Static task
static1
Behavioral task
behavioral1
Sample
80601ee00324f4d0e562c35814af544213c870fcb4dcd941eadfa07772aa2611.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
80601ee00324f4d0e562c35814af544213c870fcb4dcd941eadfa07772aa2611.exe
Resource
win10v2004-20220812-en
General
-
Target
80601ee00324f4d0e562c35814af544213c870fcb4dcd941eadfa07772aa2611
-
Size
170KB
-
MD5
099cd00c2013446e1bcf431a91db07b0
-
SHA1
22d3bc63c05b6c09723da11b8c1db42e88c686e8
-
SHA256
80601ee00324f4d0e562c35814af544213c870fcb4dcd941eadfa07772aa2611
-
SHA512
e95fddaa1fa99451b4bc76e75d3a92819ce86b1b12a29f2c27a3404c7ca500a81173008204c57d9f4b13094baf17a3ba0eec4ae49bf661ae3e6f66fcbcdd097b
-
SSDEEP
3072:l1LXPQatD3qCumOcGErdN3FXdKDSBIzlYym9/gFM5h8NmOM2M5o+S:LiUOcGydNoQ/Z9QNmOM2+o+S
Malware Config
Signatures
Files
-
80601ee00324f4d0e562c35814af544213c870fcb4dcd941eadfa07772aa2611.exe windows x86
978cbdcde835d88a93fe59b48206aeaf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
InitCommonControlsEx
common
??BCTXBSTR@@QBEPA_WXZ
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
??1CTXBSTR@@QAE@XZ
??YCTXStringW@@QAEAAV0@PB_W@Z
??YCTXStringW@@QAEAAV0@ABV0@@Z
?Format@CTXStringW@@QAAXPB_WZZ
??0CTXStringW@@QAE@XZ
??1CTXStringW@@QAE@XZ
?GetMemoryUsage@Sys@Util@@YAXAAK0@Z
??H@YA?AVCTXStringW@@PB_WABV0@@Z
ord25
??4CTXStringW@@QAEAAV0@ABV0@@Z
?RecordTransEnd@Perf@Util@@YAJ_JPB_WHH11H@Z
?Left@CTXStringW@@QBE?AV1@H@Z
?ReverseFind@CTXStringW@@QBEH_W@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
?AddIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?MinimzeMemory@Sys@Util@@YAXXZ
??BCTXStringW@@QBEPB_WXZ
?SetIdleCallback@TXTimer@@YAHPAUITXIdleCallback@@I@Z
??0CTXStringW@@QAE@PB_W@Z
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?NotifyIdle@Window@Util@@YAJXZ
?EraseIdleCallback@TXTimer@@YAHPAUITXIdleCallback@@I@Z
?DelIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z
?GetLength@CTXStringW@@QBEHXZ
??0CTXStringW@@QAE@PA_W@Z
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
?OnUninitCom@Misc@Util@@YAXXZ
?SetTencentProductName@ProductConfig@Util@@YAHABVCTXStringW@@@Z
?InitPlatformFileSystem@Boot@Util@@YAHXZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
??0CFmtString@@QAE@XZ
??1CFmtString@@QAE@XZ
?PropertyStr@CFmtString@@QAEHPB_W0@Z
?AddFmtString@TXStringBundle@@YAXABVCFmtString@@@Z
?InitBugReport@TXBugReport@@YAXPB_W000GGKHHKKP6GHPAUtagBugReportInfo@1@PBD200PAPAXPAKPAX@Z@Z
?GetSession@TXLog@@YAKXZ
?GetLCID@NLS@@YAKXZ
?ValidateBugReport@TXBugReport@@YAXXZ
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?InitNetwork@Network@Util@@YAHXZ
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
?GetString@CTXStringW@@QBEPB_WXZ
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
??8@YA_NABVCTXStringW@@PB_W@Z
??ACTXStringW@@QBE_WH@Z
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z
?GetFileHash@FS@Util@@YAHPB_WAAVCTXBuffer@@AAK@Z
?Encode16@Encode@Util@@YA?AVCTXStringW@@ABVCTXBuffer@@@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
??8@YA_NPB_WABVCTXStringW@@@Z
??4CTXStringW@@QAEAAV0@PB_W@Z
?IsEmpty@CTXStringW@@QBE_NXZ
?GetAt@CTXStringW@@QBE_WH@Z
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
?NotifyIdle@TXTimer@@YAXXZ
ord34
?OnExitWinMain@Misc@Util@@YAXXZ
?OnExitCoreCenter@Misc@Util@@YAXXZ
?Stop@TXBugMonitor@@YAHXZ
??0CTXStringW@@QAE@ABV0@@Z
?InitPlatformGFConfig@Boot@Util@@YAHXZ
imdllbuild
?GetVersionExW@Version@@YAXAAUtagVersionInfo@1@@Z
?VersionUpdate@QQUPDATECENTER@@YAJPB_W00000@Z
?GetStartupAccount@CommandLine@Util@@YA?AVCTXStringW@@XZ
?GetStartupType@CommandLine@Util@@YAHXZ
?GetStartupUI@CommandLine@Util@@YAHXZ
?IsAccountLogined@Account@Util@@YAHK@Z
?GetProgramRootDir@Sys@Util@@YA?AVCTXStringW@@XZ
?GetMajorVer@Version@@YAEXZ
?GetMinorVer@Version@@YAEXZ
?GetBuildVer@Version@@YAKXZ
?Init@Version@@YAHXZ
?IsQuickLogin@CommandLine@Util@@YAHXZ
?GetStartupMiniQTInfo@CommandLine@Util@@YA?AVCTXStringW@@XZ
?GetStartupGameID@CommandLine@Util@@YA_JXZ
kernel32
GetTickCount
GetSystemDirectoryW
GetLastError
ReleaseMutex
GetCurrentThreadId
FindFirstFileW
GetSystemInfo
QueryPerformanceFrequency
WriteProcessMemory
GlobalMemoryStatus
InterlockedDecrement
GetProcAddress
FreeLibrary
GetModuleHandleW
GetCurrentProcessId
InitializeCriticalSection
GetCurrentProcess
CreateEventW
SetThreadPriority
DeleteCriticalSection
WaitForSingleObject
CloseHandle
InterlockedIncrement
Sleep
CreateThread
CreateProcessW
RaiseException
GetVersionExW
GetPrivateProfileStringW
LocalAlloc
InterlockedExchange
LoadLibraryA
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
CreateMutexW
SetEnvironmentVariableW
QueryPerformanceCounter
SetEvent
GetEnvironmentVariableW
OpenEventW
GetModuleFileNameW
LoadLibraryW
GetCurrentThread
user32
wsprintfW
DispatchMessageW
WaitMessage
TranslateMessage
PeekMessageW
PostThreadMessageW
MessageBoxW
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
shell32
ShellExecuteExW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ole32
OleUninitialize
CoCreateInstance
CoUninitialize
OleInitialize
atl80
ord32
ord30
ord64
shlwapi
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
msvcp80
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
msvcr80
_encode_pointer
_unlock
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
__CxxFrameHandler3
__dllonexit
wcsncpy
??3@YAXPAX@Z
mbstowcs_s
_invalid_parameter_noinfo
??2@YAPAXI@Z
_CxxThrowException
_wcslwr_s
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_time64
wcsncat_s
printf
__argc
__wargv
wcsncmp
_wtoi
wcscpy_s
wcsrchr
memset
?terminate@@YAXXZ
Sections
.text Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE