No_xTrap[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
No_xTrap.rar
Size 4.5MB
Sample260801-w1q7datcma
SHA256 85cd215a3f29cdec9eba27d50681196a242df3d21ed31b2992c31992d2bab5d3
MD5 63616759e970e74dde4cc0b109608aba
SHA1 0bf5d38ea514077a3a977fbbcdd6e4c93ad66179
SHA512 83c83af79c03da1c52aa280405c41bd90fd06afe430ee1644241b265b8e6fbd7270d5e4debac7348b683b442ebf9dfc125c48e847747a99babb8f06f71347b64
SSDEEP 98304:7J2P/EdQ6qSDHU9wZAwqnlVxfPnP8x9JQpBFgrTdoPnjxCLUPO:78/EhNzqw4Vx3cQpBFg89JPO
TLSH
T16626339ADA83FE2484AC90AF95D73B46A5A3F21526145E081330CB71B31CF87A977CD7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/No xTrap/AgentServer.exe
unpack001/No xTrap/SR_GameServer.exe
unpack001/No xTrap/sro_client.exe

File Explorer

No_xTrap.rar

.rar 4.5MB
No xTrap/AgentServer.exe

.exe 912KB
No xTrap/SR_GameServer.exe

.exe 8.5MB
No xTrap/server.cfg

3KB
No xTrap/sro_client.exe

.exe 11.0MB

No_xTrap.rar

SHA256 85cd215a3f29cdec9eba27d50681196a242df3d21ed31b2992c31992d2bab5d3
MD5 63616759e970e74dde4cc0b109608aba
SHA1 0bf5d38ea514077a3a977fbbcdd6e4c93ad66179
SHA512 83c83af79c03da1c52aa280405c41bd90fd06afe430ee1644241b265b8e6fbd7270d5e4debac7348b683b442ebf9dfc125c48e847747a99babb8f06f71347b64
SSDEEP 98304:7J2P/EdQ6qSDHU9wZAwqnlVxfPnP8x9JQpBFgrTdoPnjxCLUPO:78/EhNzqw4Vx3cQpBFg89JPO
TLSH
T16626339ADA83FE2484AC90AF95D73B46A5A3F21526145E081330CB71B31CF87A977CD7
MD5 SHA1 SHA512 SSDEEP TLSH

No xTrap/AgentServer.exe

IMPHASH 85e02170ea456f684e6035bb3c0d7daa
SHA256 239a05eff5b15041d27ed832528979924c396174e505bd4c5a793c38b06cc729
MD5 9ad3547f75a8db64906c2ae38c381b60
SHA1 1b161b6389ef4765a0273155dbc3c9f2701de6d4
SHA512 432563bb8ef11b3a534a7f74b083069c7cddf1ebbd94b9b5d4763cbc14b7bd1898ffc8e89d9028a9e1fe3c8c8891838915e592dba8a76b9b226a3af007f2130e
SSDEEP 12288:Fa2dPxqAcmPTwj9TNXx0mHKdBN2znlF/Z:U2dpqyPYNhNHKx2zlf
TLSH
T12F155C00B7CAC1F3CEC7453D05EED65D962BA5861B111DD7E3AC0B0F8E547E2AA36289
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

579813

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\WORK2005\BinOut\AgentServer.pdb

kernel32

FreeLibrary GetProcAddress GetLastError LoadLibraryA CompareStringA CreateToolhelp32Snapshot Process32First GetCurrentProcessId Process32Next CloseHandle GetLocalTime Sleep DeleteCriticalSection CreateTimerQueueTimer DeleteTimerQueueTimer LeaveCriticalSection InterlockedIncrement EnterCriticalSection GetSystemInfo GetCurrentThreadId GetModuleFileNameA PostQueuedCompletionStatus CreateFileA GetFileSize ReadFile CreateEventA CreateThread SetEvent WaitForSingleObject DebugBreak CreateIoCompletionPort GetQueuedCompletionStatus GetStdHandle SetConsoleCtrlHandler SetConsoleMode SetConsoleTextAttribute WriteConsoleA AllocConsole GetConsoleWindow CreateSemaphoreA GetCurrentProcess SetUnhandledExceptionFilter WideCharToMultiByte GetUserDefaultLangID MulDiv GetLocaleInfoA GetTimeFormatA GetDateFormatA FileTimeToLocalFileTime FileTimeToSystemTime GlobalAlloc GlobalLock GlobalUnlock lstrcmpiA ExitProcess GetWindowsDirectoryA GetCurrentThread IsDebuggerPresent ResetEvent InterlockedDecrement InitializeCriticalSection ReleaseSemaphore lstrcpynA MultiByteToWideChar FlushFileBuffers SetFilePointer SetEndOfFile WriteFile UnmapViewOfFile FlushViewOfFile CreateFileMappingA MapViewOfFile CreateDirectoryA SleepEx SetThreadPriority ResumeThread SuspendThread FlushInstructionCache GetCommandLineA HeapFree HeapAlloc GetProcessHeap GetStartupInfoA GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter ExitThread RaiseException RtlUnwind GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo GetOEMCP IsValidCodePage GetTimeZoneInformation FatalAppExitA VirtualAlloc HeapReAlloc SetStdHandle GetConsoleCP GetConsoleMode GetLocaleInfoW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale CompareStringW SetEnvironmentVariableA GetConsoleOutputCP WriteConsoleW GetVersionExA GetThreadLocale GetACP InterlockedExchange GlobalMemoryStatus GetTickCount TerminateThread lstrlenA

iphlpapi

GetAdaptersInfo GetIpAddrTable

ws2_32

WSASetEvent WSAGetOverlappedResult WSAWaitForMultipleEvents WSAResetEvent WSACloseEvent gethostbyname WSACleanup WSAStartup socket inet_addr ntohs inet_ntoa WSARecvFrom WSASendTo htons setsockopt WSARecv WSAIoctl shutdown listen WSAGetLastError WSASocketA closesocket WSASend getsockopt getpeername accept connect bind getsockname WSACreateEvent

user32

SetRect LoadCursorA CopyRect UnionRect PtInRect OffsetRect GetDC SetCapture SetCursor GetSystemMetrics ReleaseCapture CreatePopupMenu ReleaseDC AppendMenuA LoadIconA CheckMenuItem GetCursorPos ScreenToClient TrackPopupMenu BeginPaint PeekMessageA TranslateMessage DispatchMessageA SetWindowTextA SetForegroundWindow SendMessageA MessageBoxA DefWindowProcA RegisterClassA CreateWindowExA DestroyWindow PostQuitMessage SetWindowPos ShowWindow UpdateWindow GetWindowRect GetClientRect GetParent RedrawWindow AdjustWindowRect GetWindowLongA MoveWindow CharNextA DrawTextA LoadMenuA SetTimer GetSubMenu GetMenu GetClassNameA EnumChildWindows EnableWindow GetDlgItem GetWindowTextA CloseClipboard OpenClipboard EmptyClipboard SetClipboardData DialogBoxParamA CreateDialogParamA GetDesktopWindow EndDialog SetDlgItemInt GetDlgItemInt SetDlgItemTextA GetDlgItemTextA InflateRect DrawIcon EndPaint IntersectRect GetSysColor DestroyMenu PostMessageA IsWindow

gdi32

LineTo MoveToEx RoundRect Rectangle CreateFontA DeleteDC BitBlt DeleteObject SelectObject CreateCompatibleBitmap CreateCompatibleDC SetTextColor GetTextExtentPoint32A SetBkMode GetNearestColor SetPixel SetBkColor TextOutA SetTextAlign GetDeviceCaps CreateSolidBrush CreatePen GetStockObject Ellipse

advapi32

RegSetValueExA SetServiceStatus RegisterServiceCtrlHandlerA RegisterEventSourceA DeregisterEventSource OpenSCManagerA CreateServiceA CloseServiceHandle OpenServiceA ControlService DeleteService StartServiceCtrlDispatcherA RegCreateKeyA RegOpenKeyA RegQueryValueExA ReportEventA RegCloseKey

ole32

CoCreateGuid

No xTrap/SR_GameServer.exe

IMPHASH 5805497573b27a2f0bb5b10beb309675
SHA256 6f9ef5494aada62ec21c9e433740f6a117baed1c80190c8c07a9ae99d50a7fc0
MD5 12a1fb0f6f8addf77e964b459b7e5e96
SHA1 f502a9dd7442a1172719003800202755d45dd8e4
SHA512 6ae2b8a3f1a726ded7ccd2b0065461ae31949f275e5aa75e8e50a8320d61c1e205db67e2e013e270f67b57d9bc727bf82af62ed193740cafc745a6a474789756
SSDEEP 98304:T8zVR5YeJoKMsOg06yYe+xS45gMYxsw69UCCerr:T8zL5YeJoeTDWMYxswmBX
TLSH
T19F964B24BBCFD0B7CF571672142AAB4E886787492B241ED3E3781F4F1EA12D2683519D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6155959

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\WORK2005\BinOut\SR_GameServer.pdb

kernel32

FormatMessageA CreateProcessA DuplicateHandle DeleteFileA MoveFileA CreatePipe DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MulDiv FindClose FindNextFileA FindFirstFileA GetCurrentDirectoryA DebugBreak GetLocalTime SetLocalTime CompareStringA InterlockedIncrement lstrlenA GetLocaleInfoA GetACP GetVersionExA IsDebuggerPresent Process32Next Process32First CreateToolhelp32Snapshot InterlockedExchange GetTickCount CloseHandle SetThreadPriority CreateThread Sleep SetEnvironmentVariableA CompareStringW WriteConsoleW GetConsoleOutputCP SetStdHandle IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetLocaleInfoW LCMapStringW LCMapStringA HeapReAlloc VirtualAlloc QueryPerformanceCounter VirtualFree HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP GetFileType SetHandleCount OutputDebugStringA GlobalMemoryStatus GetSystemInfo GetCurrentThreadId GetModuleFileNameA LoadLibraryA FreeLibrary PostQueuedCompletionStatus CreateFileA GetFileSize ReadFile CreateIoCompletionPort GetQueuedCompletionStatus GetLastError TerminateThread GetUserDefaultLangID GetCurrentProcessId CreateTimerQueueTimer DeleteTimerQueueTimer CreateEventA SetEvent WaitForSingleObject WideCharToMultiByte GetTimeFormatA GetDateFormatA SetConsoleCtrlHandler WriteConsoleA GetStdHandle CreateSemaphoreA GetCurrentProcess SetUnhandledExceptionFilter GetProcAddress GlobalAlloc GlobalLock GlobalUnlock lstrcmpiA GetWindowsDirectoryA GetCurrentThread ExitProcess ResetEvent InterlockedDecrement InitializeCriticalSection MultiByteToWideChar WriteFile UnmapViewOfFile FlushViewOfFile CreateFileMappingA MapViewOfFile FlushFileBuffers SetFilePointer SetEndOfFile CreateDirectoryA SleepEx FlushInstructionCache ResumeThread SuspendThread GetFileAttributesA SetFileAttributesA CopyFileA SetCurrentDirectoryA GetModuleHandleA GetSystemTimeAsFileTime GetDriveTypeA GetFullPathNameA GetCommandLineA HeapFree HeapAlloc GetProcessHeap GetStartupInfoA TerminateProcess UnhandledExceptionFilter GetTimeZoneInformation ExitThread RaiseException RtlUnwind TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize GetCPInfo GetOEMCP IsValidCodePage GetExitCodeProcess

user32

ReleaseCapture SetCapture IsWindowVisible MessageBoxA PostMessageA PeekMessageA IsWindow TranslateMessage DispatchMessageA ShowWindow DefWindowProcA SendMessageA LoadMenuA SetTimer GetSubMenu GetMenu DrawTextA RegisterClassA CreateWindowExA DestroyWindow PostQuitMessage UpdateWindow GetClientRect MoveWindow SetWindowTextA GetWindowTextA LoadCursorA SetCursor GetSysColor OpenClipboard EmptyClipboard SetClipboardData CloseClipboard LoadIconA IntersectRect DrawIcon InflateRect CopyRect PtInRect OffsetRect ScreenToClient EndPaint GetForegroundWindow GetParent UnionRect CreatePopupMenu SetRect AppendMenuA CheckMenuItem GetCursorPos GetDC TrackPopupMenu DestroyMenu GetSystemMetrics ReleaseDC BeginPaint RedrawWindow CharNextA

gdi32

SetTextColor CreateCompatibleBitmap CreateCompatibleDC SetBkMode BitBlt DeleteObject DeleteDC CreateFontA GetDeviceCaps SetBkColor GetNearestColor SetPixel GetStockObject Ellipse LineTo MoveToEx Rectangle GetTextExtentPoint32A TextOutA CreatePen SetTextAlign CreateSolidBrush SelectObject

shell32

ShellExecuteA

wininet

InternetOpenUrlA InternetCloseHandle InternetQueryDataAvailable InternetReadFile InternetOpenA

iphlpapi

GetAdaptersInfo GetIpAddrTable

ws2_32

WSAGetOverlappedResult WSAWaitForMultipleEvents WSASetEvent shutdown WSAIoctl WSARecv setsockopt WSACleanup WSAStartup WSACreateEvent getsockname bind connect accept getpeername getsockopt WSASend closesocket WSASocketA WSAGetLastError listen htons WSASendTo WSARecvFrom inet_ntoa ntohs WSACloseEvent WSAResetEvent gethostbyname inet_addr socket

advapi32

RegOpenKeyA RegCloseKey RegSetValueExA RegQueryValueExA

ole32

CoCreateGuid

odbc32

ord16 ord13 ord31 ord61 ord18 ord8 ord36 ord40 ord72 ord26 ord30 ord4 ord75 ord41 ord11 ord76 ord24 ord43

No xTrap/sro_client.exe

IMPHASH d3a0e2ce263915eb6eab704932dcebb1
SHA256 e9aff497f1f59777d0636f837609dd75222b8ed73b84814b7f877fb3ab3f41c6
MD5 a26d93ab4131a7cef00ae0c631d2b98f
SHA1 9dab28fbca1f0080125ecf9b0e44b47593ae536d
SHA512 39b1cd2bad6b3203d4fd40d43139a60a9dc2e89a24dc99f7575a7daf2be93648e0ff0bd084e2f7e2e0a5d56cb64aa2fb274056d451aada1fd3dc5a61a733b3a9
SSDEEP 196608:5isC1raEJP/4POwpbF3joPNlqkUBY6FSLuEzB:5isC1BZ/mpbF3j6NlqkUBYBP
TLSH
T14BC68D21FBDAC0B5EA87B1B946AFB32E5256E7881B2409D3D1143E0BDDA07F15E361C1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7641938

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\vss-od\Silkroad\Client\Out\SRO_Client.pdb

gdi32

CreateFontIndirectA SetTextColor SetBkMode SetPixel GetPixel SetDIBColorTable CreateCompatibleDC RealizePalette SelectPalette SetPaletteEntries GetTextMetricsA CreateDIBSection CreateFontA GetDeviceGammaRamp GetTextExtentPoint32W GetTextExtentPoint32A GetStockObject GetDIBits GetObjectA SetBkColor CreateSolidBrush RemoveFontResourceA AddFontResourceA BitBlt DeleteObject SetDeviceGammaRamp SelectObject CreatePalette GetGlyphOutlineW DeleteDC

