e17352a003b9d4f446ec3395764083d9f7527ff1780f818a1a798bd095617679

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2021-Sep-25 21:57:46
Detected languages English - United States
Comments
CompanyName Overwolf Ltd.
FileDescription Lunar Client
FileVersion 2.309.1.1
LegalCopyright Copyright (C) 2021 Overwolf Ltd. All Rights Reserved.
LegalTrademarks
ProductName Lunar Client
ProductVersion 2.309.1.1

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • http://nsis.sf.net
  • http://nsis.sf.net/NSIS_Error
  • nsis.sf.net
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Can access the registry:
  • RegCreateKeyExW
  • RegEnumKeyW
  • RegQueryValueExW
  • RegSetValueExW
  • RegCloseKey
  • RegDeleteValueW
  • RegDeleteKeyW
  • RegOpenKeyExW
  • RegEnumValueW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Changes object ACLs:
  • SetFileSecurityW
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Info The PE is digitally signed. Signer: Overwolf Ltd
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 6c675e89d0c7335bce7b935743a0760a 🔍
SHA1 9a59b66976d981950d580c44fad83ac88a6509e9 🔍
SHA256 e17352a003b9d4f446ec3395764083d9f7527ff1780f818a1a798bd095617679 🔍
SHA3 c2de1498fb1fcc4f57aa5130f0d74f4308d5ebb6b8bc26ccdb0dbdcf01cf4007 🔍
SSDeep 49152:5mAvS9J6xE87vxpsrFpIvQ4kvoHch90kfsFYEXupw3UhsooAFhR8MShqLAEqcYL:5heJ8PN+TIvrWccYkHouCkhsbc8M3k 🔍
Imports Hash 56a78d55f3f7af51443e58e0ce2fb5f6 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2021-Sep-25 21:57:46
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x6a00
SizeOfInitializedData 0x2da00
SizeOfUninitializedData 0x800
AddressOfEntryPoint 0x0000352D (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x7d000
SizeOfHeaders 0x400
Checksum 0x31b5ec
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 ce9df19df15aa7bfbc0a8d0af0b841d0 🔍
SHA1 6cba022a30ad3c84a5343e05a15e49562c18aba0 🔍
SHA256 c902047f3976f37a722b89e3e2401d690d77b3e70ebaf7a32e9ac5ce6ff34a5e 🔍
SHA3 a80cef7bf78b6d8cf31176f4f7b837d46a7ec1b2d2dd9ab44d791ec0b29f199c 🔍
VirtualSize 0x6897
VirtualAddress 0x1000
SizeOfRawData 0x6a00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.4584

.rdata

MD5 a118375c929d970903c1204233b7583d 🔍
SHA1 73c2bec231377068f99d5c55ff5c975960280e6c 🔍
SHA256 322668435dbcf8d7246f9f554db08e811dd251f45ad883764e7af6b723e51e0a 🔍
SHA3 712081c7df3abf95c9a3dacb7e21700d783b1ca8d1105fe9df0f6df834b73c24 🔍
VirtualSize 0x14a6
VirtualAddress 0x8000
SizeOfRawData 0x1600
PointerToRawData 0x6e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.02411

.data

MD5 82a10c59a8679bb952fc8316070b8a6c 🔍
SHA1 7e347dcff055b97091b833896e1097b7ed374fdd 🔍
SHA256 05429ca22a1221b4c12a26881799b71b769633a366bccd17b0114acd29ac162f 🔍
SHA3 e2e59928a622a7543320d477ef40fed9784205f20846697c8936055ee1f94925 🔍
VirtualSize 0x2b018
VirtualAddress 0xa000
SizeOfRawData 0x600
PointerToRawData 0x8400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.15458

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x21000
VirtualAddress 0x36000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 b8a060bd77c039dcab53946a85b010bc 🔍
SHA1 b1dd1355c3601c22b24af505a30d8134abd2bb3a 🔍
SHA256 1a55881a18ef4f9771480311563aa7b92034aafe52c3ed122f41d7c1259b570d 🔍
SHA3 36c78acac90089395cebfe797a461f840740b9208ebe08b11b3a8f17ebaa1ca7 🔍
VirtualSize 0x25fb0
VirtualAddress 0x57000
SizeOfRawData 0x26000
PointerToRawData 0x8a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.37957

