVersion	`0.0`
SubsystemVersion	`5.0`
Win32VersionValue	`0`
SizeOfImage	`0x7c17000`
SizeOfHeaders	`0x1000`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0x2e6452`
VirtualAddress	`0x1000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`

.rdata

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0xea2e`
VirtualAddress	`0x2e8000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`

.data

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0x76fcac4`
VirtualAddress	`0x2f7000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.vmp0

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0x97dd0`
VirtualAddress	`0x79f4000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`

.vmp1

MD5	`9cfc8626e31699efbb4b3e7905f1888d`
SHA1	`73b5e8bcadc12dabc721c9ceee976b371ba30abf`
SHA256	`2a0631d037438d34c85a854fd620f80cab5c4c526d71cb03bfa5e19eb5ae5838`
SHA3	`34ae37e8f155475890559b9ff86caff57ca06cef67aa9ec5fbbb55efcd251284`
VirtualSize	`0x1863f0`
VirtualAddress	`0x7a8c000`
SizeOfRawData	`0x187000`
PointerToRawData	`0x1000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`7.96115`

.reloc

MD5	`43263572b70a51bcb71015c3136847dc`
SHA1	`d5e390bc5536cf15906fe53f28de7c18d27a84f8`
SHA256	`1ce78e94532b2e43b5b7bd3ba507626a501fb4b5d39e15b5803df8cc37442f19`
SHA3	`d74d8b87236e4c08d3e63c2ecc926a1d29db72369ae9bbbe63c54eeb832f2608`
VirtualSize	`0x104`
VirtualAddress	`0x7c13000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x188000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`0.460726`

.rsrc

MD5	`875d590797cdcd63e7e8a550a2fd2aea`
SHA1	`93383c66c39129e2b202b20c6c41203644f005ae`
SHA256	`12f9767899a1cb307aa3117f437d898a264dbb7cbfbbe3e6f28a9572f3886bed`
SHA3	`7a22f4e8c0ca30acc7f316a2fd935c254afafe3de67a979b42874a91df594dc2`
VirtualSize	`0x203c`
VirtualAddress	`0x7c14000`
SizeOfRawData	`0x3000`
PointerToRawData	`0x189000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.15684`

Imports

IMM32.dll	`ImmGetCompositionStringA` `ImmGetCompositionWindow` `ImmSetCompositionWindow` `ImmGetDefaultIMEWnd` `ImmSetConversionStatus` `ImmGetContext` `ImmGetDescriptionA` `ImmGetIMEFileNameA` `ImmGetConversionStatus` `ImmReleaseContext`
DSOUND.dll	`#1` `#2`
OPENGL32.dll	`glColor3f` `glEnd` `glVertex3fv` `glTexCoord2f` `glBegin` `glColor3fv` `glGetIntegerv` `glGetString` `glAlphaFunc` `glFogf` `glFogfv` `glEnable` `glDisable` `glClearColor` `glTexImage2D` `glBindTexture` `glVertex3f` `glDepthMask` `glPolygonMode` `glFrontFace` `glStencilFunc` `glColorMask` `glVertex2f` `glDepthFunc` `glStencilOp` `glTexEnvf` `glPixelStorei` `glTexParameteri` `glDeleteTextures` `glIsTexture` `glColor4ub` `glLoadIdentity` `glMatrixMode` `glPopMatrix` `glClear` `glTranslatef` `glRotatef` `glPushMatrix` `wglDeleteContext` `wglMakeCurrent` `wglCreateContext` `glScalef` `glGenTextures` `glTexEnvi` `glReadPixels` `glGetFloatv` `glBlendFunc` `glViewport` `glFogi` `glFlush` `glColor4f`
GLU32.dll	`gluOrtho2D` `gluPerspective`
WINMM.dll	`mmioAscend` `mmioOpenA` `mmioClose` `timeGetTime` `mmioDescend` `mmioRead` `timeGetDevCaps` `timeBeginPeriod` `mmioWrite` `timeEndPeriod`
KERNEL32.dll	`TerminateThread` `CreateThread` `OpenMutexA` `EnterCriticalSection` `LeaveCriticalSection` `lstrcatA` `OpenEventA` `WaitForSingleObject` `ReleaseMutex` `GetComputerNameA` `lstrcmpA` `ExitProcess` `VirtualAlloc` `VirtualFree` `VirtualProtect` `LoadLibraryExA` `GetTempFileNameA` `GetTempPathA` `HeapFree` `GetProcessHeap` `HeapAlloc` `GetFileInformationByHandle` `GetCurrentThreadId` `GetTickCount` `Sleep` `lstrlenA` `CloseHandle` `WriteFile` `SetFilePointer` `CreateFileA` `DeleteFileA` `ReadFile` `GetLocalTime` `GetSystemDirectoryA` `lstrcmpiA` `GetVersionExA` `QueryPerformanceCounter` `SetProcessAffinityMask` `SetThreadPriority` `SetPriorityClass` `GetProcessAffinityMask` `GetThreadPriority` `GetPriorityClass` `GetCurrentThread` `GetCurrentProcess` `QueryPerformanceFrequency` `OutputDebugStringA` `FlushFileBuffers` `GetProcAddress` `LoadLibraryA` `GlobalMemoryStatus` `GlobalUnlock` `GlobalLock` `GetCommandLineA` `GetFileSize` `GetLastError` `GetPrivateProfileStringA` `GetCurrentDirectoryA` `CopyFileA` `SetFileAttributesA` `Process32Next` `TerminateProcess` `OpenProcess` `Process32First` `CreateToolhelp32Snapshot` `WinExec` `FindFirstFileA` `FindClose` `CreateMutexA` `GetModuleFileNameA` `GetFileAttributesA` `MoveFileA` `IsBadReadPtr` `CreateEventA` `CreateProcessA` `WaitForMultipleObjects` `GetExitCodeProcess` `GetModuleHandleA` `ResetEvent` `ResumeThread` `SetEndOfFile` `DeleteCriticalSection` `InitializeCriticalSection` `SetEvent` `WideCharToMultiByte` `CreateFileMappingA` `UnmapViewOfFile` `MapViewOfFile` `FindNextFileA` `RemoveDirectoryA` `CreateDirectoryA` `GetThreadContext` `lstrcpynA` `GetCurrentProcessId` `Module32First` `Module32Next` `SetUnhandledExceptionFilter` `IsValidLocale` `IsValidCodePage` `GetLocaleInfoA` `EnumSystemLocalesA` `GetUserDefaultLCID` `SetHandleCount` `GetFileType` `UnhandledExceptionFilter` `FreeEnvironmentStringsA` `FreeEnvironmentStringsW` `GetEnvironmentStrings` `LCMapStringW` `GetEnvironmentStringsW` `GetEnvironmentVariableA` `HeapDestroy` `HeapCreate` `IsBadWritePtr` `IsBadCodePtr` `GetStringTypeA` `GetStringTypeW` `CompareStringA` `CompareStringW` `SetEnvironmentVariableA` `SetConsoleCtrlHandler` `GetLocaleInfoW` `DuplicateHandle` `SetStdHandle` `CreatePipe` `GetStdHandle` `PeekNamedPipe` `lstrcpyA` `InterlockedExchange` `RtlUnwind` `InterlockedDecrement` `InterlockedIncrement` `GetTimeZoneInformation` `GetSystemTime` `GetStartupInfoA` `GetVersion` `GetSystemTimeAsFileTime` `RaiseException` `TlsSetValue` `TlsAlloc` `TlsFree` `SetLastError` `TlsGetValue` `HeapReAlloc` `HeapSize` `GetCPInfo` `GetACP` `GetOEMCP` `FatalAppExitA` `MultiByteToWideChar` `LCMapStringA` `FreeLibrary`
USER32.dll	`GetFocus` `UnregisterHotKey` `RegisterHotKey` `GetAsyncKeyState` `GetKeyboardLayout` `GetKeyboardLayoutNameA` `GetClipboardData` `SendMessageA` `wsprintfA` `GetWindowRect` `SetWindowPos` `CallNextHookEx` `UnhookWindowsHookEx` `SetWindowsHookExA` `GetDesktopWindow` `MessageBoxA` `OpenClipboard` `CallWindowProcA` `GetWindowLongA` `GetCaretPos` `GetWindowTextA` `SetWindowTextA` `ShowWindow` `ReleaseDC` `GetDC` `SetWindowLongA` `PostMessageA` `SetFocus` `IsWindowVisible` `GetScrollPos` `SetScrollPos` `SetTimer` `ShowCursor` `ChangeDisplaySettingsA` `SystemParametersInfoA` `ReleaseCapture` `SetCapture` `DefWindowProcA` `PostQuitMessage` `EndPaint` `BeginPaint` `DestroyWindow` `RegisterClassA` `LoadCursorA` `LoadIconA` `SetForegroundWindow` `GetSystemMetrics` `AdjustWindowRect` `IsIconic` `DispatchMessageA` `TranslateMessage` `CreateWindowExA` `CloseClipboard` `GetMessageA` `PeekMessageA` `UpdateWindow` `EnumDisplaySettingsA` `SetCursorPos` `SetRect` `OffsetRect` `PtInRect` `GetDoubleClickTime` `ScreenToClient` `GetCursorPos` `GetActiveWindow` `IntersectRect` `wvsprintfA` `FindWindowA`
GDI32.dll	`ChoosePixelFormat` `CreateFontA` `SetBkMode` `SwapBuffers` `SelectObject` `SetPixelFormat` `TextOutA` `SetTextColor` `DeleteObject` `DeleteDC` `CreateDIBSection` `CreateCompatibleDC` `SetBkColor` `GetTextExtentPoint32A` `GetStockObject` `GetTextExtentPointA` `BitBlt`
ADVAPI32.dll	`CryptReleaseContext` `RegDeleteKeyA` `CryptGetHashParam` `CryptDeriveKey` `CryptDecrypt` `CryptImportKey` `CryptCreateHash` `CryptHashData` `CryptVerifySignatureA` `CryptDestroyHash` `CryptDestroyKey` `InitializeSecurityDescriptor` `GetUserNameA` `RegDeleteValueA` `RegEnumValueA` `CryptAcquireContextA` `RegCreateKeyExA` `RegSetValueExA` `RegOpenKeyExA` `RegQueryValueExA` `SetSecurityDescriptorDacl` `RegCloseKey`
SHELL32.dll	`ShellExecuteA`
ole32.dll	`CoUninitialize` `CoCreateInstance` `CoInitialize`
WS2_32.dll	`gethostbyname` `WSAAsyncSelect` `setsockopt` `socket` `shutdown` `recv` `WSASend` `WSAStartup` `WSACleanup` `send` `WSAGetLastError` `inet_addr` `htons` `connect` `closesocket`
VERSION.dll	`VerQueryValueA` `GetFileVersionInfoSizeA` `GetFileVersionInfoA`
wzAudio.dll	`wzAudioStop` `wzAudioPlay` `wzAudioGetStreamOffsetRange` `wzAudioDestroy` `wzAudioOption` `wzAudioCreate`
KERNEL32.dll (#2)	`TerminateThread` `CreateThread` `OpenMutexA` `EnterCriticalSection` `LeaveCriticalSection` `lstrcatA` `OpenEventA` `WaitForSingleObject` `ReleaseMutex` `GetComputerNameA` `lstrcmpA` `ExitProcess` `VirtualAlloc` `VirtualFree` `VirtualProtect` `LoadLibraryExA` `GetTempFileNameA` `GetTempPathA` `HeapFree` `GetProcessHeap` `HeapAlloc` `GetFileInformationByHandle` `GetCurrentThreadId` `GetTickCount` `Sleep` `lstrlenA` `CloseHandle` `WriteFile` `SetFilePointer` `CreateFileA` `DeleteFileA` `ReadFile` `GetLocalTime` `GetSystemDirectoryA` `lstrcmpiA` `GetVersionExA` `QueryPerformanceCounter` `SetProcessAffinityMask` `SetThreadPriority` `SetPriorityClass` `GetProcessAffinityMask` `GetThreadPriority` `GetPriorityClass` `GetCurrentThread` `GetCurrentProcess` `QueryPerformanceFrequency` `OutputDebugStringA` `FlushFileBuffers` `GetProcAddress` `LoadLibraryA` `GlobalMemoryStatus` `GlobalUnlock` `GlobalLock` `GetCommandLineA` `GetFileSize` `GetLastError` `GetPrivateProfileStringA` `GetCurrentDirectoryA` `CopyFileA` `SetFileAttributesA` `Process32Next` `TerminateProcess` `OpenProcess` `Process32First` `CreateToolhelp32Snapshot` `WinExec` `FindFirstFileA` `FindClose` `CreateMutexA` `GetModuleFileNameA` `GetFileAttributesA` `MoveFileA` `IsBadReadPtr` `CreateEventA` `CreateProcessA` `WaitForMultipleObjects` `GetExitCodeProcess` `GetModuleHandleA` `ResetEvent` `ResumeThread` `SetEndOfFile` `DeleteCriticalSection` `InitializeCriticalSection` `SetEvent` `WideCharToMultiByte` `CreateFileMappingA` `UnmapViewOfFile` `MapViewOfFile` `FindNextFileA` `RemoveDirectoryA` `CreateDirectoryA` `GetThreadContext` `lstrcpynA` `GetCurrentProcessId` `Module32First` `Module32Next` `SetUnhandledExceptionFilter` `IsValidLocale` `IsValidCodePage` `GetLocaleInfoA` `EnumSystemLocalesA` `GetUserDefaultLCID` `SetHandleCount` `GetFileType` `UnhandledExceptionFilter` `FreeEnvironmentStringsA` `FreeEnvironmentStringsW` `GetEnvironmentStrings` `LCMapStringW` `GetEnvironmentStringsW` `GetEnvironmentVariableA` `HeapDestroy` `HeapCreate` `IsBadWritePtr` `IsBadCodePtr` `GetStringTypeA` `GetStringTypeW` `CompareStringA` `CompareStringW` `SetEnvironmentVariableA` `SetConsoleCtrlHandler` `GetLocaleInfoW` `DuplicateHandle` `SetStdHandle` `CreatePipe` `GetStdHandle` `PeekNamedPipe` `lstrcpyA` `InterlockedExchange` `RtlUnwind` `InterlockedDecrement` `InterlockedIncrement` `GetTimeZoneInformation` `GetSystemTime` `GetStartupInfoA` `GetVersion` `GetSystemTimeAsFileTime` `RaiseException` `TlsSetValue` `TlsAlloc` `TlsFree` `SetLastError` `TlsGetValue` `HeapReAlloc` `HeapSize` `GetCPInfo` `GetACP` `GetOEMCP` `FatalAppExitA` `MultiByteToWideChar` `LCMapStringA` `FreeLibrary`
ADVAPI32.dll (#2)	`CryptReleaseContext` `RegDeleteKeyA` `CryptGetHashParam` `CryptDeriveKey` `CryptDecrypt` `CryptImportKey` `CryptCreateHash` `CryptHashData` `CryptVerifySignatureA` `CryptDestroyHash` `CryptDestroyKey` `InitializeSecurityDescriptor` `GetUserNameA` `RegDeleteValueA` `RegEnumValueA` `CryptAcquireContextA` `RegCreateKeyExA` `RegSetValueExA` `RegOpenKeyExA` `RegQueryValueExA` `SetSecurityDescriptorDacl` `RegCloseKey`

