HCE Portable- Uploaded by TheStevenCrackk[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

HCE Portable- Uploaded by TheStevenCrackk.rar
Size

547.6MB
MD5

5c8d3f342490e3ac57c0b00cdb481cda
SHA1

11cbbcbc410b088689407f17fd6597eda5ea1659
SHA256

cf5c86dea87bf77a904edefc108fd035522ba90d193dd6a9b4605437bf041aaa
SHA512

207effecab6d79a091bfbdaebeb36e71784a1b21811da59828003795f7f1d0981d256977122b8185a89e2525c5017b95b12993b16c5965344b664578f28b7c63
SSDEEP

12582912:7GFBAHxC0PkNTGxVy7+hxKtmc7JTn+SmeOEacMqjuVmmxaCr+yyoqw+L4EDC99Z:6r8P4UG+hxu+SmOBMqW/5+9w+LxDeH

Score

3^/10

Malware Config

Signatures

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Halo/CONTROLS/controls.dll
unpack001/Halo/Keystone.dll
unpack001/Halo/binkw32.dll
unpack001/Halo/chimera.dll
unpack001/Halo/chktrust.exe
unpack001/Halo/drvmgt.dll
unpack001/Halo/eula.dll
unpack001/Halo/halo.exe
unpack001/Halo/haloupdate.exe
unpack001/Halo/ksimeui.dll

Files

HCE Portable- Uploaded by TheStevenCrackk.rar
.rar
Halo/00000000.016
Halo/00000000.256
Halo/CONTENT/1024editbox.ksml
Halo/CONTENT/1024log.ksml
Halo/CONTENT/1050editbox.ksml
Halo/CONTENT/1050log.ksml
Halo/CONTENT/1080editbox.ksml
Halo/CONTENT/1080log.ksml
Halo/CONTENT/1200editbox.ksml
Halo/CONTENT/1200log.ksml
Halo/CONTENT/1440editbox.ksml
Halo/CONTENT/1440log.ksml
Halo/CONTENT/1600editbox.ksml
Halo/CONTENT/1600log.ksml
Halo/CONTENT/2160editbox.ksml
Halo/CONTENT/2160log.ksml
Halo/CONTENT/480editbox.ksml
Halo/CONTENT/480log.ksml
Halo/CONTENT/576editbox.ksml
Halo/CONTENT/576log.ksml
Halo/CONTENT/600editbox.ksml
Halo/CONTENT/600log.ksml
Halo/CONTENT/720editbox.ksml
Halo/CONTENT/720log.ksml
Halo/CONTENT/768editbox.ksml
Halo/CONTENT/768log.ksml
Halo/CONTENT/864editbox.ksml
Halo/CONTENT/864log.ksml
Halo/CONTENT/900editbox.ksml
Halo/CONTENT/900log.ksml
Halo/CONTENT/960editbox.ksml
Halo/CONTENT/960log.ksml
Halo/CONTENT/GALLERY/editbox1024.png
.png
Halo/CONTENT/GALLERY/editbox1050.png
.png
Halo/CONTENT/GALLERY/editbox1080.png
.png
Halo/CONTENT/GALLERY/editbox1200.png
.png
Halo/CONTENT/GALLERY/editbox1440.png
.png
Halo/CONTENT/GALLERY/editbox1600.png
.png
Halo/CONTENT/GALLERY/editbox2160.png
.png
Halo/CONTENT/GALLERY/editbox480.png
.png
Halo/CONTENT/GALLERY/editbox576.png
.png
Halo/CONTENT/GALLERY/editbox600.png
.png
Halo/CONTENT/GALLERY/editbox720.png
.png
Halo/CONTENT/GALLERY/editbox768.png
.png
Halo/CONTENT/GALLERY/editbox864.png
.png
Halo/CONTENT/GALLERY/editbox900.png
.png
Halo/CONTENT/GALLERY/editbox960.png
.png
Halo/CONTROLS/controls.dll
.dll windows x86

c25af603ccb45a3cbfba600f7f5c3bb3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
OutputDebugStringW
EnterCriticalSection
GetLastError
CreateFileA
WriteFile
GetVersionExA
GetACP
GetPrivateProfileStringA
lstrlenA
GetModuleFileNameA
GetModuleHandleA
MultiByteToWideChar
IsDBCSLeadByteEx
GetCPInfo
GetLocaleInfoA
GetTickCount
GetUserDefaultLangID
WideCharToMultiByte
GetCPInfoExW
GetVersionExW
CompareStringW
CompareStringA
GetLocaleInfoW
SetConsoleCtrlHandler
GetTimeZoneInformation
LoadLibraryA
InitializeCriticalSection
VirtualQuery
GetSystemInfo
VirtualProtect
GetOEMCP
UnhandledExceptionFilter
IsBadCodePtr
IsBadReadPtr
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
RtlUnwind
RaiseException
ExitProcess
HeapReAlloc
HeapAlloc
GetCurrentThreadId
TlsSetValue
GetCommandLineA
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
TlsAlloc
LCMapStringA
LCMapStringW
HeapFree
GetProcAddress
SetUnhandledExceptionFilter
FatalAppExitA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
TerminateProcess
GetCurrentProcess
HeapSize
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetHandleCount
GetStdHandle
GetFileType
SetEnvironmentVariableA

user32

GetKeyboardLayout
CharNextExA
wsprintfA

ksimeui

?Clean@CKeystoneIMEUI@@QAEXXZ
?IsMainWindowUnicode@CKeystoneIMEUI@@SAHXZ
?SetImeUiCallbacks@CKeystoneIMEUI@@QAEXPAUIKeystoneRenderingEngine@@PAUIKeystoneWindow@@PAUIKeystoneControl@@@Z
?SetScreenDimension@CKeystoneIMEUI@@QAEXKK@Z
?FinalizeString@CKeystoneIMEUI@@SAXH@Z
?CreateImeUiIndicatorFont@CKeystoneIMEUI@@QAEXPAUIKeystoneDocument@@PAUIKeystoneResourceEngine@@PAUIKeystoneResourceFont@@KPAUtagRECT@@3@Z
?EnableIme@CKeystoneIMEUI@@QAEXH@Z
?SetTextViewport@CKeystoneIMEUI@@QAEXAAUtagRECT@@@Z
??0CKeystoneIMEUI@@QAE@XZ
??1CKeystoneIMEUI@@QAE@XZ
?GetCaretStatus@CKeystoneIMEUI@@QAEHXZ
?RenderUI@CKeystoneIMEUI@@QAEXHH@Z
?SetCaretPosition@CKeystoneIMEUI@@QAEXII@Z
?CreateImeUiFont@CKeystoneIMEUI@@QAEXPAUIKeystoneDocument@@PAUIKeystoneResourceEngine@@PAUIKeystoneResourceFont@@KPAUtagRECT@@3@Z

Exports

Exports

Register

Sections

.text
Size: 392KB - Virtual size: 390KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Halo/CONTROLS/controls.ini
Halo/Keystone.dll
.dll windows x86

b5771f1850c1bfe936166e12b54510bb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostbyname
WSAStartup
inet_addr
WSAGetLastError
WSACleanup
htons
WSASocketW
closesocket
WSARecv
WSASend
connect

ksimeui

?SetSupportLevel@CKeystoneIMEUI@@SAXK@Z
?IgnoreHotKey@CKeystoneIMEUI@@SAHPAUtagMSG@@@Z
?ToggleLanguageBar@CKeystoneIMEUI@@SAXH@Z
?ProcessMessage@CKeystoneIMEUI@@SAJPAUHWND__@@IIJPA_N@Z
?Initialize@CKeystoneIMEUI@@SAHPAUHWND__@@HH@Z
?FinalizeString@CKeystoneIMEUI@@SAXH@Z
?GetSupportLevel@CKeystoneIMEUI@@SAKXZ

kernel32

IsBadReadPtr
VirtualFree
VirtualAlloc
LeaveCriticalSection
OutputDebugStringW
EnterCriticalSection
GetLastError
CreateFileA
WriteFile
GetVersionExA
FindClose
FindFirstFileA
GetACP
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TryEnterCriticalSection
InterlockedIncrement
QueryPerformanceCounter
QueryPerformanceFrequency
InterlockedDecrement
MulDiv
InitializeCriticalSection
OutputDebugStringA
FreeLibrary
DeleteFileA
GetProcAddress
CloseHandle
lstrcatA
GetTempFileNameA
GetTempPathA
LoadLibraryA
FindNextFileA
GetCurrentThreadId
Sleep
SleepEx
TerminateThread
SwitchToThread
IsBadCodePtr
CreateThread
ReadFileEx
ReadFile
GetFileSize
LocalAlloc
lstrlenW
FormatMessageW
GetModuleHandleA
MapViewOfFile
CreateFileMappingA
CreateFileW
WideCharToMultiByte
UnmapViewOfFile
LockResource
LoadResource
SizeofResource
FindResourceA
FindResourceW
GetSystemInfo
IsProcessorFeaturePresent
GetFullPathNameA
lstrcmpiA
HeapAlloc
GetProcessHeap
HeapFree
GetFileAttributesA
SetFilePointer
SetConsoleCtrlHandler
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
GetOEMCP
VirtualProtect
VirtualQuery
GetTimeZoneInformation
SetStdHandle
FlushFileBuffers
GetUserDefaultLCID
SetEndOfFile
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
LocalFree
GetLocaleInfoA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
ResumeThread
HeapSize
IsBadWritePtr
HeapCreate
HeapDestroy
GetStringTypeW
GetCPInfo
GetDateFormatA
GetTimeFormatA
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
RtlUnwind
RaiseException
MultiByteToWideChar
ExitProcess
HeapReAlloc
TlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
TlsAlloc
LCMapStringA
LCMapStringW
FatalAppExitA
SetUnhandledExceptionFilter
GetTickCount
GetStringTypeA

user32

wsprintfA
GetKeyState
wsprintfW
TranslateAcceleratorA

gdi32

DeleteObject
DeleteDC
CreateCompatibleDC
SetMapMode
SetTextColor
SetBkColor
GetDeviceCaps
CreateFontA
SelectObject
GetTextMetricsA
CreateDIBSection
ExtTextOutW
GetTextExtentPoint32W
SetTextAlign

winspool.drv

EnumPrintersW
ClosePrinter
OpenPrinterW
GetPrinterW
ord203

advapi32

RegOpenKeyA
RegQueryValueExA
RegCloseKey

ole32

CoInitialize
CoCreateInstance
OleRun
CoUninitialize

oleaut32

VariantClear
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
CreateErrorInfo
GetErrorInfo
VariantChangeType
VariantInit
SetErrorInfo

Exports

Exports

?DeleteModifiedString@@YAXPAG@Z
?PrepareXML@@YAPAGPBG@Z
Call_KC_GetAttribute
Call_KC_SendMessage
Call_KC_SetAttribute
Call_KW_AddDirtyControl
Call_KW_GetControlByID
Call_KW_ReLayout
Call_KW_Release
Call_KW_SetFocusControl
Call_KW_ShowWindow
Call_KsCreateWindow
Call_KsDispatchMessage
Call_KsGetWindow
Call_KsRelease
Call_KsSetFocusWindow
Call_KsTranslateAccelerator
Call_KsUpdate
KeystoneCreate

Sections

.text
Size: 964KB - Virtual size: 960KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Halo/MAPS/a10.map
Halo/MAPS/a30.map
Halo/MAPS/a50.map
Halo/MAPS/b30.map
Halo/MAPS/b40.map
Halo/MAPS/beavercreek.map
Halo/MAPS/bitmaps.map
Halo/MAPS/bloodgulch.map
Halo/MAPS/boardingaction.map
Halo/MAPS/c10.map
Halo/MAPS/c20.map
Halo/MAPS/c40.map
Halo/MAPS/carousel.map
Halo/MAPS/chillout.map
Halo/MAPS/d20.map
Halo/MAPS/d40.map
Halo/MAPS/damnation.map
Halo/binkw32.dll
.dll windows x86

863844ad7aa759748e31329c65f10f35

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetCursor
GetClassLongA
RegisterClassA
ChangeDisplaySettingsA
IsWindowVisible
GetSystemMetrics
GetCursorPos
DefWindowProcA
ReleaseDC
PeekMessageA
CreateWindowExA
GetTopWindow
GetWindowLongA
GetActiveWindow
GetWindowThreadProcessId
GetWindow
EndPaint
ClientToScreen
DestroyWindow
MessageBoxA
ScreenToClient
GetWindowRect
IsIconic
GetClientRect
BeginPaint
GetDC
ShowCursor
UnregisterClassA

gdi32

CreateDIBSection
GetDeviceCaps
StretchBlt
GetDIBits
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
SetStretchBltMode
GetPixel
DeleteDC

kernel32

GetOEMCP
GetACP
LCMapStringW
MultiByteToWideChar
LCMapStringA
WriteFile
GetEnvironmentStringsW
GetCPInfo
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
GetStringTypeA
GetStringTypeW
HeapSize
GetCurrentThreadId
GetSystemTimeAsFileTime
RtlUnwind
GetLastError
CreateEventA
GetWindowsDirectoryA
GetSystemDirectoryA
GetModuleFileNameA
SetErrorMode
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleHandleA
Sleep
GetCurrentProcessId
QueryPerformanceCounter
GetTickCount
QueryPerformanceFrequency
CreateFileA
SetFilePointer
ReadFile
CloseHandle
WaitForSingleObject
SetEvent
RaiseException
SetThreadPriority
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
ResumeThread
CreateThread
GetCurrentProcess
TerminateProcess
ExitProcess
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetCommandLineA
HeapFree
HeapAlloc

winmm

waveOutPrepareHeader
waveOutOpen
waveOutUnprepareHeader
waveOutSetVolume
waveOutReset
waveOutRestart
waveOutPause
waveOutWrite
waveOutClose
timeGetTime

Exports

Exports

_BinkBufferBlit@12
_BinkBufferCheckWinPos@12
_BinkBufferClear@8
_BinkBufferClose@4
_BinkBufferGetDescription@4
_BinkBufferGetError@0
_BinkBufferLock@4
_BinkBufferOpen@16
_BinkBufferSetDirectDraw@8
_BinkBufferSetHWND@8
_BinkBufferSetOffset@12
_BinkBufferSetResolution@12
_BinkBufferSetScale@12
_BinkBufferUnlock@4
_BinkCheckCursor@20
_BinkClose@4
_BinkCloseTrack@4
_BinkCopyToBuffer@28
_BinkCopyToBufferRect@44
_BinkDDSurfaceType@4
_BinkDX8SurfaceType@4
_BinkDoFrame@4
_BinkGetError@0
_BinkGetKeyFrame@12
_BinkGetRealtime@12
_BinkGetRects@8
_BinkGetSummary@8
_BinkGetTrackData@8
_BinkGetTrackID@8
_BinkGetTrackMaxSize@8
_BinkGetTrackType@8
_BinkGoto@12
_BinkIsSoftwareCursor@8
_BinkLogoAddress@0
_BinkNextFrame@4
_BinkOpen@8
_BinkOpenDirectSound@4
_BinkOpenMiles@4
_BinkOpenTrack@8
_BinkOpenWaveOut@4
_BinkPause@8
_BinkRestoreCursor@4
_BinkService@4
_BinkSetError@4
_BinkSetFrameRate@8
_BinkSetIO@4
_BinkSetIOSize@4
_BinkSetMixBinVolumes@20
_BinkSetMixBins@16
_BinkSetPan@12
_BinkSetSimulate@4
_BinkSetSoundOnOff@8
_BinkSetSoundSystem@8
_BinkSetSoundTrack@8
_BinkSetVideoOnOff@8
_BinkSetVolume@12
_BinkWait@4
_RADSetMemory@8
_RADTimerRead@0
_YUV_blit_16a1bpp@52
_YUV_blit_16a1bpp_mask@60
_YUV_blit_16a4bpp@52
_YUV_blit_16a4bpp_mask@60
_YUV_blit_16bpp@48
_YUV_blit_16bpp_mask@56
_YUV_blit_24bpp@48
_YUV_blit_24bpp_mask@56
_YUV_blit_24rbpp@48
_YUV_blit_24rbpp_mask@56
_YUV_blit_32abpp@52
_YUV_blit_32abpp_mask@60
_YUV_blit_32bpp@48
_YUV_blit_32bpp_mask@56
_YUV_blit_32rabpp@52
_YUV_blit_32rabpp_mask@60
_YUV_blit_32rbpp@48
_YUV_blit_32rbpp_mask@56
_YUV_blit_UYVY@48
_YUV_blit_UYVY_mask@56
_YUV_blit_YUY2@48
_YUV_blit_YUY2_mask@56
_YUV_blit_YV12@52
_YUV_init@4
_radfree@4
_radmalloc@4

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK16
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK4444
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK5551
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32A
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK16X2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32X2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK16MX
Size: 1024B - Virtual size: 515B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32MX
Size: 1024B - Virtual size: 687B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK16M
Size: 512B - Virtual size: 503B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32M
Size: 1024B - Virtual size: 547B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKYUY2
Size: 512B - Virtual size: 361B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKYUY2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKYUY2
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKYUY2
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32R
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32RA
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK32RX
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK24
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK24X2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK24M
Size: 1024B - Virtual size: 714B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK24R
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK24RX
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK24RM
Size: 1024B - Virtual size: 804B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKUYVY
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKUYVY
Size: 512B - Virtual size: 369B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKUYVY
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKUYVY
Size: 512B - Virtual size: 327B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKYV12
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BINKDATA
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Halo/bungie.bik
Halo/chimera.dll
.dll windows x86

ff3f39d47eda809e8e90a7d47b4d021f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateDirectoryA
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FindFirstFileA
FindNextFileA
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte

msvcrt

__dllonexit
__doserrno
__mb_cur_max
__pioinfo
__setusermatherr
_amsg_exit
_beginthreadex
_endthreadex
_errno
_fdopen
_filelengthi64
_fileno
_fileno
_fstat64
_initterm
_iob
_lock
_lseeki64
_onexit
_pclose
_popen
_read
_setjmp3
_strdup
_strnicmp
_ultoa
_unlock
_write
_write
abort
acos
asin
atan
atof
atoi
atol
calloc
clearerr
clock
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
freopen
frexp
fseek
fsetpos
ftell
getwc
gmtime
fwrite
getc
getenv
isalnum
isalpha
iscntrl
isgraph
islower
ispunct
isspace
isupper
iswctype
isxdigit
localeconv
localtime
log10
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
mktime
printf
putc
putwc
rand
realloc
remove
rename
setlocale
setvbuf
sprintf
srand
strchr
strcmp
strcoll
strcpy
strerror
strftime
strlen
strncmp
strpbrk
strrchr
strspn
strstr
strtol
strtoul
strxfrm
system
tan
time
tmpfile
tmpnam
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcsxfrm

user32

MessageBoxA

Sections

.text
Size: 946KB - Virtual size: 945KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 288KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 13.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Halo/chktrust.exe
.exe windows x86

16e83ea82cb2014691b009f0104e91ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

__p__fmode
wcsrchr
??2@YAPAXI@Z
??3@YAXPAX@Z
towlower
wcslen
_exit
_XcptFilter
exit
__p___winitenv
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
wcscpy
__set_app_type
_except_handler3
_controlfp
wcscat
vwprintf
_memicmp
wcstoul
swprintf
wprintf

kernel32

SetLastError
GetModuleHandleA
CloseHandle
GetLastError
WideCharToMultiByte
FindFirstFileA
FindNextFileA
FindClose
MultiByteToWideChar
CopyFileA
CopyFileW
ReadFile
SetFilePointer
DeleteFileA
GetVersionExA
DeleteFileW
lstrlenW
CreateFileA
CreateFileW
LocalAlloc
LocalFree

mscat32

CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
IsCatalogFile
CryptCATOpen
CryptCATEnumerateMember
CryptCATClose
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminAddCatalog

wintrust

WinVerifyTrust

crypt32

CertFindAttribute
CryptMsgGetParam
CryptMsgUpdate
CryptMsgOpenToDecode
CryptSIPRetrieveSubjectGuid
CryptSIPLoad
CryptMsgClose

user32

LoadStringA
LoadStringW

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Halo/cluf.rtf
.rtf
Halo/config.txt
Halo/drvmgt.dll
.dll windows x86

3b69ed610e7a0314db7151203ffbc4de

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
Sleep
CopyFileA
GetSystemDirectoryA
lstrlenA
CreateFileA
GetLastError
DeviceIoControl
HeapReAlloc
TlsFree
SetLastError
HeapAlloc
SetFileAttributesA
GetFileAttributesA
HeapFree
GetCommandLineA
GetVersion
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetStringTypeA
LCMapStringW
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
MultiByteToWideChar
LCMapStringA
GetStringTypeW
GetProcAddress
LoadLibraryA
InterlockedDecrement
InterlockedIncrement

user32

wsprintfA

advapi32

SetServiceObjectSecurity
LockServiceDatabase
SetSecurityDescriptorDacl
ChangeServiceConfigA
ControlService
UnlockServiceDatabase
QueryServiceStatus
StartServiceA
OpenServiceA
CreateServiceA
QueryServiceConfigA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyExA
DeleteService
OpenSCManagerA
InitializeSecurityDescriptor
GetAce
GetAclInformation
GetSecurityDescriptorDacl
QueryServiceObjectSecurity
CloseServiceHandle

Exports

Exports

Remove
Setup
_DllMain@12

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Halo/ending.bik
Halo/eula.dll
.dll windows x86

23484c0c286268d6794ec064af743c46

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LCMapStringW
LCMapStringA
ReadFile
GetACP
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
FreeLibrary
GetProcAddress
lstrcatA
LoadLibraryA
CreateFileA
GetModuleFileNameA
WideCharToMultiByte
FreeEnvironmentStringsW
SetFilePointer
GetFileSize
CloseHandle
lstrlenA
GetOEMCP
lstrcpyA
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
RtlUnwind
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA

user32

SendMessageA
GetWindowTextA
MessageBoxA
GetDesktopWindow
CreateDialogParamA
LoadCursorA
SetCursor
DestroyWindow
PeekMessageA
TranslateMessage
DispatchMessageA
PostMessageA
CharNextA
GetDlgItem
EndDialog
DialogBoxParamA
LoadStringA
EnableWindow
SetWindowTextA
ShowWindow
SetFocus

gdi32

GetDeviceCaps
StartDocA
StartPage
EndPage
EndDoc
DeleteDC
SetMapMode

comdlg32

PrintDlgA

advapi32

RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA

Exports

Exports

EBUEula

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Halo/eula.rtf
.rtf
Halo/favicon.ico
Halo/gearbox.bik
Halo/halo.exe
.exe windows x86

bdab6858da105afb5c569c8409f6f120

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
VirtualAlloc
LoadLibraryA
GlobalMemoryStatus
SetErrorMode
QueryPerformanceCounter
GlobalAlloc
GetFileAttributesA
CreateDirectoryA
GlobalFree
QueryPerformanceFrequency
GetCurrentProcessId
GlobalReAlloc
GetCurrentThread
GetTickCount
FillConsoleOutputCharacterA
GetNumberOfConsoleInputEvents
WriteConsoleOutputCharacterA
ReadConsoleInputA
SetConsoleCursorPosition
GetStdHandle
WriteConsoleA
GetConsoleScreenBufferInfo
SetConsoleCursorInfo
FillConsoleOutputAttribute
GetConsoleCursorInfo
GetTimeFormatA
GetDateFormatA
VirtualQuery
GetLocalTime
GetModuleFileNameA
FormatMessageA
LocalFree
SetThreadLocale
GetThreadLocale
FindFirstFileA
CopyFileA
FindClose
FindNextFileA
DeleteFileA
GetDiskFreeSpaceExA
GlobalLock
GetACP
GlobalUnlock
LocalAlloc
GetCurrentDirectoryA
GetVersionExA
GetTempPathA
SetPriorityClass
GetPriorityClass
CreateProcessA
TerminateProcess
MultiByteToWideChar
GetModuleHandleA
GetCurrentThreadId
DuplicateHandle
RemoveDirectoryA
GetFileAttributesExA
SetFileAttributesA
WideCharToMultiByte
GetThreadPriority
LoadResource
LockResource
CreateFileW
VirtualFree
FindResourceA
FindResourceW
GetSystemInfo
IsProcessorFeaturePresent
lstrcmpiA
GetFullPathNameA
HeapAlloc
GetProcessHeap
HeapFree
GetLocaleInfoW
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetStdHandle
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
SetEnvironmentVariableA
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
UnhandledExceptionFilter
GetCPInfo
GetOEMCP
GetTimeZoneInformation
HeapSize
LCMapStringW
LCMapStringA
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
GetFileType
SetHandleCount
FlushFileBuffers
HeapReAlloc
RtlUnwind
GetCommandLineA
GetStartupInfoA
GetSystemTimeAsFileTime
RaiseException
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReadFileEx
SetLastError
GetLastError
CreateEventA
WaitForSingleObjectEx
SleepEx
SetEvent
VirtualProtect
Sleep
CreateFileMappingA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetFileSize
CreateFileA
ExitThread
GetCurrentProcess
FreeLibrary
ExitProcess
WriteFile
GetSystemTime
GetFileTime
ReadFile
SetFileTime
CompareFileTime
SizeofResource
SystemTimeToFileTime
TerminateThread
CreateThread
ResumeThread
CloseHandle
ReleaseMutex
CreateMutexA
GetExitCodeThread
SetThreadPriority
FindResourceExA
WaitForSingleObject

user32

GetPropA
LoadStringA
GetParent
RemovePropA
SendMessageA
PtInRect
GetCapture
SetPropA
InvalidateRect
GetWindowLongA
GetDlgItem
SetCapture
IsDlgButtonChecked
ReleaseCapture
SetWindowTextA
EnableWindow
DispatchMessageA
PeekMessageA
TranslateMessage
MessageBoxA
LoadCursorA
SetCursor
ClientToScreen
EndDialog
CallWindowProcA
DialogBoxIndirectParamA
DialogBoxParamA
SetDlgItemTextA
CreateDialogIndirectParamA
SetWindowPos
GetWindowPlacement
FindWindowA
CloseClipboard
PostQuitMessage
IsClipboardFormatAvailable
wsprintfA
GetClientRect
GetDoubleClickTime
GetForegroundWindow
GetClipboardData
DefWindowProcA
OpenClipboard
ValidateRect
DestroyWindow
SetActiveWindow
RegisterClassExA
SetForegroundWindow
LoadBitmapA
LoadIconA
SetFocus
GetDC
ShowCursor
SetWindowLongA
UnregisterClassA
ReleaseDC
ShowWindow
AdjustWindowRect
MoveWindow
MsgWaitForMultipleObjects
GetCursorPos
GetWindowRect
GetDesktopWindow
GetKeyState
GetAsyncKeyState
GetActiveWindow
GetSystemMetrics
CreateWindowExA

gdi32

CreateFontIndirectA
StretchBlt
GetObjectA
GetDeviceGammaRamp
SetDeviceGammaRamp
GetDeviceCaps
DeleteObject
SelectObject
CreateCompatibleDC
SetTextColor

advapi32

SetSecurityDescriptorGroup
OpenProcessToken
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AccessCheck
DuplicateToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
AllocateAndInitializeSid
SetSecurityDescriptorOwner
AddAccessAllowedAce
FreeSid
IsValidSecurityDescriptor
GetLengthSid
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptHashData
RegOpenKeyA
OpenThreadToken

ole32

CoCreateInstance
CoInitialize
StringFromGUID2
CLSIDFromString
CoUninitialize

oleaut32

VariantClear
VariantInit

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 240KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Halo/haloupdate.cfg
Halo/haloupdate.exe
.exe windows x86

7edf4a82a22c7f925a7a6f58913be622

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeGetTime

patchw32

ord1

setupapi

SetupIterateCabinetA

wininet

InternetQueryOptionW

kernel32

CreateFileA
SetFileAttributesA
LoadResource
LockResource
SizeofResource
ReadFile
GetCurrentProcess
QueryPerformanceCounter
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CompareStringA
InterlockedExchange
GetModuleHandleA
GetModuleFileNameA
WriteFile
GetSystemDirectoryA
LoadLibraryA
SetLastError
GetACP
RtlUnwind
GetLocaleInfoA
GetCurrentThreadId
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetFileType
GetStdHandle
SetHandleCount
SetFilePointer
GetStringTypeA
IsBadWritePtr
GetExitCodeProcess
GetCurrentProcessId
Sleep
WaitForSingleObject
OpenProcess
CloseHandle
GetLastError
GlobalFree
FreeLibrary
GetOEMCP
SetStdHandle
SetConsoleCtrlHandler
SetEndOfFile
IsBadCodePtr
SetEnvironmentVariableA
SetUnhandledExceptionFilter
IsBadReadPtr
GetWindowsDirectoryA
VirtualFree
HeapCreate
HeapDestroy
FlushFileBuffers
GetTimeZoneInformation
HeapSize
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
TerminateProcess
LCMapStringA
ExitProcess
GetVersionExA
GetCommandLineA
GetStartupInfoA
HeapReAlloc
HeapAlloc
HeapFree
GetSystemTimeAsFileTime

user32

PostQuitMessage
EndPaint
GetClientRect
ShowWindow
SetFocus
GetSystemMetrics
AdjustWindowRect
InvalidateRect
UpdateWindow
TranslateMessage
BeginPaint
ExitWindowsEx

gdi32

SetTextColor
DeleteDC
StretchBlt
SelectObject
CreateCompatibleDC
SetBkMode
GetStockObject
DeleteObject

advapi32

RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey

wsock32

getsockopt
gethostbyname
WSACleanup
setsockopt
select
ntohl
WSAStartup
gethostname
inet_ntoa
WSAGetLastError
send
__WSAFDIsSet
recv
closesocket
shutdown
socket
htons
ioctlsocket
connect

Sections

.text
Size: 152KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Halo/ksimeui.dll
.dll windows x86

baf0aca9737a2647e4ebda97f854af48

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

imm32

ImmGetIMEFileNameA
ImmGetVirtualKey
ImmNotifyIME
ImmReleaseContext
ImmGetContext
ImmGetDefaultIMEWnd
ImmGetOpenStatus
ImmGetCompositionStringA
ImmIsIME
ImmAssociateContext
ImmGetCandidateListW
ImmGetCompositionStringW
ImmSetConversionStatus
ImmSetOpenStatus
ImmSimulateHotKey
ImmGetConversionStatus
ImmGetCandidateListA

kernel32

EnterCriticalSection
GetLastError
CreateFileA
WriteFile
GetVersionExA
GetACP
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
CompareStringA
GetTickCount
LeaveCriticalSection
lstrcpyA
lstrlenA
GetProcAddress
LoadLibraryA
IsDBCSLeadByteEx
GetLocaleInfoA
lstrcpyW
lstrcatW
GetTimeZoneInformation
InitializeCriticalSection
VirtualQuery
GetSystemInfo
VirtualProtect
GetOEMCP
UnhandledExceptionFilter
IsBadCodePtr
IsBadReadPtr
HeapSize
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetCurrentProcess
OutputDebugStringW
SetConsoleCtrlHandler
GetLocaleInfoW
CompareStringW
SetEnvironmentVariableA
lstrcatA
TerminateProcess
GetStringTypeW
GetStringTypeA
IsValidCodePage
RtlUnwind
RaiseException
ExitProcess
HeapReAlloc
HeapAlloc
HeapFree
GetCurrentThreadId
TlsSetValue
GetCommandLineA
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
TlsAlloc
LCMapStringA
LCMapStringW
GetModuleHandleA
DeleteCriticalSection
FatalAppExitA
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetTimeFormatA
GetDateFormatA
GetCPInfo
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale

user32

TranslateMessage
GetDC
wsprintfA
LoadStringA
GetCaretBlinkTime
GetAsyncKeyState
GetFocus
PostMessageA
GetKeyboardLayout
PeekMessageA
DispatchMessageA
GetMessageA
IsWindowUnicode
PostQuitMessage
GetKeyState
SendMessageW
SendMessageA
ReleaseDC

gdi32

GetDeviceCaps

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

ole32

CoCreateInstance
CoInitialize
CoUninitialize

Exports

Exports

??0CImeUiCallback@@QAE@XZ
??0CKeystoneIMEFont@@QAE@PAUIKeystoneDocument@@PAUIKeystoneResourceEngine@@PAUIKeystoneRenderingEngine@@PAUIKeystoneResourceFont@@KPAUIKeystoneControl@@PAUIKeystoneWindow@@PAUtagRECT@@6@Z
??0CKeystoneIMEUI@@QAE@XZ
??0CListFonts@@QAE@PAUIKeystoneControl@@@Z
??1CImeUiCallback@@QAE@XZ
??1CKeystoneIMEFont@@UAE@XZ
??1CKeystoneIMEUI@@QAE@XZ
??1CListFonts@@QAE@XZ
??4CImeUiCallback@@QAEAAV0@ABV0@@Z
??_7CKeystoneIMEFont@@6B@
?Clean@CKeystoneIMEUI@@QAEXXZ
?CreateImeUiFont@CKeystoneIMEUI@@QAEXPAUIKeystoneDocument@@PAUIKeystoneResourceEngine@@PAUIKeystoneResourceFont@@KPAUtagRECT@@3@Z
?CreateImeUiIndicatorFont@CKeystoneIMEUI@@QAEXPAUIKeystoneDocument@@PAUIKeystoneResourceEngine@@PAUIKeystoneResourceFont@@KPAUtagRECT@@3@Z
?CreateNewFontSize@CListFonts@@QAEPAUIKeystoneResourceFont@@PAUIKeystoneDocument@@PAU2@KPAUIKeystoneControl@@PAUIKeystoneResourceEngine@@@Z
?DrawTextW@CKeystoneIMEFont@@UAEXPBD@Z
?DrawTextW@CKeystoneIMEFont@@UAEXPBG@Z
?EnableIme@CKeystoneIMEUI@@QAEXH@Z
?FinalizeString@CKeystoneIMEUI@@SAXH@Z
?GetCaretStatus@CKeystoneIMEUI@@QAEHXZ
?GetColor@CKeystoneIMEFont@@QAEKXZ
?GetDefaultColor@CKeystoneIMEFont@@QAEKXZ
?GetHeight@CKeystoneIMEUI@@QAEKXZ
?GetInstance@CKeystoneIMEUI@@SAPAUHINSTANCE__@@XZ
?GetScreenDPI@CKeystoneIMEUI@@SAHXZ
?GetSupportLevel@CKeystoneIMEUI@@SAKXZ
?GetTextExtent@CKeystoneIMEFont@@UAEXPBEPAK1@Z
?GetTextExtent@CKeystoneIMEFont@@UAEXPBGPAK1@Z
?GetViewport@CKeystoneIMEFont@@QAE?AUtagRECT@@XZ
?GetWidth@CKeystoneIMEUI@@QAEKXZ
?IMEUI_DrawFans@CImeUiCallback@@SAXPBUIMEUI_VERTEX@@I@Z
?IMEUI_DrawRect@CImeUiCallback@@SAXHHHHK@Z
?IgnoreHotKey@CKeystoneIMEUI@@SAHPAUtagMSG@@@Z
?Initialize@CKeystoneIMEUI@@SAHPAUHWND__@@HH@Z
?IsMainWindowUnicode@CKeystoneIMEUI@@SAHXZ
?ProcessMessage@CKeystoneIMEUI@@SAJPAUHWND__@@IIJPA_N@Z
?RenderUI@CKeystoneIMEUI@@QAEXHH@Z
?SetCallbacks@CImeUiCallback@@QAEXPAUIKeystoneRenderingEngine@@PAUIKeystoneWindow@@PAUIKeystoneControl@@@Z
?SetCaretPosition@CKeystoneIMEUI@@QAEXII@Z
?SetColor@CKeystoneIMEFont@@UAEXK@Z
?SetCompStringAppearance@CKeystoneIMEUI@@AAEXXZ
?SetHeight@CKeystoneIMEFont@@UAEXI@Z
?SetImeUiCallbacks@CKeystoneIMEUI@@QAEXPAUIKeystoneRenderingEngine@@PAUIKeystoneWindow@@PAUIKeystoneControl@@@Z
?SetInstance@CKeystoneIMEUI@@SAXPAUHINSTANCE__@@@Z
?SetPosition@CKeystoneIMEFont@@UAEXHH@Z
?SetScreenDimension@CKeystoneIMEUI@@QAEXKK@Z
?SetSupportLevel@CKeystoneIMEUI@@SAXK@Z
?SetTextViewport@CKeystoneIMEUI@@QAEXAAUtagRECT@@@Z
?SetViewport@CKeystoneIMEFont@@QAEXAAUtagRECT@@@Z
?ToggleLanguageBar@CKeystoneIMEUI@@SAXH@Z
?m_ImeUiAppearance@CKeystoneIMEUI@@0UIMEUI_APPEARANCE@@A
?m_bInitialized@CKeystoneIMEUI@@0HA
?m_hInstance@CKeystoneIMEUI@@0PAUHINSTANCE__@@A
?m_iSupportLevel@CKeystoneIMEUI@@0HA
?m_lpControl@CImeUiCallback@@0PAUIKeystoneControl@@A
?m_lpRender@CImeUiCallback@@0PAUIKeystoneRenderingEngine@@A
?m_lpWindow@CImeUiCallback@@0PAUIKeystoneWindow@@A
?ms_bUnicodeWindow@CKeystoneIMEUI@@0HA
?ms_iScreenDPI@CKeystoneIMEUI@@0HA

Sections

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Halo/ksml.xsd
.xml

Sharing

General

Malware Config

Signatures

Files

c25af603ccb45a3cbfba600f7f5c3bb3

Headers

File Characteristics

Imports

kernel32

user32

ksimeui

Exports

Exports

Sections

.text Size: 392KB - Virtual size: 390KB

.rdata Size: 64KB - Virtual size: 60KB

.data Size: 8KB - Virtual size: 25KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 28KB - Virtual size: 24KB

b5771f1850c1bfe936166e12b54510bb

Headers

File Characteristics

Imports

ws2_32

ksimeui

kernel32

user32

gdi32

winspool.drv

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 964KB - Virtual size: 960KB

.rdata Size: 132KB - Virtual size: 128KB

.data Size: 44KB - Virtual size: 57KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 36KB - Virtual size: 32KB

863844ad7aa759748e31329c65f10f35

Headers

File Characteristics

Imports

user32

gdi32

kernel32

winmm

Exports

Exports

Sections

.text Size: 53KB - Virtual size: 53KB

BINK Size: 75KB - Virtual size: 75KB

BINK16 Size: 6KB - Virtual size: 6KB

BINK4444 Size: 7KB - Virtual size: 7KB

BINK5551 Size: 6KB - Virtual size: 6KB

BINK32 Size: 6KB - Virtual size: 6KB

BINK32A Size: 7KB - Virtual size: 7KB

BINK16X2 Size: 3KB - Virtual size: 3KB

BINK32X2 Size: 3KB - Virtual size: 3KB

BINK16MX Size: 1024B - Virtual size: 515B

BINK32MX Size: 1024B - Virtual size: 687B

BINK16M Size: 512B - Virtual size: 503B

BINK32M Size: 1024B - Virtual size: 547B

BINKYUY2 Size: 512B - Virtual size: 361B

BINKYUY2 Size: 3KB - Virtual size: 3KB

BINKYUY2 Size: 512B - Virtual size: 492B

BINKYUY2 Size: 512B - Virtual size: 292B

BINK32R Size: 5KB - Virtual size: 5KB

BINK32RA Size: 6KB - Virtual size: 5KB

BINK32RX Size: 3KB - Virtual size: 3KB

BINK24 Size: 7KB - Virtual size: 7KB

BINK24X2 Size: 4KB - Virtual size: 4KB

BINK24M Size: 1024B - Virtual size: 714B

BINK24R Size: 6KB - Virtual size: 6KB

BINK24RX Size: 4KB - Virtual size: 4KB

BINK24RM Size: 1024B - Virtual size: 804B

BINKUYVY Size: 512B - Virtual size: 488B

BINKUYVY Size: 512B - Virtual size: 369B

.text
Size: 392KB - Virtual size: 390KB

.rdata
Size: 64KB - Virtual size: 60KB

.data
Size: 8KB - Virtual size: 25KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 28KB - Virtual size: 24KB

.text
Size: 964KB - Virtual size: 960KB

.rdata
Size: 132KB - Virtual size: 128KB

.data
Size: 44KB - Virtual size: 57KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 36KB - Virtual size: 32KB

.text
Size: 53KB - Virtual size: 53KB

BINK
Size: 75KB - Virtual size: 75KB

BINK16
Size: 6KB - Virtual size: 6KB

BINK4444
Size: 7KB - Virtual size: 7KB

BINK5551
Size: 6KB - Virtual size: 6KB

BINK32
Size: 6KB - Virtual size: 6KB

BINK32A
Size: 7KB - Virtual size: 7KB

BINK16X2
Size: 3KB - Virtual size: 3KB

BINK32X2
Size: 3KB - Virtual size: 3KB

BINK16MX
Size: 1024B - Virtual size: 515B

BINK32MX
Size: 1024B - Virtual size: 687B

BINK16M
Size: 512B - Virtual size: 503B

BINK32M
Size: 1024B - Virtual size: 547B

BINKYUY2
Size: 512B - Virtual size: 361B

BINKYUY2
Size: 3KB - Virtual size: 3KB

BINKYUY2
Size: 512B - Virtual size: 492B

BINKYUY2
Size: 512B - Virtual size: 292B

BINK32R
Size: 5KB - Virtual size: 5KB

BINK32RA
Size: 6KB - Virtual size: 5KB

BINK32RX
Size: 3KB - Virtual size: 3KB

BINK24
Size: 7KB - Virtual size: 7KB

BINK24X2
Size: 4KB - Virtual size: 4KB

BINK24M
Size: 1024B - Virtual size: 714B

BINK24R
Size: 6KB - Virtual size: 6KB

BINK24RX
Size: 4KB - Virtual size: 4KB

BINK24RM
Size: 1024B - Virtual size: 804B

BINKUYVY
Size: 512B - Virtual size: 488B

BINKUYVY
Size: 512B - Virtual size: 369B

BINKUYVY
Size: 4KB - Virtual size: 3KB

BINKUYVY
Size: 512B - Virtual size: 327B

BINKYV12
Size: 1024B - Virtual size: 704B

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 2KB - Virtual size: 13KB

BINKDATA
Size: 63KB - Virtual size: 63KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 21KB - Virtual size: 20KB

.text
Size: 946KB - Virtual size: 945KB

.data
Size: 9KB - Virtual size: 9KB

.rdata
Size: 82KB - Virtual size: 81KB

.eh_fram
Size: 288KB - Virtual size: 288KB

.bss
Size: - Virtual size: 13.6MB

.edata
Size: 512B - Virtual size: 52B

.idata
Size: 5KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 48B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 1024B - Virtual size: 848B

.reloc
Size: 35KB - Virtual size: 35KB

.text
Size: 11KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 252B

.rsrc
Size: 4KB - Virtual size: 3KB

.text
Size: 20KB - Virtual size: 20KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 11KB - Virtual size: 12KB

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 4KB - Virtual size: 3KB