Imports

ADVAPI32.dll RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
SHELL32.dll SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32.dll OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
COMCTL32.dll #17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
USER32.dll GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
GDI32.dll SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
KERNEL32.dll GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.51567
MD5 073590f7cafd1e6319a8372bc8f85ad6 🔍
SHA1 f8967e5de4ba1151c418ab6d4035be32050ac435 🔍
SHA256 40c6d057b212c960003a0e29e99572fb2dceb32c37683cc611e4eccd4ad55e3c 🔍
SHA3 f360f2ce5c825cb244fa9a904d60e7cb0268f57181e5571612160fe820088270 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xced9
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99425
Detected Filetype PNG graphic file
MD5 1e82da98bfa5c03169f9d9560f71020b 🔍
SHA1 2a968d0556abae47046001d49e181d2059dcd0d8 🔍
SHA256 1d422150fa414081ef2ac6205e7bcace2ff37ff4715b41c9f08b630e45b5dace 🔍
SHA3 cefa45650ba466dde51c78b4279fd17e7b621a0d8ca5b462897119b5b144fe7e 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.73595
MD5 67616f983c321f8faf2760fab7895f20 🔍
SHA1 0645146046b40c171a6f015e461ee6d51da849cc 🔍
SHA256 c94c4009224f43506a7642bcff0d3b773f2a41ab030488c3b12431f4fef62d6b 🔍
SHA3 c100526b88c39107e7366281b939db612ea953ad7f4aeb629e83e8ce98f2270b 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.88066
MD5 8519c881871e8f98a4e30ef2797cb94a 🔍
SHA1 f73b4aec49cc50e4bb040fdc4dbec865bdd8d7ec 🔍
SHA256 e97ae95d15af616fd60f6eadee0797a7af8ea25bbb0ff203ae7737710f4d1864 🔍
SHA3 5232680b3e22a0738f489e37c492f9a2dad1c42866433d8f472e9420baf5c36d 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.09273
MD5 37aa0c53a5846c33200fe1d42fd4b50b 🔍
SHA1 6b67c86038016800bfca402fdbc139bf5ef89f50 🔍
SHA256 82ef3504163aa753fc72ec34d8aa4dfba2d491dae09cbc2e617beac17fd9cc07 🔍
SHA3 7890c640f018d20e106ca854820e5fc3ccbb5032cefd2a2e4dc46eb6ee6c1758 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.27097
MD5 8695c0530638870a856337dd7af89c56 🔍
SHA1 6c22f5aef6b9d8d47c1c5a1bd41c7e681f3d3d6d 🔍
SHA256 82cb04035098ace3fc85ce67a0ab978891ed477a248afcd34d13f4cb6b007ba0 🔍
SHA3 5cb8f848943b802591c7103194ac7a3befcdb2d7649f91f616c614e6888458ed 🔍

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x100
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.66174
MD5 3409f314895161597f3c395cc5f65525 🔍
SHA1 1a99d016d65e567f24449d9362afb6ac44006d0b 🔍
SHA256 fecdb955f8d7f1c219ff8167f90b64f3cb52e53337494577ff73c0ac1dafcd96 🔍
SHA3 b3b19241cc6454389e45833e50b742ae1927a5f161017350a99f2cbc66914f26 🔍

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x11c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.88094
MD5 2d12c45dc2c029044aaff357141cb900 🔍
SHA1 083db861ab3c7db23c6257878296e73a89a74b8b 🔍
SHA256 69897c784f1491eb3024b0d52c2897196a2e245974497fda1915db5fefcf8729 🔍
SHA3 349b5d605c9c3efe5e0c4e2faa12dd21022fc5f9b053f2cbf4e2a6b8bc656442 🔍

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x60
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.48825
MD5 6be4e1387d369cf86e68eacbdd0e81dd 🔍
SHA1 351970fe2681b9b35b5d59ad052011ed96a96e17 🔍
SHA256 85025c8556952f6a651c2468c8a0d58853b0ba482be9ad5cd3060f216540dfc0 🔍
SHA3 45e552e173141e06d113209b6cc915042ad0b4d5531464b8dbe5637029f489cb 🔍

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.79908
Detected Filetype Icon file
MD5 8d953677ab92fade3682966a42f87d88 🔍
SHA1 a6c90e114c69d3607a525b8a05d3f49ffe7b4714 🔍
SHA256 d9ab629dd2f241317a45ea0227c3005162d92c57fc6a8219aa944eff3cd982b7 🔍
SHA3 0c1a2d003765d4458be002a28d131d2c1e88da4a2560b45c7ef39d86d50ba616 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x2dc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.40762
MD5 606ab2ee57b479dc254a194cbc3d7fd1 🔍
SHA1 2894f2fc724a414fca68266967a3a83cd9d0a0da 🔍
SHA256 6e646c75f8e55009535653e4574351c2a73b12f21cc64aab51bde113ba6adc01 🔍
SHA3 5c73f6ee0012919318fbd04d0aad6730366014fbd76d45c98e77072ec8d2149c 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x33e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29934
MD5 fa3478e665ee83dba96e3eca94012a34 🔍
SHA1 4882e0f0432aa61925f4a94e852b1a64ae43cf2b 🔍
SHA256 8ef5bf7c993b92c1214abc4ee521b816ffdb3f3c0a6f9088356fae8fbe975865 🔍
SHA3 8a6e26971cf218ae1afe34af19fc9f2aa393ab6dfd062270df39bef6789ac8e9 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0
FileVersion 2.309.1.1
ProductVersion 2.309.1.1
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
Comments
CompanyName Overwolf Ltd.
FileDescription Lunar Client
FileVersion (#2) 2.309.1.1
LegalCopyright Copyright (C) 2021 Overwolf Ltd. All Rights Reserved.
LegalTrademarks
ProductName Lunar Client
ProductVersion (#2) 2.309.1.1
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xd26650e9
Unmarked objects 0
C objects (VS2003 (.NET) build 4035) 2
Total imports 165
Imports (VS2003 (.NET) build 4035) 15
48 (9044) 10
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .ndata has a size of 0!
Leave a comment

No comments yet.