Static task
static1
Behavioral task
behavioral1
Sample
e89a67995746b0e1812301fb3f67320727920757a26209d17b7de5dd56de077b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e89a67995746b0e1812301fb3f67320727920757a26209d17b7de5dd56de077b.exe
Resource
win10v2004-20220812-en
General
-
Target
e89a67995746b0e1812301fb3f67320727920757a26209d17b7de5dd56de077b
-
Size
387KB
-
MD5
4eadf46eaf205bf4419c8a7440ed07f0
-
SHA1
0fa2104355f72bddd27b10522a6111ce4e4d940f
-
SHA256
e89a67995746b0e1812301fb3f67320727920757a26209d17b7de5dd56de077b
-
SHA512
49784e442906dfdde73e9a47b2f2e09342d11e80835afb6777fc24bfd0e553febe157fd85f2698b95a5ff08faf6e874a7beb89a5965bb492ea21e41d2b854692
-
SSDEEP
12288:RQN8Mo4O0zz/zz3zzDzzpzzzUzzJgzzzzzzzzzzzzzzzzzzzzxzezWzNEznzsJHh:RD90zz/zz3zzDzzpzzzUzzWzzzzzzzzZ
Malware Config
Signatures
Files
-
e89a67995746b0e1812301fb3f67320727920757a26209d17b7de5dd56de077b.exe windows x86
3d25a25da1fcedc5387e08c16d64fa14
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
InitCommonControlsEx
common
?EndLogTimer@TXLog@@YAXXZ
?TXAssert@@YAXPB_W0H@Z
?OnExitWinMain@Misc@Util@@YAXXZ
?NotifyIdle@TXTimer@@YAXXZ
??BCTXBSTR@@QBEPA_WXZ
??YCTXStringW@@QAEAAV0@PB_W@Z
??4CTXStringW@@QAEAAV0@PB_W@Z
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
??1CTXBSTR@@QAE@XZ
??YCTXStringW@@QAEAAV0@ABV0@@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
?Format@CTXStringW@@QAAXPB_WZZ
??0CTXStringW@@QAE@PB_W@Z
??1CTXStringW@@QAE@XZ
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??H@YA?AVCTXStringW@@PB_WABV0@@Z
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
ord25
??0CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@PA_W@Z
?RecordTransEnd@Perf@Util@@YAJ_JPB_WHH11H@Z
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?RecordTransBegin@Perf@Util@@YA_JPB_WHH00@Z
?AddIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
?MinimzeMemory@Sys@Util@@YAXXZ
?Left@CTXStringW@@QBE?AV1@H@Z
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?SetIdleCallback@TXTimer@@YAHPAUITXIdleCallback@@I@Z
?ConvertToPureFile@FS@@YA?AVCTXStringW@@PB_W@Z
?NotifyIdle@Window@Util@@YAJXZ
?ReverseFind@CTXStringW@@QBEH_W@Z
?DelIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z
??BCTXStringW@@QBEPB_WXZ
?GetMemoryUsage@Sys@Util@@YAXAAK0@Z
?ClearDeadQueue@Misc@Util@@YAXXZ
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?AddFmtString@TXStringBundle@@YAXABVCFmtString@@@Z
?InitBugReport@TXBugReport@@YAXPB_W000GGKHHKKP6GHPAUtagBugReportInfo@1@PBD200PAPAXPAKPAX@Z@Z
?GetSession@TXLog@@YAKXZ
?GetLCID@NLS@@YAKXZ
?ValidateBugReport@TXBugReport@@YAXXZ
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?StartLogTimer@TXLog@@YAXK@Z
?InitNetwork@Network@Util@@YAHXZ
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?SetTencentProductName@ProductConfig@Util@@YAHABVCTXStringW@@@Z
?InitPlatformFileSystem@Boot@Util@@YAHXZ
?SetBugReportUin@TXBugReport@@YAXKPB_W@Z
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
?SetBugReportFlag@TXBugReport@@YAHK@Z
??0CFmtString@@QAE@XZ
??1CFmtString@@QAE@XZ
?PropertyStr@CFmtString@@QAEHPB_W0@Z
?GetString@CTXStringW@@QBEPB_WXZ
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
??8@YA_NABVCTXStringW@@PB_W@Z
?Encode16@Encode@Util@@YA?AVCTXStringW@@ABVCTXBuffer@@@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
??8@YA_NPB_WABVCTXStringW@@@Z
?IsEmpty@CTXStringW@@QBE_NXZ
?GetAt@CTXStringW@@QBE_WH@Z
??ACTXStringW@@QBE_WH@Z
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z
ord34
?GetLength@CTXStringW@@QBEHXZ
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?GetFileHash@FS@Util@@YAHPB_WAAVCTXBuffer@@AAK@Z
?EraseIdleCallback@TXTimer@@YAHPAUITXIdleCallback@@I@Z
??0CTXStringW@@QAE@ABV0@@Z
?Stop@TXBugMonitor@@YAHXZ
?OnExitCoreCenter@Misc@Util@@YAXXZ
?OnUninitCom@Misc@Util@@YAXXZ
imdllbuild
?Create@MVC_KERNEL@@YAPAVIMVCModule@@PB_WKABVROOM_HANDLE@@@Z
?Destroy@MVC_KERNEL@@YAXPB_WKABVROOM_HANDLE@@@Z
?IsQuickLogin@CommandLine@Util@@YAHXZ
?GetStartupUin@CommandLine@Util@@YAKXZ
?GetVersionExW@Version@@YAXAAUtagVersionInfo@1@@Z
?VersionUpdate@QQUPDATECENTER@@YAJPB_W000000@Z
?GetStartupAccount@CommandLine@Util@@YA?AVCTXStringW@@XZ
?GetStartupMiniQTInfo@CommandLine@Util@@YA?AVCTXStringW@@XZ
?GetProgramRootDir@Sys@Util@@YA?AVCTXStringW@@XZ
?GetStartupType@CommandLine@Util@@YAHXZ
?GetStartupUI@CommandLine@Util@@YAHXZ
?IsAccountLogined@Account@Util@@YAHK@Z
?Init@Version@@YAHXZ
?GetStartupGameID@CommandLine@Util@@YA_JXZ
?GetMajorVer@Version@@YAEXZ
?GetMinorVer@Version@@YAEXZ
?GetBuildVer@Version@@YAKXZ
?GetVersionUpdatedInfo@CommandLine@Util@@YAHXZ
kernel32
Sleep
GetSystemInfo
WriteProcessMemory
QueryPerformanceFrequency
GlobalMemoryStatus
GetProcAddress
FreeLibrary
GetModuleHandleW
GetCurrentProcess
InterlockedIncrement
QueryPerformanceCounter
InterlockedDecrement
GetEnvironmentVariableW
SetEvent
SetEnvironmentVariableW
GetCurrentThreadId
DeleteCriticalSection
FindFirstFileW
CreateProcessW
RaiseException
FindNextFileW
FindClose
GetVersionExW
GetPrivateProfileStringW
LocalAlloc
InterlockedExchange
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
CloseHandle
ReleaseMutex
GetTickCount
GetSystemDirectoryW
GetLastError
CreateMutexW
LoadLibraryW
GetModuleFileNameW
InitializeCriticalSection
user32
wsprintfW
WaitMessage
PeekMessageW
TranslateMessage
MessageBoxW
DispatchMessageW
PostThreadMessageW
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
shell32
SHGetSpecialFolderLocation
ShellExecuteW
ShellExecuteExW
SHGetPathFromIDListW
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
OleInitialize
OleUninitialize
oleaut32
SysAllocString
SysFreeString
SysStringLen
atl80
ord64
ord32
ord30
shlwapi
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
msvcp80
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
msvcr80
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
__CxxFrameHandler3
__dllonexit
??3@YAXPAX@Z
_invalid_parameter_noinfo
??2@YAPAXI@Z
wcsncpy
_wcslwr_s
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
mbstowcs_s
??1exception@std@@UAE@XZ
wcsncat_s
__argc
__wargv
wcsncmp
_wtoi
printf
_time64
wcscpy_s
wcsrchr
memset
?terminate@@YAXXZ
_unlock
winmm
PlaySoundW
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 220KB - Virtual size: 216KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
kruqeru Size: 8KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 80KB - Virtual size: 77KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE