321e66c8a647c171ab365bb06e0836fb0df8cc76b0cada904fc626a95642bfb9
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2010-May-03 07:59:33 |
| Detected languages |
Korean - Korea
|
| CompanyName | Softnyx |
| FileDescription | GunBound |
| FileVersion | 0, 0, 2, 40 |
| InternalName | GunBound |
| LegalCopyright | Copyright â Softnyx, 2002 |
| OriginalFilename | GunBound.gme |
| ProductName | Softnyx GunBound Project |
| ProductVersion | 1, 0, 0, 1 |
Plugin Output
| Suspicious | PEiD Signature: | Armadillo 3.01, 3.05 |
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to CRC32 |
| Malicious | The PE is packed with Aspack or Armadillo |
Section .text1 is both writable and executable.
Unusual section name found: .adata Section .adata is both writable and executable. The RICH header checksum is invalid. |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 6/72 (Scanned on 2025-01-07 00:54:55) |
Bkav:
W32.AIDetectMalware
Google: Detected Ikarus: Trojan.Win32.Agent SUPERAntiSpyware: Trojan.Agent/Gen-Symmi Trapmine: suspicious.low.ml.score VirIT: Trojan.Win32.Generic.UYA |
Hashes
| MD5 | ce6108620c259670e3762f3333f08316 🔍 |
|---|---|
| SHA1 | da4c50b6bb0f3bc9171bbcea32ba9a92269e2515 🔍 |
| SHA256 | 321e66c8a647c171ab365bb06e0836fb0df8cc76b0cada904fc626a95642bfb9 🔍 |
| SHA3 | be1a0ca22193d1d2bbbda479200ae57133142533c49b1df8824a8de586578f62 🔍 |
| SSDeep | 24576:frGUHLD0eHz81AcUP/tP5x9YsO5s1/6OVc7CwgaSjNabiOkA2QhJG7x+OKb6CZJ:n0ecS5TYtCdkRzUQXG7kzdZJ 🔍 |
| Imports Hash | cf6594eb4d32b4593671e06c9e38e7db 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0x17 |
| e_oeminfo | 0 |
| e_lfanew | 0x130 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 8 |
| TimeDateStamp | 2010-May-03 07:59:33 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 83.0 |
| SizeOfCode | 0x3c000 |
| SizeOfInitializedData | 0x13e000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00E52000 (Section: .adata) |
| BaseOfCode | 0xe22000 |
| BaseOfData | 0xe62000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xfc4000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x1fb91d |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
.rdata
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x3276a |
| VirtualAddress | 0x1fd000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
.data
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0xbf144c |
| VirtualAddress | 0x230000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
.text1
| MD5 | 54c5790665781c998c378012c76a86f7 🔍 |
|---|---|
| SHA1 | 0e8eb333e4a57894b19bfe17197295d396f34c12 🔍 |
| SHA256 | 65e098c7c760b7b8daf70b66124e8380c2bfeeb070cf92dd84220f77e8f02cbe 🔍 |
| SHA3 | efc118d2a573d28ea07cb606e1fbf1c9a10dd92ec207f1823c1b67c270a863c3 🔍 |
| VirtualSize | 0x30000 |
| VirtualAddress | 0xe22000 |
| SizeOfRawData | 0x2f000 |
| PointerToRawData | 0x1000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.98469 |
.adata
| MD5 | 53d5d1a19cc4ea3146530c0f1f1d2609 🔍 |
|---|---|
| SHA1 | 6177268232387dfbbd9abdcb57aee5d5231bad42 🔍 |
| SHA256 | f91071375b4fa7a7c41d751042f2ef24365da2c8550d73c9308a40293b13c144 🔍 |
| SHA3 | ce5f3db8249c82ca599feb40a0e5ad0537cb74478f7e0cbd2ed3a9c0ca78c4d6 🔍 |
| VirtualSize | 0x10000 |
| VirtualAddress | 0xe52000 |
| SizeOfRawData | 0xd000 |
| PointerToRawData | 0x30000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 6.47362 |
.data1
| MD5 | d2cc10e43b6638e24e4051c1b6a52eb9 🔍 |
|---|---|
| SHA1 | 58f077c8a195bdafcc269c51d46479bcde29bdf0 🔍 |
| SHA256 | ae8d74a0aa6c84cbef0c11bad170800f68c99e3c9598e39b8210c37086528a06 🔍 |
| SHA3 | c7c843e38b4fa347d4d0615001e87a75dcf4fb1004e1d4745f825a7bed2442c6 🔍 |
| VirtualSize | 0x20000 |
| VirtualAddress | 0xe62000 |
| SizeOfRawData | 0x9000 |
