nemu08[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

nemu08.zip
Size

4.7MB
MD5

1172ef5996f27570258b33bfe99db4d0
SHA1

54471befcc5a9450f106eaab28924cee408afa3b
SHA256

08d2ccaade9c39a51d86567ba3a6299ad09402e9f8e82bf9ef11082d9c8b7598
SHA512

de50bec3f1ad7d0782e1c95b25d0c40de0ec75ef3242bd811be6b93b53d9d02908a267f6870d85956ffd1c4d09b33fc0ece145aa71711add5eb83411295922b6
SSDEEP

98304:d/pchlqiMcLF4O9hAhOzj87VSo9ssyoYwC2QWGuwNfLax:dPDc54OYhGjwT9s/BwmWwFA

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/kailleraclient.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/kailleraclient.dll	upx

Files

nemu08.zip
.zip
LemD3DCombine.dat
Plugin/Input.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

CIConfigure
CIFree
CIGetJoyData
CIInit
CIRumble

Sections

CODE
Size: 528KB - Virtual size: 528KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 59KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Plugin/LemCombineDebugger.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

ToolFree
ToolFunc
ToolGetMenuText
ToolInit

Sections

CODE
Size: 494KB - Virtual size: 494KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 146B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Plugin/LemD3D8.dll
.dll windows x86

dab44186fdb73c74feaf9405890de284

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

d3d8

Direct3DCreate8

kernel32

Sleep
GetSystemInfo
IsProcessorFeaturePresent
OutputDebugStringA
GetCurrentDirectoryA
HeapSize
SetEndOfFile
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetPrivateProfileStringA
VirtualAlloc
HeapFree
HeapAlloc
GetCurrentThreadId
TlsSetValue
GetCommandLineA
GetVersionExA
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
TlsFree
SetLastError
TlsGetValue
GetLastError
TlsAlloc
CloseHandle
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetACP
GetOEMCP
GetCPInfo
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
HeapReAlloc
IsBadWritePtr
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteFile
RaiseException
SetFilePointer
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CreateFileA
InitializeCriticalSection
SetStdHandle
FlushFileBuffers
VirtualProtect
VirtualQuery
ReadFile
LoadLibraryA
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr

user32

MoveWindow
DialogBoxParamA
EndDialog
FindWindowExA
ShowWindow
GetClientRect
MessageBoxA
SendMessageA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyA

Exports

Exports

ChangeWindow
CloseDLL
DllAbout
DllConfig
FillRectHack
GetCombinerPointer
GetDllInfo
InitiateGFX
ProcessDList
RomClosed
RomOpen
SetResolution
UpdateScreen

Sections

.text
Size: 192KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 489KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugin/audio.dll
.dll windows x86

c85a9bc05d1fc120559049d2df09c71c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

dsound

ord1

winmm

timeSetEvent
timeKillEvent
timeEndPeriod
timeBeginPeriod

kernel32

HeapSize
RaiseException
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
WaitForMultipleObjects
GetPrivateProfileStringA
WritePrivateProfileStringA
lstrcatA
lstrlenA
GetSystemDirectoryA
lstrcpyA
Sleep
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
GetProcAddress
LoadLibraryA
GetLocaleInfoW
VirtualQuery
GetSystemInfo
VirtualProtect
SetConsoleCtrlHandler
LCMapStringW
LCMapStringA
ReadFile
SetEndOfFile
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
GetOEMCP
GetACP
UnhandledExceptionFilter
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCPInfo
GetDateFormatA
CompareStringA
CompareStringW
GetTimeZoneInformation
HeapFree
HeapAlloc
RtlUnwind
GetCurrentThreadId
TlsSetValue
GetCommandLineA
GetVersionExA
GetLastError
WriteFile
CloseHandle
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetModuleHandleA
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FlushFileBuffers
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
TlsAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetStdHandle
CreateFileA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
GetTimeFormatA
SetEnvironmentVariableA

