89a04541291f8d179300c0935d245e11

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2006-Aug-28 09:11:33
Detected languages Korean - Korea
CompanyName WebZen
FileDescription main
FileVersion 1, 2, 44, 0
InternalName main
LegalCopyright Copyright ⓒ 2002
OriginalFilename main.exe
ProductName WebZen mu main
ProductVersion 1, 0, 0, 1

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • crl.symauth.com
  • http://pki-crl.symauth.com
  • http://pki-crl.symauth.com/ca_219679623e6b4fa507d638cbeba72ecb/LatestCRL.crl07
  • http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.crl0
  • http://pki-ocsp.symauth.com0
  • pki-crl.symauth.com
  • symauth.com
Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Suspicious This PE is packed with VMProtect Unusual section name found: .vmp0
Unusual section name found: .vmp1
The number of imports reported in the RICH header is inconsistent.
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExA
  • GetProcAddress
  • LoadLibraryA
Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
  • FindWindowA
Code injection capabilities (PowerLoader):
  • GetWindowLongA
  • FindWindowA
Can access the registry:
  • RegisterHotKey
  • RegDeleteKeyA
  • RegDeleteValueA
  • RegEnumValueA
  • RegCreateKeyExA
  • RegSetValueExA
  • RegOpenKeyExA
  • RegQueryValueExA
  • RegCloseKey
Possibly launches other programs:
  • WinExec
  • CreateProcessA
  • ShellExecuteA
Uses Microsoft's cryptographic API:
  • CryptReleaseContext
  • CryptGetHashParam
  • CryptDeriveKey
  • CryptDecrypt
  • CryptImportKey
  • CryptCreateHash
  • CryptHashData
  • CryptVerifySignatureA
  • CryptDestroyHash
  • CryptDestroyKey
  • CryptAcquireContextA
Can create temporary files:
  • GetTempPathA
  • CreateFileA
Uses functions commonly found in keyloggers:
  • GetAsyncKeyState
  • CallNextHookEx
Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
Leverages the raw socket API to access the Internet:
  • gethostbyname
  • WSAAsyncSelect
  • setsockopt
  • socket
  • shutdown
  • recv
  • WSASend
  • WSAStartup
  • WSACleanup
  • send
  • WSAGetLastError
  • inet_addr
  • htons
  • connect
  • closesocket
Interacts with services:
  • OpenSCManagerW
  • EnumServicesStatusExW
  • OpenServiceW
  • QueryServiceConfigW
Manipulates other processes:
  • Process32Next
  • OpenProcess
  • Process32First
Can take screenshots:
  • GetDC
  • FindWindowA
  • CreateCompatibleDC
  • BitBlt
Reads the contents of the clipboard:
  • GetClipboardData
Malicious VirusTotal score: 11/71 (Scanned on 2024-11-25 03:18:18) Antiy-AVL: Trojan/Win32.Agent
Cylance: Unsafe
Cynet: Malicious (score: 100)
FireEye: Generic.mg.89a04541291f8d17
Gridinsoft: Trojan.Win32.Gen.vb!n
Malwarebytes: Malware.AI.4275489363
MaxSecure: Trojan.Malware.300983.susgen
McAfee: Artemis!89A04541291F
McAfeeD: ti!63ED37CA142A
Sophos: Generic ML PUA (PUA)
Trapmine: malicious.moderate.ml.score

Hashes

MD5 89a04541291f8d179300c0935d245e11
SHA1 7cbceee35c914bead88d5238da91a39ea452985f
SHA256 63ed37ca142a006f952b70b595d7463c0c1b863ff79a19509fe53ba894135afc
SHA3 2378312e0981afc1fef144e90f550900f35086391c09140d23956f1e46d193af
SSDeep 49152:DAylXp519f0/StoDK2fX0l1ESEmYZiAcPG:DAylX/P0atlCSCZi
Imports Hash a8a75b24c273fc6d86c2b9a6d7080e15

