game[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

game.exe
Size

2.6MB
MD5

b0c80e2af17f9f5b58a38f3458d7caeb
SHA1

7c3c063ec5865b7dca4017f06ec479eec5aa4e6d
SHA256

65fd7441d315a18e48b3930ac28fcdd66572382f7d6d6e8e550e080993f23b6f
SHA512

d6049ca588dbbaa1c382e6b85fbf46986a55a3817bdaa36d5d65ac18a309d611a304dd0041ac64f3dce8f1e95f85a97ebf79e75a4970060d0c25eb431529e777
SSDEEP

49152:xm2o5vSM1lL4EdrD8LNuBVFtaQ9bHeeg/BgWaf2VXu4pF8UTwKgEa3FBhtJcD2kk:xwL40vKNuBlawbeeg/BgWaf2VXu4wCdO

Score

1^/10

Malware Config

Signatures

Files

game.exe
.exe windows x86

6a5f1d13ae64ff521d0d546619e7fb13

Code Sign

33:15:84:ff:49:fc:c2:5d:be:f8:4f:24:0d:ab:c2:cf
Certificate

Issuer

CN=BladeKnight109 Co.\,Ltd.

Not Before

31/12/2012, 17:00

Not After

31/12/2098, 17:00

Subject

CN=BladeKnight109 Co.\,Ltd.

Extended Key Usages

ExtKeyUsageCodeSigning

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

28/07/2022, 08:56

Not After

27/07/2033, 08:56

Subject

CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

97:3d:eb:37:25:70:c8:bb:b5:32:4e:84:97:93:e0:3e:28:db:f3:ee
Signer

Actual PE Digest

97:3d:eb:37:25:70:c8:bb:b5:32:4e:84:97:93:e0:3e:28:db:f3:ee

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

inet_ntoa

kernel32

CloseHandle
TerminateThread
GetExitCodeThread
FreeLibrary
WaitForSingleObject
GetProcAddress
LoadLibraryA
Sleep
SystemTimeToTzSpecificLocalTime
WritePrivateProfileStringA
GetLastError
CreateProcessA
SetUnhandledExceptionFilter
IsBadReadPtr
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileA
FormatMessageA
lstrlenA
CreateSemaphoreA
OpenSemaphoreA
CreateEventA
SetEvent
LeaveCriticalSection
EnterCriticalSection
ResetEvent
CreateThread
InitializeCriticalSection
InterlockedDecrement
GetComputerNameA
FileTimeToSystemTime
LocalFileTimeToFileTime
SystemTimeToFileTime
OpenProcess
TerminateProcess
ReadProcessMemory
GetCurrentDirectoryA
GetVersionExA
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
UnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetLastError
CreateMutexA
OpenMutexA
VirtualProtect
LoadLibraryW
GetProcessHeap
HeapFree
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
GetTempPathA
GetTempFileNameA
VirtualFreeEx
CreateRemoteThread
WriteProcessMemory
MultiByteToWideChar
CreateFileMappingA
VirtualAllocEx
GetTickCount
GetPrivateProfileIntA
GetLocalTime
GetVersion
FindFirstFileA
SetFileAttributesA
DeleteFileA
FindNextFileA
FindClose
RemoveDirectoryA
AllocConsole
FreeConsole
GetModuleFileNameA
GetDiskFreeSpaceExA
DeleteCriticalSection
MapViewOfFile
UnmapViewOfFile
GetProcessTimes
GetThreadContext
ResumeThread
VirtualProtectEx
FlushInstructionCache
SetThreadContext

user32

GetDC
CopyRect
CharLowerA
SetWindowLongA
GetWindowLongA
MoveWindow
ReleaseDC
InvalidateRect
BringWindowToTop
SetWindowTextA
wsprintfA
ReleaseCapture
SetCapture
SetCursorPos
InSendMessage
MessageBoxA
GetMessagePos
ScreenToClient
GetKeyState
SetClipboardData
OpenClipboard
GetClipboardData
EmptyClipboard
CloseClipboard
SetCaretPos
EnableWindow
ShowWindow
SetFocus
DestroyWindow
IsWindow
GetClientRect
ClientToScreen
SetWindowPos
CreateWindowExA
ShowCursor
LoadCursorFromFileA
LoadCursorA
SetCursor
SendMessageA
GetParent

comdlg32

GetOpenFileNameA

advapi32

OpenProcessToken
RegQueryValueExA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey

shell32

SHGetSpecialFolderPathA
ShellExecuteA

ole32

StgCreateDocfile
OleUninitialize
OleInitialize
OleCreate
OleSetContainedObject
OleSave

filtertext

CreateTextFilter

lualibdll

lua_typename
lua_setglobal
lua_getn
lua_stackspace
lua_rawgeti
lua_rawseti
lua_error
lua_newtable
lua_settable
lua_curpack
lua_rawget
lua_pushnil
lua_isstring
lua_pushstring
lua_pushnumber
lua_type
lua_tonumber
lua_gettop
lua_tostring
lua_pushcclosure

msvcp80

?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEPADXZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z

msvcr80

_localtime32
_purecall
strcat
strftime
isgraph
atoi
printf
freopen
__iob_func
free
realloc
malloc
memmove
_mbsicmp
isspace
abs
_difftime32
memcmp
sscanf
memmove_s
_mktime32
rand
fclose
fwrite
fopen
srand
memcpy
isdigit
_mbsstr
remove
_ui64toa
_i64toa
fflush
fprintf
_gmtime32
sprintf_s
_chmod
vsprintf
_vsnprintf
strrchr
_ctime32
exit
_mkdir
_CIsqrt
puts
floor
strncmp
_CIcos
_CIsin
strtoul
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
strcmp
memset
strlen
??_V@YAXPAX@Z
_snprintf
_time32
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
_CxxThrowException
??2@YAPAXI@Z
_invalid_parameter_noinfo
??3@YAXPAX@Z
__CxxFrameHandler3
strcpy
strchr
strstr
sprintf
strncpy
_itoa
_stricmp
_getcwd
_strlwr
__CxxFrameHandler
labs
calloc

