85eaa9c6ca2acb0b592ee377e8ba77e2

Sharing

Copy URL Twitter E-mail

General

Target

85eaa9c6ca2acb0b592ee377e8ba77e2
Size

4.6MB
MD5

85eaa9c6ca2acb0b592ee377e8ba77e2
SHA1

14ebd912d27de0026934756ffc34de9a83b79c35
SHA256

a997fd93ab28d0b3f4ed1f78305e380d7eadb408768e866b842b1cf8e7593241
SHA512

0b66d068e3c7fcb10f27381c64a8a7cfe6042dd812bb60bf844433cd3f52dc5f011fe72bf27f301e09bbca041790b53bcb30503973b40551f5a57e69e26c6881
SSDEEP

98304:wIbMH802Gj9ZMUOwAnLrpunTnfJZ+DpbSgXdjcoUJlo7s6FAnc9wu:w8MHJZMUvURunThZ+DRSgXd9w6Fp9wu

Score

7^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/Main/npgmup.dll	acprotect

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Main/main.exe
unpack001/Main/npgmup.dll
unpack001/Main/ogg.dll
unpack001/Main/vorbisfile.dll
unpack001/Main/wsctlcd.dll
unpack001/Main/wzAudio.dll
unpack001/Main/wz_zp.dll

Files

85eaa9c6ca2acb0b592ee377e8ba77e2
.rar
Data/Logo/character_back01.ozj
.jpg
Data/Logo/character_back02.ozj
.jpg
Main/main.exe
.exe windows:4 windows x86 arch:x86

f4f60dab73dacb93a4a690a3159382f2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptImportKey
CryptGetHashParam
CryptDeriveKey
CryptDecrypt
CryptCreateHash
CryptHashData
CryptVerifySignatureA
CryptDestroyHash
RegEnumValueA
RegDeleteValueA
GetUserNameA
RegDeleteKeyA
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptAcquireContextA

dinput8

DirectInput8Create

dsound

DirectSoundCreate
DirectSoundEnumerateA

gdi32

TextOutA
GetTextExtentPoint32A
GetTextExtentPointA
SelectObject
CreateFontA
SetBkMode
SetTextColor
SetTextAlign
GetTextExtentExPointA
CreateFontIndirectA
GetStockObject
SetBkColor
SetPixelFormat
DeleteObject
DeleteDC
CreateDIBSection
SwapBuffers
BitBlt
CreateCompatibleDC
ChoosePixelFormat

glu32

gluOrtho2D
gluPerspective

imm32

ImmGetDefaultIMEWnd
ImmReleaseContext
ImmGetCompositionStringA
ImmGetCompositionWindow
ImmSetCompositionWindow
ImmGetProperty
ImmSetOpenStatus
ImmGetConversionStatus
ImmSetConversionStatus
ImmGetContext
ImmGetDescriptionA
ImmGetIMEFileNameA
ImmNotifyIME
ImmGetOpenStatus