user32

LoadIconA
LoadCursorA
RegisterClassExA
BeginPaint
GetClientRect
EndPaint
SystemParametersInfoA
SendMessageA
SetWindowPos
DefWindowProcA
CreateWindowExA
DestroyWindow
SetWindowTextA
ShowWindow
DialogBoxParamA
SendDlgItemMessageA
CheckDlgButton
EndDialog
IsDlgButtonChecked
GetAsyncKeyState
MessageBoxA

gdi32

GetStockObject
CreateFontIndirectA

Exports

Exports

AIConfigure
AIFree
AIGetReg
AIInit
AIKillSound
AISetReg
AISetUCodeID
AIStop
AUDList
AiDacrateChanged
AiLenChanged
AiReadLength
AiUpdate
CloseDLL
DCTList
DllAbout
DllConfig
DllTest
GetDllInfo
InitiateAudio
Mp3DCT
ProcessAList
RomClosed

Sections

.text
Size: 188KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugin/debugger.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

ToolFree
ToolFunc
ToolGetMenuText
ToolInit

Sections

CODE
Size: 775KB - Virtual size: 775KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Plugin/dialogs.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

NemuSettings
ToolFree
ToolFunc
ToolGetMenuText
ToolInit

Sections

CODE
Size: 530KB - Virtual size: 529KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 158B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Plugin/profile.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

ToolFree
ToolFunc
ToolGetMenuText
ToolInit

Sections

CODE
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 135B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
config.ini
gs_dll.dll
.dll regsvr32 windows x86

690297c513aa8aefbdb212972f27def1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LeaveCriticalSection
GetLastError
WritePrivateProfileStringA
lstrcatA
FreeResource
LoadResource
FindResourceA
GlobalLock
GetProcAddress
GetPrivateProfileStringA
GetModuleHandleA
lstrcpyA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
lstrcmpiA
GlobalGetAtomNameA
GetCurrentThreadId
lstrlenA
GetVersion
FreeLibrary
LoadLibraryA
SetThreadPriority
GetThreadPriority
ResumeThread
SuspendThread
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThread
lstrcmpA
GlobalAlloc
GetModuleFileNameA
CloseHandle
WaitForSingleObject
SetEvent
CreateEventA
lstrlenW
SetLastError
MulDiv
LocalFree
LocalAlloc
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
GlobalHandle
GetLocaleInfoW
SetEnvironmentVariableA
EnumSystemLocalesA
SetStdHandle
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoA
IsValidCodePage
GetStringTypeA
IsBadCodePtr
GetStringTypeW
VirtualAlloc
SetConsoleCtrlHandler
UnhandledExceptionFilter
CompareStringW
HeapReAlloc
HeapAlloc
VirtualFree
CompareStringA
SetUnhandledExceptionFilter
HeapDestroy
HeapFree
HeapCreate
GetEnvironmentStringsW
GetVersionExA
GetEnvironmentVariableA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
SetHandleCount
GetStartupInfoA
GetFileType
Sleep
LCMapStringW
LCMapStringA
GetLocalTime
FatalAppExitA
GetACP
GetStdHandle
GetSystemTime
GetTimeZoneInformation
CreateThread
DebugBreak
ExitThread
HeapValidate
TerminateProcess
ExitProcess
RtlUnwind
RaiseException
GetCommandLineA
SystemTimeToFileTime
lstrcpyW
SetFileAttributesA
GetTickCount
LocalFileTimeToFileTime
GetFileSize
SetFileTime
GetDiskFreeSpaceA
GetFileTime
GetShortPathNameA
GetTempFileNameA
GetFileAttributesA
GetVolumeInformationA
GetStringTypeExA
GetFullPathNameA
DeleteFileA
FindFirstFileA
FindClose
UnlockFile
MoveFileA
SetEndOfFile
SetFilePointer
LockFile
FlushFileBuffers
CreateFileA
WriteFile
ReadFile
FindResourceExA
GetCurrentProcess
DuplicateHandle
CopyFileA
OutputDebugStringA
GetThreadLocale
GetCurrentDirectoryA
GlobalSize
FormatMessageA
FileTimeToLocalFileTime
GetProfileIntA
VirtualProtect
GetCPInfo
FileTimeToSystemTime
GetOEMCP
GlobalUnlock
IsBadReadPtr
GetProcessVersion
GetPrivateProfileSectionA
SizeofResource
IsBadStringPtrW
IsBadWritePtr
IsBadStringPtrA
lstrcpynA
GetPrivateProfileIntA
GlobalFlags
LocalReAlloc
SetErrorMode
TlsGetValue
GlobalReAlloc
TlsSetValue
EnterCriticalSection
GlobalFree
LockResource
TlsFree

