47213d3a04a00fb4f9b3e854b1e97050N

resource
47213d3a04a00fb4f9b3e854b1e97050N
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsis7z.dll
unpack001/MissBong.exe
unpack001/bink2w64.dll

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 d06e9ce775bede2bc7c71b02ea389080b874ec408268edf1b5ef6d6fe7de0dde
MD5 47213d3a04a00fb4f9b3e854b1e97050
SHA1 fab6ca5546ced7239e6fd3c01a3702ce405b3ce3
SHA512 e51298ab113ec0636f3f9de90fb2894a426b37cf4586803941f3b88b7bc68515aef33c266257ba7346cc335bbf28f90bb7134e04017e2ba25b73312bbb037446
SSDEEP 24576:N0CHpcG1szLSvJwLWFxT9xWiXoyOWtgNHYdjKnsYu2iaGj+drEH7T:ncfqvCLyxR/YbJ1ujKnk1atQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/InstallOptions.dll

IMPHASH 4b45b7e00344a87332fbd12653854d1a
SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
MD5 ece25721125d55aa26cdfe019c871476
SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile SetCurrentDirectoryW GetPrivateProfileStringW GetPrivateProfileIntW MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree GlobalAlloc WriteFile SetFilePointer

user32

LoadCursorW SetWindowRgn GetDlgCtrlID CloseClipboard DrawFocusRect OpenClipboard DrawTextW SetCursor LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW GetClientRect ShowWindow GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW CallWindowProcW PostMessageW MessageBoxW GetSysColor CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW GetWindowLongW EnableMenuItem PtInRect MapWindowPoints GetClipboardData

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectW

shell32

SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

$PLUGINSDIR/modern-header.bmp

SHA256 50762265ca7b9a7f48f73ff9ce353af7de7f58846f7d280b4b48c5d1c453bce0
MD5 15e7f79af4aa1976f23981eea59ac537
SHA1 f2055ade0c91d731d7e14c178b0d87dfb9ebc32e
SHA512 bf87f6db549c0068cf565db1e8073cc960c0ada078f64e5dd1307572b959cbf69b62a64bb7e901211eaa932a27e3c006459cbed980863b71dff32fa206d5312e
SSDEEP 768:SBCu9t6nA/7kSxYvpJ5hQRULM8jGopj/Je7X:SBCytZk4Yvj5CRP8j/LJe7X
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-wizard.bmp

SHA256 22d0d58cfb64fa48a652e57ec99ed97096d45e283a1a14b6ea9d059824f458bc
MD5 878b42e1aa1d562c426c5b24fd09b6f6
SHA1 86dfcb36266357ad875550ce7f793b6d0ee808e0
SHA512 8c0cd9a155da2251447372c147190fcb74ea434b46a41af0daa2340528f58c2f17b75109b41e2e837906d34355c2a84162610d3e59018b3261093ff55ec94f75
SSDEEP 3072:P/QcoFQX3zJ3aJlGLGGJI5VKKKKKKEKK7KKKZTKK4KKKK77Ht81ERMT05N9vWUol:P3zc1u5TTwWPztT1TT+pXTWzTtTRuQPa
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsis7z.dll

IMPHASH 2656ea25cde98f31a490513c2db04ae8
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

268568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LocalFree FormatMessageW GetFileInformationByHandle SetLastError DeviceIoControl GetModuleHandleW GetProcAddress HeapAlloc HeapFree GetProcessHeap GetSystemTimeAsFileTime GetStdHandle WaitForMultipleObjects GetTickCount GetConsoleMode AreFileApisANSI SetFileApisToOEM SetFileApisToANSI GlobalAlloc GlobalFree lstrcpynW lstrcpyW MultiByteToWideChar WideCharToMultiByte FreeLibrary GetModuleFileNameW LoadLibraryExW GetCurrentDirectoryW CreateDirectoryW CreateSemaphoreW RemoveDirectoryW SetFileAttributesW SetFileTime GetTempPathW GetCurrentProcessId GetCurrentThreadId MoveFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetModuleHandleA SetEndOfFile GetCurrentProcess GetSystemInfo GlobalMemoryStatus GetProcessAffinityMask IsProcessorFeaturePresent WriteConsoleW HeapSize GetStringTypeW DecodePointer SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA WaitForSingleObject CreateEventW ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetVersionExW VirtualFree VirtualAlloc GetLastError CloseHandle WriteFile SetFilePointer ReadFile GetFileSize CreateFileW DeleteFileW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx GetFileSizeEx GetConsoleCP FlushFileBuffers GetFileType HeapReAlloc LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind RaiseException InterlockedFlushSList EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess

user32

SendMessageW FindWindowExW SetWindowTextW GetDlgItem wsprintfW CharUpperW

advapi32

SetFileSecurityW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

oleaut32

VariantClear SysAllocStringLen SysStringLen SysFreeString VariantCopy

GameCfg.cfg

SHA256 3732891de8047a28f89912578ccb9c7682813bf70b2c19aaf58f341689cab0a0
MD5 361710c48263459319ae79effd1221e8
SHA1 28262aa147b5d4d970c830f0eb14b078f1a7bf90
SHA512 1515059681e9a55fc7e2837b658dffd8aa7f5031e129510d5dc7bdcfadf1c05467058714295e8cb9a51c81b7623a903ac5a3c946a02fda2b7017e88f279a4fda
SSDEEP 1536:L4aV6Tf8+ra9tzYHJhAKujpuOeHzy8VNvD6iLf:ck6Tf8+rCtMHnAKYUOe+wVD
MD5 SHA1 SHA512 SSDEEP

GameKey.sav

SHA256 190853ceaf8cc8bd9fc4a21f043aa42858157906dfbc63d2d769a941c6869bb2
MD5 2681df33293c3ae774d74fbf80e4b8ad
SHA1 48765685bcb0e7816f2ef035c39428bad18976da
SHA512 6d1c188a9be4e78868b1ad95d507463e251f045732c6691ed04c01fb5c61907793a0507ccea081258080ad29ed22dcb60d3c3ba4576df690683b54bba0d9dabd
MD5 SHA1 SHA512

IO Input.ini

SHA256 7995368fa200343a8f6a43a2a700ae05dd5854d3c0e98580cb1f6c4f7b93b0d9
MD5 e122d9fde13b68fa0c24f3e65aa02b0d
SHA1 6304d2d7ff48ef3d21b913468d46534043018a04
SHA512 65f665f8803519351bef20b7a09a78ea53e9d02d94d42999e47c7d46bb7bf7725b79cfa8214f8f9fdc7d8239cce9bd11b9a377b4c8ded6608395004d1d6859c5
MD5 SHA1 SHA512

MissBong.exe

IMPHASH 42f05bb6157e0109d46dbf9100892633
SHA256 7950182c909964cd7432edb8a0820731109f1d86dc1bd1daeff3d3e7e819d175
MD5 fd775c57356072fa91cd629772a16e80
SHA1 1d6e8f4e05032f4b13a56ec643e93a7e14d8818f
SHA512 b8ff6a0c81fdbfc8807ee584d025f897cc952e5587511bbf6e8886914629aa175bde51debfb722df1eefbdf3989c6d654538181d1ed63f0bc3f6fc1f61027577
SSDEEP 24576:wBks+xJGYzcnB/t3XUUCfU11Y6SCfU11Y6:wBks+nGYYnB/tnUUCfU11Y6SCfU11Y6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

516420

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Cloud\Game\미쓰봉\source\240809Ver2.46\x64\Release_End\MissBong.pdb

kernel32

HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW WideCharToMultiByte GetLocalTime DeleteFileA DeviceIoControl QueryPerformanceCounter QueryPerformanceFrequency SetLocalTime SetCommMask SetupComm PurgeComm SetCommTimeouts GetCommState SetCommState CreateEventA ClearCommError CreateThread WaitCommEvent GetOverlappedResult HeapReAlloc GetTickCount RaiseException DeleteCriticalSection IsDebuggerPresent OutputDebugStringW GetCurrentThreadId GetTickCount64 GetVersionExA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress GetStartupInfoW GetCurrentProcessId HeapFree HeapSize GetCurrentProcess InitializeCriticalSection lstrlenA GetSystemTimeAsFileTime InitializeSListHead MultiByteToWideChar LocalFree IsBadWritePtr GetLastError CreateDirectoryA WriteFile SetFilePointer HeapDestroy ReadFile CreateFileA CloseHandle Sleep WritePrivateProfileStringA GetPrivateProfileStringA ExitProcess LeaveCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection

user32

EndDialog CallWindowProcA SendMessageA GetWindowTextA SetWindowTextA SetFocus ShowCursor MessageBoxA GetKeyState SetRect PostMessageA wsprintfA SetWindowPos GetWindowRect PostQuitMessage EndPaint LoadStringA LoadAcceleratorsA PeekMessageA TranslateAcceleratorA TranslateMessage DispatchMessageA LoadIconA BeginPaint DefWindowProcA DestroyWindow DialogBoxParamA UpdateWindow ShowWindow SetWindowLongPtrA CreateWindowExA AdjustWindowRect RegisterClassExA LoadCursorA

advapi32

OpenProcessToken RegCloseKey RegQueryValueExA RegCreateKeyExA AdjustTokenPrivileges LookupPrivilegeValueA RegSetValueExA

