| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2022-Nov-15 05:19:46 |
| Info | Matching compiler(s): |
Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ Microsoft Visual C++ v6.0 Microsoft Visual C++ v5.0/v6.0 (MFC) |
| Suspicious | PEiD Signature: | Crunch 4 |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious | The PE is possibly packed. | Unusual section name found: pacode |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | VirusTotal score: 2/74 (Scanned on 2024-05-31 23:26:32) |
Sangfor:
Suspicious.Win32.Save.ins
Trapmine: malicious.high.ml.score |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x108 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2022-Nov-15 05:19:46 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x1d4000 |
| SizeOfInitializedData | 0x363000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x001C64DB (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x1d5000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x538000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| msapi.dll |
initializeMSchat
selectMSgame initializeMS loginMShost loginMSPlayer fetchMSgame requestMSgame resetMSfilter connectMS closeMS updateMSgame sendMSchat |
|---|---|
| DDRAW.dll |
DirectDrawCreate
DirectDrawEnumerateA |
| DSOUND.dll |
#1
#6 |
| DINPUT.dll |
DirectInputCreateA
|
| WINMM.dll |
joyGetPosEx
timeGetDevCaps timeKillEvent timeSetEvent joyGetNumDevs joyGetDevCapsA timeBeginPeriod timeEndPeriod timeGetTime mmioRead mmioDescend mmioAscend mmioOpenA mmioSeek mmioClose mmioAdvance mmioGetInfo mmioSetInfo mmioWrite mmioCreateChunk |
| USER32.dll |
GetKeyState
GetKeyboardType CharUpperA SendNotifyMessageA PostMessageA AdjustWindowRect SetWindowPos UnregisterClassA AdjustWindowRectEx CreateWindowExA SetActiveWindow DestroyWindow IsIconic BeginPaint EndPaint GetClientRect PostQuitMessage GetAsyncKeyState CallNextHookEx SetWindowsHookExA LoadIconA LoadCursorA RegisterClassA SystemParametersInfoA DefWindowProcA ClientToScreen SetCursorPos GetDesktopWindow ShowWindow GetCursor keybd_event GetSystemMetrics SetForegroundWindow PostThreadMessageA wsprintfA GetWindowLongA TranslateMessage DispatchMessageA GetMessageA FindWindowA ReleaseDC KillTimer GetForegroundWindow ShowCursor GetDC SetCursor MessageBoxA MsgWaitForMultipleObjects SetTimer UnhookWindowsHookEx |
| GDI32.dll |
GetDeviceCaps
GetStockObject |
| ADVAPI32.dll |
RegCloseKey
RegFlushKey RegSetValueExA RegOpenKeyExA RegQueryValueExA |
| VERSION.dll |
VerQueryValueA
GetFileVersionInfoA GetFileVersionInfoSizeA |
| WSOCK32.dll |
__WSAFDIsSet
getsockopt send htonl shutdown inet_ntoa WSAGetLastError accept connect bind getsockname sendto setsockopt listen WSAStartup WSACleanup socket closesocket ntohs ioctlsocket recv gethostbyname inet_addr gethostname select recvfrom htons |
| SHELL32.dll |
ShellExecuteExA
|
| MMDLL.dll |
?MMDisconnect@@YAHXZ
?MMInvisJoinServer@@YAHXZ ?MMConnect@@YAHPADH@Z ?sendMSresults@@YAHPAXPADH@Z |
| KERNEL32.dll |
SetEnvironmentVariableA
SetThreadPriority GetTickCount CreateDirectoryA ExitProcess TlsAlloc TlsSetValue GetFileType PeekNamedPipe GetFileInformationByHandle GetModuleFileNameA MultiByteToWideChar GetVersion GetCommandLineA TerminateProcess GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime GetLocalTime GetTimeZoneInformation HeapAlloc HeapFree InterlockedIncrement InterlockedDecrement GetFileAttributesA SetFileAttributesA IsBadReadPtr IsBadWritePtr GetSystemInfo PulseEvent ResetEvent WaitForMultipleObjectsEx ExitThread GetThreadPriority TerminateThread ResumeThread SleepEx GetCurrentThreadId GetCurrentProcess GetCurrentThread DuplicateHandle DisableThreadLibraryCalls SetEndOfFile UnmapViewOfFile SetFilePointer GetFileSize CreateFileMappingA MapViewOfFile GetCurrentDirectoryA SetCurrentDirectoryA GetDiskFreeSpaceA GetLogicalDriveStringsA GetLogicalDrives GetFullPathNameA GetVolumeInformationA QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetProcAddress GetCommProperties FindClose FindNextFileA CompareStringW CompareStringA GetOEMCP GetACP FindFirstFileA PurgeComm GetCommState SetCommState GetCPInfo GetCurrentProcessId RaiseException SetStdHandle SetEnvironmentVariableW HeapSize RtlUnwind GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter FlushFileBuffers GetStartupInfoA GetStdHandle SetHandleCount HeapReAlloc HeapCreate HeapDestroy GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA WideCharToMultiByte CreateFileA GetOverlappedResult MoveFileA WinExec GlobalMemoryStatus GetCommModemStatus OutputDebugStringA GetSystemTime Sleep CopyFileA DeleteFileA CreateEventA CloseHandle SetEvent GetLastError CreateMutexA ReleaseMutex WaitForSingleObject TlsGetValue WriteFile SetLastError SetCommTimeouts GetVersionExA VirtualFree VirtualAlloc ReadFile CreateThread InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleHandleA EscapeCommFunction |
| XOR Key | 0x5abcb67f |
|---|---|
| Unmarked objects | 0 |
| 12 (7291) | 15 |
| 14 (7299) | 33 |
| Linker (VC++ 6.0 SP5 imp/exp build 8447) | 2 |
| 19 (8034) | 22 |
| Total imports | 269 |
| Linker (VS98 build 8168) | 3 |
| 18 (8112) | 58 |
| C objects (VC++ 6.0 SP5 imp/exp build 8447) | 115 |
| C++ objects (VS98 build 8168) | 6 |
| C objects (VS98 build 8168) | 708 |
| Unmarked objects (#2) | 11 |
No comments yet.