Delayed Imports

1

Type	`RT_ICON`
Language	Korean - Korea
Codepage	UNKNOWN
Size	`0x2e8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.07176`
MD5	`46bd0e570128820855709b0ef7baedf1`
SHA1	`e3a00e970a62c66795522d5638fd07feb0ec9cee`
SHA256	`419f856569df391049fe54baa3eaba23333af684d468b3db54032b1ae99da84a`
SHA3	`273d3ff86bc30ad79810481368f1ef676f2541739920ac15a65e4afa13cde7c5`

2

Type	`RT_ICON`
Language	Korean - Korea
Codepage	UNKNOWN
Size	`0xea8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.70736`
MD5	`9326002520adbb64c0e22cfe4b56ef9f`
SHA1	`23fb80ddf56393ca578790aab88b93c089a06537`
SHA256	`e17119d66f71f8a055295d5f87c9c2cca081bbd83904fe01ab6bdc6381c6e191`
SHA3	`eb013a7517ae50bb603f8250befe6b486888245afa87edb5ce2cd7c5faf202db`

3

Type	`RT_ICON`
Language	Korean - Korea
Codepage	UNKNOWN
Size	`0x8a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.91116`
MD5	`5b3f8baf6ed52b5f2a5c88c5001736fa`
SHA1	`c9b4a610997f92be3f21c555f4b517308cac47c0`
SHA256	`ae3c6b324c9eaa11bde5b44c15c87968f088fec942f9b483b75741da8fce6813`
SHA3	`d7d179d7618467f6554a6a91a8d6c1966a8025551b1f1208fb792e72039b9bac`

4

Type	`RT_ICON`
Language	Korean - Korea
Codepage	UNKNOWN
Size	`0x128`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.67625`
MD5	`8a36e0ba48ea6216c985b760e8601777`
SHA1	`79ed19e9df7265a95acdac0945fe4e887095c78e`
SHA256	`f8e4fc643d9f8874d5180c8f75795d3cdf10c5344390a42320d3a3f5bcc3e07d`
SHA3	`1bcb14873608eb156ee667c93b68e3328363931b0c9f75d27e4696081e6c14fb`

101

Type	`RT_GROUP_ICON`
Language	Korean - Korea
Codepage	UNKNOWN
Size	`0x3e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.70237`
Detected Filetype	Icon file
MD5	`7a5323bc7bc1f8b5d24ac4563187979e`
SHA1	`0cf74ff14e9af6df11b035640c019fb5acd9f38f`
SHA256	`30318b36a5012a6a445f593ce7966ba1a0c19d9e74a8009c94903e019fd12a27`
SHA3	`21e12534926c86bf2785d56922f6e48dce8230252a7023bdf1f9549c5177b8ed`

1 (#2)

Type	`RT_VERSION`
Language	Korean - Korea
Codepage	UNKNOWN
Size	`0x324`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.33409`
MD5	`1a74b8555e21c145c339f4e07b43e75f`
SHA1	`7e7c3b4611f424cfeeda62ee8e1b2ae4ad469b1b`
SHA256	`3c0a8c5fe88ca3124553b4a42c206027b564f165839ee95038bbfe5c828873ea`
SHA3	`36562e277983d04674a229b13223b07cb27703fe794e1dda5bc816a66812c21d`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.2.44.0
ProductVersion	1.0.0.1
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT` `VOS_NT_WINDOWS32` `VOS_WINCE` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	Korean - Korea
CompanyName	WebZen
FileDescription	main
FileVersion (#2)	1, 2, 44, 0
InternalName	main
LegalCopyright	Copyright ⓒ 2002
OriginalFilename	main.exe
ProductName	WebZen mu main
ProductVersion (#2)	1, 0, 0, 1

Resource LangID	Korean - Korea

TLS Callbacks

Load Configuration

RICH Header

XOR Key	`0xe810f6a3`
Unmarked objects	`0`
Linker (VC++ 6.0 SP5 imp/exp build 8447)	`2`
12 (7291)	`4`
14 (7299)	`39`
C objects (VS98 SP6 build 8804)	`163`
C++ objects (8047)	`3`
C++ objects (VC++ 6.0 SP5 build 8804)	`10`
C objects (VS98 build 8168)	`44`
C++ objects (9178)	`1`
Imports (9210)	`2`
Total imports	`362`
19 (8034)	`25`
C++ objects (VS98 SP6 build 8804)	`157`
Resource objects (VS98 SP6 cvtres build 1736)	`1`

Errors

[*] Warning: Section .text has a size of 0!
[*] Warning: Section .rdata has a size of 0!
[*] Warning: Section .data has a size of 0!
[*] Warning: Section .vmp0 has a size of 0!