engine

EDOneTimePad_Decipher
?Run@KWin32App@@UAEXXZ
?Init@KWin32App@@UAEHPAUHINSTANCE__@@PAD@Z
??0KWin32App@@QAE@XZ
?InitClass@KWin32App@@MAEHPAUHINSTANCE__@@@Z
?InitWindow@KWin32App@@MAEHPAUHINSTANCE__@@@Z
?ShowMouse@KWin32App@@UAEXH@Z
?SetMultiGame@KWin32App@@UAEXH@Z
?MsgProc@KWin32App@@UAEJPAUHWND__@@IIJ@Z
?SetMouseHoverTime@KWin32App@@QAEXI@Z
?Start@KTimer@@QAEXXZ
?GetElapse@KTimer@@QAEKXZ
InitTextRender
?g_InitEngine@@YAHPBD0@Z
?g_ExitEngine@@YAXXZ
?g_DebugLog@@YAXPBDZZ
EDOneTimePad_Encipher
RegisterInlineCtrl
RemoveInlineWndCtrl
?g_StrCpy@@YAXPADPBD@Z
?g_StrCmpLen@@YAHPBD0H@Z
?g_StrLen@@YAHPBD@Z
?GetString@KTabFile@@UAEHHHPBDPADK@Z
?SetKeepDataForOutMaxWidth@KTabFile@@QAEXH@Z
?Init@KSG_LogFile@@QAEHPBD@Z
?puts@KSG_LogFile@@QAEXPBD@Z
?write_date_time@KSG_LogFile@@QAEXXZ
?GetScript@KLuaScriptSet@@QAEPAVKLuaScript@@PBD@Z
?LoadScriptByRelPath@KLuaScriptSet@@QAE?AW4_CODE_RESULT@@PBDPAPAVKLuaScript@@H@Z
?FormatCallByVaList@KLuaCall@@QAEHPBDPAH0PAD@Z
??1KNode@@UAE@XZ
?RegisterFunctions@KLuaScriptSet@@QAEHPAUTLua_Funcs@@H@Z
?SetGlobalInt@KLuaScriptSet@@QAEXPBDH@Z
?SetRootPath@KLuaScriptSet@@QAEXPBD@Z
?GetScript@KLuaScriptSet@@QAEPAVKLuaScript@@K@Z
?GetFloat@KTabFile@@UAEHHPBDMPAMH@Z
?Insert@KLinkArray@@QAEXH@Z
?Init@KLinkArray@@QAEXH@Z
?GetInteger@KTabFile@@UAEHHHHPAH@Z
?FindColumn@KTabFile@@UAEHPBD@Z
??0KLuaScriptSet@@QAE@HH@Z
??1KLuaScriptSet@@QAE@XZ
?SetGlobalName@KLuaCall@@QAEXPBD@Z
?g_FileName2Id@@YAKPBD@Z
?GetNext@KLinkArray@@QBEHH@Z
??1KLinkArray@@QAE@XZ
??0KLinkArray@@QAE@XZ
?Remove@KLinkArray@@QAEXH@Z
??1KSoundCache@@QAE@XZ
?Exit@KDirectSound@@QAEXXZ
?SetVolume@KWavSound@@QAEXH@Z
?SetPan@KWavSound@@QAEXH@Z
?Stop@KWavSound@@QAEXXZ
?IsPlaying@KWavSound@@QAEHXZ
??0KDirectSound@@QAE@XZ
??1KDirectSound@@QAE@XZ
??1KMusic@@UAE@XZ
??0KMemClass@@QAE@XZ
??_7KMp3Music@@6B@
??0KMusic@@QAE@XZ
??0KSoundCache@@QAE@XZ
?Init@KDirectSound@@QAEHXZ
?Open@KMp3Music@@UAEHPAD@Z
?Close@KMusic@@UAEXXZ
?Play@KMusic@@UAEXH@Z
?Stop@KMusic@@UAEXXZ
?Rewind@KMp3Music@@UAEXXZ
?SetVolume@KMusic@@UAEXJ@Z
?HandleNotify@KMusic@@UAEHXZ
?IsPlaying@KMusic@@UAEHXZ
?Init@KMusic@@MAEHXZ
?InitSoundFormat@KMp3Music@@MAEXXZ
?InitSoundBuffer@KMusic@@MAEHXZ
?FreeSoundBuffer@KMusic@@MAEXXZ
?InitSoundNotify@KMusic@@MAEHXZ
?FreeSoundNotify@KMusic@@MAEXXZ
?InitEventHandle@KMusic@@MAEHXZ
?FreeEventHandle@KMusic@@MAEXXZ
?FillBufferWithSound@KMusic@@MAEHK@Z
?FillBufferWithSilence@KMusic@@MAEHXZ
?ReadWaveData@KMp3Music@@MAEKPAEK@Z
?Mp3Init@KMp3Music@@MAEHXZ
?Mp3FillBuffer@KMp3Music@@MAEHXZ
?Mp3Decode@KMp3Music@@MAEKPAEK@Z
?Mp3FileOpen@KMp3Music@@MAEHPAD@Z
?Mp3FileRead@KMp3Music@@MAEKPAEK@Z
?Mp3FileSeek@KMp3Music@@MAEKJ@Z
?Seek@KMp3Music@@UAEXH@Z
??1KMemClass@@QAE@XZ
?Play@KWavSound@@QAEXHHH@Z
?GetNext@KNode@@QBEPAV1@XZ
?Remove@KNode@@QAEXXZ
?GetHead@KList@@QBEPAVKNode@@XZ
??0KNode@@QAE@XZ
?GetPrev@KLinkArray@@QBEHH@Z
?AddTail@KList@@QAEXPAVKNode@@@Z
?GetString@KTabFile@@UAEHPBD00PADK@Z
?g_StrCat@@YAXPADPBD@Z
?SetGlobalName@KLuaScript@@QAEXPBD@Z
??0KList@@QAE@XZ
?GetWidth@KTabFile@@UAEHXZ
TGetLimitLenEncodedString
?g_StrLower@@YAXPAD@Z
?Clear@KPolygon@@QAEXXZ
??0KPolygon@@QAE@XZ
?g_StrCmp@@YAHPBD0@Z
?AddHead@KList@@QAEXPAVKNode@@@Z
?RemoveHead@KList@@QAEPAVKNode@@XZ
?GetRect@KIniFile@@QAEXPBD0PAUtagRECT@@@Z
?Seek@KPakFile@@QAEKHI@Z
?Stop@KTimer@@QAEXXZ
?g_GetRandomSeed@@YAIXZ
?GetValuesFromStack@KLuaScript@@QAAHPBDZZ
?g_StrWrap@@YAXPADPBDH@Z
?g_UnitePathAndName@@YAXPBD0PAD@Z
?KSG_StringGetInt@@YAHPAPBDH@Z
?KSG_StringSkipSymbol@@YA_NPAPBDH@Z
gAdviseMemFileNotify
?GetInteger@KTabFile@@UAEHPBD0HPAH@Z
?GetActionScriptID@KLuaScript@@SAKPAUlua_State@@@Z
?PushNumber@KLuaCall@@QAEXN@Z
?IsLoaded@KLuaScript@@QBEHXZ
?g_GetRootPath@@YAXPADI@Z
??0KTabFile@@QAE@ABV0@@Z
?WriteString@KTabFileCtrl@@QAEHHPBD0H@Z
?WriteString@KTabFileCtrl@@QAEHHHPBDK@Z
?Search@KTabFile@@QAEHPBD0H@Z
?Search@KTabFile@@QAEHPBDHH@Z
?Save@KTabFileCtrl@@QAEHXZ
?Save@KTabFile@@UAEHPBD@Z
?FindRow@KTabFile@@UAEHPBDH@Z
?GetFloat@KTabFile@@UAEHPBD0MPAM@Z
?GetFloat@KTabFile@@UAEHHHMPAM@Z
??0KTabFileCtrl@@QAE@XZ
?Load@KTabFileCtrl@@UAEHPBD@Z
?Save@KTabFileCtrl@@UAEHPBD@Z
?FindRow@KTabFileCtrl@@UAEHPBDH@Z
?FindColumn@KTabFileCtrl@@UAEHPBD@Z
?GetWidth@KTabFileCtrl@@UAEHXZ
?GetHeight@KTabFileCtrl@@UAEHXZ
?GetString@KTabFileCtrl@@UAEHPBD00PADK@Z
?GetString@KTabFileCtrl@@UAEHHHPBDPADK@Z
?GetString@KTabFileCtrl@@UAEHHPBD0PADKH@Z
?GetInteger@KTabFileCtrl@@UAEHPBD0HPAH@Z
?GetInteger@KTabFileCtrl@@UAEHHHHPAH@Z
?GetInteger@KTabFileCtrl@@UAEHHPBDHPAHH@Z
?GetFloat@KTabFileCtrl@@UAEHPBD0MPAM@Z
?GetFloat@KTabFileCtrl@@UAEHHHMPAM@Z
?GetFloat@KTabFileCtrl@@UAEHHPBDMPAMH@Z
?Clear@KTabFileCtrl@@UAEXXZ
??1KTabFileCtrl@@UAE@XZ
?GetNodeCount@KList@@QBEJXZ
gAddToMemFileManager
gOnUpdateFinishForMemFileManager
?release_image@@YAXPAUKSGImageContent@@@Z
?g_FileExists@@YAHPBD@Z
?Tell@KPakFile@@QAEKXZ
?RemoveTail@KList@@QAEPAVKNode@@XZ
?GetTail@KList@@QBEPAVKNode@@XZ
?GetGlobalName@KLuaScript@@QAEXPBD@Z
??0KMutex@@QAE@XZ
?Lock@KMutex@@QAEXXZ
?Unlock@KMutex@@QAEXXZ
??1KMutex@@QAE@XZ
?GetTopIndex@KLuaCall@@QBEHXZ
?StackCall@KLuaCall@@QAEHPBDHHPAH@Z
?ValueToNumber@KLuaCall@@QAEIH@Z
?ValueToString@KLuaCall@@QAEPBDH@Z
??1KLuaCall@@QAE@XZ
?g_RandomSeed@@YAXI@Z
?CallFunction@KLuaScript@@QAEHPBDH0PAD@Z
?SafeCallBegin@KLuaScript@@QAEXPAH@Z
?SafeCallEnd@KLuaScript@@QAEXH@Z
?GetNextKey@KIniFile@@QAEHPBD0PAD@Z
TGetEncodedTextOutputLenPos
TGetEncodedTextEffectCtrls
?g_Random@@YAII@Z
?Clear@KTabFile@@UAEXXZ
?Open@KFile@@QAEHPBD@Z
?Read@KFile@@QAEKPAXK@Z
?Load@KTabFile@@UAEHPBD@Z
?GetHeight@KTabFile@@UAEHXZ
?GetInteger@KTabFile@@UAEHHPBDHPAHH@Z
?GetString@KTabFile@@UAEHHPBD0PADKH@Z
??1KTabFile@@UAE@XZ
??0KTabFile@@QAE@XZ
TSplitEncodedString
?IsSectionExist@KIniFile@@QAEHPBD@Z
?KSG_StringToMD5String@@YAHQADQBD@Z
?WriteStruct@KIniFile@@QAEXPBD0PAXK@Z
?EraseKey@KIniFile@@QAEXPBD0@Z
?GetStruct@KIniFile@@QAEXPBD0PAXK@Z
TClearSpecialCtrlInEncodedText
?g_GetDrawHWnd@@YAPAUHWND__@@XZ
TEncodeTextAndPickCtrl
?GetInteger2@KIniFile@@QAEHPBD0PAH1@Z
TRemoveCtrlInEncodedText
GetCtrlHandle
??1KIme@@QAE@XZ
??0KIme@@QAE@XZ
TIsLocalWord
TSplitString
TSplitStringLine
TIsHightChar
?EnableLanguageChange@KIme@@QAEXXZ
?OpenIME@KIme@@QAEXXZ
?SetCaretPos@KIme@@QAEXHH@Z
?IsIme@KIme@@QAEHXZ
TGetLimitLenString
??0KPakFile@@QAE@XZ
??0KFile@@QAE@XZ
?Create@KFile@@QAEHPBD@Z
?Open@KPakFile@@QAEHPBD@Z
?Size@KPakFile@@QAEKXZ
?Read@KPakFile@@QAEKPAXI@Z
?Close@KPakFile@@QAEXXZ
??1KFile@@QAE@XZ
??1KPakFile@@QAE@XZ
TGetEncodedTextLineCount
TFindSpecialCtrlInEncodedText
??0KTimer@@QAE@XZ
?Clear@KIniFile@@QAEXXZ
?Close@KFile@@QAEXXZ
?Write@KFile@@QAEKPAXK@Z
?Seek@KFile@@QAEKJK@Z
?g_pIme@@3PAVKIme@@A
?DisableLanguageChange@KIme@@QAEXXZ
?CloseIME@KIme@@QAEXXZ
?TurnOn@KIme@@QAEXXZ
?EraseSection@KIniFile@@QAEXPBD@Z
?LoadBuffer@KLuaScript@@QAEHPAEKPBD@Z
?ExecuteCode@KLuaScript@@QAEHXZ
?Release@KLuaScript@@QAEXXZ
?CreateScript@KLuaScriptSet@@QAEPAVKLuaScript@@XZ
?RegisterFunctions@KLuaScript@@QAEHPAUTLua_Funcs@@H@Z
?g_StrCpyLen@@YAXPADPBDH@Z
?WriteInteger@KIniFile@@QAEXPBD0H@Z
?Save@KIniFile@@QAEHPBD@Z
?g_GetFullPath@@YAXPADIPBD@Z
?g_GetMainHWnd@@YAPAUHWND__@@XZ
?g_CreatePath@@YAXPBD@Z
??1KSG_LogFile@@UAE@XZ
??0KSG_LogFile@@QAE@PBD@Z
?InitWithDate@KSG_LogFile@@QAEHPBD0H@Z
?printf_t@KSG_LogFile@@QAAXPBDZZ
?GetTmpScript@KLuaScriptSet@@QAEPAVKLuaScript@@XZ
?AddIncluder@KLuaScript@@QAEXK@Z
??0KLuaCall@@QAE@PAVKLuaScript@@H@Z
??1KIniFile@@QAE@XZ
?GetString@KIniFile@@QAEHPBD00PADK@Z
?Load@KIniFile@@QAEHPBD@Z
?WriteString@KIniFile@@QAEXPBD00@Z
?g_HashString2Id@@YAKPBD@Z
TEncodeText
?GetInteger@KIniFile@@QAEHPBD0HPAH@Z
??0KIniFile@@QAE@XZ
TIsLocalChar

imm32

ImmAssociateContext

winmm

timeGetTime

gdi32

GetDeviceCaps
RealizePalette
SelectPalette

oleaut32

SysAllocString
VariantClear
SysFreeString

Exports

Exports

CreateCoreShell
GetSoundShell
_GetDecryptProc@4
_GetEncryptProc@4
_SetDecryptionKey@4

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 264KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 15.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a5f1d13ae64ff521d0d546619e7fb13

Code Sign

33:15:84:ff:49:fc:c2:5d:be:f8:4f:24:0d:ab:c2:cfCertificate

Extended Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

97:3d:eb:37:25:70:c8:bb:b5:32:4e:84:97:93:e0:3e:28:db:f3:eeSigner

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

comdlg32

advapi32

shell32

ole32

filtertext

lualibdll

msvcp80

msvcr80

engine

imm32

winmm

gdi32

oleaut32

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 264KB - Virtual size: 261KB

.data Size: 68KB - Virtual size: 15.6MB

.rsrc Size: 8KB - Virtual size: 4KB

33:15:84:ff:49:fc:c2:5d:be:f8:4f:24:0d:ab:c2:cf
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

97:3d:eb:37:25:70:c8:bb:b5:32:4e:84:97:93:e0:3e:28:db:f3:ee
Signer

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 264KB - Virtual size: 261KB

.data
Size: 68KB - Virtual size: 15.6MB

.rsrc
Size: 8KB - Virtual size: 4KB