kernel32

HeapReAlloc
GetSystemTimeAsFileTime
HeapAlloc
ExitProcess
GetVersion
FatalAppExitA
LCMapStringA
LCMapStringW
GetStartupInfoA
GetCPInfo
CompareStringA
CompareStringW
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
HeapSize
GetACP
GetCurrentThreadId
GetTickCount
Sleep
lstrlenA
CloseHandle
WriteFile
SetFilePointer
CreateFileA
DeleteFileA
ReadFile
GetLocalTime
GetSystemDirectoryA
lstrcmpiA
GetVersionExA
QueryPerformanceCounter
SetProcessAffinityMask
SetThreadPriority
SetPriorityClass
GetProcessAffinityMask
GetThreadPriority
GetPriorityClass
GetCurrentThread
GetCurrentProcess
QueryPerformanceFrequency
GetOEMCP
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalMemoryStatus
GlobalUnlock
GlobalLock
GetCommandLineA
GetFileSize
GetLastError
GetPrivateProfileStringA
GetCurrentDirectoryA
CopyFileA
SetFileAttributesA
Process32Next
TerminateProcess
OpenProcess
Process32First
CreateToolhelp32Snapshot
WinExec
FindClose
FindFirstFileA
GetModuleFileNameA
IsBadReadPtr
GetModuleHandleA
GetNumberFormatA
HeapFree
RaiseException
GetSystemTime
GetTimeZoneInformation
RtlUnwind
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
LeaveCriticalSection
DeleteCriticalSection
InterlockedExchange
InitializeCriticalSection
EnterCriticalSection
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
FindNextFileA
RemoveDirectoryA
GetFileAttributesA
CreateDirectoryA
GetThreadContext
lstrcpynA
GetCurrentProcessId
Module32First
Module32Next
SetUnhandledExceptionFilter
WaitForSingleObject
OpenEventA
lstrcatA
OpenMutexA
CreateThread
TerminateThread
CreateMutexA
ReleaseMutex
GetComputerNameA
lstrcmpA
CreateEventA
GetModuleFileNameW
VirtualProtect
OpenFileMappingA
LoadLibraryExA
GetTempFileNameA
GetTempPathA
GetProcessHeap
GetFileInformationByHandle
DuplicateHandle
CreatePipe
PeekNamedPipe
lstrcpyA
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
FlushFileBuffers
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
SetEnvironmentVariableA
SetEndOfFile
SetConsoleCtrlHandler
GetLocaleInfoW
SetEvent
ResumeThread
ResetEvent
GetExitCodeProcess
WaitForMultipleObjects
CreateProcessA
OutputDebugStringA

opengl32

glColor3f
glEnd
glVertex3fv
glTexCoord2f
glBegin
glColor3fv
glGetIntegerv
glGetString
glAlphaFunc
glFogf
glFogfv
glEnable
glDisable
glClearColor
glTexImage2D
glBindTexture
glVertex3f
glDepthMask
glPolygonMode
glFrontFace
glStencilFunc
glColorMask
glVertex2f
glDepthFunc
glStencilOp
glTexParameteri
glTexEnvf
glPixelStorei
glDeleteTextures
glIsTexture
glColor4ub
glLoadIdentity
glMatrixMode
glPopMatrix
glClear
glTranslatef
glRotatef
glPushMatrix
wglDeleteContext
wglMakeCurrent
wglCreateContext
glScalef
glGenTextures
glTexEnvi
glReadPixels
glGetFloatv
glBlendFunc
glViewport
glFogi
glFlush
glTexSubImage2D
glColor4f

shell32

ShellExecuteA
ShellExecuteExA

user32

GetFocus
UnregisterHotKey
RegisterHotKey
GetAsyncKeyState
GetKeyboardLayout
GetKeyboardLayoutNameA
OpenClipboard
SendMessageA
wsprintfA
GetWindowRect
SetWindowPos
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetDesktopWindow
MessageBoxA
SetWindowLongA
CallWindowProcA
GetWindowLongA
GetCaretPos
GetWindowTextA
SetWindowTextA
ShowWindow
ReleaseDC
GetDC
CreateWindowExA
CloseClipboard
SetFocus
IsWindowVisible
GetScrollPos
SetScrollPos
SetTimer
FindWindowA
ShowCursor
SystemParametersInfoA
ReleaseCapture
SetCapture
DefWindowProcA
PostQuitMessage
EndPaint
BeginPaint
DestroyWindow
RegisterClassA
LoadCursorA
LoadIconA
SetForegroundWindow
GetSystemMetrics
AdjustWindowRect
IsIconic
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
UpdateWindow
PostMessageA
GetClipboardData
EnumDisplaySettingsA
SetCursorPos
KillTimer
SetRect
OffsetRect
PtInRect
GetDoubleClickTime
ScreenToClient
GetCursorPos
GetActiveWindow
IntersectRect
ClientToScreen
wvsprintfA
ChangeDisplaySettingsA

