0b7a0bddff724424ff14b970ba83e895ed0ab836cf0614604bdb940c67d83457

Sharing

Copy URL Twitter E-mail

General

Target

0b7a0bddff724424ff14b970ba83e895ed0ab836cf0614604bdb940c67d83457
Size

432KB
MD5

686b6e07c09dfe6063a59cfb8923c283
SHA1

3cfb895d259ec24d358e909582789e31831fdb67
SHA256

0b7a0bddff724424ff14b970ba83e895ed0ab836cf0614604bdb940c67d83457
SHA512

7d8f9ea7cd8cf4a4846db828a29a6dc4ae6fceb6d82fd13f3b06336a9e74fa15d819f006e0e9542ffcfe6b3caff6b93e0a7dbaf31e8ef53c88846b012554ae82
SSDEEP

12288:BO2HF6OqvL/5DINCtR795wsSt78Rd+zB3WbQ:BO2l6OqvL/dIIR//St78R8z

Score

N/A

Malware Config

Signatures

Files

0b7a0bddff724424ff14b970ba83e895ed0ab836cf0614604bdb940c67d83457
.exe windows x86

2bcb00c8a68b14735477b48f551afa3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

2dlib

WNew
WDelete
??1WBitmap@@UAE@XZ
??4WAlphaBitmap@@QAEAAV0@ABV0@@Z
??_7WAlphaBitmap@@6B@
??_7WBitmap@@6B@
??_7WObject@@6B@
?Draw@WCanvas@@UAEKABVWObject@@K@Z
?Destroy@WBitmap@@UAEXXZ
?SubBitmap@WBitmap@@UBEPAV1@HHHH@Z
?Create@WBitmap@@UAEKHH@Z
?Create@WBitmap@@UAEKHHPAX@Z
?IsCover@WBitmap@@UBE_NU?$WPointEx@H@@@Z
?SetUserData@WBitmap@@UBEXK@Z
?Affect@WObject@@UBE_NHH@Z
?Duplicate@WBitmap@@UBEPAUWObjStruct@@PAVWObjectHeap@@@Z
?DrawFunc@WBitmap@@UBEP6GKKK@ZK@Z
?GetH@WCanvas@@UBEHXZ
?GetW@WCanvas@@UBEHXZ
?IsValid@WObject@@UBE_NXZ
??3?$memory@VWCanvas@@$00@@SAXPAX@Z
??0WCanvas@@QAE@HH@Z
??2?$memory@VWCanvas@@$00@@SAPAXI@Z
??1WCanvas@@UAE@XZ
?Blit2DC@WCanvas@@QAEXPAUHDC__@@HH@Z
?Clear@WCanvas@@QAEXUWPixel@@@Z
??1WObject@@UAE@XZ
?Destroy@WAlphaBitmap@@UAEXXZ
??1WAlphaBitmap@@UAE@XZ
?Create@WBitmap@@QAEKABV1@HHHH@Z
?SetPos@WCanvas@@QAEAAV1@HH@Z
?Create@WAlphaBitmap@@QAEKABV1@HHHH@Z
??1WFile@@UAE@XZ
?Load@WBitmap@@QAEKPAX@Z
?LoadTGA@WAlphaBitmap@@QAEKPBX@Z
?Load@WFile@@QAEKPBD@Z
??0WFile@@QAE@XZ
?Draw@WFont@@QAEXAAVWBitmap@@PBDUWPixel@@K@Z
??0WAlphaBitmap@@QAE@XZ
?Create@WFont@@QAEKPAUHFONT__@@HH@Z
?Destroy@WFont@@QAEXXZ

skinmagic

ord50
ord49

shlwapi

SHGetValueA
PathFileExistsA

game

?GetLooker@CGameFrame@@QAEPAUst_plygamedata@@XZ
?IsVisitor@CGameFrame@@QAE_NXZ
??1CGameFrame@@QAE@XZ
?InitInstance@CGameFrame@@QAEHXZ
?SetSoundDir@CGameFrame@@QAEXABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetMusicDir@CGameFrame@@QAEXABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetGraphicDir@CGameFrame@@QAEXABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetFNOnRecv@CGameFrame@@QAEXP6AXPBDH@Z@Z
?SetFNCreateGame@CGameFrame@@QAEXP6AHPAVCWnd@@PAPAVCGameInterface@@@Z@Z
??0CGameFrame@@QAE@PAVCWinApp@@PAUHICON__@@@Z
?ExitInstance@CGameFrame@@QAEXXZ
?GetMe@CGameFrame@@QAEPAUst_plygamedata@@XZ
?AddSysMsg@CGameFrame@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?QuitRequest@CGameFrame@@QAEXXZ
?PlaySoundA@CGameFrame@@QAEXPBDK@Z
?Send@CGameFrame@@QAEXPBDH@Z
?IsMoneyRoom@CGameFrame@@QAE_NXZ
??1CGameInterface@@UAE@XZ
??_7CGameInterface@@6B@
??1CAvatarShow@@QAE@XZ
?Init@CAvatarShow@@QAEXHHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAVCRect@@@Z
??0CAvatarShow@@QAE@PAVCWnd@@@Z
?GetUser@CGameFrame@@QAEPAUst_plygamedata@@H@Z
?GetUserCount@CGameFrame@@QAEHXZ
?FindUser@CGameFrame@@QAEPAUst_plygamedata@@H@Z

mfc71

ord2835
ord4307
ord2714
ord2838
ord2540
ord2646
ord2533
ord3718
ord3719
ord3709
ord2644
ord3949
ord4481
ord4261
ord3333
ord757
ord578
ord304
ord3830
ord2248
ord566
ord781
ord876
ord2322
ord310
ord1091
ord2367
ord784
ord297
ord1489
ord2902
ord6118
ord299
ord2933
ord2469
ord5490
ord1123
ord1482
ord3934
ord1916
ord5563
ord2731
ord2537
ord5566
ord5213
ord5230
ord4568
ord3948
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord1063
ord1280
ord3204
ord1934
ord3210
ord1084
ord3683
ord4541
ord5102
ord1207

msvcr71

_setmbcp
__CxxFrameHandler
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_CxxThrowException
free
_except_handler3
rand
srand
time
memmove
strstr
strftime
localtime
fclose
vfprintf
fflush
fprintf
fopen
memset
__security_error_handler
?terminate@@YAXXZ
__dllonexit
_onexit
??1type_info@@UAE@XZ
_c_exit
_exit
_controlfp
__set_app_type
__p__fmode
__p__commode
_XcptFilter
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
_adjust_fdiv

kernel32

GetVersionExA
LoadLibraryA
FreeLibrary
GetTickCount
Sleep
InitializeCriticalSection
DeleteCriticalSection
ExitProcess
GetModuleHandleA
GetStartupInfoA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

user32

LoadIconA
LoadCursorA
SetRectEmpty
PtInRect
IsRectEmpty
CopyRect
SetCursor
FlashWindow
ReleaseDC
GetDC
GetClientRect
PostQuitMessage
OffsetRect
SetRect

gdi32

CreateFontA

comctl32

ord17

ole32

CoInitialize

ws2_32

ntohl
WSACleanup
htons
htonl
ntohs

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z

Exports

Exports

??0C2XSprite@@QAE@ABV0@@Z
??0C2XSprite@@QAE@XZ
??1C2XSprite@@UAE@XZ
??4C2XSprite@@QAEAAV0@ABV0@@Z
??_7C2XSprite@@6B@
?DeleteSurface@C2XSprite@@AAEXXZ
?DrawData@C2XSprite@@AAEXHHHHHH@Z
?DrawSprite@C2XSprite@@QAEHHHHHHH@Z
?DrawSprite@C2XSprite@@QAEHHHVCRect@@@Z
?DrawSprite@C2XSprite@@QAEHVCPoint@@HHHH@Z
?DrawSprite@C2XSprite@@QAEHVCRect@@HHHH@Z
?DrawSpriteCenterH@C2XSprite@@QAEHHHHHHH@Z
?DrawSpriteCenterV@C2XSprite@@QAEHHHHHHH@Z
?GetH@C2XSprite@@QAEHXZ
?GetW@C2XSprite@@QAEHXZ
?LoadFile@C2XSprite@@AAEXPBD@Z
?LoadSprite@C2XSprite@@QAEXPBDPAUtagRECT@@PAVWCanvas@@@Z
?ReleaseSprite@C2XSprite@@QAEXXZ
?RestoreSprite@C2XSprite@@QAEXPAVWCanvas@@@Z
?SetAlpha@C2XSprite@@QAEXH@Z

Sections

.text
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.T�
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2bcb00c8a68b14735477b48f551afa3c

Headers

File Characteristics

Imports

2dlib

skinmagic

shlwapi

game

mfc71

msvcr71

kernel32

user32

gdi32

comctl32

ole32

ws2_32

msvcp71

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 77KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 96KB - Virtual size: 92KB

.T� Size: 232KB - Virtual size: 232KB

.text
Size: 80KB - Virtual size: 77KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 96KB - Virtual size: 92KB

.T�
Size: 232KB - Virtual size: 232KB