ole32

CoUninitialize CoInitializeSecurity CoInitializeEx CoCreateInstance

oleaut32

VariantClear SysFreeString SysStringLen SysAllocString

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z _Thrd_join _Thrd_id _Cnd_wait ?_Throw_C_error@std@@YAXH@Z _Thrd_start _Mtx_unlock _Cnd_destroy _Cnd_signal _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Mtx_init _Cnd_init ?_Random_device@std@@YAIXZ _Mtx_destroy ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Xlength_error@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ

d3d9

Direct3DCreate9

d3dx9_43

D3DXMatrixScaling D3DXMatrixTranslation D3DXMatrixMultiply D3DXCreateLine D3DXCreateFontIndirectA D3DXCreateSprite D3DXCompileShader D3DXMatrixRotationZ D3DXVec3Normalize D3DXVec3TransformNormal

winmm

timeGetTime

dsound

ord1

iphlpapi

GetAdaptersAddresses

bink2w64

BinkSetSoundSystem BinkGetRects BinkPause BinkGoto BinkNextFrame BinkShouldSkip BinkDoFrame BinkRegisterFrameBuffers BinkWait BinkGetFrameBuffersInfo BinkOpen BinkClose BinkSetVolume BinkOpenDirectSound

rpcrt4

UuidCreateSequential

vcruntime140

__std_exception_copy __std_exception_destroy _CxxThrowException __C_specific_handler memset memcmp memcpy memmove __CxxFrameHandler3 __std_terminate strchr _purecall strrchr strstr

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo _register_thread_local_exe_atexit_callback _c_exit _errno _invalid_parameter_noinfo_noreturn _initterm_e terminate _initterm exit _get_narrow_winmain_command_line system _exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vsprintf_s fwrite ftell _set_fmode fseek fflush __stdio_common_vfprintf __stdio_common_vsprintf fopen_s __p__commode fclose fread fopen

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-convert-l1-1-0

atol atoi

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-string-l1-1-0

strcpy_s strncpy strcmp strncmp

api-ms-win-crt-math-l1-1-0

__setusermatherr sinf _fdtest atan2f sqrtf acosf cosf

api-ms-win-crt-multibyte-l1-1-0

_mbsupr _mbscmp

api-ms-win-crt-time-l1-1-0

_time64 clock

api-ms-win-crt-filesystem-l1-1-0

rename

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

OiddInfo.ini

SHA256 c5606932920c94d9ba8ca002a4c7778023bae1974a2121499e8efde331056355
MD5 aff496a7a086312151b51cc4479d0a89
SHA1 04d5980ea6141cdab65edeafb650e807f0627237
SHA512 f7c2919fdbaa871c4f9994013d61496ba184e62de7ee998f3a04ea172ca89691ef04bf0ad2f4580b9f04f395b2c58d7b87dde87573cad7fd4f2443735290dea4
MD5 SHA1 SHA512

bink2w64.dll

IMPHASH 6b35d3999e2a065212609a92b090406a
SHA256 0e19736e87202938d565f1471d0820979a95282c24a0a2b8b81c94a3599cd56b
MD5 e36959ce05a81e732ea81f6c5a010a2d
SHA1 02bdfaa1aecf85761c354b3a13f48e38b0de887a
SHA512 1a59d132d9ba39beeefa2a88177fa78787599f0c74123a5f5e73ce479f0f3161b85b174fe194753f3ee55bf96cae5d0016ed0975eeb5b84c1a7cd87480656212
SSDEEP 6144:jxVfNyeVD93sL8oWyxMq+gFNn47b5mMkkj3wzk6Mi/PuKshrYULi7N7dcHQYSkD6:NV93/oWy9+gF4kkb5CshrjJ962L+R
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

14968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\devel\projects\bink\build\bink2w64.pdb

user32

GetWindow ChangeDisplaySettingsA IsWindowVisible GetSystemMetrics GetCursorPos DefWindowProcA ReleaseDC PeekMessageA CreateWindowExA UnregisterClassA ShowCursor GetDC BeginPaint GetClassLongPtrA GetClientRect IsIconic GetWindowLongPtrA GetTopWindow GetWindowLongA GetActiveWindow GetWindowThreadProcessId RegisterClassA EndPaint ClientToScreen DestroyWindow SetCursor ScreenToClient GetWindowRect

gdi32

CreateDIBSection GetDeviceCaps StretchBlt GetDIBits SetPixel DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap SetStretchBltMode GetPixel DeleteDC

kernel32

GetLocaleInfoA InitializeCriticalSectionAndSpinCount GetStringTypeA WriteFile HeapReAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo GetSystemTimeAsFileTime MultiByteToWideChar GetStringTypeW LCMapStringA LCMapStringW HeapSize LocalAlloc ReleaseMutex SetErrorMode FreeLibrary GetProcAddress LoadLibraryA GetModuleHandleA Sleep GetSystemInfo GetCurrentProcessId OutputDebugStringA QueryPerformanceCounter GetTickCount GetEnvironmentVariableA QueryPerformanceFrequency CreateFileA SetFilePointer ReadFile GetLastError CloseHandle HeapAlloc HeapFree HeapCreate SetUnhandledExceptionFilter WaitForSingleObject GetCurrentThread InitializeCriticalSection LeaveCriticalSection CreateSemaphoreA SetThreadPriority ReleaseSemaphore RaiseException EnterCriticalSection OpenThread GetThreadPriority CreateMutexA DeleteCriticalSection GetCurrentThreadId SetThreadAffinityMask ResumeThread CreateThread RtlUnwindEx HeapDestroy HeapSetInformation GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStartupInfoA GetFileType GetStdHandle SetHandleCount ExitProcess GetModuleHandleW FlsAlloc FlsSetValue GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer DecodePointer FlsGetValue FlsFree SetLastError

winmm

waveOutPrepareHeader waveOutOpen waveOutUnprepareHeader waveOutSetVolume waveOutReset waveOutRestart waveOutPause waveOutWrite waveOutClose timeGetTime timeEndPeriod timeBeginPeriod

ole32

CoInitializeEx CoCreateInstance

BinkBufferBlit BinkBufferCheckWinPos BinkBufferClear BinkBufferClose BinkBufferGetDescription BinkBufferGetError BinkBufferLock BinkBufferOpen BinkBufferSetDirectDraw BinkBufferSetHWND BinkBufferSetOffset BinkBufferSetResolution BinkBufferSetScale BinkBufferUnlock BinkCheckCursor BinkClose BinkCloseTrack BinkControlBackgroundIO BinkControlPlatformFeatures BinkCopyToBuffer BinkCopyToBufferRect BinkDDSurfaceType BinkDX8SurfaceType BinkDX9SurfaceType BinkDoFrame BinkDoFrameAsync BinkDoFrameAsyncWait BinkDoFramePlane BinkFreeGlobals BinkGetError BinkGetFrameBuffersInfo BinkGetKeyFrame BinkGetPalette BinkGetPlatformInfo BinkGetRealtime BinkGetRects BinkGetSummary BinkGetTrackData BinkGetTrackID BinkGetTrackMaxSize BinkGetTrackType BinkGoto BinkIsSoftwareCursor BinkLogoAddress BinkNextFrame BinkOpen BinkOpenDirectSound BinkOpenMiles BinkOpenTrack BinkOpenWaveOut BinkOpenWithOptions BinkOpenXAudio2 BinkPause BinkRegisterFrameBuffers BinkRequestStopAsyncThread BinkRestoreCursor BinkService BinkSetError BinkSetFileOffset BinkSetFrameRate BinkSetIO BinkSetIOSize BinkSetMemory BinkSetPan BinkSetSimulate BinkSetSoundOnOff BinkSetSoundSystem BinkSetSoundSystem2 BinkSetSoundTrack BinkSetSpeakerVolumes BinkSetVideoOnOff BinkSetVolume BinkSetWillLoop BinkShouldSkip BinkStartAsyncThread BinkUseTelemetry BinkUseTmLite BinkWait BinkWaitStopAsyncThread RADTimerRead

Name

.text

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

BINK16

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

BINK32

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

BINKP8

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

BINK

Size

226KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

RADCODE

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

BINKBSS

Size

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

BINKDATA

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BINKCONS

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

RADDATA

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

RADCONST

Size

512B

Virtual Size

150B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

oidd.id

SHA256 f05b26155287cfffdd65b8f89e2c279baa79fd88543795f86ed62a24b6b0606b
MD5 d34c4002606a4edff27534026d27219c
SHA1 423cc333ea7447933a8491cfb20f4a6ac20e267e
SHA512 d95980e21a893e668f49dae0167ae0169b6904de4e33f9e7b3bc85e845190fcfb7766779a1b43b53d80f403ab8f5ca7147b3a630f8f00895624af8b521bb543e
MD5 SHA1 SHA512

pass.pwd

SHA256 c9932c85c7ea2ead06bf2f2c7dcaeb39f55be3d5f06d48104a5685c200a1d435
MD5 4c1a09e0135785fd53274d980983604c
SHA1 efb7471d7856d3ed3e8733e4f3e94522279c407e
SHA512 fc362eef6e9f7b89f10a88fd88bd39f01d9f2063e7f6a0fd09f2b12ffaabbd1d14c76699d8fbc17bdbf3802296e9edef29a24b9b87c4b5986dc4cc6a9967930b
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer