1fba70ed0852b48ecbaa9ccf74f5ba50f32e720929584e1350f638d4510e79fd

Sharing

Copy URL

Twitter E-mail

General

Target

1fba70ed0852b48ecbaa9ccf74f5ba50f32e720929584e1350f638d4510e79fd
Size

3.8MB
MD5

8756f66feb8330af67c9f6bd00ec8814
SHA1

fa499c9efa087b1c91362075a5faf0b5946f3c11
SHA256

1fba70ed0852b48ecbaa9ccf74f5ba50f32e720929584e1350f638d4510e79fd
SHA512

b8cf7d1c37cc44210d21987d4ad86920e376617cd87edcde3f72f5a03c721caf8de8bccef2588d98fb8131861895d82149827dacbb08ae4a21736d58daab652f
SSDEEP

98304:gLAz+wTp3vt+J1QKbxB6VU/impKN1vXGXXCsA7c7:5/KJ1QSB563N1vS7

Score

N/A

Malware Config

Signatures

Files

1fba70ed0852b48ecbaa9ccf74f5ba50f32e720929584e1350f638d4510e79fd
.7z
象棋奇兵 5.0/ECCO.DLL
.dll windows x86

fb80b577eec61d576561a1fb3cd53b9d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapCreate
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
GetCommandLineA
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind

Exports

Exports

_EccoIndex@4
_EccoInitOpenVar@4
_EccoOpening@4
_EccoVariation@4
_EccoVersion@0

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
象棋奇兵 5.0/bmp/24/1.bmp
象棋奇兵 5.0/bmp/24/10.bmp
象棋奇兵 5.0/bmp/24/11.bmp
象棋奇兵 5.0/bmp/24/12.bmp
象棋奇兵 5.0/bmp/24/13.bmp
象棋奇兵 5.0/bmp/24/14.bmp
象棋奇兵 5.0/bmp/24/2.bmp
象棋奇兵 5.0/bmp/24/3.bmp
象棋奇兵 5.0/bmp/24/4.bmp
象棋奇兵 5.0/bmp/24/5.bmp
象棋奇兵 5.0/bmp/24/6.bmp
象棋奇兵 5.0/bmp/24/7.bmp
象棋奇兵 5.0/bmp/24/8.bmp
象棋奇兵 5.0/bmp/24/9.bmp
象棋奇兵 5.0/bmp/24/Hint.bmp
象棋奇兵 5.0/bmp/24/Name.bmp
象棋奇兵 5.0/bmp/24/board.bmp
象棋奇兵 5.0/bmp/36/1.bmp
象棋奇兵 5.0/bmp/36/10.bmp
象棋奇兵 5.0/bmp/36/11.bmp
象棋奇兵 5.0/bmp/36/12.bmp
象棋奇兵 5.0/bmp/36/13.bmp
象棋奇兵 5.0/bmp/36/14.bmp
象棋奇兵 5.0/bmp/36/2.bmp
象棋奇兵 5.0/bmp/36/3.bmp
象棋奇兵 5.0/bmp/36/4.bmp
象棋奇兵 5.0/bmp/36/5.bmp
象棋奇兵 5.0/bmp/36/6.bmp
象棋奇兵 5.0/bmp/36/7.bmp
象棋奇兵 5.0/bmp/36/8.bmp
象棋奇兵 5.0/bmp/36/9.bmp
象棋奇兵 5.0/bmp/36/Hint.bmp
象棋奇兵 5.0/bmp/36/Name.bmp
象棋奇兵 5.0/bmp/36/board.bmp
象棋奇兵 5.0/bmp/48/1.bmp
象棋奇兵 5.0/bmp/48/10.bmp
象棋奇兵 5.0/bmp/48/11.bmp
象棋奇兵 5.0/bmp/48/12.bmp
象棋奇兵 5.0/bmp/48/13.bmp
象棋奇兵 5.0/bmp/48/14.bmp
象棋奇兵 5.0/bmp/48/2.bmp
象棋奇兵 5.0/bmp/48/3.bmp
象棋奇兵 5.0/bmp/48/4.bmp
象棋奇兵 5.0/bmp/48/5.bmp
象棋奇兵 5.0/bmp/48/6.bmp
象棋奇兵 5.0/bmp/48/7.bmp
象棋奇兵 5.0/bmp/48/8.bmp
象棋奇兵 5.0/bmp/48/9.bmp
象棋奇兵 5.0/bmp/48/Hint.bmp
象棋奇兵 5.0/bmp/48/Name.bmp
象棋奇兵 5.0/bmp/48/board.bmp
象棋奇兵 5.0/bmp/bk/bk1.bmp
象棋奇兵 5.0/bmp/bk/bk2.bmp
象棋奇兵 5.0/bmp/bk/bk3.bmp
象棋奇兵 5.0/bmp/bk/bk4.bmp
象棋奇兵 5.0/book.bin
象棋奇兵 5.0/cavalier.exe
.exe windows x86