| PointerToRawData | 0x3d000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 2.99097 |
.pdata
| MD5 | 6b2a9b5f1c51435737b49aed4e419a41 🔍 |
|---|---|
| SHA1 | c8b78ad661baa3b028a36574e4f2229a20955c1b 🔍 |
| SHA256 | 6140e0c339025a5930c736ef3bb2a7b434fd819dce2a01724e568f9adc381121 🔍 |
| SHA3 | f0993cc241595bd412ca3e5610dfdfa277aa31a1be25b42b6293018206e59cf4 🔍 |
| VirtualSize | 0x140000 |
| VirtualAddress | 0xe82000 |
| SizeOfRawData | 0x133000 |
| PointerToRawData | 0x46000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.99514 |
.rsrc
| MD5 | 9528579c4fb5da1bd9323b4dcc3104a6 🔍 |
|---|---|
| SHA1 | ef42762e2cd3ebfdf1c75fb4e26c8da91ac11fca 🔍 |
| SHA256 | 445e508f98b820cd68bb548ddef9c0391af3fb48b98e5c2c5f9cfa4f56ad5270 🔍 |
| SHA3 | b17aa02136c0854df6e14e11aec78a8d6ccf52c658e636b769882aae6e315069 🔍 |
| VirtualSize | 0x2000 |
| VirtualAddress | 0xfc2000 |
| SizeOfRawData | 0x2000 |
| PointerToRawData | 0x179000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 2.78909 |
Imports
| KERNEL32.dll |
SetThreadPriority
GetCurrentThread CreateProcessA GetCommandLineA GetModuleFileNameA GetStartupInfoA SetEnvironmentVariableA ReleaseMutex Sleep WaitForSingleObject CreateMutexA OpenMutexA GetCurrentProcessId CreateThread GetCurrentThreadId GetTickCount CloseHandle ReadFile GetFileSize CreateFileA VirtualQueryEx FindClose FindFirstFileA FindFirstFileW GetModuleFileNameW GetExitCodeProcess ContinueDebugEvent SetThreadContext ReadProcessMemory GetThreadContext WaitForDebugEvent SuspendThread DebugActiveProcess ResumeThread CreateProcessW GetCommandLineW GetStartupInfoW MapViewOfFile GetVersionExA GetCurrentProcess CreateFileMappingA VirtualProtectEx ExitProcess CompareStringA FlushFileBuffers LCMapStringW LCMapStringA SetStdHandle GetOEMCP GetACP GetCPInfo GetStringTypeW GetStringTypeA MultiByteToWideChar SetFilePointer CompareStringW HeapReAlloc WriteFile VirtualFree HeapCreate HeapDestroy GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings WideCharToMultiByte FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter HeapFree HeapAlloc GetVersion GetLocalTime GetSystemTime GetTimeZoneInformation WriteProcessMemory SetLastError LoadLibraryA GetLastError GetProcAddress VirtualAlloc VirtualProtect GetEnvironmentVariableA FreeConsole DuplicateHandle GetModuleHandleA TerminateProcess RtlUnwind |
|---|---|
| USER32.dll |
GetDesktopWindow
MoveWindow SetPropA EnumThreadWindows GetPropA WaitForInputIdle GetMessageA PeekMessageA TranslateMessage DispatchMessageA BeginPaint EndPaint KillTimer DefWindowProcA LoadCursorA RegisterClassA GetAsyncKeyState GetSystemMetrics CreateWindowExA PostMessageA IsWindow SetWindowTextA GetDlgItem CreateDialogIndirectParamA ShowWindow UpdateWindow LoadStringA LoadStringW FindWindowA SendMessageA DestroyWindow MessageBoxA SetTimer |
| GDI32.dll |
SelectObject
BitBlt DeleteObject CreatePalette CreateDCA SelectPalette RealizePalette CreateDIBitmap DeleteDC CreateCompatibleDC |
Delayed Imports
1
| Type |
RT_CURSOR
|
|---|---|
| Language | Korean - Korea |
| Codepage | UNKNOWN |
| Size | 0x694 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.09831 |
| MD5 | 86c4e9efe07b3032fc2ba0fbb870cb5e 🔍 |
| SHA1 | 542baadfa571cd16c8fa6f48c27c2b3c96ad9908 🔍 |
| SHA256 | beb52ffa1a86dec580509c55099564d28df70e7a8e60c1826a3d096517865a04 🔍 |
| SHA3 | 802e3d00156c51dc35d588319143a562c288f731b0b7d25ecdafd1f439299f4b 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | Korean - Korea |
| Codepage | UNKNOWN |
| Size | 0x2e8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 0.941635 |
| MD5 | a7b7b83195013cd07c428da9d01d2496 🔍 |
| SHA1 | 0d2366b8ccc66a470472b138fe2bed24c0ca63be 🔍 |
| SHA256 | 5a72577122d18e73fcc32d5552b9434fbe12615793a7bebf9d5f7db91c98f0ce 🔍 |
| SHA3 | d5b2e8bf0dad5a7094851c6a11029ccb42e73fb2a6fb4f5df5ce452fb34eef73 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | Korean - Korea |
| Codepage | UNKNOWN |
| Size | 0x128 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.53323 |
| MD5 | e5fe581b6ea251c567e248a42b10cb63 🔍 |
| SHA1 | 2ee3435cfbe17a85a0ca79254ea358ea5ee8b59f 🔍 |
| SHA256 | 88f6ce89f984aa271c6e4bbd21b76bfb051a7f2c02b8b618910c26e3e3620fcc 🔍 |
| SHA3 | e6d8a72fc983570b9e4f915a064e22186234ccf04207353cb00e103352793d1d 🔍 |
110
| Type |
RT_GROUP_CURSOR
|
|---|---|
| Language | Korean - Korea |
| Codepage | UNKNOWN |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.1815 |
| Detected Filetype | Cursor file |
| MD5 | 010fe911410a0d0f690107f75419429b 🔍 |
| SHA1 | f521ef368dfeb141d4564c78da4ce880f1d9d06a 🔍 |
| SHA256 | 73c5d90cb11a4ae8f684517e6028cb0a536b15dfbf4e896c7e99d476dc5ce38c 🔍 |
| SHA3 | c54163c9058ef41ffda9185115e4e703a14b7d3a3e63c2a04eed7228268af93f 🔍 |
| Preview |
|
112
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | Korean - Korea |
| Codepage | UNKNOWN |
| Size | 0x22 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.47702 |
| Detected Filetype | Icon file |
| MD5 | 29a1f473b6fc0b877ce30be83212f25a 🔍 |
| SHA1 | a66309103e9f7ff118fd964f2cd5ae04bbd4a322 🔍 |
| SHA256 | e5d571d7f26fa57c7e00290d0fa8aef8c1d519983e0aa5ecd75f5d4b41fa4cda 🔍 |
| SHA3 | c3b0b1b14385cdc2d88d02c11aaca33ca55d509d2fe1dce1777c05d32c0e8a30 🔍 |
1 (#2)
| Type |
RT_VERSION
|
|---|---|
| Language | Korean - Korea |
| Codepage | UNKNOWN |
| Size | 0x2e0 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.39094 |
| MD5 | f5a116fe6986b5cde6bd1ee622ddcc2b 🔍 |
| SHA1 | 0d0deb0c556fa7705198045d29c529574d22b8c8 🔍 |
| SHA256 | bfb1c7477adb9070b1079368d60ebae61decff73ad6d953120c7e3ab1e46a173 🔍 |
| SHA3 | 8813899ff9d0c378080458a824d70e45b155a8b34fb8fb94ca691ca0eeda5b34 🔍 |
MANIFEST_RESOURCE_ID
| Type |
RT_MANIFEST
|
|---|---|
| Language | Korean - Korea |
| Codepage | UNKNOWN |
| Size | 0x25f |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.81983 |
| MD5 | d541f9b1a9ecd586f1dfa20c66a3ec81 🔍 |
| SHA1 | bb36d31d06377b23b3f46654bc1a4b204208b05a 🔍 |
| SHA256 | dfa4c5436f962836f712523b9331168dd86f618d9d201469fc6e0b409097836e 🔍 |
| SHA3 | fa1ba1f082260bb5137d300f17bbc190a846a0f19496b068920a7c9e96512505 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 0.0.2.40 |
| ProductVersion | 1.0.0.1 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | Korean - Korea |
| CompanyName | Softnyx |
| FileDescription | GunBound |
| FileVersion (#2) | 0, 0, 2, 40 |
| InternalName | GunBound |
| LegalCopyright | Copyright â Softnyx, 2002 |
| OriginalFilename | GunBound.gme |
| ProductName | Softnyx GunBound Project |
| ProductVersion (#2) | 1, 0, 0, 1 |
| Resource LangID | Korean - Korea |
|---|
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0xe7fb293f |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2003 (.NET) build 3077) | 2 |
| ASM objects (VS2003 (.NET) build 3077) | 10 |
| C objects (9178) | 2 |
| C objects (VS98 SP6 build 8804) | 10 |
| 105 (2067) | 11 |
| C++ objects (VS98 SP6 build 8804) | 9 |
| C objects (VS2003 (.NET) build 3077) | 36 |
| Imports (VS2003 (.NET) SP1 build 6030) | 2 |
| Unmarked objects (#2) | 5 |
| C objects (VS98 build 8168) | 13 |
| C++ objects (VS2003 (.NET) build 3077) | 66 |
| Imports (9210) | 4 |
| Imports (2067) | 2 |
| Imports (2179) | 19 |
| Total imports | 438 |
| 100 (VS2003 (.NET) build 3077) | 376 |
| 94 (VS2003 (.NET) build 3052) | 1 |
| Linker (VS2003 (.NET) build 3077) | 1 |
Errors
[*] Warning: Section .text has a size of 0!
[*] Warning: Section .rdata has a size of 0!
[*] Warning: Section .data has a size of 0!
Leave a comment
No comments yet.