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 7
TimeDateStamp 2006-Aug-28 09:11:33
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x187000
SizeOfInitializedData 0x4000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x07C123DE (Section: .vmp1)
BaseOfCode 0x1000
BaseOfData 0x2e8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 5.0
ImageVersion 0.0
SubsystemVersion 5.0
Win32VersionValue 0
SizeOfImage 0x7c17000
SizeOfHeaders 0x1000
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x2e6452
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0xea2e
VirtualAddress 0x2e8000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x76fcac4
VirtualAddress 0x2f7000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x97dd0
VirtualAddress 0x79f4000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1

MD5 9cfc8626e31699efbb4b3e7905f1888d
SHA1 73b5e8bcadc12dabc721c9ceee976b371ba30abf
SHA256 2a0631d037438d34c85a854fd620f80cab5c4c526d71cb03bfa5e19eb5ae5838
SHA3 34ae37e8f155475890559b9ff86caff57ca06cef67aa9ec5fbbb55efcd251284
VirtualSize 0x1863f0
VirtualAddress 0x7a8c000
SizeOfRawData 0x187000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.96115

.reloc

MD5 43263572b70a51bcb71015c3136847dc
SHA1 d5e390bc5536cf15906fe53f28de7c18d27a84f8
SHA256 1ce78e94532b2e43b5b7bd3ba507626a501fb4b5d39e15b5803df8cc37442f19
SHA3 d74d8b87236e4c08d3e63c2ecc926a1d29db72369ae9bbbe63c54eeb832f2608
VirtualSize 0x104
VirtualAddress 0x7c13000
SizeOfRawData 0x1000
PointerToRawData 0x188000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.460726

.rsrc

MD5 875d590797cdcd63e7e8a550a2fd2aea
SHA1 93383c66c39129e2b202b20c6c41203644f005ae
SHA256 12f9767899a1cb307aa3117f437d898a264dbb7cbfbbe3e6f28a9572f3886bed
SHA3 7a22f4e8c0ca30acc7f316a2fd935c254afafe3de67a979b42874a91df594dc2
VirtualSize 0x203c
VirtualAddress 0x7c14000
SizeOfRawData 0x3000
PointerToRawData 0x189000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.15684

Imports

IMM32.dll ImmGetCompositionStringA
ImmGetCompositionWindow
ImmSetCompositionWindow
ImmGetDefaultIMEWnd
ImmSetConversionStatus
ImmGetContext
ImmGetDescriptionA
ImmGetIMEFileNameA
ImmGetConversionStatus
ImmReleaseContext
DSOUND.dll #1
#2
OPENGL32.dll glColor3f
glEnd
glVertex3fv
glTexCoord2f
glBegin
glColor3fv
glGetIntegerv
glGetString
glAlphaFunc
glFogf
glFogfv
glEnable
glDisable
glClearColor
glTexImage2D
glBindTexture
glVertex3f
glDepthMask
glPolygonMode
glFrontFace
glStencilFunc
glColorMask
glVertex2f
glDepthFunc
glStencilOp
glTexEnvf
glPixelStorei
glTexParameteri
glDeleteTextures
glIsTexture
glColor4ub
glLoadIdentity
glMatrixMode
glPopMatrix
glClear
glTranslatef
glRotatef
glPushMatrix
wglDeleteContext
wglMakeCurrent
wglCreateContext
glScalef
glGenTextures
glTexEnvi
glReadPixels
glGetFloatv
glBlendFunc
glViewport
glFogi
glFlush
glColor4f
GLU32.dll gluOrtho2D
gluPerspective
WINMM.dll mmioAscend
mmioOpenA
mmioClose
timeGetTime
mmioDescend
mmioRead
timeGetDevCaps
timeBeginPeriod
mmioWrite
timeEndPeriod
KERNEL32.dll TerminateThread
CreateThread
OpenMutexA
EnterCriticalSection
LeaveCriticalSection
lstrcatA
OpenEventA
WaitForSingleObject
ReleaseMutex
GetComputerNameA
lstrcmpA
ExitProcess
VirtualAlloc
VirtualFree
VirtualProtect
LoadLibraryExA
GetTempFileNameA
GetTempPathA
HeapFree
GetProcessHeap
HeapAlloc
GetFileInformationByHandle
GetCurrentThreadId
GetTickCount
Sleep
lstrlenA
CloseHandle
WriteFile
SetFilePointer
CreateFileA
DeleteFileA
ReadFile
GetLocalTime
GetSystemDirectoryA
lstrcmpiA
GetVersionExA
QueryPerformanceCounter
SetProcessAffinityMask
SetThreadPriority
SetPriorityClass
GetProcessAffinityMask
GetThreadPriority
GetPriorityClass
GetCurrentThread
GetCurrentProcess
QueryPerformanceFrequency
OutputDebugStringA
FlushFileBuffers
GetProcAddress
LoadLibraryA
GlobalMemoryStatus
GlobalUnlock
GlobalLock
GetCommandLineA
GetFileSize
GetLastError
GetPrivateProfileStringA
GetCurrentDirectoryA
CopyFileA
SetFileAttributesA
Process32Next
TerminateProcess
OpenProcess
Process32First
CreateToolhelp32Snapshot
WinExec
FindFirstFileA
FindClose
CreateMutexA
GetModuleFileNameA
GetFileAttributesA
MoveFileA
IsBadReadPtr
CreateEventA
CreateProcessA
WaitForMultipleObjects
GetExitCodeProcess
GetModuleHandleA
ResetEvent
ResumeThread
SetEndOfFile
DeleteCriticalSection
InitializeCriticalSection
SetEvent
WideCharToMultiByte
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
FindNextFileA
RemoveDirectoryA
CreateDirectoryA
GetThreadContext
lstrcpynA
GetCurrentProcessId
Module32First
Module32Next
SetUnhandledExceptionFilter
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetHandleCount
GetFileType
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
LCMapStringW
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
IsBadWritePtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetConsoleCtrlHandler
GetLocaleInfoW
DuplicateHandle
SetStdHandle
CreatePipe
GetStdHandle
PeekNamedPipe
lstrcpyA
InterlockedExchange
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
GetStartupInfoA
GetVersion
GetSystemTimeAsFileTime
RaiseException
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
HeapReAlloc
HeapSize
GetCPInfo
GetACP
GetOEMCP
FatalAppExitA
MultiByteToWideChar
LCMapStringA
FreeLibrary
USER32.dll GetFocus
UnregisterHotKey
RegisterHotKey
GetAsyncKeyState
GetKeyboardLayout
GetKeyboardLayoutNameA
GetClipboardData
SendMessageA
wsprintfA
GetWindowRect
SetWindowPos
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetDesktopWindow
MessageBoxA
OpenClipboard
CallWindowProcA
GetWindowLongA
GetCaretPos
GetWindowTextA
SetWindowTextA
ShowWindow
ReleaseDC
GetDC
SetWindowLongA
PostMessageA
SetFocus
IsWindowVisible
GetScrollPos
SetScrollPos
SetTimer
ShowCursor
ChangeDisplaySettingsA
SystemParametersInfoA
ReleaseCapture
SetCapture
DefWindowProcA
PostQuitMessage
EndPaint
BeginPaint
DestroyWindow
RegisterClassA
LoadCursorA
LoadIconA
SetForegroundWindow
GetSystemMetrics
AdjustWindowRect
IsIconic
DispatchMessageA
TranslateMessage
CreateWindowExA
CloseClipboard
GetMessageA
PeekMessageA
UpdateWindow
EnumDisplaySettingsA
SetCursorPos
SetRect
OffsetRect
PtInRect
GetDoubleClickTime
ScreenToClient
GetCursorPos
GetActiveWindow
IntersectRect
wvsprintfA
FindWindowA
GDI32.dll ChoosePixelFormat
CreateFontA
SetBkMode
SwapBuffers
SelectObject
SetPixelFormat
TextOutA
SetTextColor
DeleteObject
DeleteDC
CreateDIBSection
CreateCompatibleDC
SetBkColor
GetTextExtentPoint32A
GetStockObject
GetTextExtentPointA
BitBlt
ADVAPI32.dll CryptReleaseContext
RegDeleteKeyA
CryptGetHashParam
CryptDeriveKey
CryptDecrypt
CryptImportKey
CryptCreateHash
CryptHashData
CryptVerifySignatureA
CryptDestroyHash
CryptDestroyKey
InitializeSecurityDescriptor
GetUserNameA
RegDeleteValueA
RegEnumValueA
CryptAcquireContextA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
SetSecurityDescriptorDacl
RegCloseKey
SHELL32.dll ShellExecuteA
ole32.dll CoUninitialize
CoCreateInstance
CoInitialize
WS2_32.dll gethostbyname
WSAAsyncSelect
setsockopt
socket
shutdown
recv
WSASend
WSAStartup
WSACleanup
send
WSAGetLastError
inet_addr
htons
connect
closesocket
VERSION.dll VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
wzAudio.dll wzAudioStop
wzAudioPlay
wzAudioGetStreamOffsetRange
wzAudioDestroy
wzAudioOption
wzAudioCreate
KERNEL32.dll (#2) TerminateThread
CreateThread
OpenMutexA
EnterCriticalSection
LeaveCriticalSection
lstrcatA
OpenEventA
WaitForSingleObject
ReleaseMutex
GetComputerNameA
lstrcmpA
ExitProcess
VirtualAlloc
VirtualFree
VirtualProtect
LoadLibraryExA
GetTempFileNameA
GetTempPathA
HeapFree
GetProcessHeap
HeapAlloc
GetFileInformationByHandle
GetCurrentThreadId
GetTickCount
Sleep
lstrlenA
CloseHandle
WriteFile
SetFilePointer
CreateFileA
DeleteFileA
ReadFile
GetLocalTime
GetSystemDirectoryA
lstrcmpiA
GetVersionExA
QueryPerformanceCounter
SetProcessAffinityMask
SetThreadPriority
SetPriorityClass
GetProcessAffinityMask
GetThreadPriority
GetPriorityClass
GetCurrentThread
GetCurrentProcess
QueryPerformanceFrequency
OutputDebugStringA
FlushFileBuffers
GetProcAddress
LoadLibraryA
GlobalMemoryStatus
GlobalUnlock
GlobalLock
GetCommandLineA
GetFileSize
GetLastError
GetPrivateProfileStringA
GetCurrentDirectoryA
CopyFileA
SetFileAttributesA
Process32Next
TerminateProcess
OpenProcess
Process32First
CreateToolhelp32Snapshot
WinExec
FindFirstFileA
FindClose
CreateMutexA
GetModuleFileNameA
GetFileAttributesA
MoveFileA
IsBadReadPtr
CreateEventA
CreateProcessA
WaitForMultipleObjects
GetExitCodeProcess
GetModuleHandleA
ResetEvent
ResumeThread
SetEndOfFile
DeleteCriticalSection
InitializeCriticalSection
SetEvent
WideCharToMultiByte
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
FindNextFileA
RemoveDirectoryA
CreateDirectoryA
GetThreadContext
lstrcpynA
GetCurrentProcessId
Module32First
Module32Next
SetUnhandledExceptionFilter
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetHandleCount
GetFileType
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
LCMapStringW
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
IsBadWritePtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetConsoleCtrlHandler
GetLocaleInfoW
DuplicateHandle
SetStdHandle
CreatePipe
GetStdHandle
PeekNamedPipe
lstrcpyA
InterlockedExchange
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
GetStartupInfoA
GetVersion
GetSystemTimeAsFileTime
RaiseException
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
HeapReAlloc
HeapSize
GetCPInfo
GetACP
GetOEMCP
FatalAppExitA
MultiByteToWideChar
LCMapStringA
FreeLibrary
ADVAPI32.dll (#2) CryptReleaseContext
RegDeleteKeyA
CryptGetHashParam
CryptDeriveKey
CryptDecrypt
CryptImportKey
CryptCreateHash
CryptHashData
CryptVerifySignatureA
CryptDestroyHash
CryptDestroyKey
InitializeSecurityDescriptor
GetUserNameA
RegDeleteValueA
RegEnumValueA
CryptAcquireContextA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
SetSecurityDescriptorDacl
RegCloseKey

