Halo[.]Combat[.]Evolved[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Halo.Combat.Evolved.zip
Size

678.1MB
MD5

b90c19de87828ea6f69d01dd577221aa
SHA1

9200041cd0e9d12fe92a61ff18638f16cb31e6bf
SHA256

ce3cf8948e0a8e429635b4a5669139466972689e42ce331870304f12c74afcae
SHA512

8a200a85f52ccb6b9f226ef1ce39ec8e6d6e78276c2917ab53b39ce68836945c3b1aa1e0063f1c024aa280c5d677440122ea30a2be7c36792f8bef465ccfd025
SSDEEP

12582912:1C4jAIlucttEYT3LgysmG5Qp5DK6t7XqpZhzTAzF7Jhq3eVunIkfKcO4NvP/9p2:Y4UIlu+6wG5Q5uCGfh4zhJDGKcO4NvPC

Score

3^/10

Malware Config

Signatures

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Halo.Combat.Evolved/Halo/CONTROLS/controls.dll
unpack001/Halo.Combat.Evolved/Halo/GSArcade.exe
unpack001/Halo.Combat.Evolved/Halo/binkw32.dll
unpack001/Halo.Combat.Evolved/Halo/chktrust.exe
unpack001/Halo.Combat.Evolved/Halo/drvmgt.dll
unpack001/Halo.Combat.Evolved/Halo/eula.dll
unpack001/Halo.Combat.Evolved/Halo/halo.exe
unpack001/Halo.Combat.Evolved/Halo/haloupdate.exe
unpack001/Halo.Combat.Evolved/Halo/keystone.dll
unpack001/Halo.Combat.Evolved/Halo/ksimeui.dll

Files

Halo.Combat.Evolved.zip
.zip
Halo.Combat.Evolved/Halo/00000000.016
Halo.Combat.Evolved/Halo/00000000.256
Halo.Combat.Evolved/Halo/CONTENT/1024editbox.ksml
Halo.Combat.Evolved/Halo/CONTENT/1024log.ksml
Halo.Combat.Evolved/Halo/CONTENT/1200editbox.ksml
Halo.Combat.Evolved/Halo/CONTENT/1200log.ksml
Halo.Combat.Evolved/Halo/CONTENT/480editbox.ksml
Halo.Combat.Evolved/Halo/CONTENT/480log.ksml
Halo.Combat.Evolved/Halo/CONTENT/576editbox.ksml
Halo.Combat.Evolved/Halo/CONTENT/576log.ksml
Halo.Combat.Evolved/Halo/CONTENT/600editbox.ksml
Halo.Combat.Evolved/Halo/CONTENT/600log.ksml
Halo.Combat.Evolved/Halo/CONTENT/720editbox.ksml
Halo.Combat.Evolved/Halo/CONTENT/720log.ksml
Halo.Combat.Evolved/Halo/CONTENT/768editbox.ksml
Halo.Combat.Evolved/Halo/CONTENT/768log.ksml
Halo.Combat.Evolved/Halo/CONTENT/864editbox.ksml
Halo.Combat.Evolved/Halo/CONTENT/864log.ksml
Halo.Combat.Evolved/Halo/CONTENT/900editbox.ksml
Halo.Combat.Evolved/Halo/CONTENT/900log.ksml
Halo.Combat.Evolved/Halo/CONTENT/960editbox.ksml
Halo.Combat.Evolved/Halo/CONTENT/960log.ksml
Halo.Combat.Evolved/Halo/CONTENT/GALLERY/editbox1024.png
.png
Halo.Combat.Evolved/Halo/CONTENT/GALLERY/editbox1200.png
.png
Halo.Combat.Evolved/Halo/CONTENT/GALLERY/editbox480.png
.png
Halo.Combat.Evolved/Halo/CONTENT/GALLERY/editbox576.png
.png
Halo.Combat.Evolved/Halo/CONTENT/GALLERY/editbox600.png
.png
Halo.Combat.Evolved/Halo/CONTENT/GALLERY/editbox720.png
.png
Halo.Combat.Evolved/Halo/CONTENT/GALLERY/editbox768.png
.png
Halo.Combat.Evolved/Halo/CONTENT/GALLERY/editbox864.png
.png
Halo.Combat.Evolved/Halo/CONTENT/GALLERY/editbox900.png
.png
Halo.Combat.Evolved/Halo/CONTENT/GALLERY/editbox960.png
.png
Halo.Combat.Evolved/Halo/CONTROLS/controls.dll
.dll windows x86

c25af603ccb45a3cbfba600f7f5c3bb3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
OutputDebugStringW
EnterCriticalSection
GetLastError
CreateFileA
WriteFile
GetVersionExA
GetACP
GetPrivateProfileStringA
lstrlenA
GetModuleFileNameA
GetModuleHandleA
MultiByteToWideChar
IsDBCSLeadByteEx
GetCPInfo
GetLocaleInfoA
GetTickCount
GetUserDefaultLangID
WideCharToMultiByte
GetCPInfoExW
GetVersionExW
CompareStringW
CompareStringA
GetLocaleInfoW
SetConsoleCtrlHandler
GetTimeZoneInformation
LoadLibraryA
InitializeCriticalSection
VirtualQuery
GetSystemInfo
VirtualProtect
GetOEMCP
UnhandledExceptionFilter
IsBadCodePtr
IsBadReadPtr
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
RtlUnwind
RaiseException
ExitProcess
HeapReAlloc
HeapAlloc
GetCurrentThreadId
TlsSetValue
GetCommandLineA
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
TlsAlloc
LCMapStringA
LCMapStringW
HeapFree
GetProcAddress
SetUnhandledExceptionFilter
FatalAppExitA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
TerminateProcess
GetCurrentProcess
HeapSize
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetHandleCount
GetStdHandle
GetFileType
SetEnvironmentVariableA

user32

GetKeyboardLayout
CharNextExA
wsprintfA

ksimeui

?Clean@CKeystoneIMEUI@@QAEXXZ
?IsMainWindowUnicode@CKeystoneIMEUI@@SAHXZ
?SetImeUiCallbacks@CKeystoneIMEUI@@QAEXPAUIKeystoneRenderingEngine@@PAUIKeystoneWindow@@PAUIKeystoneControl@@@Z
?SetScreenDimension@CKeystoneIMEUI@@QAEXKK@Z
?FinalizeString@CKeystoneIMEUI@@SAXH@Z
?CreateImeUiIndicatorFont@CKeystoneIMEUI@@QAEXPAUIKeystoneDocument@@PAUIKeystoneResourceEngine@@PAUIKeystoneResourceFont@@KPAUtagRECT@@3@Z
?EnableIme@CKeystoneIMEUI@@QAEXH@Z
?SetTextViewport@CKeystoneIMEUI@@QAEXAAUtagRECT@@@Z
??0CKeystoneIMEUI@@QAE@XZ
??1CKeystoneIMEUI@@QAE@XZ
?GetCaretStatus@CKeystoneIMEUI@@QAEHXZ
?RenderUI@CKeystoneIMEUI@@QAEXHH@Z
?SetCaretPosition@CKeystoneIMEUI@@QAEXII@Z
?CreateImeUiFont@CKeystoneIMEUI@@QAEXPAUIKeystoneDocument@@PAUIKeystoneResourceEngine@@PAUIKeystoneResourceFont@@KPAUtagRECT@@3@Z

Exports

Exports

Register

Sections

.text
Size: 392KB - Virtual size: 390KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Halo.Combat.Evolved/Halo/CONTROLS/controls.ini
Halo.Combat.Evolved/Halo/GSArcade.exe
.exe windows x86

52304e2a18fa5608f4f4aeb8041c7da0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Imports

kernel32

GetCommandLineA
SetErrorMode
GetModuleHandleA
MulDiv
GetTempFileNameA
GetModuleFileNameA
lstrlenA
_lclose
lstrcpyA
FormatMessageA
lstrcatA
GetLastError
_lwrite
_llseek
GlobalUnlock
GlobalFree
GlobalAlloc
_lopen
GetProcAddress
_lcreat
LoadLibraryA
GetVersionExA
FreeLibrary
OpenFile
ExitProcess
GetCurrentProcess
WinExec
GetTempPathA
_lread
LocalFree
GetWindowsDirectoryA
GlobalLock

user32

GetDC
DrawTextA
EndPaint
InvalidateRect
PostQuitMessage
SendMessageA
DefWindowProcA
GetClientRect
CreateWindowExA
BeginPaint
ReleaseDC
SetWindowPos
ShowWindow
UpdateWindow
SetTimer
LoadIconA
RegisterClassA
MessageBoxA
ExitWindowsEx
LoadCursorA

gdi32

DeleteObject
PatBlt
CreateSolidBrush
GetDeviceCaps
SetTextColor
SetBkMode
TextOutA
StretchDIBits
CreateFontA
SelectObject
SelectPalette
CreatePalette
RealizePalette
GetStockObject

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

Exports

Exports

_MainWndProc@16
_StubFileWrite@12

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Halo.Combat.Evolved/Halo/MAPS/a10.map
Halo.Combat.Evolved/Halo/MAPS/a30.map
Halo.Combat.Evolved/Halo/MAPS/a50.map
Halo.Combat.Evolved/Halo/MAPS/b30.map
Halo.Combat.Evolved/Halo/MAPS/b40.map
Halo.Combat.Evolved/Halo/MAPS/beavercreek.map
Halo.Combat.Evolved/Halo/MAPS/bitmaps.map
Halo.Combat.Evolved/Halo/MAPS/bloodgulch.map
Halo.Combat.Evolved/Halo/MAPS/boardingaction.map
Halo.Combat.Evolved/Halo/MAPS/c10.map
Halo.Combat.Evolved/Halo/MAPS/c20.map
Halo.Combat.Evolved/Halo/MAPS/c40.map
Halo.Combat.Evolved/Halo/MAPS/carousel.map
Halo.Combat.Evolved/Halo/MAPS/chillout.map
Halo.Combat.Evolved/Halo/MAPS/d20.map
Halo.Combat.Evolved/Halo/MAPS/d40.map
Halo.Combat.Evolved/Halo/MAPS/damnation.map
Halo.Combat.Evolved/Halo/binkw32.dll
.dll windows x86

863844ad7aa759748e31329c65f10f35

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetCursor
GetClassLongA
RegisterClassA
ChangeDisplaySettingsA
IsWindowVisible
GetSystemMetrics
GetCursorPos
DefWindowProcA
ReleaseDC
PeekMessageA
CreateWindowExA
GetTopWindow
GetWindowLongA
GetActiveWindow
GetWindowThreadProcessId
GetWindow
EndPaint
ClientToScreen
DestroyWindow
MessageBoxA
ScreenToClient
GetWindowRect
IsIconic
GetClientRect
BeginPaint
GetDC
ShowCursor
UnregisterClassA

gdi32

CreateDIBSection
GetDeviceCaps
StretchBlt
GetDIBits
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
SetStretchBltMode
GetPixel
DeleteDC

kernel32

GetOEMCP
GetACP
LCMapStringW
MultiByteToWideChar
LCMapStringA
WriteFile
GetEnvironmentStringsW
GetCPInfo
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
GetStringTypeA
GetStringTypeW
HeapSize
GetCurrentThreadId
GetSystemTimeAsFileTime
RtlUnwind
GetLastError
CreateEventA
GetWindowsDirectoryA
GetSystemDirectoryA
GetModuleFileNameA
SetErrorMode
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleHandleA
Sleep
GetCurrentProcessId
QueryPerformanceCounter
GetTickCount
QueryPerformanceFrequency
CreateFileA
SetFilePointer
ReadFile
CloseHandle
WaitForSingleObject
SetEvent
RaiseException
SetThreadPriority
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
ResumeThread
CreateThread
GetCurrentProcess
TerminateProcess
ExitProcess
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetCommandLineA
HeapFree
HeapAlloc

winmm

waveOutPrepareHeader
waveOutOpen
waveOutUnprepareHeader
waveOutSetVolume
waveOutReset
waveOutRestart
waveOutPause
waveOutWrite
waveOutClose
timeGetTime

Exports

Exports

_BinkBufferBlit@12
_BinkBufferCheckWinPos@12
_BinkBufferClear@8
_BinkBufferClose@4
_BinkBufferGetDescription@4
_BinkBufferGetError@0
_BinkBufferLock@4
_BinkBufferOpen@16
_BinkBufferSetDirectDraw@8
_BinkBufferSetHWND@8
_BinkBufferSetOffset@12
_BinkBufferSetResolution@12
_BinkBufferSetScale@12
_BinkBufferUnlock@4
_BinkCheckCursor@20
_BinkClose@4
_BinkCloseTrack@4
_BinkCopyToBuffer@28
_BinkCopyToBufferRect@44
_BinkDDSurfaceType@4
_BinkDX8SurfaceType@4
_BinkDoFrame@4
_BinkGetError@0
_BinkGetKeyFrame@12
_BinkGetRealtime@12
_BinkGetRects@8
_BinkGetSummary@8
_BinkGetTrackData@8
_BinkGetTrackID@8
_BinkGetTrackMaxSize@8
_BinkGetTrackType@8
_BinkGoto@12
_BinkIsSoftwareCursor@8
_BinkLogoAddress@0
_BinkNextFrame@4
_BinkOpen@8
_BinkOpenDirectSound@4
_BinkOpenMiles@4
_BinkOpenTrack@8
_BinkOpenWaveOut@4
_BinkPause@8
_BinkRestoreCursor@4
_BinkService@4
_BinkSetError@4
_BinkSetFrameRate@8
_BinkSetIO@4
_BinkSetIOSize@4
_BinkSetMixBinVolumes@20
_BinkSetMixBins@16
_BinkSetPan@12
_BinkSetSimulate@4
_BinkSetSoundOnOff@8
_BinkSetSoundSystem@8
_BinkSetSoundTrack@8
_BinkSetVideoOnOff@8
_BinkSetVolume@12
_BinkWait@4
_RADSetMemory@8
_RADTimerRead@0
_YUV_blit_16a1bpp@52
_YUV_blit_16a1bpp_mask@60
_YUV_blit_16a4bpp@52
_YUV_blit_16a4bpp_mask@60
_YUV_blit_16bpp@48
_YUV_blit_16bpp_mask@56
_YUV_blit_24bpp@48
_YUV_blit_24bpp_mask@56
_YUV_blit_24rbpp@48
_YUV_blit_24rbpp_mask@56
_YUV_blit_32abpp@52
_YUV_blit_32abpp_mask@60
_YUV_blit_32bpp@48
_YUV_blit_32bpp_mask@56
_YUV_blit_32rabpp@52
_YUV_blit_32rabpp_mask@60
_YUV_blit_32rbpp@48
_YUV_blit_32rbpp_mask@56
_YUV_blit_UYVY@48
_YUV_blit_UYVY_mask@56
_YUV_blit_YUY2@48
_YUV_blit_YUY2_mask@56
_YUV_blit_YV12@52
_YUV_init@4
_radfree@4
_radmalloc@4

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK16
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK4444
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK5551
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32A
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK16X2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32X2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK16MX
Size: 1024B - Virtual size: 515B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32MX
Size: 1024B - Virtual size: 687B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK16M
Size: 512B - Virtual size: 503B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32M
Size: 1024B - Virtual size: 547B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKYUY2
Size: 512B - Virtual size: 361B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKYUY2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKYUY2
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKYUY2
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32R
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32RA
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32RX
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK24
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK24X2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK24M
Size: 1024B - Virtual size: 714B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK24R
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK24RX
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK24RM
Size: 1024B - Virtual size: 804B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKUYVY
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKUYVY
Size: 512B - Virtual size: 369B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKUYVY
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKUYVY
Size: 512B - Virtual size: 327B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKYV12
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BINKDATA
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Halo.Combat.Evolved/Halo/bungie.bik
Halo.Combat.Evolved/Halo/chktrust.exe
.exe windows x86

16e83ea82cb2014691b009f0104e91ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

__p__fmode
wcsrchr
??2@YAPAXI@Z
??3@YAXPAX@Z
towlower
wcslen
_exit
_XcptFilter
exit
__p___winitenv
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
wcscpy
__set_app_type
_except_handler3
_controlfp
wcscat
vwprintf
_memicmp
wcstoul
swprintf
wprintf

kernel32

SetLastError
GetModuleHandleA
CloseHandle
GetLastError
WideCharToMultiByte
FindFirstFileA
FindNextFileA
FindClose
MultiByteToWideChar
CopyFileA
CopyFileW
ReadFile
SetFilePointer
DeleteFileA
GetVersionExA
DeleteFileW
lstrlenW
CreateFileA
CreateFileW
LocalAlloc
LocalFree

mscat32

CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
IsCatalogFile
CryptCATOpen
CryptCATEnumerateMember
CryptCATClose
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminAddCatalog

wintrust

WinVerifyTrust

crypt32

CertFindAttribute
CryptMsgGetParam
CryptMsgUpdate
CryptMsgOpenToDecode
CryptSIPRetrieveSubjectGuid
CryptSIPLoad
CryptMsgClose

user32

LoadStringA
LoadStringW

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Halo.Combat.Evolved/Halo/config.txt
Halo.Combat.Evolved/Halo/drvmgt.dll
.dll windows x86

3b69ed610e7a0314db7151203ffbc4de

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
Sleep
CopyFileA
GetSystemDirectoryA
lstrlenA
CreateFileA
GetLastError
DeviceIoControl
HeapReAlloc
TlsFree
SetLastError
HeapAlloc
SetFileAttributesA
GetFileAttributesA
HeapFree
GetCommandLineA
GetVersion
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetStringTypeA
LCMapStringW
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
MultiByteToWideChar
LCMapStringA
GetStringTypeW
GetProcAddress
LoadLibraryA
InterlockedDecrement
InterlockedIncrement

user32

wsprintfA

advapi32

SetServiceObjectSecurity
LockServiceDatabase
SetSecurityDescriptorDacl
ChangeServiceConfigA
ControlService
UnlockServiceDatabase
QueryServiceStatus
StartServiceA
OpenServiceA
CreateServiceA
QueryServiceConfigA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyExA
DeleteService
OpenSCManagerA
InitializeSecurityDescriptor
GetAce
GetAclInformation
GetSecurityDescriptorDacl
QueryServiceObjectSecurity
CloseServiceHandle

Exports

Exports

Remove
Setup
_DllMain@12

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Halo.Combat.Evolved/Halo/ending.bik
Halo.Combat.Evolved/Halo/eula.dll
.dll windows x86

23484c0c286268d6794ec064af743c46

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LCMapStringW
LCMapStringA
ReadFile
GetACP
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
FreeLibrary
GetProcAddress
lstrcatA
LoadLibraryA
CreateFileA
GetModuleFileNameA
WideCharToMultiByte
FreeEnvironmentStringsW
SetFilePointer
GetFileSize
CloseHandle
lstrlenA
GetOEMCP
lstrcpyA
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
RtlUnwind
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA

user32

SendMessageA
GetWindowTextA
MessageBoxA
GetDesktopWindow
CreateDialogParamA
LoadCursorA
SetCursor
DestroyWindow
PeekMessageA
TranslateMessage
DispatchMessageA
PostMessageA
CharNextA
GetDlgItem
EndDialog
DialogBoxParamA
LoadStringA
EnableWindow
SetWindowTextA
ShowWindow
SetFocus

gdi32

GetDeviceCaps
StartDocA
StartPage
EndPage
EndDoc
DeleteDC
SetMapMode

comdlg32

PrintDlgA

advapi32

RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA

Exports

Exports

EBUEula

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Halo.Combat.Evolved/Halo/eula.rtf
.rtf
Halo.Combat.Evolved/Halo/favicon.ico
Halo.Combat.Evolved/Halo/flt-halo.nfo
Halo.Combat.Evolved/Halo/gamespy.ico
Halo.Combat.Evolved/Halo/gearbox.bik
Halo.Combat.Evolved/Halo/halo.exe
.exe windows x86

5c6e636ce12b8d4110bb8f4aedf61daf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

inet_ntoa
recvfrom
WSAGetLastError
setsockopt
sendto
socket
gethostname
WSAStartup
gethostbyname
inet_addr

dsound

ord9

winmm

timeEndPeriod
timeBeginPeriod

kernel32

SetLastError
ReadFileEx
SystemTimeToFileTime
CompareFileTime
SetFileTime
ReadFile
GetFileTime
GetSystemTime
WriteFile
VirtualFree
VirtualAlloc
ExitProcess
GlobalMemoryStatus
SetErrorMode
QueryPerformanceCounter
GlobalAlloc
GetFileAttributesA
CreateDirectoryA
GlobalFree
QueryPerformanceFrequency
GetCurrentProcessId
GlobalReAlloc
GetCurrentThread
GetTickCount
FillConsoleOutputCharacterA
GetNumberOfConsoleInputEvents
WriteConsoleOutputCharacterA
ReadConsoleInputA
SetConsoleCursorPosition
GetStdHandle
WriteConsoleA
GetConsoleScreenBufferInfo
SetConsoleCursorInfo
FillConsoleOutputAttribute
GetConsoleCursorInfo
GetTimeFormatA
GetDateFormatA
VirtualQuery
GetLocalTime
GetModuleFileNameA
FreeLibrary
FormatMessageA
GetProcAddress
LoadLibraryA
LocalFree
SetThreadLocale
GetThreadLocale
FindFirstFileA
CopyFileA
FindClose
FindNextFileA
DeleteFileA
GetDiskFreeSpaceExA
GetCurrentProcess
GlobalLock
GetACP
GlobalUnlock
LocalAlloc
GetCurrentDirectoryA
GetVersionExA
GetLastError
SetPriorityClass
GetPriorityClass
CreateProcessA
MultiByteToWideChar
GetModuleHandleA
GetCurrentThreadId
DuplicateHandle
RemoveDirectoryA
GetFileAttributesExA
SetFileAttributesA
WideCharToMultiByte
GetThreadPriority
LoadResource
FindResourceExA
LockResource
CreateFileW
SizeofResource
FindResourceA
FindResourceW
GetSystemInfo
IsProcessorFeaturePresent
lstrcmpiA
GetFullPathNameA
HeapAlloc
GetProcessHeap
HeapFree
CompareStringA
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
RaiseException
GetSystemTimeAsFileTime
TerminateProcess
GetStartupInfoA
GetCommandLineA
RtlUnwind
HeapReAlloc
FlushFileBuffers
SetHandleCount
GetFileType
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
LCMapStringA
LCMapStringW
HeapSize
GetTimeZoneInformation
GetOEMCP
GetCPInfo
UnhandledExceptionFilter
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
CreateEventA
WaitForSingleObjectEx
SleepEx
SetEvent
VirtualProtect
Sleep
CreateFileMappingA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetFileSize
CreateFileA
ExitThread
TerminateThread
CreateThread
ResumeThread
CloseHandle
ReleaseMutex
CreateMutexA
GetExitCodeThread
SetThreadPriority
WaitForSingleObject
CompareStringW
SetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetLocaleInfoW
GetTempPathA
SetEnvironmentVariableA
InitializeCriticalSection

vorbisfile

ov_clear
ov_crosslap
ov_open_callbacks
ov_read

user32

LoadStringA
GetParent
RemovePropA
SendMessageA
PtInRect
GetCapture
SetPropA
InvalidateRect
GetWindowLongA
GetDlgItem
EndDialog
IsDlgButtonChecked
ReleaseCapture
SetWindowTextA
EnableWindow
CallWindowProcA
DialogBoxIndirectParamA
DialogBoxParamA
SetDlgItemTextA
CreateDialogIndirectParamA
GetPropA
GetWindowPlacement
FindWindowA
CloseClipboard
PostQuitMessage
IsClipboardFormatAvailable
wsprintfA
GetClientRect
GetDoubleClickTime
GetForegroundWindow
GetClipboardData
DefWindowProcA
OpenClipboard
ValidateRect
DestroyWindow
SetActiveWindow
RegisterClassExA
SetForegroundWindow
LoadBitmapA
LoadIconA
SetFocus
GetDC
SetCapture
ClientToScreen
SetWindowPos
ShowCursor
SetWindowLongA
UnregisterClassA
CreateWindowExA
ReleaseDC
ShowWindow
AdjustWindowRect
MoveWindow
MsgWaitForMultipleObjects
GetCursorPos
GetWindowRect
GetDesktopWindow
GetKeyState
GetAsyncKeyState
GetActiveWindow
GetSystemMetrics
SetCursor
MessageBoxA
LoadCursorA
TranslateMessage
PeekMessageA
DispatchMessageA

gdi32

SetTextColor
CreateFontIndirectA
StretchBlt
GetObjectA
GetDeviceGammaRamp
SetDeviceGammaRamp
GetDeviceCaps
DeleteObject
CreateCompatibleDC
SelectObject

advapi32

OpenThreadToken
RegOpenKeyA
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
GetLengthSid
IsValidSecurityDescriptor
RegQueryValueExA
FreeSid
AddAccessAllowedAce
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
OpenProcessToken
SetSecurityDescriptorGroup
AccessCheck
DuplicateToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
AllocateAndInitializeSid
SetSecurityDescriptorOwner

ole32

CoCreateInstance
StringFromGUID2
CoInitialize
CoUninitialize
CLSIDFromString

oleaut32

VariantInit
VariantClear

binkw32

_BinkSetSoundSystem@8
_BinkDoFrame@4
_BinkOpenDirectSound@4
_BinkCopyToBuffer@28
_BinkPause@8
_BinkNextFrame@4
_BinkOpen@8
_BinkWait@4
_BinkClose@4

wininet

InternetQueryOptionA

wsock32

__WSAFDIsSet
ntohl
htonl
ntohs
htons
getsockname
closesocket
bind
select
send
WSACleanup
inet_ntoa
shutdown
recv
connect

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 168KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Halo.Combat.Evolved/Halo/haloupdate.cfg
Halo.Combat.Evolved/Halo/haloupdate.exe
.exe windows x86

6bb07ddf5c1c54b5c5161e1f2fb637a9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeGetTime

patchw32

ord1

setupapi

SetupIterateCabinetA

wininet

InternetQueryOptionW

kernel32

CreateFileA
SetFileAttributesA
LoadResource
LockResource
SizeofResource
ReadFile
GetCurrentProcess
QueryPerformanceCounter
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CompareStringA
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
WriteFile
LoadLibraryA
InterlockedExchange
SetLastError
GetACP
RtlUnwind
GetLocaleInfoA
GetCurrentThreadId
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetFileType
GetStdHandle
SetHandleCount
SetFilePointer
GetStringTypeA
IsBadWritePtr
GetExitCodeProcess
GetCurrentProcessId
Sleep
WaitForSingleObject
OpenProcess
CloseHandle
GetLastError
GlobalFree
FreeLibrary
GetOEMCP
SetStdHandle
SetConsoleCtrlHandler
SetEndOfFile
IsBadCodePtr
SetEnvironmentVariableA
SetUnhandledExceptionFilter
IsBadReadPtr
GetSystemDirectoryA
VirtualFree
HeapCreate
HeapDestroy
FlushFileBuffers
GetTimeZoneInformation
HeapSize
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
TerminateProcess
LCMapStringA
ExitProcess
GetVersionExA
GetCommandLineA
GetStartupInfoA
HeapReAlloc
HeapAlloc
HeapFree
GetSystemTimeAsFileTime

user32

PostQuitMessage
EndPaint
GetClientRect
ShowWindow
GetSystemMetrics
AdjustWindowRect
InvalidateRect
UpdateWindow
SetFocus
TranslateMessage
BeginPaint
ExitWindowsEx

gdi32

SetTextColor
DeleteDC
StretchBlt
SelectObject
CreateCompatibleDC
SetBkMode
GetStockObject
DeleteObject

advapi32

RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey

wsock32

getsockopt
gethostbyname
WSACleanup
setsockopt
select
ntohl
WSAStartup
gethostname
inet_ntoa
WSAGetLastError
send
__WSAFDIsSet
recv
closesocket
shutdown
socket
htons
ioctlsocket
connect

Sections

.text
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Halo.Combat.Evolved/Halo/haloupdate.txt
Halo.Combat.Evolved/Halo/keystone.dll
.dll windows x86

b53017e5a2b7007cd9bed3deff45cf66

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostbyname
WSAStartup
inet_addr
WSAGetLastError
WSACleanup
htons
WSASocketW
closesocket
WSARecv
WSASend
connect

ksimeui

?SetSupportLevel@CKeystoneIMEUI@@SAXK@Z
?IgnoreHotKey@CKeystoneIMEUI@@SAHPAUtagMSG@@@Z
?ToggleLanguageBar@CKeystoneIMEUI@@SAXH@Z
?ProcessMessage@CKeystoneIMEUI@@SAJPAUHWND__@@IIJPA_N@Z
?Initialize@CKeystoneIMEUI@@SAHPAUHWND__@@HH@Z
?FinalizeString@CKeystoneIMEUI@@SAXH@Z
?GetSupportLevel@CKeystoneIMEUI@@SAKXZ

kernel32

IsBadReadPtr
VirtualFree
VirtualAlloc
LeaveCriticalSection
OutputDebugStringW
EnterCriticalSection
GetLastError
CreateFileA
WriteFile
GetVersionExA
FindClose
FindFirstFileA
GetACP
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TryEnterCriticalSection
InterlockedIncrement
QueryPerformanceCounter
QueryPerformanceFrequency
InterlockedDecrement
MulDiv
InitializeCriticalSection
OutputDebugStringA
FreeLibrary
DeleteFileA
GetProcAddress
CloseHandle
lstrcatA
GetTempFileNameA
GetTempPathA
LoadLibraryA
FindNextFileA
GetCurrentThreadId
SleepEx
TerminateThread
Sleep
SwitchToThread
IsBadCodePtr
ReadFileEx
ReadFile
GetFileSize
LocalAlloc
lstrlenW
FormatMessageW
GetModuleHandleA
MapViewOfFile
CreateFileMappingA
CreateFileW
WideCharToMultiByte
UnmapViewOfFile
LockResource
LoadResource
SizeofResource
FindResourceA
FindResourceW
GetSystemInfo
IsProcessorFeaturePresent
GetFullPathNameA
lstrcmpiA
HeapAlloc
GetProcessHeap
HeapFree
GetFileAttributesA
SetFilePointer
SetConsoleCtrlHandler
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
GetOEMCP
VirtualProtect
VirtualQuery
GetTimeZoneInformation
SetStdHandle
FlushFileBuffers
SetEndOfFile
GetUserDefaultLCID
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
LocalFree
GetLocaleInfoA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
CreateThread
HeapSize
IsBadWritePtr
HeapCreate
HeapDestroy
GetStringTypeW
GetCPInfo
GetDateFormatA
GetTimeFormatA
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
RtlUnwind
RaiseException
MultiByteToWideChar
ExitProcess
HeapReAlloc
TlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
TlsAlloc
LCMapStringA
LCMapStringW
FatalAppExitA
SetUnhandledExceptionFilter
GetTickCount
GetStringTypeA

user32

wsprintfA
GetKeyState
wsprintfW
TranslateAcceleratorA

gdi32

DeleteObject
DeleteDC
CreateCompatibleDC
SetMapMode
SetTextColor
SetTextAlign
GetDeviceCaps
CreateFontA
SelectObject
GetTextMetricsA
CreateDIBSection
ExtTextOutW
GetTextExtentPoint32W
SetBkColor

winspool.drv

EnumPrintersW
ClosePrinter
OpenPrinterW
GetPrinterW
ord203

advapi32

RegOpenKeyA
RegQueryValueExA
RegCloseKey

ole32

CoInitialize
CoCreateInstance
OleRun
CoUninitialize

oleaut32

VariantClear
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
CreateErrorInfo
GetErrorInfo
VariantChangeType
VariantInit
SetErrorInfo

Exports

Exports

?DeleteModifiedString@@YAXPAG@Z
?PrepareXML@@YAPAGPBG@Z
Call_KC_GetAttribute
Call_KC_SendMessage
Call_KC_SetAttribute
Call_KW_AddDirtyControl
Call_KW_GetControlByID
Call_KW_ReLayout
Call_KW_Release
Call_KW_SetFocusControl
Call_KW_ShowWindow
Call_KsCreateWindow
Call_KsDispatchMessage
Call_KsGetWindow
Call_KsRelease
Call_KsSetFocusWindow
Call_KsTranslateAccelerator
Call_KsUpdate
KeystoneCreate

Sections

.text
Size: 964KB - Virtual size: 960KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Halo.Combat.Evolved/Halo/ksimeui.dll
.dll windows x86

baf0aca9737a2647e4ebda97f854af48

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

imm32

ImmGetIMEFileNameA
ImmGetVirtualKey
ImmNotifyIME
ImmReleaseContext
ImmGetContext
ImmGetDefaultIMEWnd
ImmGetOpenStatus
ImmGetCompositionStringA
ImmIsIME
ImmAssociateContext
ImmGetCandidateListW
ImmGetCompositionStringW
ImmSetConversionStatus
ImmSetOpenStatus
ImmSimulateHotKey
ImmGetConversionStatus
ImmGetCandidateListA

kernel32

EnterCriticalSection
GetLastError
CreateFileA
WriteFile
GetVersionExA
GetACP
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
CompareStringA
GetTickCount
LeaveCriticalSection
lstrcpyA
lstrlenA
GetProcAddress
LoadLibraryA
IsDBCSLeadByteEx
GetLocaleInfoA
lstrcpyW
lstrcatW
GetTimeZoneInformation
InitializeCriticalSection
VirtualQuery
GetSystemInfo
VirtualProtect
GetOEMCP
UnhandledExceptionFilter
IsBadCodePtr
IsBadReadPtr
HeapSize
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetCurrentProcess
OutputDebugStringW
SetConsoleCtrlHandler
GetLocaleInfoW
CompareStringW
SetEnvironmentVariableA
lstrcatA
TerminateProcess
GetStringTypeW
GetStringTypeA
IsValidCodePage
RtlUnwind
RaiseException
ExitProcess
HeapReAlloc
HeapAlloc
HeapFree
GetCurrentThreadId
TlsSetValue
GetCommandLineA
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
TlsAlloc
LCMapStringA
LCMapStringW
GetModuleHandleA
DeleteCriticalSection
FatalAppExitA
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetTimeFormatA
GetDateFormatA
GetCPInfo
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale

user32

TranslateMessage
GetDC
wsprintfA
LoadStringA
GetCaretBlinkTime
GetAsyncKeyState
GetFocus
PostMessageA
GetKeyboardLayout
PeekMessageA
DispatchMessageA
GetMessageA
IsWindowUnicode
PostQuitMessage
GetKeyState
SendMessageW
SendMessageA
ReleaseDC

gdi32

GetDeviceCaps

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

ole32

CoCreateInstance
CoInitialize
CoUninitialize

Exports

Exports

??0CImeUiCallback@@QAE@XZ
??0CKeystoneIMEFont@@QAE@PAUIKeystoneDocument@@PAUIKeystoneResourceEngine@@PAUIKeystoneRenderingEngine@@PAUIKeystoneResourceFont@@KPAUIKeystoneControl@@PAUIKeystoneWindow@@PAUtagRECT@@6@Z
??0CKeystoneIMEUI@@QAE@XZ
??0CListFonts@@QAE@PAUIKeystoneControl@@@Z
??1CImeUiCallback@@QAE@XZ
??1CKeystoneIMEFont@@UAE@XZ
??1CKeystoneIMEUI@@QAE@XZ
??1CListFonts@@QAE@XZ
??4CImeUiCallback@@QAEAAV0@ABV0@@Z
??_7CKeystoneIMEFont@@6B@
?Clean@CKeystoneIMEUI@@QAEXXZ
?CreateImeUiFont@CKeystoneIMEUI@@QAEXPAUIKeystoneDocument@@PAUIKeystoneResourceEngine@@PAUIKeystoneResourceFont@@KPAUtagRECT@@3@Z
?CreateImeUiIndicatorFont@CKeystoneIMEUI@@QAEXPAUIKeystoneDocument@@PAUIKeystoneResourceEngine@@PAUIKeystoneResourceFont@@KPAUtagRECT@@3@Z
?CreateNewFontSize@CListFonts@@QAEPAUIKeystoneResourceFont@@PAUIKeystoneDocument@@PAU2@KPAUIKeystoneControl@@PAUIKeystoneResourceEngine@@@Z
?DrawTextW@CKeystoneIMEFont@@UAEXPBD@Z
?DrawTextW@CKeystoneIMEFont@@UAEXPBG@Z
?EnableIme@CKeystoneIMEUI@@QAEXH@Z
?FinalizeString@CKeystoneIMEUI@@SAXH@Z
?GetCaretStatus@CKeystoneIMEUI@@QAEHXZ
?GetColor@CKeystoneIMEFont@@QAEKXZ
?GetDefaultColor@CKeystoneIMEFont@@QAEKXZ
?GetHeight@CKeystoneIMEUI@@QAEKXZ
?GetInstance@CKeystoneIMEUI@@SAPAUHINSTANCE__@@XZ
?GetScreenDPI@CKeystoneIMEUI@@SAHXZ
?GetSupportLevel@CKeystoneIMEUI@@SAKXZ
?GetTextExtent@CKeystoneIMEFont@@UAEXPBEPAK1@Z
?GetTextExtent@CKeystoneIMEFont@@UAEXPBGPAK1@Z
?GetViewport@CKeystoneIMEFont@@QAE?AUtagRECT@@XZ
?GetWidth@CKeystoneIMEUI@@QAEKXZ
?IMEUI_DrawFans@CImeUiCallback@@SAXPBUIMEUI_VERTEX@@I@Z
?IMEUI_DrawRect@CImeUiCallback@@SAXHHHHK@Z
?IgnoreHotKey@CKeystoneIMEUI@@SAHPAUtagMSG@@@Z
?Initialize@CKeystoneIMEUI@@SAHPAUHWND__@@HH@Z
?IsMainWindowUnicode@CKeystoneIMEUI@@SAHXZ
?ProcessMessage@CKeystoneIMEUI@@SAJPAUHWND__@@IIJPA_N@Z
?RenderUI@CKeystoneIMEUI@@QAEXHH@Z
?SetCallbacks@CImeUiCallback@@QAEXPAUIKeystoneRenderingEngine@@PAUIKeystoneWindow@@PAUIKeystoneControl@@@Z
?SetCaretPosition@CKeystoneIMEUI@@QAEXII@Z
?SetColor@CKeystoneIMEFont@@UAEXK@Z
?SetCompStringAppearance@CKeystoneIMEUI@@AAEXXZ
?SetHeight@CKeystoneIMEFont@@UAEXI@Z
?SetImeUiCallbacks@CKeystoneIMEUI@@QAEXPAUIKeystoneRenderingEngine@@PAUIKeystoneWindow@@PAUIKeystoneControl@@@Z
?SetInstance@CKeystoneIMEUI@@SAXPAUHINSTANCE__@@@Z
?SetPosition@CKeystoneIMEFont@@UAEXHH@Z
?SetScreenDimension@CKeystoneIMEUI@@QAEXKK@Z
?SetSupportLevel@CKeystoneIMEUI@@SAXK@Z
?SetTextViewport@CKeystoneIMEUI@@QAEXAAUtagRECT@@@Z
?SetViewport@CKeystoneIMEFont@@QAEXAAUtagRECT@@@Z
?ToggleLanguageBar@CKeystoneIMEUI@@SAXH@Z
?m_ImeUiAppearance@CKeystoneIMEUI@@0UIMEUI_APPEARANCE@@A
?m_bInitialized@CKeystoneIMEUI@@0HA
?m_hInstance@CKeystoneIMEUI@@0PAUHINSTANCE__@@A
?m_iSupportLevel@CKeystoneIMEUI@@0HA
?m_lpControl@CImeUiCallback@@0PAUIKeystoneControl@@A
?m_lpRender@CImeUiCallback@@0PAUIKeystoneRenderingEngine@@A
?m_lpWindow@CImeUiCallback@@0PAUIKeystoneWindow@@A
?ms_bUnicodeWindow@CKeystoneIMEUI@@0HA
?ms_iScreenDPI@CKeystoneIMEUI@@0HA

Sections

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Halo.Combat.Evolved/Halo/ksml.xsd
.xml

Sharing

General

Malware Config

Signatures

Files

c25af603ccb45a3cbfba600f7f5c3bb3

Headers

File Characteristics

Imports

kernel32

user32

ksimeui

Exports

Exports

Sections

.text Size: 392KB - Virtual size: 390KB

.rdata Size: 64KB - Virtual size: 60KB

.data Size: 8KB - Virtual size: 25KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 28KB - Virtual size: 24KB

52304e2a18fa5608f4f4aeb8041c7da0

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

863844ad7aa759748e31329c65f10f35

Headers

File Characteristics

Imports

user32

gdi32

kernel32

winmm

Exports

Exports

Sections

.text Size: 53KB - Virtual size: 53KB

BINK Size: 75KB - Virtual size: 75KB

BINK16 Size: 6KB - Virtual size: 6KB

BINK4444 Size: 7KB - Virtual size: 7KB

BINK5551 Size: 6KB - Virtual size: 6KB

BINK32 Size: 6KB - Virtual size: 6KB

BINK32A Size: 7KB - Virtual size: 7KB

BINK16X2 Size: 3KB - Virtual size: 3KB

BINK32X2 Size: 3KB - Virtual size: 3KB

BINK16MX Size: 1024B - Virtual size: 515B

BINK32MX Size: 1024B - Virtual size: 687B

BINK16M Size: 512B - Virtual size: 503B

BINK32M Size: 1024B - Virtual size: 547B

BINKYUY2 Size: 512B - Virtual size: 361B

BINKYUY2 Size: 3KB - Virtual size: 3KB

BINKYUY2 Size: 512B - Virtual size: 492B

BINKYUY2 Size: 512B - Virtual size: 292B

BINK32R Size: 5KB - Virtual size: 5KB

BINK32RA Size: 6KB - Virtual size: 5KB

BINK32RX Size: 3KB - Virtual size: 3KB

BINK24 Size: 7KB - Virtual size: 7KB

BINK24X2 Size: 4KB - Virtual size: 4KB

BINK24M Size: 1024B - Virtual size: 714B

BINK24R Size: 6KB - Virtual size: 6KB

BINK24RX Size: 4KB - Virtual size: 4KB

BINK24RM Size: 1024B - Virtual size: 804B

BINKUYVY Size: 512B - Virtual size: 488B

BINKUYVY Size: 512B - Virtual size: 369B

BINKUYVY Size: 4KB - Virtual size: 3KB

BINKUYVY Size: 512B - Virtual size: 327B

BINKYV12 Size: 1024B - Virtual size: 704B

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 2KB - Virtual size: 13KB

BINKDATA Size: 63KB - Virtual size: 63KB

.text
Size: 392KB - Virtual size: 390KB

.rdata
Size: 64KB - Virtual size: 60KB

.data
Size: 8KB - Virtual size: 25KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 28KB - Virtual size: 24KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.text
Size: 53KB - Virtual size: 53KB

BINK
Size: 75KB - Virtual size: 75KB

BINK16
Size: 6KB - Virtual size: 6KB

BINK4444
Size: 7KB - Virtual size: 7KB

BINK5551
Size: 6KB - Virtual size: 6KB

BINK32
Size: 6KB - Virtual size: 6KB

BINK32A
Size: 7KB - Virtual size: 7KB

BINK16X2
Size: 3KB - Virtual size: 3KB

BINK32X2
Size: 3KB - Virtual size: 3KB

BINK16MX
Size: 1024B - Virtual size: 515B

BINK32MX
Size: 1024B - Virtual size: 687B

BINK16M
Size: 512B - Virtual size: 503B

BINK32M
Size: 1024B - Virtual size: 547B

BINKYUY2
Size: 512B - Virtual size: 361B

BINKYUY2
Size: 3KB - Virtual size: 3KB

BINKYUY2
Size: 512B - Virtual size: 492B

BINKYUY2
Size: 512B - Virtual size: 292B

BINK32R
Size: 5KB - Virtual size: 5KB

BINK32RA
Size: 6KB - Virtual size: 5KB

BINK32RX
Size: 3KB - Virtual size: 3KB

BINK24
Size: 7KB - Virtual size: 7KB

BINK24X2
Size: 4KB - Virtual size: 4KB

BINK24M
Size: 1024B - Virtual size: 714B

BINK24R
Size: 6KB - Virtual size: 6KB

BINK24RX
Size: 4KB - Virtual size: 4KB

BINK24RM
Size: 1024B - Virtual size: 804B

BINKUYVY
Size: 512B - Virtual size: 488B

BINKUYVY
Size: 512B - Virtual size: 369B

BINKUYVY
Size: 4KB - Virtual size: 3KB

BINKUYVY
Size: 512B - Virtual size: 327B

BINKYV12
Size: 1024B - Virtual size: 704B

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 2KB - Virtual size: 13KB

BINKDATA
Size: 63KB - Virtual size: 63KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 21KB - Virtual size: 20KB

.text
Size: 11KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 252B

.rsrc
Size: 4KB - Virtual size: 3KB

.text
Size: 20KB - Virtual size: 20KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 11KB - Virtual size: 12KB

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 13KB

.rsrc
Size: 16KB - Virtual size: 12KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 236KB - Virtual size: 236KB

.data
Size: 168KB - Virtual size: 2.0MB

.tls
Size: 4KB - Virtual size: 4KB