GameMain
Static task
static1
Behavioral task
behavioral1
Sample
魔兽争霸3:冰封王座8M以上地图联机补丁/game.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
魔兽争霸3:冰封王座8M以上地图联机补丁/game.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
魔兽争霸3:冰封王座8M以上地图联机补丁/游迅网_Yxdown.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
魔兽争霸3:冰封王座8M以上地图联机补丁/游迅网_Yxdown.url
Resource
win10v2004-20231215-en
General
-
Target
230a4cf03cb70c9b526c224c7a04ee2d
-
Size
2.7MB
-
MD5
230a4cf03cb70c9b526c224c7a04ee2d
-
SHA1
3ba39a8cbc47f4535825e4cb1a08fb6d1b3bf8ad
-
SHA256
37914ecad4d940140219436d7f24966d2f039851d09fc8b990ec1a6afb62097e
-
SHA512
a6b96acec3e868bbcb1959e821841c7a8f93c9a1f42b8f1bedb38ac5997d9733e9b6fea6efc95434c2196783af8efaa2288dc991f91b59d9be970d4e1f8f04ac
-
SSDEEP
49152:iB2G7NZNY63F40E5+ukhGMKNTbvVMbFZBc6yviP3tAy8043MXKchoTVtOU:c2qNY63F4D5tvMeXvVW7BFyKl43MXDQp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/魔兽争霸3:冰封王座8M以上地图联机补丁/game.dll
Files
-
230a4cf03cb70c9b526c224c7a04ee2d.rar
-
魔兽争霸3:冰封王座8M以上地图联机补丁/game.dll.dll windows:4 windows x86 arch:x86
cbd36fa7be631228469b7c2e42d54d83
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
comctl32
ImageList_Create
ImageList_EndDrag
ImageList_DragLeave
ImageList_BeginDrag
ImageList_DragEnter
ImageList_GetImageCount
ImageList_Add
ImageList_Replace
ImageList_DragMove
_TrackMouseEvent
ImageList_DragShowNolock
InitCommonControlsEx
ImageList_Destroy
wsock32
WSASetLastError
getservbyport
gethostbyaddr
getservbyname
inet_addr
WSAGetLastError
WSACleanup
accept
select
connect
send
gethostbyname
recv
recvfrom
sendto
WSAStartup
socket
ioctlsocket
getsockopt
ntohl
inet_ntoa
ntohs
closesocket
getpeername
getsockname
listen
bind
setsockopt
gethostname
winmm
timeGetTime
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
VirtualAlloc
VirtualProtect
FlushInstructionCache
VirtualFree
GetLogicalDriveStringsA
GetDriveTypeA
SuspendThread
ResumeThread
GlobalAlloc
GlobalFree
GlobalSize
GlobalLock
GlobalUnlock
TerminateThread
GetQueuedCompletionStatus
CreateIoCompletionPort
PostQueuedCompletionStatus
InterlockedDecrement
InterlockedIncrement
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
GetCurrentThreadId
CreateSemaphoreA
ReleaseMutex
OpenMutexA
CreateMutexA
ReleaseSemaphore
WaitForMultipleObjects
DuplicateHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ResetEvent
WaitForSingleObject
GetDiskFreeSpaceA
FindFirstFileA
FindNextFileA
FindClose
SetCurrentDirectoryA
RemoveDirectoryA
CreateDirectoryA
CopyFileA
MoveFileA
SetFileAttributesA
SetEndOfFile
SetFileTime
GetFileTime
FormatMessageA
FreeLibrary
GetModuleHandleA
MultiByteToWideChar
GetACP
Sleep
OutputDebugStringA
GetLastError
WideCharToMultiByte
InterlockedExchange
InterlockedCompareExchange
WriteFile
CreateFileA
DeleteFileA
CreateProcessA
GetUserDefaultLangID
GetTimeZoneInformation
GetDiskFreeSpaceExA
GetUserDefaultLCID
GetSystemDefaultLangID
GetLocaleInfoA
QueryPerformanceFrequency
QueryPerformanceCounter
SetThreadPriority
GetThreadPriority
GetCurrentThread
GetTickCount
SystemTimeToFileTime
GetSystemTime
CompareFileTime
GetLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetTimeFormatA
GetDateFormatA
GetCommandLineA
GetModuleFileNameA
GetWindowsDirectoryA
GetFileAttributesA
GetSystemInfo
GetVersionExA
GetComputerNameA
GlobalMemoryStatus
CreateEventA
ReadFile
FlushFileBuffers
SetFilePointer
GetFileSize
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
CloseHandle
LocalFree
SetEvent
OpenEventA
GetCurrentProcess
CreateThread
RaiseException
TryEnterCriticalSection
comdlg32
GetOpenFileNameA
GetSaveFileNameA
advapi32
RegCreateKeyExA
FreeSid
CryptGenRandom
CryptAcquireContextA
GetUserNameA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
CryptCreateHash
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
wininet
InternetCanonicalizeUrlA
storm
ord612
ord609
ord638
ord603
ord633
ord601
ord636
ord403
ord293
ord252
ord263
ord253
ord267
ord266
ord270
ord423
ord151
ord264
ord268
ord300
ord578
ord465
ord401
ord422
ord622
ord501
ord405
ord426
ord425
ord507
ord509
ord543
ord542
ord541
ord548
ord280
ord504
ord279
ord587
ord545
ord572
ord470
ord496
ord590
ord272
ord568
ord469
ord460
ord565
ord567
ord585
ord289
ord506
ord576
ord275
ord281
ord288
ord607
ord621
ord628
ord619
ord428
ord406
ord291
ord524
ord525
ord534
ord537
ord580
ord503
ord575
ord508
ord571
ord574
ord570
ord581
ord589
ord482
ord510
ord295
ord579
ord596
ord461
ord553
ord595
ord551
ord552
ord472
ord474
ord479
ord476
ord569
ord577
ord462
ord463
ord269
ord265
ord586
ord424
ord502
ord421
ord597
ord563
ord624
ord606
ord584
ord471
ord251
ord294
ord302
ord271
ord544
ijl15
ord2
ord4
ord3
msvcr80
_CIexp
_CIatan
_CItan
iswspace
isalnum
strncpy
malloc
realloc
fread
fseek
ftell
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
strstr
isupper
isdigit
strnlen
setvbuf
_beginthreadex
_CIlog10
_clearfp
strncmp
_time64
_ctime64
exit
__iob_func
fprintf
vfprintf
fputc
fputs
putc
toupper
sprintf
srand
sscanf
atof
printf
rand
floor
fopen
fwrite
fclose
_ismbcspace
_HUGE
ceil
_CIatan2
_CIasin
_mbsstr
_itoa
atoi
memmove
_CIfmod
qsort
_CIpow
isprint
_CIsqrt
_CIsin
_CIcos
strcat_s
sprintf_s
strtoul
strncpy_s
free
calloc
strcpy_s
strchr
strtol
_vsnprintf
memset
atol
__CxxFrameHandler3
_snprintf_s
_localtime64_s
_strnicmp
_stricmp
_fsopen
fflush
sscanf_s
strtok_s
_itoa_s
_CIacos
_vsnprintf_s
_purecall
_control87
memcpy
mss32
_AIL_3D_sample_attribute@12
_AIL_set_3D_sample_preference@12
_AIL_open_stream@12
_AIL_shutdown@0
_AIL_mem_use_malloc@4
_AIL_mem_use_free@4
_AIL_set_redist_directory@4
_AIL_startup@0
_AIL_open_digital_driver@16
_AIL_set_file_callbacks@16
_AIL_open_XMIDI_driver@4
_AIL_DLS_open@28
_AIL_set_3D_orientation@28
_AIL_DLS_unload@8
_AIL_set_3D_position@16
_AIL_digital_CPU_percent@4
_AIL_set_3D_speaker_type@8
_AIL_set_3D_provider_preference@12
_AIL_set_3D_room_type@8
_AIL_set_XMIDI_master_volume@8
_AIL_open_3D_provider@4
_AIL_last_error@0
_AIL_open_3D_listener@4
_AIL_set_3D_distance_factor@8
_AIL_enumerate_3D_providers@12
_AIL_file_type@8
_AIL_MIDI_to_XMI@20
_AIL_register_EOS_callback@8
_AIL_set_sample_user_data@12
_AIL_register_3D_EOS_callback@8
_AIL_set_3D_user_data@12
_AIL_sample_status@4
_AIL_3D_sample_status@4
_AIL_sequence_status@4
_AIL_stream_status@4
_AIL_sample_position@4
_AIL_3D_sample_offset@4
_AIL_stream_position@4
_AIL_stream_ms_position@12
_AIL_3D_sample_length@4
_AIL_set_sample_ms_position@8
_AIL_set_stream_ms_position@8
_AIL_set_sample_playback_rate@8
_AIL_sample_playback_rate@4
_AIL_set_3D_sample_playback_rate@8
_AIL_3D_sample_playback_rate@4
_AIL_set_stream_playback_rate@8
_AIL_stream_playback_rate@4
_AIL_set_3D_sample_obstruction@8
_AIL_3D_user_data@8
_AIL_sample_user_data@8
_AIL_set_3D_sample_distances@12
_AIL_sequence_user_data@8
_AIL_set_sample_volume@8
_AIL_set_3D_sample_volume@8
_AIL_set_stream_volume@8
_AIL_set_sequence_volume@12
_AIL_DLS_compact@4
_AIL_DLS_load_memory@12
_AIL_pause_stream@8
_AIL_set_stream_loop_count@8
_AIL_set_3D_velocity@20
_AIL_set_sample_pan@8
_AIL_init_sequence@12
_AIL_sequence_ms_position@12
_AIL_set_3D_sample_cone@16
_AIL_set_stream_pan@8
_AIL_set_3D_sample_occlusion@8
_AIL_end_sequence@4
_AIL_end_3D_sample@4
_AIL_end_sample@4
_AIL_allocate_3D_sample_handle@4
_AIL_stop_sequence@4
_AIL_stop_3D_sample@4
_AIL_set_3D_sample_effects_level@8
_AIL_register_sequence_callback@8
_AIL_set_sequence_user_data@12
_AIL_allocate_sample_handle@4
_AIL_allocate_sequence_handle@4
_AIL_close_stream@4
_AIL_release_sequence_handle@4
_AIL_release_sample_handle@4
_AIL_extract_DLS@28
_AIL_find_DLS@24
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_set_sequence_loop_count@8
_AIL_resume_sequence@4
_AIL_start_sequence@4
_AIL_set_sample_loop_count@8
_AIL_resume_sample@4
_AIL_start_sample@4
_AIL_set_3D_sample_info@8
_AIL_set_3D_sample_loop_count@8
_AIL_resume_3D_sample@4
_AIL_stop_sample@4
_AIL_register_stream_callback@8
_AIL_mem_free_lock@4
_AIL_init_sample@4
_AIL_set_named_sample_file@20
_AIL_WAV_info@8
_AIL_sample_ms_position@12
_AIL_close_3D_listener@4
_AIL_close_3D_provider@4
_AIL_DLS_close@8
_AIL_close_XMIDI_driver@4
_AIL_close_digital_driver@4
_AIL_stream_user_data@8
_AIL_set_stream_user_data@12
_AIL_release_3D_sample_handle@4
opengl32
glVertexPointer
glNormalPointer
glNormal3fv
glColorPointer
glDrawElements
glTexCoordPointer
glViewport
glDepthRange
glScissor
glMatrixMode
glLoadMatrixf
glFinish
wglSwapLayerBuffers
glReadBuffer
glReadPixels
glClearColor
glClear
glPolygonOffset
glMaterialfv
glLightModelfv
glTexGeni
glColorMaterial
glLightfv
glLightf
glDepthFunc
glDrawBuffer
glFogi
glFogf
glFogfv
glDepthMask
glTexEnvi
glDisable
glDisableClientState
glEnable
glEnableClientState
glBlendFunc
glAlphaFunc
glGenTextures
glBindTexture
glTexParameteri
glPixelStorei
glTexImage2D
glTexSubImage2D
glDeleteTextures
wglGetProcAddress
glGetIntegerv
glGetString
wglDeleteContext
wglCreateContext
wglMakeCurrent
imm32
ImmNotifyIME
ImmGetCandidateListA
ImmGetConversionStatus
ImmGetOpenStatus
ImmAssociateContext
ImmGetContext
ImmGetCompositionStringA
ImmAssociateContextEx
ImmReleaseContext
rpcrt4
RpcStringFreeA
UuidToStringA
secur32
FreeCredentialsHandle
DeleteSecurityContext
FreeContextBuffer
InitializeSecurityContextA
QueryContextAttributesA
EncryptMessage
DecryptMessage
ApplyControlToken
AcquireCredentialsHandleA
crypt32
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertFreeCertificateContext
user32
DestroyIcon
GetKeyState
MessageBeep
SetWindowPlacement
GetWindowPlacement
EnableWindow
SetActiveWindow
SetClassLongA
GetWindowTextA
SetCursor
SetScrollPos
GetScrollInfo
SetScrollInfo
OpenClipboard
GetClipboardData
CloseClipboard
GetSysColor
GetSysColorBrush
GetWindowTextLengthA
GetFocus
GetWindowInfo
IsWindowEnabled
IsWindowVisible
GetParent
DrawMenuBar
GetMenuItemInfoA
SetMenuItemInfoA
GetMenuItemCount
GetActiveWindow
KillTimer
RemovePropA
SetPropA
GetPropA
SendMessageA
wvsprintfA
EmptyClipboard
SetClipboardData
ScreenToClient
ClientToScreen
CreateDialogIndirectParamA
DeleteMenu
TranslateAcceleratorA
MessageBoxA
DrawFocusRect
DrawTextA
SetWindowTextA
PeekMessageA
IsDialogMessageA
SetParent
CreateAcceleratorTableA
DestroyAcceleratorTable
SetMenu
InsertMenuItemA
CreatePopupMenu
CreateMenu
SetCapture
GetMenu
DestroyMenu
SystemParametersInfoA
WindowFromPoint
ReleaseCapture
GetClassLongA
TrackPopupMenu
GetWindow
GetDesktopWindow
SetForegroundWindow
GetDCEx
SetCursorPos
GetCursorPos
GetWindowRect
ClipCursor
UnregisterClassA
DestroyWindow
ShowWindow
SetWindowPos
ChangeDisplaySettingsExA
EnumDisplaySettingsA
EnumDisplayDevicesA
ReleaseDC
GetDC
DefWindowProcA
EndPaint
BeginPaint
SetWindowLongA
GetWindowLongA
MapWindowPoints
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadImageA
SetFocus
PostMessageA
GetClientRect
ChangeDisplaySettingsA
DispatchMessageA
TranslateMessage
GetMessageA
ShowCursor
InvalidateRect
SetTimer
FillRect
RegisterClassA
CallWindowProcA
GetForegroundWindow
UpdateWindow
gdi32
CreateDIBitmap
SetDeviceGammaRamp
GetDeviceGammaRamp
CreateFontA
GetStockObject
TextOutW
CreatePen
MoveToEx
LineTo
GetTextExtentPoint32A
CreateRectRgnIndirect
CombineRgn
SetBkMode
SelectObject
CreateSolidBrush
FillRgn
GetBkColor
GetDeviceCaps
ChoosePixelFormat
DescribePixelFormat
SetPixelFormat
DeleteObject
SetBkColor
SetTextColor
SetTextAlign
shell32
ShellExecuteA
SHGetPathFromIDListA
DragQueryFileA
DragAcceptFiles
SHBrowseForFolderA
FindExecutableA
SHGetFolderPathA
SHGetMalloc
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CoCreateGuid
Exports
Exports
Sections
.text Size: 8.5MB - Virtual size: 8.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 388KB - Virtual size: 642KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 820KB - Virtual size: 817KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
魔兽争霸3:冰封王座8M以上地图联机补丁/游迅网_Yxdown.URL
-
魔兽争霸3:冰封王座8M以上地图联机补丁/说明.txt