Delayed Imports

1

Type RT_ICON
Language Korean - Korea
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.07176
MD5 46bd0e570128820855709b0ef7baedf1
SHA1 e3a00e970a62c66795522d5638fd07feb0ec9cee
SHA256 419f856569df391049fe54baa3eaba23333af684d468b3db54032b1ae99da84a
SHA3 273d3ff86bc30ad79810481368f1ef676f2541739920ac15a65e4afa13cde7c5

2

Type RT_ICON
Language Korean - Korea
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.70736
MD5 9326002520adbb64c0e22cfe4b56ef9f
SHA1 23fb80ddf56393ca578790aab88b93c089a06537
SHA256 e17119d66f71f8a055295d5f87c9c2cca081bbd83904fe01ab6bdc6381c6e191
SHA3 eb013a7517ae50bb603f8250befe6b486888245afa87edb5ce2cd7c5faf202db

3

Type RT_ICON
Language Korean - Korea
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.91116
MD5 5b3f8baf6ed52b5f2a5c88c5001736fa
SHA1 c9b4a610997f92be3f21c555f4b517308cac47c0
SHA256 ae3c6b324c9eaa11bde5b44c15c87968f088fec942f9b483b75741da8fce6813
SHA3 d7d179d7618467f6554a6a91a8d6c1966a8025551b1f1208fb792e72039b9bac

4

Type RT_ICON
Language Korean - Korea
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.67625
MD5 8a36e0ba48ea6216c985b760e8601777
SHA1 79ed19e9df7265a95acdac0945fe4e887095c78e
SHA256 f8e4fc643d9f8874d5180c8f75795d3cdf10c5344390a42320d3a3f5bcc3e07d
SHA3 1bcb14873608eb156ee667c93b68e3328363931b0c9f75d27e4696081e6c14fb

101

Type RT_GROUP_ICON
Language Korean - Korea
Codepage UNKNOWN
Size 0x3e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.70237
Detected Filetype Icon file
MD5 7a5323bc7bc1f8b5d24ac4563187979e
SHA1 0cf74ff14e9af6df11b035640c019fb5acd9f38f
SHA256 30318b36a5012a6a445f593ce7966ba1a0c19d9e74a8009c94903e019fd12a27
SHA3 21e12534926c86bf2785d56922f6e48dce8230252a7023bdf1f9549c5177b8ed

1 (#2)

Type RT_VERSION
Language Korean - Korea
Codepage UNKNOWN
Size 0x324
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.33409
MD5 1a74b8555e21c145c339f4e07b43e75f
SHA1 7e7c3b4611f424cfeeda62ee8e1b2ae4ad469b1b
SHA256 3c0a8c5fe88ca3124553b4a42c206027b564f165839ee95038bbfe5c828873ea
SHA3 36562e277983d04674a229b13223b07cb27703fe794e1dda5bc816a66812c21d

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.2.44.0
ProductVersion 1.0.0.1
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language Korean - Korea
CompanyName WebZen
FileDescription main
FileVersion (#2) 1, 2, 44, 0
InternalName main
LegalCopyright Copyright ⓒ 2002
OriginalFilename main.exe
ProductName WebZen mu main
ProductVersion (#2) 1, 0, 0, 1
Resource LangID Korean - Korea

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xe810f6a3
Unmarked objects 0
Linker (VC++ 6.0 SP5 imp/exp build 8447) 2
12 (7291) 4
14 (7299) 39
C objects (VS98 SP6 build 8804) 163
C++ objects (8047) 3
C++ objects (VC++ 6.0 SP5 build 8804) 10
C objects (VS98 build 8168) 44
C++ objects (9178) 1
Imports (9210) 2
Total imports 362
19 (8034) 25
C++ objects (VS98 SP6 build 8804) 157
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .vmp0 has a size of 0!
<-- -->