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

winmm

mmioAscend
mmioOpenA
mmioClose
timeGetTime
mmioDescend
mmioRead
timeGetDevCaps
timeBeginPeriod
mmioWrite
timeEndPeriod

ws2_32

gethostbyname
WSAAsyncSelect
setsockopt
socket
shutdown
recv
WSASend
WSAStartup
WSACleanup
send
WSAGetLastError
inet_addr
htons
connect
closesocket

ole32

CoUninitialize
CoCreateInstance
CoInitialize

wzaudio

wzAudioStop
wzAudioPlay
wzAudioGetStreamOffsetRange
wzAudioDestroy
wzAudioOption
wzAudioCreate

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 107KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 136KB - Virtual size: 119.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zero
Size: - Virtual size: 9.2MB

.as_0002
Size: 114KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zero
Size: - Virtual size: 264KB

.as_0003
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Main/npgmup.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

text
Size: - Virtual size: 92KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rdata
Size: 55KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Main/ogg.dll
.dll windows:4 windows x86 arch:x86

6735c42b0686b3434395406c0333d3d6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
HeapReAlloc
HeapFree
GetCommandLineA
GetVersion
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
RtlUnwind
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Exports

Exports

ogg_packet_clear
ogg_page_bos
ogg_page_continued
ogg_page_eos
ogg_page_granulepos
ogg_page_packets
ogg_page_pageno
ogg_page_serialno
ogg_page_version
ogg_stream_clear
ogg_stream_destroy
ogg_stream_eos
ogg_stream_flush
ogg_stream_init
ogg_stream_packetin
ogg_stream_packetout
ogg_stream_packetpeek
ogg_stream_pagein
ogg_stream_pageout
ogg_stream_reset
ogg_stream_reset_serialno
ogg_sync_buffer
ogg_sync_clear
ogg_sync_destroy
ogg_sync_init
ogg_sync_pageout
ogg_sync_pageseek
ogg_sync_reset
ogg_sync_wrote
oggpack_adv
oggpack_adv1
oggpack_bits
oggpack_bytes
oggpack_get_buffer
oggpack_look
oggpack_look1
oggpack_read
oggpack_read1
oggpack_readinit
oggpack_reset
oggpack_write
oggpack_writealign
oggpack_writeclear
oggpack_writeinit

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Main/vorbisfile.dll
.dll windows:4 windows x86 arch:x86

b6220e63fcea816421d3355524337df0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ogg

ogg_stream_packetpeek
ogg_page_continued
ogg_stream_reset
ogg_page_eos
ogg_page_granulepos
ogg_sync_reset
ogg_sync_pageseek
ogg_page_serialno
ogg_stream_reset_serialno
ogg_stream_pagein
ogg_stream_packetout
ogg_sync_init
ogg_sync_buffer
ogg_sync_wrote
ogg_stream_init
ogg_stream_clear
ogg_sync_clear
oggpack_writealign
oggpack_readinit
oggpack_look
oggpack_adv
oggpack_read
oggpack_write
oggpack_writeclear
oggpack_writeinit
oggpack_bytes

msvcrt

_adjust_fdiv
_initterm
fseek
fread
ftell
_errno
ldexp
ceil
frexp
exit
qsort
realloc
malloc
floor
free
calloc
_CIpow
_ftol
fclose

kernel32

DisableThreadLibraryCalls

Exports

Exports

ov_bitrate
ov_bitrate_instant
ov_clear
ov_comment
ov_info
ov_open
ov_open_callbacks
ov_pcm_seek
ov_pcm_seek_page
ov_pcm_tell
ov_pcm_total
ov_raw_seek
ov_raw_tell
ov_raw_total
ov_read
ov_read_float
ov_seekable
ov_serialnumber
ov_streams
ov_test
ov_test_callbacks
ov_test_open
ov_time_seek
ov_time_seek_page
ov_time_tell
ov_time_total

Sections

.text
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 892KB - Virtual size: 904KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Main/wsctlcd.dll
.dll windows:4 windows x86 arch:x86

93a03327866c3ac9111d82716cb9e7f4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