user32

InSendMessage
CopyAcceleratorTableA
CharNextA
DestroyIcon
ReuseDDElParam
TranslateAcceleratorA
LoadAcceleratorsA
DestroyCursor
SetCursorPos
ReleaseCapture
GetAsyncKeyState
DestroyMenu
UnpackDDElParam
GetClipboardFormatNameA
GetDialogBaseUnits
UnregisterClassA
LoadStringA
CheckMenuRadioItem
GetMenuContextHelpId
SetMenuContextHelpId
LoadMenuIndirectA
LoadMenuA
RemoveMenu
ModifyMenuA
InsertMenuA
GetSubMenu
GetMenuItemInfoA
GetMenuStringA
GetMenuState
GetMenuItemID
GetMenuItemCount
GetMenuDefaultItem
SetMenuDefaultItem
EnableMenuItem
CheckMenuItem
AppendMenuA
DeleteMenu
IsMenu
CreatePopupMenu
CreateMenu
ScrollDC
GrayStringA
GetTabbedTextExtentA
DrawTextA
DrawFocusRect
DrawEdge
DrawStateA
DrawIcon
InvertRect
FrameRect
FillRect
ExcludeUpdateRgn
WindowFromDC
GetSysColorBrush
SubtractRect
UnionRect
InflateRect
SetRectEmpty
SetRect
PtInRect
IsRectEmpty
GetMessageA
TranslateMessage
GetCursorPos
SetCursor
PostQuitMessage
wvsprintfA
OemToCharA
CharToOemA
TabbedTextOutA
GetMenuCheckMarkDimensions
LoadBitmapA
SetMenuItemBitmaps
OpenIcon
CloseWindow
LoadCursorA
PostThreadMessageA
MapDialogRect
GetWindowContextHelpId
SetWindowContextHelpId
SendNotifyMessageA
GetForegroundWindow
SetForegroundWindow
CharUpperA
MessageBeep
SetCaretPos
GetCaretPos
CreateCaret
GetClipboardViewer
GetClipboardOwner
GetOpenClipboardWindow
OpenClipboard
SetClipboardViewer
ChangeClipboardChain
FlashWindow
WindowFromPoint
SetParent
GetLastActivePopup
FindWindowA
ChildWindowFromPointEx
ChildWindowFromPoint
ShowScrollBar
GetNextDlgTabItem
GetNextDlgGroupItem
DlgDirSelectComboBoxExA
DlgDirSelectExA
DlgDirListComboBoxA
DlgDirListA
GetDesktopWindow
SetCapture
KillTimer
SetTimer
EnableScrollBar
LockWindowUpdate
GetDCEx
ShowOwnedPopups
IsWindowVisible
ValidateRgn
ValidateRect
InvalidateRgn
InvalidateRect
GetUpdateRgn
GetUpdateRect
UpdateWindow
ReleaseDC
GetWindowDC
GetDC
EndPaint
BeginPaint
ClientToScreen
BringWindowToTop
GetWindowRgn
SetWindowRgn
ArrangeIconicWindows
IsZoomed
HiliteMenuItem
GetSystemMenu
DrawMenuBar
SetMenu
GetMenu
PostMessageA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
ScrollWindowEx
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
LoadIconA
SendDlgItemMessageA
GetClientRect
MapWindowPoints
GetSysColor
PeekMessageA
DispatchMessageA
GetFocus
SetFocus
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
BeginDeferWindowPos
IsClipboardFormatAvailable
WaitMessage
GetWindowThreadProcessId
HideCaret
ShowCaret
RedrawWindow
CopyRect
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
MessageBoxA
IsChild
GetParent
GetWindow
GetCapture
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
TrackPopupMenu
SetWindowPlacement
GetWindowTextLengthA
GetWindowTextA
GetKeyState
SendMessageA
DefWindowProcA
GetClassNameA
GetDlgCtrlID
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
EndDialog
GetActiveWindow
SetActiveWindow
IsWindow
EnableWindow
CreateDialogIndirectParamA
DestroyWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetSystemMetrics
DrawFrameControl
RegisterClipboardFormatA

gdi32

CombineRgn
DeleteMetaFile
CloseEnhMetaFile
CreateEnhMetaFileA
ExtTextOutA
CreateMetaFileA
CreateBitmap
CloseMetaFile
SetBkColor
SetTextColor
GetObjectA
GetDCOrgEx
EqualRgn
GetClipBox
GetRgnBox
PtInRegion
OffsetRgn
CreateICA
CreateCompatibleDC
CreateDCA
GetBrushOrgEx
SetBrushOrgEx
GetDeviceCaps
SelectObject
GetNearestColor
EnumObjects
UpdateColors
GetBkColor
RealizePalette
GetPolyFillMode
GetROP2
GetBkMode
GetTextColor
GetMapMode
GetStretchBltMode
GetViewportExtEx
GetWindowOrgEx
GetViewportOrgEx
DPtoLP
LPtoDP
GetWindowExtEx
FrameRgn
InvertRgn
FillRgn
PtVisible
RectVisible
PaintRgn
Arc
Polyline
GetCurrentPositionEx
Ellipse
Pie
Chord
PolyPolygon
Rectangle
Polygon
PatBlt
BitBlt
RoundRect
GetPixel
SetPixel
StretchBlt
GetStockObject
ExtFloodFill
FloodFill
GetTextExtentPoint32A
GetTextAlign
TextOutA
GetTextMetricsA
GetTextCharacterExtra
GetTextFaceA
GetAspectRatioFilterEx
Escape
GetCharWidthA
GetBoundsRect
ResetDCA
SetBoundsRect
GetCharABCWidthsA
GetFontData
GetOutlineTextMetricsA
GetGlyphOutlineA
StartDocA
GetKerningPairsA
EndPage
SetAbortProc
StartPage
EndDoc
MaskBlt
AbortDoc
SetPixelV
AngleArc
PlgBlt
PolyPolyline
GetColorAdjustment
GetArcDirection
PolyBezier
DrawEscape
GetCurrentObject
GetCharABCWidthsFloatA
GetCharWidthFloatA
ExtEscape
BeginPath
CloseFigure
AbortPath
FillPath
FlattenPath
EndPath
GetPath
SetMiterLimit
GetMiterLimit
StrokePath
SetRectRgn
GetRegionData
ExtCreateRegion
PathToRegion
CreateRoundRectRgn
CreatePolyPolygonRgn
CreatePolygonRgn
CreateEllipticRgnIndirect
CreateEllipticRgn
CreateRectRgnIndirect
CreateRectRgn
ResizePalette
GetNearestPaletteIndex
AnimatePalette
SetPaletteEntries
GetPaletteEntries
CreateHalftonePalette
CreatePalette
CreateDiscardableBitmap
CreateCompatibleBitmap
GetBitmapDimensionEx
SetBitmapDimensionEx
GetBitmapBits
SetBitmapBits
CreateBitmapIndirect
CreateHatchBrush
CreateBrushIndirect
GdiComment
PlayEnhMetaFile
DeleteDC
SaveDC
RestoreDC
SelectPalette
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
MoveToEx
LineTo
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
PolyBezierTo
DeleteObject
GetClipRgn
SelectClipPath
ExtSelectClipRgn
WidenPath
StrokeAndFillPath
RectInRegion
ExtCreatePen
CreateSolidBrush
EnumMetaFile
PlayMetaFile
StretchDIBits
CreateFontA
CreateFontIndirectA
CreateDIBPatternBrushPt
CreatePatternBrush
PlayMetaFileRecord
GetObjectType
CopyMetaFileA
CreatePenIndirect
CreatePen
UnrealizeObject
EnumFontFamiliesExA

comdlg32

CommDlgExtendedError
PrintDlgA
PageSetupDlgA
GetFileTitleA
ChooseColorA
GetOpenFileNameA
GetSaveFileNameA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegCreateKeyA
RegDeleteKeyA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegSetValueA
RegOpenKeyA
RegQueryValueA
RegEnumKeyA
SetFileSecurityA
GetFileSecurityA

shell32

SHGetFileInfoA
ExtractIconA
DragQueryFileA
DragFinish
DragAcceptFiles

comctl32

ImageList_Merge
ord17
ord8
PropertySheetA
DestroyPropertySheetPage
CreatePropertySheetPageA
ord13
ImageList_Destroy
ImageList_Create
ImageList_LoadImageA
ImageList_Read
ImageList_Write
ord14
ImageList_GetImageCount
ImageList_Add
ImageList_AddMasked
ImageList_Remove
ImageList_Replace
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Draw
ImageList_SetBkColor
ImageList_GetBkColor
ImageList_SetOverlayImage
ImageList_GetImageInfo
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragMove
ImageList_SetDragCursorImage
ImageList_DragShowNolock
ImageList_GetDragImage
ImageList_DragEnter
ImageList_DragLeave

oledlg

ord3
ord7
ord6
ord5
ord9
ord4
ord8

ole32

CreateItemMoniker
CreateGenericComposite
CreateFileMoniker
GetClassFile
CreateStreamOnHGlobal
OleFlushClipboard
CoGetMalloc
StgCreateDocfile
StgOpenStorage
StgIsStorageFile
OleLockRunning
OleSetContainedObject
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreateFromFile
OleCreateLinkToFile
OleCreate
OleLoad
OleSave
StgIsStorageILockBytes
GetHGlobalFromILockBytes
OleGetIconOfClass
WriteClassStm
OleSaveToStream
OleIsRunning
OleQueryCreateFromData
OleQueryLinkFromData
OleGetClipboard
OleIsCurrentClipboard
OleSetClipboard
OleRegEnumVerbs
OleRegGetMiscStatus
OleCreateMenuDescriptor
StgOpenStorageOnILockBytes
CreateOleAdviseHolder
CreateDataAdviseHolder
OleTranslateAccelerator
IsAccelerator
GetRunningObjectTable
CoLockObjectExternal
CoGetClassObject
ReleaseStgMedium
CoTreatAsClass
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CreateBindCtx
CoTaskMemAlloc
OleDuplicateData
CoDisconnectObject
CLSIDFromString
CLSIDFromProgID
StringFromCLSID
CoTaskMemFree
CoRevokeClassObject
CoRegisterClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoCreateInstance
OleRun
StgCreateDocfileOnILockBytes
StringFromGUID2
CreateILockBytesOnHGlobal
OleSetMenuDescriptor
DoDragDrop
OleDestroyMenuDescriptor

olepro32

ord253

oleaut32

VarCyFromStr
LoadTypeLi
SysReAllocStringLen
SysStringLen
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCopy
VarBstrFromDate
VarDateFromStr
VarBstrFromCy
SysAllocString
SysAllocStringByteLen
VariantCopy
SafeArrayCreate
SafeArrayRedim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
DosDateTimeToVariantTime
VariantChangeType
VariantTimeToSystemTime
SafeArrayGetElemsize
SafeArrayGetDim
VariantClear
SysAllocStringLen
SysStringByteLen
SysFreeString

Exports

Exports

?GSConfigure@@YAXXZ
?GSInitialize@@YAXPAD00@Z
?GSUpdate@@YAXXZ
DllCanUnloadNow
DllGetClassObject
DllRegisterServer

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
kailleraclient.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

_kailleraChatSend@4
_kailleraEndGame@0
_kailleraGetVersion@4
_kailleraInit@0
_kailleraModifyPlayValues@8
_kailleraSelectServerDialog@4
_kailleraSetInfos@4
_kailleraShutdown@0

Sections

UPX0
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nemu64.exe
.exe windows x86

45c58ec138a63185db8fb93d8616f753

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_AddMasked
ImageList_Create
ord17

winmm

timeGetTime

kailleraclient

_kailleraShutdown@0
_kailleraEndGame@0
_kailleraModifyPlayValues@8
_kailleraInit@0
_kailleraSelectServerDialog@4
_kailleraSetInfos@4

gs_dll

?GSInitialize@@YAXPAD00@Z
?GSConfigure@@YAXXZ
?GSUpdate@@YAXXZ

kernel32

GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
HeapSize
SetEndOfFile
GetCPInfo
GetOEMCP
VirtualProtect
SuspendThread
QueryPerformanceCounter
Sleep
SetThreadPriority
QueryPerformanceFrequency
CloseHandle
CreateThread
FreeLibrary
FindFirstFileA
GetProcAddress
FindClose
LoadLibraryA
FindNextFileA
FindResourceA
lstrlenA
lstrcpynA
LoadResource
GetLogicalDrives
VirtualFree
GetDriveTypeA
GetVolumeInformationA
lstrcatA
SetCurrentDirectoryA
GetLastError
VirtualAlloc
MoveFileA
LockResource
GetPrivateProfileStructA
GetCurrentDirectoryA
GetSystemInfo
DeleteFileA
GetFileSize
OpenFile
WritePrivateProfileStructA
ReadFile
GetPrivateProfileStringA
WritePrivateProfileStringA
lstrcpyA
GetACP
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
SetStdHandle
CreateFileA
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetModuleFileNameA
FlushFileBuffers
SetFilePointer
GetFileType
GetStdHandle
SetHandleCount
WriteFile
HeapCreate
HeapDestroy
GetCurrentProcess
TerminateProcess
RtlUnwind
ExitProcess
GetVersionExA
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
HeapReAlloc
HeapAlloc
HeapFree
VirtualQuery
LCMapStringA
LCMapStringW
ResumeThread

user32

DestroyWindow
ClientToScreen
EndPaint
SetWindowTextA
GetMessageA
LoadIconA
FindWindowExA
GetClientRect
MessageBoxA
EnableMenuItem
GetMenu
GetWindowRect
InsertMenuItemA
RegisterClassExA
LoadStringA
PostQuitMessage
SetFocus
BeginPaint
GetDC
TranslateMessage
TrackPopupMenuEx
CheckMenuRadioItem
InvalidateRect
CreateWindowExA
TranslateAcceleratorA
EndDialog
DefWindowProcA
SetWindowPos
GetMenuItemInfoA
LoadAcceleratorsA
ShowWindow
CreatePopupMenu
DrawMenuBar
DispatchMessageA
LoadImageA
UpdateWindow
EnableWindow
AdjustWindowRect
DestroyMenu
LoadCursorA
DialogBoxParamA
CheckMenuItem
GetWindow
MoveWindow
SendMessageA
ReleaseDC

gdi32

SetPixelV
DeleteObject
GetPixel

comdlg32

GetSaveFileNameA
GetOpenFileNameA

shell32

DragAcceptFiles
ShellExecuteA
DragQueryFileA
DragFinish

Sections

.text
Size: 188KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 236KB - Virtual size: 64.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
nemu64.ini

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 528KB - Virtual size: 528KB

DATA Size: 7KB - Virtual size: 7KB

BSS Size: - Virtual size: 59KB

.idata Size: 9KB - Virtual size: 8KB

.edata Size: 512B - Virtual size: 148B

.reloc Size: 38KB - Virtual size: 38KB

.rsrc Size: 35KB - Virtual size: 35KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 494KB - Virtual size: 494KB

DATA Size: 6KB - Virtual size: 5KB

BSS Size: - Virtual size: 4KB

.idata Size: 9KB - Virtual size: 8KB

.edata Size: 512B - Virtual size: 146B

.reloc Size: 35KB - Virtual size: 34KB

.rsrc Size: 40KB - Virtual size: 40KB

dab44186fdb73c74feaf9405890de284

Headers

File Characteristics

Imports

d3d8

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 192KB - Virtual size: 188KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 12KB - Virtual size: 489KB

.data1 Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 28KB - Virtual size: 24KB

c85a9bc05d1fc120559049d2df09c71c

Headers

File Characteristics

Imports

dsound

winmm

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 188KB - Virtual size: 186KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 48KB - Virtual size: 1.2MB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 20KB - Virtual size: 16KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 775KB - Virtual size: 775KB

DATA Size: 8KB - Virtual size: 7KB

BSS Size: - Virtual size: 4KB

.idata Size: 9KB - Virtual size: 9KB

.edata Size: 512B - Virtual size: 136B

.reloc Size: 55KB - Virtual size: 54KB

.rsrc Size: 105KB - Virtual size: 105KB

Headers

File Characteristics

Exports

Exports

Sections

CODE
Size: 528KB - Virtual size: 528KB

DATA
Size: 7KB - Virtual size: 7KB

BSS
Size: - Virtual size: 59KB

.idata
Size: 9KB - Virtual size: 8KB

.edata
Size: 512B - Virtual size: 148B

.reloc
Size: 38KB - Virtual size: 38KB

.rsrc
Size: 35KB - Virtual size: 35KB

CODE
Size: 494KB - Virtual size: 494KB

DATA
Size: 6KB - Virtual size: 5KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 9KB - Virtual size: 8KB

.edata
Size: 512B - Virtual size: 146B

.reloc
Size: 35KB - Virtual size: 34KB

.rsrc
Size: 40KB - Virtual size: 40KB

.text
Size: 192KB - Virtual size: 188KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 12KB - Virtual size: 489KB

.data1
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 28KB - Virtual size: 24KB

.text
Size: 188KB - Virtual size: 186KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 48KB - Virtual size: 1.2MB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 20KB - Virtual size: 16KB

CODE
Size: 775KB - Virtual size: 775KB

DATA
Size: 8KB - Virtual size: 7KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 9KB - Virtual size: 9KB

.edata
Size: 512B - Virtual size: 136B

.reloc
Size: 55KB - Virtual size: 54KB

.rsrc
Size: 105KB - Virtual size: 105KB

CODE
Size: 530KB - Virtual size: 529KB

DATA
Size: 6KB - Virtual size: 5KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 8KB

.edata
Size: 512B - Virtual size: 158B

.reloc
Size: 37KB - Virtual size: 37KB

.rsrc
Size: 45KB - Virtual size: 45KB

CODE
Size: 315KB - Virtual size: 315KB

DATA
Size: 4KB - Virtual size: 4KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 8KB - Virtual size: 7KB

.edata
Size: 512B - Virtual size: 135B

.reloc
Size: 22KB - Virtual size: 21KB

.rsrc
Size: 13KB - Virtual size: 13KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 132KB - Virtual size: 129KB

.data
Size: 84KB - Virtual size: 1.3MB

.idata
Size: 24KB - Virtual size: 22KB

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 80KB - Virtual size: 77KB

UPX0
Size: - Virtual size: 44KB

UPX1
Size: 23KB - Virtual size: 24KB

.rsrc
Size: 3KB - Virtual size: 4KB