36182e62adb1f69691cada28d683037276224c3accbee16ac9ff1d4498644167

Sharing

Copy URL Twitter E-mail

General

Target
36182e62adb1f69691cada28d683037276224c3accbee16ac9ff1d4498644167
Size 5.4MB
Sample260805-a8a98sbc33
SHA256 36182e62adb1f69691cada28d683037276224c3accbee16ac9ff1d4498644167
MD5 12bd4158a54519f15c209044508f2503
SHA1 a5e385e475a8898a7c7bfdaa650c4a7be8b82dd8
SHA512 b953c47d3f3d539b68c1cb7d3caa64c49e873529ab1a26ff4ce05ec1a87079bee8fbe1cfea8121658a60d5c0015c5129b861358ecbce3f3d6dbcae39fb1053d5
SSDEEP 98304:6VACU9Wuk6y/GdaGzIgnVNdHghhzgV4i2AHGFXfmtQJ6T:6Vl2W0yCaG1Cx6t
TLSH
T11A46BE21B906C1B1E9C211B5897CBFBF856C98241B6449D7D3C81E6EDE702C33B7299B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36182e62adb1f69691cada28d683037276224c3accbee16ac9ff1d4498644167

File Explorer

36182e62adb1f69691cada28d683037276224c3accbee16ac9ff1d4498644167

.exe 5.4MB

36182e62adb1f69691cada28d683037276224c3accbee16ac9ff1d4498644167

IMPHASH 0633975028658a42b04d78b30ff3519d
SHA256 36182e62adb1f69691cada28d683037276224c3accbee16ac9ff1d4498644167
MD5 12bd4158a54519f15c209044508f2503
SHA1 a5e385e475a8898a7c7bfdaa650c4a7be8b82dd8
SHA512 b953c47d3f3d539b68c1cb7d3caa64c49e873529ab1a26ff4ce05ec1a87079bee8fbe1cfea8121658a60d5c0015c5129b861358ecbce3f3d6dbcae39fb1053d5
SSDEEP 98304:6VACU9Wuk6y/GdaGzIgnVNdHghhzgV4i2AHGFXfmtQJ6T:6Vl2W0yCaG1Cx6t
TLSH
T11A46BE21B906C1B1E9C211B5897CBFBF856C98241B6449D7D3C81E6EDE702C33B7299B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2914704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\tauri\Desktop\Martysama v5.8 Ikarus v2 Ultimate Multilanguage\UPDATE-2.5--source-client\source-client\Srcs\Client\bin\Release\metin2client.pdb

kernel32

DeleteFileA GetCurrentDirectoryA GetTickCount GetCurrentDirectoryW ReadProcessMemory GetCurrentProcessId GetCurrentProcess GetLastError SetEndOfFile FindNextFileA FindFirstFileA FindClose MultiByteToWideChar ReleaseMutex WriteConsoleW HeapQueryInformation HeapSize OutputDebugStringW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetStdHandle DeleteFileW GetTimeZoneInformation CreateProcessW GetExitCodeProcess SetConsoleCtrlHandler HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect CreateMutexA HeapAlloc HeapFree GetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType ExitProcess TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread SetFileAttributesA FlsSetValue FlsGetValue FlsAlloc InterlockedFlushSList InterlockedPushEntrySList RtlUnwind RaiseException GetThreadTimes GetCurrentThread QueryPerformanceFrequency SetLastError WaitNamedPipeW PeekNamedPipe GetModuleFileNameW GetSystemTimeAsFileTime GetStartupInfoW InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive FindResourceW FindResourceA SizeofResource LoadResource LockResource CreateFileW IsProcessorFeaturePresent InterlockedDecrement GetProcessHeap HeapValidate InterlockedIncrement GetCPInfo CompareStringEx GetModuleFileNameA GlobalFree lstrlenA GetPrivateProfileStringA MoveFileA WakeConditionVariable TryAcquireSRWLockExclusive GetLogicalProcessorInformationEx GetExitCodeThread SwitchToThread WaitForSingleObjectEx IsThreadAFiber GetSystemTimePreciseAsFileTime LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx Module32Next Module32First Process32Next Process32First CreateToolhelp32Snapshot GetSystemInfo OpenProcess SetThreadPriority Sleep CreateEventA WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetStringTypeW CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFile2 CreateDirectoryExW GetModuleHandleW DeviceIoControl AreFileApisANSI CreateFile2 GetTempPathW SetFileTime SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindFirstFileW CreateDirectoryW SetCurrentDirectoryW GetLocaleInfoEx LocalFree FormatMessageA QueryPerformanceCounter CopyFileA CreateSemaphoreA ReleaseSemaphore GetLocaleInfoA CompareStringA WideCharToMultiByte lstrlenW GlobalLock GlobalUnlock FreeLibrary GetVersionExA GetSystemDirectoryA GetModuleHandleA WriteFile SetFilePointer ReadFile LoadLibraryA GetProcAddress GetCurrentThreadId SetUnhandledExceptionFilter GetFileSize CreateFileA CreateFileMappingA UnmapViewOfFile MapViewOfFile OutputDebugStringA GetTempFileNameA GetTempPathA RemoveDirectoryA AllocConsole GlobalAlloc InitializeCriticalSection CloseHandle GetFileAttributesA FlsFree CreateDirectoryA

user32

EndPaint InvalidateRect GetClientRect FillRect SetCursorPos SetRect OffsetRect LoadStringA MessageBoxA CharNextW GetClipboardData CloseClipboard OpenClipboard GetKeyboardLayout GetKeyboardLayoutNameA DispatchMessageA TranslateMessage BeginPaint LoadCursorA AdjustWindowRectEx GetWindowRect SetWindowTextA GetMenu RegisterClassA CharPrevExA CharNextExA SetWindowLongA GetWindowLongA UpdateWindow SetFocus MoveWindow DestroyWindow IsWindow CreateWindowExA RegisterClassExA GetMessageA GetDC PeekMessageA SetCursor ShowCursor GetKeyState SystemParametersInfoA LoadIconA SetCapture UnregisterClassA DefWindowProcA GetCapture ShowWindow GetAsyncKeyState SetWindowPos PostQuitMessage DestroyCursor LoadImageA ReleaseDC FindWindowA ScreenToClient GetCursorPos GetSystemMetrics ChangeDisplaySettingsA ReleaseCapture ClientToScreen

gdi32

SetTextColor SelectObject CreateCompatibleDC DeleteDC SetBkMode SetDIBitsToDevice CreateDIBSection TextOutA GetTextExtentPoint32W GetCharABCWidthsFloatW CreateFontIndirectA EnumFontFamiliesExA CreateSolidBrush DeleteObject PatBlt StretchBlt GetTextExtentPoint32A SetBkColor TextOutW GetStockObject

ole32

CoInitializeEx OleUninitialize OleInitialize CoCreateInstance CoInitialize CoUninitialize CoGetClassObject OleSetContainedObject

winmm

timeGetDevCaps timeGetTime timeEndPeriod timeBeginPeriod

d3d8

Direct3DCreate8

python27

PyDict_GetItemString PyObject_GetAttrString PyObject_HasAttrString Py_IncRef PyInt_FromLong PyInt_FromSize_t PyBool_FromLong PyString_FromString PyString_AsString PyTuple_New PyList_New PyList_Size PyList_GetItem PyList_Append PyDict_New PyDict_SetItemString PyImport_ImportModule _Py_NoneStruct PyInt_AsLong PyDict_Next PyDict_Size PyErr_SetString PyExc_RuntimeError PyFloat_FromDouble PyArg_ParseTuple PyTuple_Size PyModule_AddStringConstant PyString_InternFromString PyObject_GetAttr PyCallable_Check PyLong_AsLongLong Py_BuildValue PyErr_Clear PyErr_BadArgument PyErr_Print PyObject_CallObject PyNumber_Check PyModule_GetDict PyErr_Fetch Py_SetProgramName Py_Initialize Py_Finalize PyRun_StringFlags PyEval_SetTrace Py_FlushLine PyImport_GetMagicNumber PyImport_AddModule PyObject_AsCharBuffer PyCode_Addr2Line PyEval_EvalCode Py_OptimizeFlag PyCode_Type PyUnicodeUCS2_DecodeUTF8 _PyLong_FromByteArray PyComplex_FromCComplex PyLong_AsLong PyTuple_GetItem Py_InitModule4 PyTuple_SetItem PyModule_AddIntConstant PyString_FromStringAndSize PyList_SetItem PyDict_SetItem PyErr_Occurred PyErr_NoMemory PyEval_GetRestricted PyCode_New PyMarshal_ReadObjectFromString _PyLong_New _Py_EllipsisObject PyExc_StopIteration PyExc_EOFError PyExc_ValueError PyFloat_AsDouble PyLong_FromLongLong

imm32

ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmGetContext ImmIsIME ImmGetIMEFileNameA ImmNotifyIME

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

devil

ilGenImages ilDeleteImages ilBindImage ilInit ilTexImage ilSetPixels ilSave ilShutDown ilOriginFunc ilLoad ilEnable ilCopyPixels ilConvertImage ilGetInteger

granny2

_GrannyGetMeshVertexCount@4 _GrannyGetTotalTypeSize@4 _GrannyGetWorldPoseComposite4x4@8 _GrannyGetWorldPose4x4@8 _GrannyFreeWorldPose@4 _GrannyNewWorldPose@4 _GrannyFindBoneByName@12 _GrannyGetMeshBindingToBoneIndices@4 _GrannyFreeMeshBinding@4 _GrannyNewMeshBinding@12 _GrannyFreeModelInstance@4 _GrannyInstantiateModel@4 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyFreeLocalPose@4 _GrannyNewLocalPose@4 _GrannyUpdateModelMatrix@20 _GrannySampleModelAnimationsAccelerated@20 _GrannyGetMeshIndexCount@4 _GrannySetModelClock@8 _GrannyGetSourceSkeleton@4 _GrannyGetFileInfo@4 _GrannyFreeFile@4 _GrannyGetMeshVertexType@4 _GrannyReadEntireFileFromMemory@8 _GrannyConvertSingleObject@20 _GrannyFindMatchingMember@16 _GrannyGetMaterialTextureByType@8 _GrannySetLogCallback@4 _GrannyCopyMeshVertices@12 _GrannyGetMeshVertices@4 _GrannyCopyMeshIndices@12 _GrannyNewMeshDeformer@16 _GrannyFreeMeshDeformer@4 _GrannyDeformVertices@24 GrannyPNT332VertexType _GrannyFreeControl@4 _GrannyFreeControlOnceUnused@4 _GrannyCompleteControlAt@8 _GrannyControlIsComplete@4 _GrannyFreeControlIfComplete@4 _GrannyGetControlLoopCount@4 _GrannySetControlLoopCount@8 _GrannyGetControlSpeed@4 _GrannySetControlSpeed@8 _GrannyGetControlLocalDuration@4 _GrannySetControlEaseIn@8 _GrannySetControlEaseInCurve@28 _GrannySetControlEaseOut@8 _GrannySetControlEaseOutCurve@28 _GrannyGetControlRawLocalClock@4 _GrannySetControlRawLocalClock@8 _GrannyPlayControlledAnimation@12 _GrannyGetMeshTriangleGroupCount@4 _GrannyMeshIsRigid@4 _GrannyFreeCompletedModelControls@4 _GrannyGetMeshTriangleGroups@4 _GrannyFreeFileSection@8

mss32

_AIL_mem_free_lock@4 _AIL_file_read@8 _AIL_set_file_callbacks@16 _AIL_WAV_info@8 _AIL_decompress_ASI@24 _AIL_decompress_ADPCM@12 _AIL_file_type@8 _AIL_auto_update_3D_position@8 _AIL_open_digital_driver@16 _AIL_3D_sample_volume@4 _AIL_3D_sample_status@4 _AIL_set_3D_sample_loop_count@8 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_file@8 _AIL_end_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_stop_3D_sample@4 _AIL_start_3D_sample@4 _AIL_release_3D_sample_handle@4 _AIL_allocate_3D_sample_handle@4 _AIL_sample_volume_pan@12 _AIL_sample_status@4 _AIL_set_sample_loop_count@8 _AIL_set_sample_volume_pan@12 _AIL_end_sample@4 _AIL_resume_sample@4 _AIL_stop_sample@4 _AIL_start_sample@4 _AIL_set_sample_file@12 _AIL_init_sample@4 _AIL_release_sample_handle@4 _AIL_allocate_sample_handle@4 _AIL_last_error@0 _AIL_stream_status@4 _AIL_set_stream_loop_count@8 _AIL_stream_volume_levels@12 _AIL_set_stream_volume_levels@12 _AIL_pause_stream@8 _AIL_start_stream@4 _AIL_close_stream@4 _AIL_set_redist_directory@4 _AIL_shutdown@0 _AIL_startup@0 _AIL_set_3D_orientation@28 _AIL_set_3D_velocity@20 _AIL_set_3D_position@16 _AIL_close_3D_listener@4 _AIL_open_3D_listener@4 _AIL_close_3D_provider@4 _AIL_open_3D_provider@4 _AIL_enumerate_3D_providers@12 _AIL_close_digital_driver@4 _AIL_open_stream@12 _AIL_update_3D_position@8

speedtreert

?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?DeleteTransientData@CSpeedTreeRT@@QAEXXZ ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ??3CSpeedTreeRT@@SAXPAX@Z ?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ ?SetTime@CSpeedTreeRT@@SAXM@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ??0SGeometry@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1CSpeedTreeRT@@QAE@XZ ??2CSpeedTreeRT@@SAPAXI@Z ?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z

dinput8

DirectInput8Create

ws2_32

select __WSAFDIsSet closesocket connect ioctlsocket recv send socket WSAGetLastError WSAStartup WSACleanup htonl htons inet_addr ntohl ntohs gethostbyname gethostname

ddraw

DirectDrawCreate

advapi32

RegSetValueExW CryptAcquireContextA RegOpenKeyExA RegQueryValueExA CryptReleaseContext CryptGenRandom RegOpenKeyA RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathA

oleaut32

VariantClear VariantInit SafeArrayAccessData SafeArrayDestroy SafeArrayCreate SysAllocString SysFreeString

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

686KB

Virtual Size

685KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

211KB

Virtual Size

683KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

196KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=43, id=264, version=36252,

count=49, id=259, version=33145,

count=220, id=261, version=33145,

count=4, id=170, productName=VS2010 build 30319, version=30319,

count=59, id=261, version=33523,

count=2, id=262, version=33145,

count=58, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=48, version=9044,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=2, id=257, productName=VS2015 [14.0] build 23026, version=23026,

count=5, id=261, productName=VS2019 v16.11.1 build 30133, version=30133,

count=1, id=253, version=35721,

count=29, id=259, version=35721,

count=20, id=260, version=35721,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=28, version=9178,

count=76, id=29, version=9178,

count=1, id=18, version=8444,

count=8, productName=Unmarked objects (old),

count=4, id=25, version=9210,

count=1, id=260, version=36252,

count=43, id=260, version=33145,

count=25, id=257, version=33145,

count=543, id=1, productName=Unmarked objects,

count=100, id=261, version=35721,

count=303, id=261, version=36252,

count=1, id=255, version=36252,

count=1, id=151,

count=1, id=258, version=36252,