后门x2 0930[.]7z

Sharing

Copy URL Twitter E-mail

General

Target

后门x2 0930.7z
Size

1.2MB
MD5

39f55b22fdb4d8b9dbf61094e83ec51c
SHA1

7830a5c221663e25b6b8618f7486ba4affa03a9d
SHA256

5149a5f48ad64788af9f56c7744a513b65d92450053a745c80e8c31aa7fe301a
SHA512

5e2e7c9d612850611546d2bdef66eef9c0bc21d8978a15d5f8f489afa6d934fa5fce7e14d5a0afae315f9fdc97d88e10d350d0d1d9fd97bef8bd8f989ea94f52
SSDEEP

24576:OpHERZGgqg9bv7w386qt6Q48u/Eyuv46IckOADma2Dn6FB4or138:OxERZTwMvb48Mk4y+snW4ox8

Score

N/A

Malware Config

Signatures

Files

后门x2 0930.7z
.7z

Password: infected
点击安装(飞机)简体中文语言包_v34.exe
.exe windows x64

ed83cc1f929fd7a8eacbed13a26c4727

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

Sleep
WriteConsoleW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetFileType
CloseHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetProcessHeap
HeapSize
CreateFileW
RtlUnwind

Sections

.text
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
跑分话术资料+.bat
.exe windows x86

82c344058fb1e135a5b9965af31eb688

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeResource
MulDiv
LocalFree
FormatMessageA
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
lstrcmpA
InterlockedExchange
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
GetCurrentThreadId
DeleteCriticalSection
TlsFree
GetModuleFileNameW
GlobalFlags
InterlockedIncrement
GetCPInfo
GetOEMCP
GetModuleHandleW
WritePrivateProfileStringA
FlushFileBuffers
GetCurrentProcess
SetErrorMode
RtlUnwind
GetSystemTimeAsFileTime
RaiseException
HeapFree
HeapAlloc
GetCommandLineA
GetStartupInfoA
HeapReAlloc
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
HeapCreate
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
CompareStringA
LoadLibraryA
SetLastError
MultiByteToWideChar
lstrcmpW
GetModuleHandleA
GetProcAddress
SetFileTime
GetCurrentDirectoryA
GetFileAttributesA
CreateDirectoryA
LocalFileTimeToFileTime
lstrcpyA
lstrlenA
lstrcatA
SystemTimeToFileTime
ReadFile
SetFilePointer
CreateFileMappingA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
FindFirstFileA
FindClose
GetLastError
GetCurrentProcessId
OpenProcess
QueryFullProcessImageNameW
GetTickCount64
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetModuleFileNameA
ExitProcess
Sleep
GetVersionExA
DeleteFileA
CreateFileA
WriteFile
CloseHandle
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
LocalReAlloc
InterlockedDecrement

user32

GetMessageA
SetCursor
DestroyMenu
GetSysColorBrush
LoadCursorA
UnregisterClassA
ReleaseDC
GetDC
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
IsWindowEnabled
ShowWindow
SetWindowTextA
IsDialogMessageA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuState
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
TranslateMessage
SetWindowsHookExA
CallNextHookEx
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
GetKeyState
SetMenu
SetForegroundWindow
IsWindowVisible
UpdateWindow
PostMessageA
GetSubMenu
GetMenuItemID
GetMenuItemCount
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
EnableWindow
SendMessageA
GetParent
GetWindowRect
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
GetWindowLongA
GetCursorPos
ValidateRect
PostQuitMessage
GetWindowThreadProcessId
CharUpperW
IsIconic
GetClientRect
GetSystemMetrics
wsprintfA
EndPaint
BeginPaint
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetCapture
SetWindowLongA
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
GetWindow
GetClassLongA
UnhookWindowsHookEx

gdi32

GetStockObject
DeleteDC
GetClipBox
SetTextColor
SetBkColor
GetObjectA
SetViewportExtEx
CreateBitmap
SaveDC
DeleteObject
ScaleWindowExtEx
RestoreDC
SetMapMode
PtVisible
SetWindowExtEx
GetDeviceCaps
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
ScaleViewportExtEx

advapi32

RegCreateKeyExA
RegQueryValueA
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegSetValueExA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteA
ShellExecuteExA

ole32

CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

VariantClear
VariantChangeType
VariantInit

shlwapi

PathFindFileNameA
PathFindExtensionA

psapi

EnumProcesses

oleacc

LresultFromObject
CreateStdAccessibleObject

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

Sections

.text
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.0MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

ed83cc1f929fd7a8eacbed13a26c4727

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 133KB - Virtual size: 132KB

.rdata Size: 70KB - Virtual size: 69KB

.data Size: 4KB - Virtual size: 10KB

.pdata Size: 8KB - Virtual size: 7KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 2KB - Virtual size: 2KB

82c344058fb1e135a5b9965af31eb688

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

oleacc

winspool.drv

Sections

.text Size: 149KB - Virtual size: 149KB

.rdata Size: 41KB - Virtual size: 41KB

.data Size: 1.0MB - Virtual size: 1.1MB

.rsrc Size: 46KB - Virtual size: 46KB

.text
Size: 133KB - Virtual size: 132KB

.rdata
Size: 70KB - Virtual size: 69KB

.data
Size: 4KB - Virtual size: 10KB

.pdata
Size: 8KB - Virtual size: 7KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 149KB - Virtual size: 149KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 1.0MB - Virtual size: 1.1MB

.rsrc
Size: 46KB - Virtual size: 46KB