0x0ject (gamehack).unpacked.exe - Win.Trojan.Hacktool-407

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

parent	0x0ject (gamehack).exe
filename	0x0ject (gamehack).unpacked.exe
size	159744 (0x27000)
md5	b8113283ddd7d800a497680c691edbd6

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	Win.Trojan.Hacktool-407 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
14	7299	18
10	9782	64
49	9044	1
0	0	5
19	8034	13
1	0	145
11	9782	6
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x42e11783
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x10000
SizeOfInitializedData	0x1af000
SizeOfUninitializedData	0
AddressOfEntryPoint	0xa737
BaseOfCode	0x1000
BaseOfData	0x11000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x1c0000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

Armadillo v4.x

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xf184	0x10000	R-X CODE
.rdata	0x11000	0x142c	0x2000	R-- IDATA
.data	0x13000	0x19ec58	0x6000	RW- IDATA
.rsrc	0x1b2000	0xd6e0	0xe000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x116f8	0xa0
RESOURCE	0x1b2000	0xd6e0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
WAVE	#155	2916
WAVE	#157	11684
WAVE	#158	4244
ICON	#1	872
ICON	#2	3240
ICON	#3	872
ICON	#4	3240
ICON	#5	872
ICON	#6	3240
ICON	#7	3240
ICON	#8	872
ICON	#9	3240
ICON	#10	744
ICON	#11	296
ICON	#12	1640
ICON	#13	2216
ICON	#14	3752
ICON	#15	1384
MENU	#147	468
DIALOG	#136	510
DIALOG	#148	1594
DIALOG	#153	596
DIALOG	#180	692
GROUP_ICON	#101	34
GROUP_ICON	#102	34
GROUP_ICON	#103	34
GROUP_ICON	#104	20
GROUP_ICON	#105	34
GROUP_ICON	#106	90
MANIFEST	#1	651

module_name	hint	ord	function_name
KERNEL32.DLL			WaitForSingleObject
KERNEL32.DLL			CreateRemoteThread
KERNEL32.DLL			WriteProcessMemory
KERNEL32.DLL			VirtualAllocEx
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			GetExitCodeThread
KERNEL32.DLL			LocalFree
KERNEL32.DLL			FormatMessageA
KERNEL32.DLL			UnmapViewOfFile
KERNEL32.DLL			MapViewOfFile
KERNEL32.DLL			LocalAlloc
KERNEL32.DLL			DebugActiveProcess
KERNEL32.DLL			TerminateProcess
KERNEL32.DLL			FreeLibrary
KERNEL32.DLL			GetFileSize
KERNEL32.DLL			CreateFileA
KERNEL32.DLL			SetStdHandle
KERNEL32.DLL			GetOEMCP
KERNEL32.DLL			GetACP
KERNEL32.DLL			GetCPInfo
KERNEL32.DLL			GetStringTypeW
KERNEL32.DLL			GetStringTypeA
KERNEL32.DLL			SetFilePointer
KERNEL32.DLL			HeapReAlloc
KERNEL32.DLL			VirtualAlloc
KERNEL32.DLL			WriteFile
KERNEL32.DLL			RtlUnwind
KERNEL32.DLL			VirtualFreeEx
KERNEL32.DLL			HeapCreate
KERNEL32.DLL			HeapDestroy
KERNEL32.DLL			GetVersionExA
KERNEL32.DLL			GetEnvironmentVariableA
KERNEL32.DLL			GetFileType
KERNEL32.DLL			GetStdHandle
KERNEL32.DLL			SetHandleCount
KERNEL32.DLL			GetEnvironmentStringsW
KERNEL32.DLL			GetEnvironmentStrings
KERNEL32.DLL			FreeEnvironmentStringsW
KERNEL32.DLL			FreeEnvironmentStringsA
KERNEL32.DLL			UnhandledExceptionFilter
KERNEL32.DLL			LCMapStringW
KERNEL32.DLL			LCMapStringA
KERNEL32.DLL			MultiByteToWideChar
KERNEL32.DLL			WideCharToMultiByte
KERNEL32.DLL			HeapAlloc
KERNEL32.DLL			HeapFree
KERNEL32.DLL			ExitProcess
KERNEL32.DLL			GetVersion
KERNEL32.DLL			GetCommandLineA
KERNEL32.DLL			GetStartupInfoA
KERNEL32.DLL			SuspendThread
KERNEL32.DLL			FlushFileBuffers
KERNEL32.DLL			FlushInstructionCache
KERNEL32.DLL			SetThreadContext
KERNEL32.DLL			CreateProcessA
KERNEL32.DLL			ResumeThread
KERNEL32.DLL			VirtualProtectEx
KERNEL32.DLL			GetLastError
KERNEL32.DLL			Module32First
KERNEL32.DLL			Module32Next
KERNEL32.DLL			GetModuleFileNameA
KERNEL32.DLL			OpenProcess
KERNEL32.DLL			GetFileAttributesA
KERNEL32.DLL			CreateToolhelp32Snapshot
KERNEL32.DLL			Process32First
KERNEL32.DLL			CloseHandle
KERNEL32.DLL			Process32Next
KERNEL32.DLL			GetModuleHandleA
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			GetCurrentThread
KERNEL32.DLL			GetThreadContext
KERNEL32.DLL			GetTickCount
KERNEL32.DLL			SetUnhandledExceptionFilter
KERNEL32.DLL			RaiseException
KERNEL32.DLL			Sleep
KERNEL32.DLL			IsDebuggerPresent
KERNEL32.DLL			GetCurrentProcessId
KERNEL32.DLL			GetCurrentProcess
KERNEL32.DLL			VirtualFree
KERNEL32.DLL			ReadProcessMemory
ADVAPI32.dll			RegCreateKeyExA
ADVAPI32.dll			AdjustTokenPrivileges
ADVAPI32.dll			LookupPrivilegeValueA
ADVAPI32.dll			GetSecurityInfo
ADVAPI32.dll			SetEntriesInAclA
ADVAPI32.dll			SetSecurityInfo
ADVAPI32.dll			RegDeleteKeyA
ADVAPI32.dll			OpenProcessToken
ADVAPI32.dll			RegSetValueExA
ADVAPI32.dll			RegOpenKeyExA
ADVAPI32.dll			RegQueryValueExA
ADVAPI32.dll			RegCloseKey
comdlg32.dll			GetOpenFileNameA
GDI32.dll			CreateFontA
GDI32.dll			SelectObject
GDI32.dll			DeleteObject
GDI32.dll			SetBkColor
GDI32.dll			SetTextColor
GDI32.dll			SetBkMode
GDI32.dll			GetTextExtentPoint32A
GDI32.dll			GetTextMetricsA
GDI32.dll			ExtTextOutA
SHLWAPI.dll			PathRemoveFileSpecA
SHLWAPI.dll			PathCompactPathA
SHLWAPI.dll			PathStripPathA
USER32.dll			EnableMenuItem
USER32.dll			DlgDirListComboBoxA
USER32.dll			GetMenu
USER32.dll			CheckMenuItem
USER32.dll			GetAsyncKeyState
USER32.dll			GetDlgItemTextA
USER32.dll			SetFocus
USER32.dll			DialogBoxParamA
USER32.dll			GetDC
USER32.dll			DrawIcon
USER32.dll			ReleaseDC
USER32.dll			KillTimer
USER32.dll			GetSysColorBrush
USER32.dll			EnableWindow
USER32.dll			SetTimer
USER32.dll			GetDesktopWindow
USER32.dll			GetWindow
USER32.dll			ShowWindow
USER32.dll			GetClassLongA
USER32.dll			GetClientRect
USER32.dll			InvalidateRect
USER32.dll			UpdateWindow
USER32.dll			GetWindowThreadProcessId
USER32.dll			MessageBoxA
USER32.dll			FindWindowA
USER32.dll			FindWindowExA
USER32.dll			EnumWindows
USER32.dll			SetWindowTextA
USER32.dll			GetSysColor
USER32.dll			SetRect
USER32.dll			DrawIconEx
USER32.dll			GetDlgItem
USER32.dll			LoadIconA
USER32.dll			SendMessageA
USER32.dll			EndDialog
USER32.dll			GetWindowTextA
USER32.dll			GetDialogBaseUnits
USER32.dll			MoveWindow
USER32.dll			SendMessageTimeoutA
USER32.dll			SetDlgItemTextA
WINMM.dll			PlaySoundA

show previews

offset	size	type	comment
0	159744	EXE	07/22/2005 15:57:55	#
15c1	15	HTM		#
21d38	2908	WAV		#
228a0	11676	WAV		#
25648	4236	WAV		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

0x0ject (gamehack).unpacked.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

0x0ject (gamehack).unpacked.exe
-