1f12d11290b2d01b15d31679ea3132d57499094d5f4dc1f3000a51379853b7e6

Sharing

Copy URL Twitter E-mail

General

Target

1f12d11290b2d01b15d31679ea3132d57499094d5f4dc1f3000a51379853b7e6
Size

5.7MB
MD5

bda962bb3db2e03de1e236759d18f065
SHA1

ec91206d0638b4951d904a7ae2d3a7129130fe14
SHA256

1f12d11290b2d01b15d31679ea3132d57499094d5f4dc1f3000a51379853b7e6
SHA512

c12c1f7a6e339281f5499e081f567f73786905259d254c46ba0a7452d770fe0c772f2b9e668c42da386c69345949eeb550779cad0c74764563bb91ac809bca6e
SSDEEP

98304:6GtGd1x3qfuoprp1CqJ9TP2FhQjUMdfkgdkXlzCrzAEo6ikGC/hSA6EYOyfavJ:bqsHJxP2rQj9dfkgdk1zMEYiaVofah

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/五笔打字通/appface.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/五笔打字通/appface.dll	upx

Files

1f12d11290b2d01b15d31679ea3132d57499094d5f4dc1f3000a51379853b7e6
.7z
五笔打字通/1.txt
五笔打字通/16d.TXT
五笔打字通/2.txt
五笔打字通/3.txt
五笔打字通/4.txt
五笔打字通/5.txt
五笔打字通/6.txt
五笔打字通/7.txt
五笔打字通/8.txt
五笔打字通/86help.htm
.html
五笔打字通/CLDZGR.TXT
五笔打字通/CoronaLAST.urf
五笔打字通/D1.txt
五笔打字通/D2.txt
五笔打字通/D3.txt
五笔打字通/DZyyy.TXT
五笔打字通/ERROR.WAV
五笔打字通/HDX.TXT
五笔打字通/LE4.urf
五笔打字通/MUSIC1.MID
五笔打字通/MUSIC10.mid
五笔打字通/MUSIC11.mid
五笔打字通/MUSIC12.mid
五笔打字通/MUSIC13.MID
五笔打字通/MUSIC14.mid
五笔打字通/MUSIC15.MID
五笔打字通/MUSIC2.MID
五笔打字通/MUSIC3.MID
五笔打字通/MUSIC4.MID
五笔打字通/MUSIC5.MID
五笔打字通/MUSIC6.MID
五笔打字通/MUSIC7.MID
五笔打字通/MUSIC8.MID
五笔打字通/MUSIC9.MID
五笔打字通/MacOS.urf
五笔打字通/NCC.TXT
五笔打字通/OpusOS.urf
五笔打字通/PixOS.urf
五笔打字通/RhodiumX.urf
五笔打字通/Type.wav
五笔打字通/VB5DB.DLL
.dll windows x86

2824fcddda9a05ec563c0e7037537798

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

EnterCriticalSection
GetLastError
OpenFile
_llseek
GetTempFileNameA
GetTempPathA
_lwrite
_lread
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
DeleteFileA
GetCommandLineA
GetProcAddress
GetModuleHandleA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
_lclose
LeaveCriticalSection
HeapAlloc
HeapFree
VirtualAlloc
LoadLibraryA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
FlushFileBuffers
CloseHandle
SetStdHandle
SetFilePointer

ole32

CoGetMalloc

oleaut32

SysAllocString
SysAllocStringByteLen
SysFreeString
SafeArrayDestroy
VariantInit
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
CreateErrorInfo
SysStringLen
VariantChangeType
SysAllocStringLen
VariantCopy
SafeArrayCreate
SetErrorInfo

Exports

Exports

DnaNewCRCRecordset

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
五笔打字通/XP-Luna.urf
五笔打字通/XP-Metallic.urf
五笔打字通/ZDQ.TXT
五笔打字通/ZFC.TXT
五笔打字通/ZGH.TXT
五笔打字通/appface.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

BkCreate
BkDelete
BkDraw
SkinRemove
SkinStart
SkinStartW
SkinThread
SkinWindowSet
SkinWindowSetEx
SkinWindowSetExW

Sections

UPX0
Size: - Virtual size: 424KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
五笔打字通/ar.txt
五笔打字通/bei.TXT
五笔打字通/bjx.txt
五笔打字通/bmp/001.bmp
五笔打字通/bmp/002.bmp
五笔打字通/bmp/003.bmp
五笔打字通/bmp/004.bmp
五笔打字通/bmp/005.bmp
五笔打字通/bmp/006.bmp
五笔打字通/bmp/007.bmp
五笔打字通/bmp/008.bmp
五笔打字通/bmp/009.bmp
五笔打字通/bmp/010.bmp
五笔打字通/bmp/011.bmp
五笔打字通/bmp/012.bmp
五笔打字通/bmp/013.bmp
五笔打字通/bmp/014.bmp
五笔打字通/bmp/015.bmp
五笔打字通/bmp/016.bmp
五笔打字通/bmp/017.bmp
五笔打字通/bmp/018.bmp
五笔打字通/bmp/019.bmp
五笔打字通/bmp/020.bmp
五笔打字通/bmp/021.bmp
五笔打字通/bmp/022.bmp
五笔打字通/bmp/023.bmp
五笔打字通/bmp/024.bmp
五笔打字通/bmp/025.bmp
五笔打字通/bmp/026.bmp
五笔打字通/bmp/027.bmp
五笔打字通/bmp/028.bmp
五笔打字通/bmp/029.bmp
五笔打字通/bmp/030.bmp
五笔打字通/bmp/031.bmp
五笔打字通/bmp/032.bmp
五笔打字通/bmp/033.bmp
五笔打字通/bmp/034.bmp
五笔打字通/bmp/035.bmp
五笔打字通/bmp/036.bmp
五笔打字通/bmp/037.bmp
五笔打字通/bmp/038.bmp
五笔打字通/bmp/039.bmp
五笔打字通/bmp/040.bmp
五笔打字通/bmp/041.bmp
五笔打字通/bmp/042.bmp
五笔打字通/bmp/043.bmp
五笔打字通/bmp/044.bmp
五笔打字通/bmp/045.bmp
五笔打字通/bmp/046.bmp
五笔打字通/bmp/047.bmp
五笔打字通/bmp/048.bmp
五笔打字通/bmp/049.bmp
五笔打字通/bmp/050.bmp
五笔打字通/bmp/051.bmp
五笔打字通/bmp/052.bmp
五笔打字通/bmp/053.bmp
五笔打字通/bmp/054.bmp
五笔打字通/bmp/055.bmp
五笔打字通/bmp/056.bmp
五笔打字通/bmp/057.bmp
五笔打字通/bmp/058.bmp
五笔打字通/bmp/059.bmp
五笔打字通/bmp/060.bmp
五笔打字通/bmp/061.bmp
五笔打字通/bmp/062.bmp
五笔打字通/bmp/063.bmp
五笔打字通/bmp/064.bmp
五笔打字通/bmp/065.bmp
五笔打字通/bmp/066.bmp
五笔打字通/bmp/067.bmp
五笔打字通/bmp/068.bmp
五笔打字通/bmp/069.bmp
五笔打字通/bmp/070.bmp
五笔打字通/bmp/071.bmp
五笔打字通/bmp/072.bmp
五笔打字通/bmp/073.bmp
五笔打字通/bmp/074.bmp
五笔打字通/bmp/075.bmp
五笔打字通/bmp/076.bmp
五笔打字通/bmp/077.bmp
五笔打字通/bmp/078.bmp
五笔打字通/bmp/079.bmp
五笔打字通/bmp/080.bmp
五笔打字通/bmp/081.bmp
五笔打字通/bmp/082.bmp
五笔打字通/bmp/083.bmp
五笔打字通/bmp/084.bmp
五笔打字通/bmp/085.bmp
五笔打字通/bmp/086.bmp
五笔打字通/bmp/087.bmp
五笔打字通/bmp/088.bmp
五笔打字通/bmp/089.bmp
五笔打字通/bmp/090.bmp
五笔打字通/bmp/091.bmp
五笔打字通/bmp/092.bmp
五笔打字通/bmp/093.bmp
五笔打字通/bmp/094.bmp
五笔打字通/bmp/095.bmp
五笔打字通/bmp/096.bmp
五笔打字通/bmp/097.bmp
五笔打字通/bmp/098.bmp
五笔打字通/bmp/099.bmp
五笔打字通/bmp/100.bmp
五笔打字通/bmp/101.bmp
五笔打字通/bmp/102.bmp
五笔打字通/bmp/103.bmp
五笔打字通/bmp/104.bmp
五笔打字通/bmp/105.bmp
五笔打字通/bmp/106.bmp
五笔打字通/bmp/107.bmp
五笔打字通/bmp/108.bmp
五笔打字通/bmp/109.bmp
五笔打字通/bmp/110.bmp
五笔打字通/bmp/111.bmp
五笔打字通/bmp/112.bmp
五笔打字通/bmp/113.bmp
五笔打字通/bmp/114.bmp
五笔打字通/bmp/115.bmp
五笔打字通/bmp/116.bmp
五笔打字通/bmp/117.bmp
五笔打字通/bmp/118.bmp
五笔打字通/bmp/119.bmp
五笔打字通/bmp/120.bmp
五笔打字通/bmp/121.bmp
五笔打字通/bmp/122.bmp
五笔打字通/bmp/123.bmp
五笔打字通/bmp/124.bmp
五笔打字通/bmp/125.bmp
五笔打字通/bmp/126.bmp
五笔打字通/bmp/127.bmp
五笔打字通/bmp/128.bmp
五笔打字通/bmp/129.bmp
五笔打字通/bmp/130.bmp
五笔打字通/bmp/131.bmp
五笔打字通/bmp/132.bmp
五笔打字通/bmp/133.bmp
五笔打字通/bmp/134.bmp
五笔打字通/bmp/135.bmp
五笔打字通/bmp/136.bmp
五笔打字通/bmp/137.bmp
五笔打字通/bmp/138.bmp
五笔打字通/bmp/139.bmp
五笔打字通/bmp/140.bmp
五笔打字通/bmp/141.bmp
五笔打字通/bmp/142.bmp
五笔打字通/bmp/143.bmp
五笔打字通/bmp/144.bmp
五笔打字通/bmp/145.bmp
五笔打字通/bmp/146.bmp
五笔打字通/bmp/147.bmp
五笔打字通/bmp/148.bmp
五笔打字通/bmp/149.bmp
五笔打字通/bmp/150.bmp
五笔打字通/bmp/151.bmp
五笔打字通/bmp/152.bmp
五笔打字通/bmp/153.bmp
五笔打字通/bmp/154.bmp
五笔打字通/bmp/155.bmp
五笔打字通/bmp/156.bmp
五笔打字通/bmp/157.bmp
五笔打字通/bmp/158.bmp
五笔打字通/bmp/159.bmp
五笔打字通/bmp/160.bmp
五笔打字通/bmp/161.bmp
五笔打字通/bmp/162.bmp
五笔打字通/bmp/163.bmp
五笔打字通/bmp/164.bmp
五笔打字通/bmp/165.bmp
五笔打字通/bmp/166.bmp
五笔打字通/bmp/167.bmp
五笔打字通/bmp/168.bmp
五笔打字通/bmp/169.bmp
五笔打字通/bmp/170.bmp
五笔打字通/bmp/171.bmp
五笔打字通/bmp/172.bmp
五笔打字通/bmp/173.bmp
五笔打字通/bmp/174.bmp
五笔打字通/bmp/175.bmp
五笔打字通/bmp/176.bmp
五笔打字通/bmp/177.bmp
五笔打字通/bmp/178.bmp
五笔打字通/bmp/179.bmp
五笔打字通/bmp/180.bmp
五笔打字通/bmp/181.bmp
五笔打字通/bmp/182.bmp
五笔打字通/bmp/183.bmp
五笔打字通/bmp/184.bmp
五笔打字通/bmp/185.bmp
五笔打字通/bmp/186.bmp
五笔打字通/bmp/187.bmp
五笔打字通/bmp/188.bmp
五笔打字通/bmp/189.bmp
五笔打字通/bmp/190.bmp
五笔打字通/bmp/191.bmp
五笔打字通/bmp/192.bmp
五笔打字通/bmp/193.bmp
五笔打字通/bmp/194.bmp
五笔打字通/bmp/195.bmp
五笔打字通/bmp/196.bmp
五笔打字通/bmp/197.bmp
五笔打字通/bmp/198.bmp
五笔打字通/bmp/199.bmp
五笔打字通/bmp/1一.bmp
五笔打字通/bmp/1上.bmp
五笔打字通/bmp/1不.bmp
五笔打字通/bmp/1中.bmp
五笔打字通/bmp/1为.bmp
五笔打字通/bmp/1主.bmp
五笔打字通/bmp/1了.bmp
五笔打字通/bmp/1产.bmp
五笔打字通/bmp/1人.bmp
五笔打字通/bmp/1以.bmp
五笔打字通/bmp/1发.bmp
五笔打字通/bmp/1同.bmp
五笔打字通/bmp/1和.bmp
五笔打字通/bmp/1国.bmp
五笔打字通/bmp/1在.bmp
五笔打字通/bmp/1地.bmp
五笔打字通/bmp/1工.bmp
五笔打字通/bmp/1我.bmp
五笔打字通/bmp/1是.bmp
五笔打字通/bmp/1有.bmp
五笔打字通/bmp/1民.bmp
五笔打字通/bmp/1的.bmp
五笔打字通/bmp/1经.bmp
五笔打字通/bmp/1要.bmp
五笔打字通/bmp/1这.bmp
五笔打字通/bmp/200.bmp
五笔打字通/bmp/201.bmp
五笔打字通/bmp/202.bmp
五笔打字通/bmp/203.bmp
五笔打字通/bmp/204.bmp
五笔打字通/bmp/205.bmp
五笔打字通/bmp/206.bmp
五笔打字通/bmp/207.bmp
五笔打字通/bmp/208.bmp
五笔打字通/bmp/209.bmp
五笔打字通/bmp/210.bmp
五笔打字通/bmp/211.bmp
五笔打字通/bmp/212.bmp
五笔打字通/bmp/213.bmp
五笔打字通/c1.txt
五笔打字通/c2.txt
五笔打字通/c3.txt
五笔打字通/c4.txt
五笔打字通/c5.txt
五笔打字通/c6.txt
五笔打字通/c7.txt
五笔打字通/cap.txt
五笔打字通/cz21.txt
五笔打字通/cz22.txt
五笔打字通/cz23.txt
五笔打字通/cz31.txt
五笔打字通/cz32.txt
五笔打字通/cz33.txt
五笔打字通/cz41.txt
五笔打字通/cz42.txt
五笔打字通/cz43.txt
五笔打字通/czzg.txt
五笔打字通/dmcz2.txt
五笔打字通/dmcz3.txt
五笔打字通/employee2.dat
五笔打字通/employee3.dat
五笔打字通/employee4.dat
五笔打字通/face.txt
五笔打字通/gz.txt
五笔打字通/help/a.bmp
五笔打字通/help/b.bmp
五笔打字通/help/c.bmp
五笔打字通/help/d.bmp
五笔打字通/help/e.bmp
五笔打字通/help/f.bmp
五笔打字通/help/g.bmp
五笔打字通/help/h.bmp
五笔打字通/help/i.bmp
五笔打字通/help/j.bmp
五笔打字通/help/k.bmp
五笔打字通/help/l.bmp
五笔打字通/help/m.bmp
五笔打字通/help/n.bmp
五笔打字通/help/o.bmp
五笔打字通/help/p.bmp
五笔打字通/help/q.bmp
五笔打字通/help/r.bmp
五笔打字通/help/s.bmp
五笔打字通/help/t.bmp
五笔打字通/help/u.bmp
五笔打字通/help/v.bmp
五笔打字通/help/w.bmp
五笔打字通/help/x.bmp
五笔打字通/help/y.bmp
五笔打字通/hu.TXT
五笔打字通/huangdi.TXT
五笔打字通/hui.TXT
五笔打字通/j1.txt
五笔打字通/j2.txt
五笔打字通/j3.txt
五笔打字通/j4.txt
五笔打字通/jmz.txt
五笔打字通/jw.txt
五笔打字通/mzgn.TXT
五笔打字通/nz.txt
五笔打字通/p1.bmp
五笔打字通/p186.GIF
.gif
五笔打字通/p2.bmp
五笔打字通/qh.txt
五笔打字通/qwwz.txt
五笔打字通/save.txt
五笔打字通/savehz.txt
五笔打字通/savewz0.txt
五笔打字通/savewz1.txt
五笔打字通/savewz10.txt
五笔打字通/savewz12.txt
五笔打字通/savewz13.txt
五笔打字通/savewz14.txt
五笔打字通/savewz15.txt
五笔打字通/savewz16.txt
五笔打字通/savewz17.txt
五笔打字通/savewz18.txt
五笔打字通/savewz19.txt
五笔打字通/savewz2.txt
五笔打字通/savewz20.txt
五笔打字通/savewz3.txt
五笔打字通/savewz4.txt
五笔打字通/savewz5.txt
五笔打字通/savewz6.txt
五笔打字通/savewz7.txt
五笔打字通/savewz8.txt
五笔打字通/savewz9.txt
五笔打字通/savewzgd.txt
五笔打字通/savezx1.txt
五笔打字通/savezx2.txt
五笔打字通/sbm.GIF
.gif
五笔打字通/sbm.txt
五笔打字通/sjq.txt
五笔打字通/slate.urf
五笔打字通/sz.txt
五笔打字通/wb86dzt.exe
.exe windows x86

c8bb2fd82fc271d9a8d954abdc750b54

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
__vbaVarTstGt
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaLateIdCall
__vbaLineInputStr
__vbaStrVarMove
__vbaLenBstr
ord588
__vbaEnd
__vbaVarIdiv
__vbaFreeVarList
_adj_fdiv_m64
ord620
__vbaRaiseEvent
__vbaLineInputVar
__vbaFreeObjList
ord516
_adj_fprem1
__vbaRecAnsiToUni
ord518
__vbaVarCmpNe
__vbaStrCat
ord660
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
__vbaHresultCheckObj
ord665
__vbaLenVar
_adj_fdiv_m32
__vbaVarTstLe
__vbaAryDestruct
__vbaVarCmpGe
__vbaLateMemSt
ord592
__vbaExitProc
ord593
__vbaVarForInit
ord594
__vbaOnError
__vbaObjSet
ord595
ord596
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaFpR4
ord520
__vbaStrFixstr
__vbaBoolVar
ord521
__vbaVarTstLt
__vbaFpR8
__vbaBoolVarNull
_CIsin
__vbaErase
ord631
ord524
__vbaVargVarMove
__vbaVarCmpGt
ord632
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
ord527
__vbaGenerateBoundsError
ord528
__vbaStrCmp
__vbaVarTstEq
ord560
__vbaPutOwner4
__vbaPrintObj
__vbaI2I4
DllFunctionCall
__vbaVarLateMemSt
__vbaVarOr
__vbaCastObjVar
__vbaStrR4
_adj_fpatan
__vbaR4Var
ord567
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRedim
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaVarMul
__vbaExceptHandler
__vbaStrToUnicode
__vbaPrintFile
ord712
__vbaInputFile
_adj_fprem
_adj_fdivr_m64
__vbaI2Str
__vbaVarDiv
ord608
__vbaVarCmpLe
__vbaFPException
__vbaInStrVar
ord717
__vbaGetOwner3
__vbaStrVarVal
__vbaGetOwner4
__vbaVarCat
__vbaI2Var
__vbaFileSeek
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord648
ord570
__vbaR8Str
__vbaInStr
__vbaNew2
__vbaVarInt
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarCmpLt
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaI4Var
__vbaVarCmpEq
ord610
__vbaVarAdd
ord612
__vbaVarDup
__vbaStrToAnsi
__vbaVerifyVarObj
ord613
__vbaFpI2
ord616
__vbaVarCopy
__vbaVarTstGe
__vbaFpI4
__vbaR8IntI2
__vbaLateMemCallLd
__vbaRecDestructAnsi
ord617
_CIatan
__vbaCastObj
ord618
__vbaStrMove
__vbaStrVarCopy
__vbaR8IntI4
ord619
ord543
_allmul
ord544
__vbaLateIdSt
_CItan
ord546
__vbaUI1Var
ord547
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeObj
__vbaFreeStr
ord581

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
五笔打字通/wwbb11.dat
五笔打字通/wwbb11.mdb
五笔打字通/wwbb11cz.dat
五笔打字通/xiao.txt
五笔打字通/xjp.txt
五笔打字通/xjq.txt
五笔打字通/yfwb/a.txt
五笔打字通/yfwb/addcz.txt
五笔打字通/yfwb/b.txt
五笔打字通/yfwb/delcz.txt
五笔打字通/yfwb/help.rtf
.rtf
五笔打字通/yfwb/hyfrjp.exe
.exe windows x86

499ae001f5c9c30e33bed79a7593b932

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
ord696
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaVarTstLe
__vbaAryDestruct
ord595
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaFpR4
ord520
__vbaFpR8
_CIsin
ord632
__vbaChkstk
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
__vbaFpUI1
_adj_fpatan
__vbaStrR8
EVENT_SINK_Release
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaStrToUnicode
ord712
ord606
_adj_fprem
_adj_fdivr_m64
__vbaI2Str
ord608
__vbaFPException
__vbaUbound
__vbaStrVarVal
__vbaVarCat
_CIlog
__vbaErrorOverflow
__vbaNew2
__vbaInStr
__vbaR8Str
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaVarDup
__vbaStrToAnsi
__vbaFpI2
__vbaFpI4
ord617
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr
ord581

Sections

.text
Size: 332KB - Virtual size: 329KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
五笔打字通/yfwb/hyfzgb.exe
.exe windows x86

52ed6649936e25d5f9f3d57042306d40

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

_CIcos
_adj_fptan
__vbaFreeVar
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
DllFunctionCall
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
ord645
_CIlog
__vbaErrorOverflow
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaFpI2
_CIatan
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
五笔打字通/yfwb/set.ini
五笔打字通/yfwb/云峰五笔.exe
.exe windows x86

813fe99ec04d5ebc71e842423716a9f6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarTstGt
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaHresultCheck
__vbaVarVargNofree
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaLineInputStr
ord696
__vbaEnd
__vbaFreeVarList
__vbaVarIdiv
_adj_fdiv_m64
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
_adj_fprem1
ord518
__vbaStrCat
__vbaVarCmpNe
__vbaLsetFixstr
ord553
ord660
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaExitProc
ord301
__vbaObjSet
__vbaOnError
ord595
ord596
_adj_fdiv_m16i
__vbaObjSetAddref
ord597
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
__vbaFpR4
ord520
ord307
__vbaVarTstLt
__vbaBoolVarNull
__vbaFpR8
__vbaRefVarAry
_CIsin
__vbaErase
ord631
__vbaVarZero
ord632
__vbaVarCmpGt
ord525
__vbaChkstk
__vbaCyVar
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaGenerateBoundsError
ord529
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaObjVar
__vbaI2I4
__vbaVarLikeVar
DllFunctionCall
__vbaVarLateMemSt
__vbaVarOr
__vbaFpUI1
ord564
__vbaStrR4
__vbaRedimPreserve
_adj_fpatan
__vbaR4Var
ord567
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaStrR8
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaStrUI1
ord710
__vbaUI1I4
__vbaVarMul
__vbaExceptHandler
ord711
__vbaStrToUnicode
ord712
__vbaPrintFile
ord606
_adj_fprem
_adj_fdivr_m64
__vbaI2Str
ord607
__vbaVarDiv
ord608
ord716
__vbaFPException
__vbaInStrVar
ord717
__vbaStrVarVal
__vbaUbound
__vbaVarCat
__vbaDateVar
ord535
__vbaI2Var
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord648
__vbaNew2
__vbaR8Str
__vbaInStr
ord570
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord573
__vbaI4Str
ord681
__vbaFreeStrList
__vbaVarNot
__vbaVarCmpLt
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
__vbaLateMemCall
__vbaVarAdd
__vbaAryLock
__vbaStrToAnsi
__vbaVarDup
__vbaFpI2
__vbaVarMod
__vbaVarLateMemCallLd
__vbaVarCopy
__vbaFpI4
ord616
ord617
_CIatan
ord618
__vbaStrMove
__vbaCastObj
__vbaUI1Str
__vbaAryCopy
__vbaStrVarCopy
ord619
ord542
ord650
_allmul
__vbaLateIdSt
ord545
_CItan
ord546
__vbaFPInt
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
ord581

Sections

.text
Size: 736KB - Virtual size: 734KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
五笔打字通/zg.txt
五笔打字通/zg2.TXT
五笔打字通/zgb/222.bmp
五笔打字通/zgb/86wb.bmp
五笔打字通/zgb/J1.bmp
五笔打字通/zgb/J2.bmp
五笔打字通/zgb/J3.bmp
五笔打字通/zgw.txt
五笔打字通/zx/单字/一级字频度表中常用500字加常用二级简码字.txt
五笔打字通/zx/单字/五笔字型：最常用500字.txt
五笔打字通/zx/单字/五笔字型：次常用500字.txt
五笔打字通/zx/单字/常用1500字.txt
五笔打字通/zx/单字/常用1500字分段练习 (1).txt
五笔打字通/zx/单字/常用1500字分段练习 (2).txt
五笔打字通/zx/单字/常用1500字分段练习 (3).txt
五笔打字通/zx/单字/常用1500字分段练习 (4).txt
五笔打字通/zx/单字/常用1500字分段练习 (5).txt
五笔打字通/zx/单字/文章/亮剑.txt
五笔打字通/zx/单字/文章/从百草园到三味书屋.txt
五笔打字通/zx/单字/文章/别跟我耍中国人那一套.txt
五笔打字通/zx/单字/文章/古龙·绝代双娇.txt
五笔打字通/zx/单字/文章/声律启蒙·上卷.txt
五笔打字通/zx/单字/文章/打字考核文本.txt
五笔打字通/zx/单字/文章/沈从文·往事.txt
五笔打字通/zx/单字/文章/爱迪生传.txt
五笔打字通/zx/单字/次常用1500字.txt
五笔打字通/zx/单字/次常用1500字分段练习 (1).txt
五笔打字通/zx/单字/次常用1500字分段练习 (2).txt
五笔打字通/zx/单字/次常用1500字分段练习 (3).txt
五笔打字通/zx/单字/次常用1500字分段练习 (4).txt
五笔打字通/zx/单字/次常用1500字分段练习 (5).txt
五笔打字通/三字经.txt
五笔打字通/伊斯兰教.txt
五笔打字通/假如给我三天光明.txt
五笔打字通/入洞房来历.txt
五笔打字通/匆匆.txt
五笔打字通/咖啡文化.txt
五笔打字通/增广贤文.txt
五笔打字通/太空生活趣事多.txt
五笔打字通/女娲补天.txt
五笔打字通/愚人节.txt
五笔打字通/拉萨古城.txt
五笔打字通/春.txt
五笔打字通/灯.txt
五笔打字通/狮子王.txt
五笔打字通/王昭君故事.txt
五笔打字通/电信局长洗澡.txt
五笔打字通/祖国，我终于回来了.txt
五笔打字通/绿.TXT
五笔打字通/自述文件.txt
五笔打字通/荷塘月色.TXT
五笔打字通/落花生.txt
五笔打字通/计算机.txt
五笔打字通/谁是最可爱的人.TXT
五笔打字通/赤壁赋.txt
五笔打字通/这片土地是神圣的.txt
五笔打字通/阿房宫赋.txt
五笔打字通/雅鲁藏布大峡谷.txt
五笔打字通/雨季不再来.txt
五笔打字通/顺治帝出家之迷.txt

Sharing

General

Malware Config

Signatures

Files

2824fcddda9a05ec563c0e7037537798

Headers

File Characteristics

Imports

kernel32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 63KB - Virtual size: 62KB

.data Size: 18KB - Virtual size: 18KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 424KB

UPX1 Size: 236KB - Virtual size: 236KB

.rsrc Size: 3KB - Virtual size: 4KB

c8bb2fd82fc271d9a8d954abdc750b54

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 4.3MB - Virtual size: 4.3MB

.data Size: 4KB - Virtual size: 41KB

.rsrc Size: 4KB - Virtual size: 2KB

499ae001f5c9c30e33bed79a7593b932

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 332KB - Virtual size: 329KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 4KB - Virtual size: 1KB

52ed6649936e25d5f9f3d57042306d40

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 72KB - Virtual size: 71KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 1KB

813fe99ec04d5ebc71e842423716a9f6

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 736KB - Virtual size: 734KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 63KB - Virtual size: 62KB

.data
Size: 18KB - Virtual size: 18KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

UPX0
Size: - Virtual size: 424KB

UPX1
Size: 236KB - Virtual size: 236KB

.rsrc
Size: 3KB - Virtual size: 4KB

.text
Size: 4.3MB - Virtual size: 4.3MB

.data
Size: 4KB - Virtual size: 41KB

.rsrc
Size: 4KB - Virtual size: 2KB

.text
Size: 332KB - Virtual size: 329KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 4KB - Virtual size: 1KB

.text
Size: 72KB - Virtual size: 71KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 1KB

.text
Size: 736KB - Virtual size: 734KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 1KB