MessageBoxA
wsprintfA

ws2_32

connect
recv
send
htons
inet_addr
gethostbyname
WSAAsyncSelect
closesocket
socket
WSAGetLastError
WSAStartup
WSACleanup

kernel32

IsBadReadPtr
HeapValidate
GetCurrentThread
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
SetStdHandle
CloseHandle
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
IsBadWritePtr
FatalAppExitA
InitializeCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapFree
VirtualFree
SetConsoleCtrlHandler
GetStringTypeW
LCMapStringA
UnhandledExceptionFilter
RtlUnwind
HeapAlloc
HeapReAlloc
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
FlushFileBuffers
Sleep
SetFilePointer
MultiByteToWideChar
GetStringTypeA

Exports

Exports

??0CWsctlc@@QAE@XZ
??1CWsctlc@@QAE@XZ
??4CWsctlc@@QAEAAV0@ABV0@@Z
?AddStack@CWsctlc@@AAEHPAEH@Z
?Cleanup@CWsctlc@@QAEXXZ
?Close@CWsctlc@@QAEHAAI@Z
?Close@CWsctlc@@QAEHXZ
?Connect@CWsctlc@@QAEHPADGK@Z
?Create@CWsctlc@@QAEHPAUHWND__@@@Z
?FDWriteSend@CWsctlc@@QAEHXZ
?GetReadMsg@CWsctlc@@QAEPAEXZ
?GetSocket@CWsctlc@@QAEIXZ
?LogHexPrint@CWsctlc@@QAEXPAEH@Z
?LogPrintOff@CWsctlc@@QAEXXZ
?LogPrintOn@CWsctlc@@QAEXXZ
?Startup@CWsctlc@@QAEHXZ
?fnWsctlc@@YAHXZ
?nRecv@CWsctlc@@QAEHXZ
?nWsctlc@@3HA
?sSend@CWsctlc@@QAEHIPADH@Z
?sSend@CWsctlc@@QAEHPADH@Z

Sections

.text
Size: 176KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Main/wzAudio.dll
.dll windows:4 windows x86 arch:x86

2812bc594b86151ba488c2abfb4e07ec

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetEvent
EnterCriticalSection
WaitForSingleObject
GetModuleFileNameA
GetFileAttributesA
GetModuleHandleA
CreateThread
TerminateThread
lstrcpynA
SetFilePointer
ReadFile
CreateFileA
FreeLibrary
GetProcAddress
LoadLibraryA
FindClose
FindNextFileA
LeaveCriticalSection
lstrcmpiA
SetThreadPriority
GetCurrentThread
VirtualAlloc
VirtualFree
Sleep
GetFileSize
SetEnvironmentVariableA
CompareStringW
CompareStringA
CloseHandle
SetEndOfFile
RaiseException
FlushFileBuffers
FindFirstFileA
DeleteCriticalSection
SetStdHandle
InterlockedIncrement
InterlockedDecrement
CreateEventA
InitializeCriticalSection
lstrcpyA
lstrcatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
WriteFile
GetOEMCP
GetACP
lstrlenA
GetCPInfo
RtlUnwind
ExitProcess
HeapReAlloc
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
SetLastError
TlsFree
TlsAlloc
GetVersion
GetCommandLineA
ExitThread
TlsGetValue
TlsSetValue
GetCurrentThreadId
GetTimeZoneInformation
GetSystemTime
GetLocalTime
HeapAlloc
HeapFree
GetLastError

user32

MsgWaitForMultipleObjects
DefWindowProcA
DestroyWindow
CreateWindowExA
RegisterClassExA
PostThreadMessageA
PostMessageA
SetTimer
WaitMessage
GetWindowLongA
PeekMessageA

gdi32

DeleteObject

ole32

CoUninitialize
CoInitialize

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey

winmm

waveOutGetNumDevs
waveOutSetVolume
waveOutPause
waveOutWrite
waveOutRestart
waveOutReset
waveOutUnprepareHeader
waveOutPrepareHeader
timeSetEvent
timeKillEvent
mixerGetControlDetailsA
mixerSetControlDetails
waveOutOpen
mixerOpen
mixerGetDevCapsA
mixerGetLineInfoA
mixerGetLineControlsA
waveOutClose
mixerClose

dsound

ord1

wininet

InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetSetOptionA
InternetReadFileExA

comdlg32

GetSaveFileNameA
GetOpenFileNameA

vorbisfile

ov_time_total
ov_bitrate
ov_info
ov_streams
ov_open_callbacks
ov_clear
ov_pcm_seek
ov_pcm_total
ov_read
ov_time_tell

Exports

Exports

wzAudioCreate
wzAudioDestroy
wzAudioGetStreamInfo
wzAudioGetStreamOffsetRange
wzAudioGetStreamOffsetSec
wzAudioGetVolume
wzAudioOpenFile
wzAudioOption
wzAudioPause
wzAudioPlay
wzAudioSeek
wzAudioSetEqualizer
wzAudioSetMixerMode
wzAudioSetVolume
wzAudioStop
wzAudioVolumeDown
wzAudioVolumeUp

Sections

.text
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Main/wz_zp.dll
.dll windows:4 windows x86 arch:x86

c4ff1c06e0b4fa267d2b363da567d1f9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
CloseHandle
ReadFile
CreateFileA
HeapCreate
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
InitializeCriticalSection
FatalAppExitA
GetModuleHandleA
RtlUnwind
HeapAlloc
HeapReAlloc
HeapFree
GetLastError
VirtualFree
VirtualAlloc
GetEnvironmentVariableA
WriteFile
HeapDestroy
GetEnvironmentStringsW
GetEnvironmentStrings
GetACP
GetOEMCP
FlushFileBuffers
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
CompareStringW
SetEnvironmentVariableA
SetConsoleCtrlHandler
LCMapStringA
LCMapStringW
SetFilePointer
SetStdHandle
UnhandledExceptionFilter
Sleep
SetEndOfFile
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA

user32

wsprintfA

Exports

Exports

BZ2_bzBuffToBuffCompress
BZ2_bzBuffToBuffDecompress
BZ2_bzCompress
BZ2_bzCompressEnd
BZ2_bzCompressInit
BZ2_bzDecompress
BZ2_bzDecompressEnd
BZ2_bzDecompressInit
BZ2_bzRead
BZ2_bzReadClose
BZ2_bzReadGetUnused
BZ2_bzReadOpen
BZ2_bzWrite
BZ2_bzWriteClose
BZ2_bzWriteClose64
BZ2_bzWriteOpen
BZ2_bzclose
BZ2_bzdopen
BZ2_bzerror
BZ2_bzflush
BZ2_bzlibVersion
BZ2_bzopen
BZ2_bzread
BZ2_bzwrite
WZCompressFile
WZDecompressFile

Sections

.text
Size: 316KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Preview.jpg
.jpg
ReadMe.txt
object52/Object107.bmd
object52/Object119.bmd
object52/Object120.bmd
object52/Object121.bmd
object52/Object122.bmd
object52/Object123.bmd
object52/Object125.bmd
object52/Object129.bmd
object52/Object131.bmd
object52/Object132.bmd
object52/Object133.bmd
object52/Object36.bmd
object52/Object39.bmd
object52/Object41.bmd
object52/Object59.bmd
object52/Object93.bmd
object52/Object95.bmd
object52/Object96.bmd
object52/Object99.bmd
object52/Sea3Weaponshop09.OZJ
.jpg
object52/cr1_branch04.OZT
object52/cr1_grass02.OZT
object52/cr1_tree01.OZJ
.jpg
object52/cr_stone10.OZJ
.jpg
object52/dpshield02.ozj
.jpg
object52/dropsword.ozj
.jpg
object52/grass_01.OZT
object52/skeleton_001.OZJ
.jpg
object52/so_sku01.OZT
object52/so_sku01.tga
object52/so_sku02.OZJ
.jpg
object52/song_k21magma01.OZT
object52/song_k21magma02.OZJ
.jpg
object52/song_k21magma03.OZJ
.jpg
object52/song_k21wall01.OZJ
.jpg
object52/song_k21wall02.OZJ
.jpg
object52/song_k21wall03.OZJ
.jpg
object52/song_k21wall04.OZJ
.jpg
object52/sos3mo01.OZJ
.jpg
object52/sos3mo03.OZJ
.jpg .ps1 polyglot
object52/sos3mo04.OZJ
.jpg
object52/tile_wood01.OZJ
.jpg
world52/TileGrass03.OZT
world52/encterrain52.att
world52/encterrain52.map
world52/encterrain52.obj
world52/leaf01.OZJ
.jpg
world52/leaf01.ozt
world52/leaf02.ozj
.jpg
world52/rain01.ozt
world52/rain02.ozt
world52/rain03.OZT
world52/terrain.att
world52/terrain.map
world52/terrain.obj
world52/terrainheight.ozb
world52/terrainlight.ozj
.jpg
world52/terrainserver.att
world52/tilegrass01.ozj
.jpg
world52/tilegrass01.ozt
world52/tilegrass02.ozj
.jpg
world52/tilegrass02.ozt
world52/tileground01.ozj
.jpg
world52/tileground02.ozj
.jpg
world52/tileground03.ozj
.jpg
world52/tilerock01.ozj
.jpg
world52/tilerock02.ozj
.jpg
world52/tilerock03.ozj
.jpg
world52/tilerock04.ozj
.jpg
world52/tilerock05.ozj
.jpg
world52/tilerock06.ozj
.jpg
world52/tilerock07.ozj
.jpg
world52/tilewater01.ozj
.jpg
world52/tilewood01.ozj
.jpg

Sharing

General

Malware Config

Signatures

Files

f4f60dab73dacb93a4a690a3159382f2

Headers

File Characteristics

Imports

advapi32

dinput8

dsound

gdi32

glu32

imm32

kernel32

opengl32

shell32

user32

version

winmm

ws2_32

ole32

wzaudio

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.data Size: 107KB - Virtual size: 108KB

Size: 136KB - Virtual size: 119.1MB

.rsrc Size: 8KB - Virtual size: 12KB

.idata Size: 8KB - Virtual size: 12KB

.zero Size: - Virtual size: 9.2MB

.as_0002 Size: 114KB - Virtual size: 120KB

.zero Size: - Virtual size: 264KB

.as_0003 Size: 48KB - Virtual size: 48KB

Headers

File Characteristics

Sections

text Size: - Virtual size: 92KB

rdata Size: 55KB - Virtual size: 56KB

.rsrc Size: 3KB - Virtual size: 4KB

6735c42b0686b3434395406c0333d3d6

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 22KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 12KB - Virtual size: 12KB

.reloc Size: 4KB - Virtual size: 3KB

b6220e63fcea816421d3355524337df0

Headers

File Characteristics

Imports

ogg

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 62KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 892KB - Virtual size: 904KB

.reloc Size: 12KB - Virtual size: 11KB

93a03327866c3ac9111d82716cb9e7f4

Headers

File Characteristics

Imports

user32

ws2_32

kernel32

Exports

Exports

Sections

.text Size: 176KB - Virtual size: 172KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 20KB - Virtual size: 25KB

.idata Size: 4KB - Virtual size: 2KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.data
Size: 107KB - Virtual size: 108KB

.rsrc
Size: 8KB - Virtual size: 12KB

.idata
Size: 8KB - Virtual size: 12KB

.zero
Size: - Virtual size: 9.2MB

.as_0002
Size: 114KB - Virtual size: 120KB

.zero
Size: - Virtual size: 264KB

.as_0003
Size: 48KB - Virtual size: 48KB

text
Size: - Virtual size: 92KB

rdata
Size: 55KB - Virtual size: 56KB

.rsrc
Size: 3KB - Virtual size: 4KB

.text
Size: 24KB - Virtual size: 22KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 12KB - Virtual size: 12KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 64KB - Virtual size: 62KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 892KB - Virtual size: 904KB

.reloc
Size: 12KB - Virtual size: 11KB

.text
Size: 176KB - Virtual size: 172KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 20KB - Virtual size: 25KB

.idata
Size: 4KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 6KB

.text
Size: 92KB - Virtual size: 89KB

.rdata
Size: 84KB - Virtual size: 81KB

.data
Size: 20KB - Virtual size: 25KB

.reloc
Size: 8KB - Virtual size: 6KB

.text
Size: 316KB - Virtual size: 312KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 24KB - Virtual size: 30KB

.idata
Size: 4KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 7KB