2237aa5854a41139b9af58cb340ab377

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
InterlockedExchange
GetNumberOfConsoleInputEvents
PeekNamedPipe
FlushConsoleInputBuffer
SetConsoleMode
GetConsoleMode
GetStdHandle
GetTickCount
SetConsoleTextAttribute
GetCurrentThread
GetProcAddress
ResumeThread
SetThreadAffinityMask
VirtualAlloc
ExitProcess
GetLastError
GetSystemInfo
VirtualFree
GetCurrentProcess
SetEnvironmentVariableA
CompareStringW
GetModuleHandleA
CreateFileA
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
HeapFree
DeleteFileA
GetSystemTimeAsFileTime
SetConsoleCtrlHandler
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetFileAttributesA
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
SetFilePointer
WriteFile
WideCharToMultiByte
GetConsoleCP
FlushFileBuffers
Sleep
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
RtlUnwind
MultiByteToWideChar
ReadFile
GetModuleFileNameA
LoadLibraryA
InitializeCriticalSection
HeapReAlloc
HeapDestroy
HeapCreate
LCMapStringA
LCMapStringW
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
CompareStringA
SetEndOfFile

Sections

.text
Size: 368KB - Virtual size: 364KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
象棋奇兵 5.0/cavalier.rc
象棋奇兵 5.0/data.mdb
象棋奇兵 5.0/lang_big5.dll
.dll windows x86

b15f50e3f2711e0feb9b6d0b6f0258b5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
LoadLibraryA
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualProtect
GetSystemInfo

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 292KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
象棋奇兵 5.0/lang_eng.dll
.dll windows x86

b15f50e3f2711e0feb9b6d0b6f0258b5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
LoadLibraryA
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualProtect
GetSystemInfo

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
象棋奇兵 5.0/lang_gb.dll
.dll windows x86

b15f50e3f2711e0feb9b6d0b6f0258b5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
LoadLibraryA
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualProtect
GetSystemInfo

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
象棋奇兵 5.0/position.bin
象棋奇兵 5.0/wav/PutPiece.wav
象棋奇兵 5.0/wav/cannon_eatpiece.wav
象棋奇兵 5.0/wav/check.wav
象棋奇兵 5.0/wav/eatpiece.wav
象棋奇兵 5.0/xqmaster.exe
.exe windows x86

3acfef942eeb52014b92ed79c36e0fc4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdiplusShutdown
GdipDrawLineI
GdipReleaseDC
GdiplusStartup
GdipCreatePen1
GdipDeletePen
GdipDeleteGraphics
GdipSetPenStartCap
GdipSetPenEndCap
GdipCreateFromHDC

kernel32

GetLocaleInfoW
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
IsBadCodePtr
IsBadReadPtr
GetDriveTypeA
GetCurrentProcessId
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
SetUnhandledExceptionFilter
GetTimeZoneInformation
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
GetFileType
SetStdHandle
ExitThread
GetCommandLineA
SearchPathA
GetTempPathA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
GetLastError
SizeofResource
LockResource
LoadResource
FindResourceA
GetVersion
lstrcmpiA
lstrlenW
lstrlenA
CompareStringA
CompareStringW
GetStringTypeExA
InterlockedIncrement
LocalAlloc
FormatMessageA
InterlockedDecrement
GetCurrencyFormatA
GetCPInfo
GlobalUnlock
GlobalLock
GlobalSize
GlobalFree
GlobalAlloc
LoadLibraryA
FreeLibrary
GetModuleHandleA
GetModuleFileNameA
SetCurrentDirectoryA
GetSystemDefaultLangID
GetProcAddress
DeviceIoControl
GetStartupInfoA
TerminateProcess
ExitProcess
HeapReAlloc
GetSystemTimeAsFileTime
HeapSize
GetDateFormatA
GetTimeFormatA
RtlUnwind
VirtualQuery
GetSystemInfo
VirtualAlloc
HeapFree
HeapAlloc
FindResourceExA
LocalFileTimeToFileTime
SetErrorMode
GetOEMCP
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
LeaveCriticalSection
GlobalFlags
GetProfileIntA
VirtualProtect
FileTimeToLocalFileTime
FindNextFileA
GetDiskFreeSpaceA
GetTempFileNameA
GetFileTime
SetFileTime
GetFileAttributesA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
lstrcpyA
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
DeleteFileA
MoveFileA
lstrcmpA
DeleteCriticalSection
InitializeCriticalSection
RaiseException
CreateEventA
SetEvent
WaitForSingleObject
SystemTimeToFileTime
FileTimeToSystemTime
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcatA
lstrcmpW
SetLastError
CopyFileA
lstrcpynA
LocalFree
FreeResource
GetTickCount
MulDiv
GlobalReAlloc
GetCurrentDirectoryA
SetThreadPriority
SuspendThread
ResumeThread
CreateThread
CreateDirectoryA
GetCurrentProcess
PeekNamedPipe
ReadFile
WriteFile
Sleep
CreatePipe
CreateProcessA
CreateFileA
CloseHandle
SetEnvironmentVariableA

user32

BringWindowToTop
SetMenu
TranslateAcceleratorA
WaitMessage
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
PostQuitMessage
MapVirtualKeyA
GetKeyNameTextA
EndPaint
BeginPaint
GetWindowDC
ValidateRect
DestroyMenu
SetMenuItemBitmaps
CheckMenuItem
GetMenuCheckMarkDimensions
SetWindowTextA
IsDialogMessageA
CheckDlgButton
RegisterWindowMessageA
WinHelpA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
GetForegroundWindow
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
LoadIconA
MapWindowPoints
ScrollWindow
MessageBoxA
TrackPopupMenu
SetScrollRange
GetScrollRange
SetForegroundWindow
ShowScrollBar
GetMenu
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
RegisterClassA
UnregisterClassA
SetWindowPlacement
InsertMenuItemA
CallWindowProcA
SetWindowPos
IsIconic
GetWindowPlacement
GetWindowTextLengthA
DrawTextExA
GrayStringA
DestroyIcon
DrawIcon
FindWindowA
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
DefFrameProcA
GetWindowThreadProcessId
MapVirtualKeyExA
GetWindowTextA
GetScrollPos
SetScrollPos
GetWindow
SetFocus
GetMenuStringA
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindowEnabled
EndDialog
GetDoubleClickTime
IsWindowVisible
CopyIcon
ClipCursor
GetMessagePos
GetClassInfoA
DefWindowProcA
LoadAcceleratorsA
ReuseDDElParam
UnpackDDElParam
GetAsyncKeyState
RegisterClipboardFormatA
GetDCEx
LockWindowUpdate
CharNextA
CopyAcceleratorTableA
GetFocus
GetCapture
InvertRect
IsWindow
GetKeyState
TranslateMessage
DrawFrameControl
IsRectEmpty
GetDlgItem
SetWindowLongA
FindWindowExA
GetCursorPos
IntersectRect
ReleaseCapture
LoadCursorA
SetCapture
EnableMenuItem
MoveWindow
ShowWindow
ExitWindowsEx
PeekMessageA
InvalidateRgn
GetNextDlgGroupItem
UnionRect
PostThreadMessageA
IsCharLowerA
GetWindowRgn
CharUpperBuffA
GetMenuDefaultItem
SetMenuDefaultItem
EnumChildWindows
CreateAcceleratorTableA
GetSystemMenu
SetParent
GetDlgCtrlID
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
SubtractRect
CharUpperA
EnableWindow
wsprintfA
GetClientRect
InvalidateRect
SetRect
CopyRect
LoadBitmapA
FillRect
DrawEdge
CreateMenu
CreatePopupMenu
DeleteMenu
AppendMenuA
GetMenuItemCount
GetMenuItemID
SetCursorPos
GetMenuState
GetSubMenu
InsertMenuA
ModifyMenuA
RemoveMenu
GetDC
ReleaseDC
GetDesktopWindow
TabbedTextOutA
GetMessageA
DispatchMessageA
IsChild
MessageBeep
RedrawWindow
SetWindowRgn
KillTimer
SetTimer
ScreenToClient
UpdateWindow
DestroyCursor
LoadImageA
GetIconInfo
PostMessageA
SetCursor
IsMenu
GetWindowLongA
WindowFromPoint
GetParent
GetNextDlgTabItem
GetActiveWindow
GetWindowRect
DrawFocusRect
FrameRect
InflateRect
DrawStateA
SetRectEmpty
SendMessageA
ClientToScreen
LoadMenuA
GetClipboardData
OpenClipboard
EmptyClipboard
CloseClipboard
SetClipboardData
IsClipboardFormatAvailable
OffsetRect
PtInRect
GetMenuItemInfoA
GetSystemMetrics
SystemParametersInfoA
EnableScrollBar
CopyImage
DestroyAcceleratorTable
IsZoomed
SetClassLongA
GetUpdateRect
DrawIconEx
GetSysColor
GetSysColorBrush
DrawTextA

gdi32

PathToRegion
BeginPath
EndPath
StrokeAndFillPath
CreatePatternBrush
CreateFontA
GetCurrentObject
GetTextMetricsA
CopyMetaFileA
CreateDCA
GetDCOrgEx
GetClipBox
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
LineTo
MoveToEx
SetTextAlign
LPtoDP
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
PolyBezierTo
ExtSelectClipRgn
SelectPalette
GetObjectType
SetRectRgn
GetTextColor
GetRgnBox
EnumFontFamiliesExA
DPtoLP
GetMapMode
GetBkColor
SetBkColor
SetTextColor
GetStockObject
CreateDIBitmap
GetDIBits
CombineRgn
StretchBlt
CreateRectRgnIndirect
CreateBitmap
CreateDIBSection
SelectObject
DeleteObject
DeleteDC
Escape
ExtTextOutA
CreatePen
CreateSolidBrush
CreateHatchBrush
CreateFontIndirectA
GetObjectA
CreateCompatibleDC
GetDeviceCaps
Ellipse
Rectangle
PatBlt
BitBlt
GetPixel
SetPixel
GetTextExtentPoint32A
PtVisible
RectVisible
CreateCompatibleBitmap
EnumFontFamiliesA
GetTextCharsetInfo
CreateRoundRectRgn
CreateEllipticRgn
CreatePolygonRgn
Polyline
Polygon
RoundRect
OffsetRgn
RealizePalette
FillRgn
FrameRgn
CreatePalette
GetPaletteEntries
PtInRegion
GetBoundsRect
ExtFloodFill
SetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
SetPixelV
GetViewportOrgEx
GetWindowOrgEx
GetTextFaceA
TextOutA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
PrintDlgA
CommDlgExtendedError
ChooseColorA
GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegCloseKey
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSetValueA
RegOpenKeyA
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegEnumKeyA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
SetFileSecurityA
GetFileSecurityA
RegCreateKeyA
RegQueryValueExA

shell32

SHAppBarMessage
ShellExecuteA
SHGetFileInfoA
SHGetPathFromIDListA
SHGetMalloc
SHBrowseForFolderA
ExtractIconA
DragQueryFileA
DragFinish

comctl32

ImageList_Create
ImageList_Draw
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_AddMasked
ImageList_GetImageCount
ImageList_GetImageInfo
ord17
ImageList_Destroy
ImageList_LoadImageA
ImageList_DrawEx
ImageList_Remove
ImageList_Add
ImageList_DrawIndirect
PropertySheetA
DestroyPropertySheetPage
ImageList_GetIconSize
CreatePropertySheetPageA

shlwapi

PathFindFileNameA
PathFindExtensionA
PathStripToRootA
PathIsUNCA

oledlg

ord8

ole32

CoRegisterMessageFilter
CoRevokeClassObject
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleGetClipboard
CLSIDFromProgID
CLSIDFromString
OleDuplicateData
ReleaseStgMedium
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance
OleRun
OleLockRunning
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator

oleaut32

SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
VariantInit
VariantCopy
VariantClear
SysAllocStringLen
VarUdateFromDate
SafeArrayGetElement
SafeArrayPutElement
SafeArrayCreate
VariantTimeToSystemTime
SystemTimeToVariantTime
VarDateFromStr
SysStringLen
SafeArrayDestroy
OleCreateFontIndirect
GetErrorInfo
VariantChangeType

ws2_32

htonl
inet_ntoa
ntohl
WSACleanup
WSAStartup
gethostbyname
htons
select
send
connect
socket
WSAGetLastError
closesocket
recv

winmm

PlaySoundA

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 296KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb80b577eec61d576561a1fb3cd53b9d

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 20KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 20KB - Virtual size: 20KB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 8KB - Virtual size: 5KB

2237aa5854a41139b9af58cb340ab377

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 368KB - Virtual size: 364KB

.rdata Size: 40KB - Virtual size: 36KB

.data Size: 20KB - Virtual size: 3.1MB

.rsrc Size: 4KB - Virtual size: 176B

b15f50e3f2711e0feb9b6d0b6f0258b5

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 292KB - Virtual size: 289KB

.reloc Size: 4KB - Virtual size: 3KB

b15f50e3f2711e0feb9b6d0b6f0258b5

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 184KB - Virtual size: 183KB

.reloc Size: 4KB - Virtual size: 3KB

b15f50e3f2711e0feb9b6d0b6f0258b5

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 180KB - Virtual size: 178KB

.reloc Size: 4KB - Virtual size: 3KB

3acfef942eeb52014b92ed79c36e0fc4

Headers

File Characteristics

Imports

gdiplus

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

winmm

.text
Size: 24KB - Virtual size: 20KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 20KB - Virtual size: 20KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 5KB

.text
Size: 368KB - Virtual size: 364KB

.rdata
Size: 40KB - Virtual size: 36KB

.data
Size: 20KB - Virtual size: 3.1MB

.rsrc
Size: 4KB - Virtual size: 176B

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 292KB - Virtual size: 289KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 184KB - Virtual size: 183KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 180KB - Virtual size: 178KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 312KB - Virtual size: 311KB

.data
Size: 44KB - Virtual size: 70KB

.rsrc
Size: 296KB - Virtual size: 295KB