advapi32

GetUserNameA OpenProcessToken GetTokenInformation EqualSid RegCloseKey RegSetValueExA RegCreateKeyExA FreeSid RegOpenKeyExA RegOpenKeyA RegQueryValueExA AllocateAndInitializeSid

user32

CloseClipboard GetClipboardData OpenClipboard IsClipboardFormatAvailable CreateWindowExA IsCharAlphaW IsCharAlphaNumericW SetCursorPos ScreenToClient GetCursorPos GetActiveWindow SetRect PostMessageA GetWindowThreadProcessId EndDialog SetWindowPos MessageBoxA GetWindowRect HideCaret GetKeyState SendMessageA GetWindow IsWindow FindWindowA SetFocus CallNextHookEx SetCursor GetWindowTextA wsprintfA DefWindowProcA PostQuitMessage ChangeDisplaySettingsA SystemParametersInfoA EnumDisplaySettingsA ClipCursor GetClassLongA ShowCaret SetMenu DestroyAcceleratorTable LoadMenuA RegisterClassA DestroyMenu GetIconInfo EnableWindow CheckRadioButton SetWindowTextA AppendMenuA CreatePopupMenu CreateMenu CharNextExA CallWindowProcA UnhookWindowsHookEx SetWindowLongA GetWindowLongA SetWindowsHookExA PtInRect AdjustWindowRect GetClientRect GetDesktopWindow RegisterClassExA LoadCursorA DestroyWindow LoadIconA ShowWindow DispatchMessageA TranslateMessage TranslateAcceleratorA GetMessageA PeekMessageA RegisterHotKey LoadAcceleratorsA SetForegroundWindow LoadStringA MoveWindow GetKeyboardLayout GetFocus GetMenu IsDlgButtonChecked GetDC ReleaseDC UpdateWindow MessageBoxW CharNextA CharNextW DialogBoxParamA GetSystemMetrics GetDlgItem SetWindowTextW

imm32

ImmGetCandidateWindow ImmSetConversionStatus ImmGetConversionStatus ImmNotifyIME ImmSetCandidateWindow ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmGetProperty ImmAssociateContext

kernel32

LCMapStringA GetTimeZoneInformation IsValidCodePage GetOEMCP GetCPInfo HeapSize LCMapStringW HeapCreate HeapDestroy HeapReAlloc VirtualAlloc VirtualFree FatalAppExitA SetHandleCount GetFileType GetConsoleCP GetConsoleMode SetConsoleCtrlHandler FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetStdHandle InterlockedExchange Sleep CloseHandle WriteFile CreateFileW ReadFile GetFileSize CreateFileA lstrlenA GetLastError InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetFilePointer WideCharToMultiByte InterlockedIncrement InterlockedDecrement ResetEvent CreateEventA DeleteFileA CreateDirectoryA SetCurrentDirectoryA MultiByteToWideChar SetEvent WaitForSingleObject CreateThread OutputDebugStringA GetTickCount GetModuleFileNameA VirtualQuery lstrcmpW GetACP GetVersion GlobalUnlock GlobalLock Beep GetProcAddress GetModuleHandleA CreateMutexA WinExec GetCurrentProcess GetCurrentProcessId GetLocalTime SetUnhandledExceptionFilter CompareStringA FindClose FindFirstFileA FileTimeToSystemTime FileTimeToLocalFileTime GetFileTime GetSystemDirectoryA FindNextFileA SetFileAttributesA GetCommandLineA FreeLibrary LoadLibraryA GetLocaleInfoA GetThreadLocale GetVersionExA lstrcmpA GetSystemInfo IsProcessorFeaturePresent MapViewOfFile CreateFileMappingA UnmapViewOfFile LockResource LoadResource SizeofResource FindResourceA FindResourceW GetFullPathNameA lstrcmpiA HeapAlloc GetProcessHeap HeapFree GetCurrentThread TlsFree TlsSetValue TlsAlloc TlsGetValue IsDebuggerPresent TerminateProcess GetStartupInfoA UnhandledExceptionFilter ExitProcess GetSystemTimeAsFileTime RaiseException RtlUnwind GlobalFree GlobalAlloc GlobalMemoryStatus SetLastError Process32First Process32Next CreateToolhelp32Snapshot Module32First Module32Next CopyFileA GetFileAttributesA GetCurrentDirectoryA QueryPerformanceCounter GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW GetLocaleInfoW SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile CompareStringW SetEnvironmentVariableA TerminateThread SetThreadPriority ExitThread lstrcpyA lstrcatA GetExitCodeThread VirtualProtect GetSystemDefaultLangID _lwrite QueryPerformanceFrequency MulDiv lstrcpynA ResumeThread GetWindowsDirectoryA SuspendThread CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatus FlushViewOfFile ReleaseSemaphore SleepEx FlushInstructionCache GetCurrentThreadId

