8eabc7bd3e8573fdc0d88a7372bd4bdd
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2005-Nov-28 05:16:06 |
| Detected languages |
Korean - Korea
|
| Debug artifacts |
ents and Settings\krynn44.WEBZENDEV\���� ȭ��\Working Folder\Mu project\Mu\tmp\Release\main.pdb
|
| CompanyName | WebZen |
| FileDescription | main |
| FileVersion | 1, 1, 46, 0 |
| InternalName | main |
| LegalCopyright | Copyright ⓒ 2002 |
| OriginalFilename | main.exe |
| ProductName | WebZen mu main |
| ProductVersion | 1, 0, 0, 1 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ 6.0 - 8.0
MASM/TASM - sig1(h) Microsoft Visual C++ Microsoft Visual C++ v6.0 |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. |
3039 bytes of data starting at offset 0x2d7000.
The overlay data has an entropy of 7.63121 and is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 7/71 (Scanned on 2024-12-02 01:09:04) |
CrowdStrike:
win/grayware_confidence_60% (W)
Cylance: Unsafe Google: Detected Gridinsoft: Trojan.Win32.Gen.vb!n Ikarus: Trojan.Crypt McAfeeD: ti!94864A91AC35 Symantec: ML.Attribute.HighConfidence |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x110 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2005-Nov-28 05:16:06 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x2a6000 |
| SizeOfInitializedData | 0x769b000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x002A6E1C (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x2a7000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x7942000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
Imports
| IMM32.dll |
ImmGetCompositionStringA
ImmGetCompositionWindow ImmSetCompositionWindow ImmGetDefaultIMEWnd ImmSetConversionStatus ImmGetContext ImmGetDescriptionA ImmGetIMEFileNameA ImmGetConversionStatus ImmReleaseContext |
|---|---|
| DSOUND.dll |
#1
#2 |
| OPENGL32.dll |
glColor3f
glEnd glVertex3fv glTexCoord2f glBegin glColor3fv glGetIntegerv glGetString glFogf glFogfv glEnable glDisable glClearColor glTexImage2D glBindTexture glVertex3f glDepthMask glPolygonMode glFrontFace glStencilFunc glColorMask glVertex2f glDepthFunc glStencilOp glTexEnvf glPixelStorei glTexParameteri glDeleteTextures glIsTexture glColor4ub glLoadIdentity glMatrixMode glPopMatrix glClear glAlphaFunc glTranslatef glRotatef glPushMatrix wglDeleteContext wglGetProcAddress wglMakeCurrent wglCreateContext glScalef glGenTextures glTexEnvi glReadPixels glGetFloatv glBlendFunc glViewport glFogi glFlush glColor4f |
| GLU32.dll |
gluOrtho2D
gluPerspective |
| WINMM.dll |
mmioOpenA
mmioAscend mmioClose mmioDescend mmioRead timeEndPeriod timeGetDevCaps timeBeginPeriod timeGetTime mmioWrite |
| KERNEL32.dll |
ReleaseMutex
CreateMutexA TerminateThread CreateThread OpenMutexA EnterCriticalSection LeaveCriticalSection lstrcatA GetComputerNameA lstrcmpA ExitProcess VirtualAlloc VirtualFree VirtualProtect LoadLibraryExA GetTempFileNameA GetTempPathA HeapFree GetProcessHeap HeapAlloc GetFileInformationByHandle DuplicateHandle GetCurrentThreadId GetTickCount Sleep lstrlenA CloseHandle WriteFile SetFilePointer CreateFileA DeleteFileA ReadFile GetLocalTime GetSystemDirectoryA lstrcmpiA GetVersionExA QueryPerformanceCounter SetProcessAffinityMask SetThreadPriority SetPriorityClass GetProcessAffinityMask GetThreadPriority GetPriorityClass GetCurrentThread GetCurrentProcess QueryPerformanceFrequency OutputDebugStringA SetStdHandle GetProcAddress LoadLibraryA GlobalMemoryStatus GlobalUnlock GlobalLock GetCommandLineA GetFileSize GetLastError GetPrivateProfileStringA GetCurrentDirectoryA CopyFileA SetFileAttributesA Process32Next TerminateProcess OpenProcess Process32First CreateToolhelp32Snapshot WinExec FindFirstFileA FindClose GetModuleFileNameA GetFileAttributesA MoveFileExA IsBadReadPtr OpenEventA WaitForSingleObject CreateEventA CreateProcessA WaitForMultipleObjects GetExitCodeProcess GetModuleHandleA ResetEvent ResumeThread SetEndOfFile DeleteCriticalSection InitializeCriticalSection SetEvent WideCharToMultiByte CreateFileMappingA UnmapViewOfFile MapViewOfFile FindNextFileA RemoveDirectoryA CreateDirectoryA GetThreadContext lstrcpynA GetCurrentProcessId Module32First Module32Next SetUnhandledExceptionFilter IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID SetHandleCount GetFileType GetEnvironmentVariableA HeapDestroy IsValidLocale HeapCreate IsBadWritePtr UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW IsBadCodePtr GetStringTypeA GetStringTypeW CompareStringA CompareStringW SetEnvironmentVariableA SetConsoleCtrlHandler GetLocaleInfoW CreatePipe GetStdHandle PeekNamedPipe FlushFileBuffers lstrcpyA InterlockedExchange RtlUnwind InterlockedDecrement InterlockedIncrement GetTimeZoneInformation GetSystemTime GetStartupInfoA GetVersion GetSystemTimeAsFileTime RaiseException TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP FatalAppExitA MultiByteToWideChar LCMapStringA LCMapStringW FreeLibrary |
| USER32.dll |
GetKeyboardLayoutNameA
wvsprintfA SendMessageA RegisterHotKey GetWindowRect SetWindowPos CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetDesktopWindow MessageBoxA UnregisterHotKey GetFocus SetWindowLongA CloseClipboard GetClipboardData OpenClipboard CallWindowProcA GetWindowLongA GetCaretPos GetWindowTextA SetWindowTextA ShowWindow ReleaseDC GetDC GetKeyboardLayout PostMessageA SetFocus IsWindowVisible GetScrollPos SetScrollPos FindWindowA ShowCursor ChangeDisplaySettingsA SystemParametersInfoA DefWindowProcA PostQuitMessage EndPaint BeginPaint DestroyWindow RegisterClassA LoadCursorA LoadIconA SetForegroundWindow IsIconic DispatchMessageA TranslateMessage GetMessageA PeekMessageA UpdateWindow EnumDisplaySettingsA SetCursorPos CreateWindowExA GetAsyncKeyState SetRect OffsetRect PtInRect GetDoubleClickTime ScreenToClient GetCursorPos IntersectRect wsprintfA SetTimer |
| GDI32.dll |
GetTextExtentPoint32A
GetTextExtentPointA SelectObject SwapBuffers DeleteDC TextOutA BitBlt GetStockObject SetBkColor SetPixelFormat ChoosePixelFormat CreateFontA SetTextColor CreateCompatibleDC DeleteObject CreateDIBSection SetBkMode |
| ADVAPI32.dll |
CryptReleaseContext
RegDeleteKeyA CryptGetHashParam CryptDeriveKey CryptDecrypt CryptImportKey CryptCreateHash CryptHashData CryptVerifySignatureA CryptDestroyHash CryptDestroyKey InitializeSecurityDescriptor GetUserNameA RegDeleteValueA RegEnumValueA CryptAcquireContextA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegQueryValueExA SetSecurityDescriptorDacl RegCloseKey |
| SHELL32.dll |
ShellExecuteA
|
| ole32.dll |
CoUninitialize
CoCreateInstance CoInitialize |
| WS2_32.dll |
connect
setsockopt socket shutdown recv WSASend WSAStartup WSACleanup send WSAGetLastError gethostbyname inet_addr htons WSAAsyncSelect closesocket |
| VERSION.dll |
VerQueryValueA
GetFileVersionInfoSizeA GetFileVersionInfoA |
| wzAudio.dll |
wzAudioStop
wzAudioPlay wzAudioDestroy wzAudioOption wzAudioCreate |
Delayed Imports
1
2
3
4
101
1 (#2)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.1.46.0 |
| ProductVersion | 1.0.0.1 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | Korean - Korea |
| CompanyName | WebZen |
| FileDescription | main |
| FileVersion (#2) | 1, 1, 46, 0 |
| InternalName | main |
| LegalCopyright | Copyright ⓒ 2002 |
| OriginalFilename | main.exe |
| ProductName | WebZen mu main |
| ProductVersion (#2) | 1, 0, 0, 1 |
| Resource LangID | Korean - Korea |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2005-Nov-28 05:16:06 |
| Version | 0.0 |
| SizeofData | 120 |
| AddressOfRawData | 0 |
| PointerToRawData | 0x2d7000 |
| Referenced File | ents and Settings\krynn44.WEBZENDEV\���� ȭ��\Working Folder\Mu project\Mu\tmp\Release\main.pdb |
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0x79b181e5 |
|---|---|
| Unmarked objects | 0 |
| Linker (VC++ 6.0 SP5 imp/exp build 8447) | 2 |
| 12 (7291) | 4 |
| 14 (7299) | 38 |
| C objects (VS98 SP6 build 8804) | 161 |
| C++ objects (8047) | 3 |
| C objects (VC++ 6.0 SP5 build 8804) | 1 |
| C++ objects (VC++ 6.0 SP5 build 8804) | 10 |
| C objects (VS98 build 8168) | 44 |
| C++ objects (9178) | 1 |
| Imports (9210) | 2 |
| Total imports | 357 |
| 19 (8034) | 25 |
| C++ objects (VS98 SP6 build 8804) | 139 |
| Resource objects (VS98 SP6 cvtres build 1736) | 1 |
Errors
[*] Warning: Raw bytes from section .text could not be obtained.