shell32

ShellExecuteW ShellExecuteA SHGetSpecialFolderPathA ExtractIconExA

wininet

InternetCloseHandle InternetGetLastResponseInfoA FtpSetCurrentDirectoryA FtpCreateDirectoryA FtpRemoveDirectoryA FtpDeleteFileA FtpRenameFileA InternetOpenA FtpOpenFileA FtpGetFileA FtpGetCurrentDirectoryA InternetFindNextFileA FtpFindFirstFileA DeleteUrlCacheEntry FtpPutFileA InternetCrackUrlA InternetConnectA InternetWriteFile

urlmon

URLDownloadToFileA

ws2_32

inet_ntoa WSAGetOverlappedResult gethostname WSAResetEvent WSAWaitForMultipleEvents gethostbyaddr ntohs inet_addr WSACleanup closesocket bind htonl htons socket WSACloseEvent WSARecvFrom WSASendTo WSAStartup getsockname select WSAGetLastError connect ioctlsocket send WSACreateEvent recvfrom gethostbyname sendto accept getpeername getsockopt WSASend listen WSASocketA shutdown WSAIoctl WSARecv setsockopt WSASetEvent

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

ddraw

DirectDrawCreateEx

iphlpapi

GetAdaptersInfo GetTcpTable

winmm

timeGetTime mmioAscend mmioRead mmioDescend mmioGetInfo mmioCreateChunk mmioSeek mmioSetInfo mmioAdvance mmioWrite mmioClose mmioOpenA timeSetEvent timeKillEvent

d3d9

Direct3DCreate9

ole32

CoCreateGuid CoUninitialize CoInitialize

dsound

ord11

generic

count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=36, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=2, id=126, version=50327,

count=67, id=125, productName=VS2005 build 50727, version=50727,

count=236, id=109, productName=VS2005 build 50727, version=50727,

count=21, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=98, id=114, version=50727,

count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=28, version=9178,

count=9, id=95, version=2067,

count=6, id=18, version=8444,

count=110, id=29, version=9178,

count=6, id=25, version=9210,

count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=391, id=1, productName=Unmarked objects,

count=762, id=110, productName=VS2005 build 50727, version=50727,

count=1, id=122, productName=VS2005 build 50727, version=50727,

count=1, id=124, productName=VS2005 build 50727, version=50727,

count=1, id=120, productName=VS2005 build 50727, version=50727,

Sharing

General

Malware Config

Signatures

File Explorer

No_xTrap.rar

No xTrap/AgentServer.exe

kernel32

iphlpapi

ws2_32

user32

gdi32

advapi32

ole32

generic

No xTrap/SR_GameServer.exe

kernel32

user32

gdi32

shell32

wininet

iphlpapi

ws2_32

advapi32

ole32

odbc32

generic

No xTrap/server.cfg

No xTrap/sro_client.exe

gdi32

advapi32

user32

imm32

kernel32

shell32

wininet

urlmon

ws2_32

version

ddraw

iphlpapi

winmm

d3d9

ole32

dsound

generic