09238e013da42b83602ad3eabd759f980292e6208d0d67f95051e2b29893f9b6

Sharing

Copy URL

Twitter E-mail

General

Target

09238e013da42b83602ad3eabd759f980292e6208d0d67f95051e2b29893f9b6
Size

663KB
MD5

66b7385938c5dd49bae67b1fa439db4d
SHA1

4c7860b8a2ec3676a5ec33cf0880ab0c8f106fd4
SHA256

09238e013da42b83602ad3eabd759f980292e6208d0d67f95051e2b29893f9b6
SHA512

66c837c98768a65aee402bafa6637684e247e15a5b6655b06d5b2575a1f406032c0a3f6b7684caa06ce1fca998b0a9638ce5e0c47fe412f3828f21e33fe24906
SSDEEP

12288:evxr7CgRWWmPOMEyAtACL7okarUaSvPUMWC7LD79zOyrTLQt5aGcM:sxregQWmOzySrL7ovr+vPUHChlrTUtR

Score

N/A

Malware Config

Signatures

Files

09238e013da42b83602ad3eabd759f980292e6208d0d67f95051e2b29893f9b6
.rar
SWZ-2.03/【520传奇】守望者加速2.03/GWH_d3d9.dll
.dll windows x86

759e158cfae3497ebc0894663470e0ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetModuleHandleA
GetLocalTime
GetCurrentProcessId
IsBadWritePtr
GetTickCount
LoadLibraryA
IsBadReadPtr
VirtualProtect
FlushFileBuffers
CloseHandle
CreateFileA
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
RaiseException
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
VirtualAlloc
HeapReAlloc
HeapSize
RtlUnwind
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

user32

GetClientRect
OffsetRect

winmm

timeGetTime

d3d9

Direct3DCreate9

Exports

Exports

GetSysInfo
InitD3D10H
InitD3D9H
ReleaseD3D9H

Sections

.text
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SWZ-2.03/【520传奇】守望者加速2.03/GWHookMan.dll
.dll windows x86

6d9275b7bb47068eda3b5f46012118a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineW
PathRemoveFileSpecW

kernel32

EnterCriticalSection
GetModuleHandleA
DeleteCriticalSection
CloseHandle
CreateFileW
CreateEventA
LoadLibraryA
FreeLibrary
DeviceIoControl
GetModuleFileNameW
GetSystemDirectoryW
GetTickCount
GetModuleHandleW
LoadLibraryW
GetCurrentProcessId
GetProcAddress
InitializeCriticalSectionAndSpinCount
GetSystemTimeAdjustment
GetVersion
SetSystemTimeAdjustment
QueryPerformanceCounter
Sleep
VirtualProtect
IsBadReadPtr
IsBadWritePtr
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LeaveCriticalSection
OpenProcess
InitializeCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
FormatMessageW
GetCurrentProcess
SetUnhandledExceptionFilter
SetStdHandle
GetLocaleInfoW
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
TerminateProcess
UnhandledExceptionFilter
InterlockedCompareExchange
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RaiseException
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
InterlockedExchange
RtlUnwind
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale

user32

UnhookWindowsHookEx
CallNextHookEx
SetDoubleClickTime
GetDoubleClickTime
SetTimer
SetWindowsHookExW

advapi32

LookupPrivilegeValueA
CloseServiceHandle
DeleteService
ControlService
StartServiceW
OpenServiceW
CreateServiceW
OpenSCManagerW
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges

winmm

timeGetTime

psapi

GetProcessMemoryInfo
GetModuleBaseNameA
EnumProcessModules

Exports

Exports

?HookProc@@YGJHIJ@Z
GwDllRefresh
GwInitSysInfo
GwSdRefresh
GwSetText
Initialise
InstallHook
RemoveHook
SetTemperature

Sections

.text
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CONST
Size: 512B - Virtual size: 31B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HookSec
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SWZ-2.03/【520传奇】守望者加速2.03/GameWatcher.exe
.exe windows x86

1c372311534116eeffdf56f3f6c69c5c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
ExitProcess
GetProcAddress

user32

wsprintfA
MessageBoxA

Sections

.text
Size: 418KB - Virtual size: 1008KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.itext
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 24KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 98KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rapsft
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SWZ-2.03/【520传奇】守望者加速2.03/Gwken.dll
.exe windows x86

2f84b7bb98978210b653a71d669e6a3e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlInitUnicodeString
RtlGetVersion
memcpy
KeServiceDescriptorTable
RtlCopyUnicodeString
ExAllocatePoolWithTag
RtlCompareUnicodeString
IofCompleteRequest
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
MmGetSystemRoutineAddress
KeDelayExecutionThread
IoDeleteDevice
IoDeleteSymbolicLink
KeInitializeEvent
ObReferenceObjectByHandle
ExEventObjectType
IoCreateSymbolicLink
KeTickCount
KeBugCheckEx
_allmul
_alldiv
DbgPrint
ExFreePoolWithTag
ZwClose
ZwSetSecurityObject
ObOpenObjectByPointer
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
_wcsnicmp
RtlAddAccessAllowedAce
RtlLengthSid
memset
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
RtlFreeUnicodeString

hal

KeQueryPerformanceCounter
KfRaiseIrql
KeRaiseIrqlToDpcLevel
KfLowerIrql

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 768B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 128B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 896B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SWZ-2.03/【520传奇】守望者加速2.03/showinfo.txt
下载说明.txt
数码资源网.url
.url

Sharing

General

Malware Config

Signatures

Files

759e158cfae3497ebc0894663470e0ab

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

winmm

d3d9

Exports

Exports

Sections

.text Size: 67KB - Virtual size: 66KB

.rdata Size: 41KB - Virtual size: 41KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 9KB - Virtual size: 8KB

6d9275b7bb47068eda3b5f46012118a0

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

winmm

psapi

Exports

Exports

Sections

.text Size: 135KB - Virtual size: 134KB

.rdata Size: 53KB - Virtual size: 53KB

.data Size: 13KB - Virtual size: 23KB

CONST Size: 512B - Virtual size: 31B

.HookSec Size: 4KB - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 13KB - Virtual size: 13KB

1c372311534116eeffdf56f3f6c69c5c

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 418KB - Virtual size: 1008KB

.itext Size: 2KB - Virtual size: 4KB

.data Size: 9KB - Virtual size: 28KB

.bss Size: - Virtual size: 24KB

.idata Size: 5KB - Virtual size: 16KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 68KB

.rsrc Size: 98KB - Virtual size: 156KB

.rapsft Size: 4KB - Virtual size: 4KB

2f84b7bb98978210b653a71d669e6a3e

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 768B - Virtual size: 648B

PAGE Size: 5KB - Virtual size: 4KB

PAGE Size: 128B - Virtual size: 4B

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 936B

.reloc Size: 896B - Virtual size: 848B

.text
Size: 67KB - Virtual size: 66KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 9KB - Virtual size: 8KB

.text
Size: 135KB - Virtual size: 134KB

.rdata
Size: 53KB - Virtual size: 53KB

.data
Size: 13KB - Virtual size: 23KB

CONST
Size: 512B - Virtual size: 31B

.HookSec
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 13KB - Virtual size: 13KB

.text
Size: 418KB - Virtual size: 1008KB

.itext
Size: 2KB - Virtual size: 4KB

.data
Size: 9KB - Virtual size: 28KB

.bss
Size: - Virtual size: 24KB

.idata
Size: 5KB - Virtual size: 16KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 68KB

.rsrc
Size: 98KB - Virtual size: 156KB

.rapsft
Size: 4KB - Virtual size: 4KB

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 768B - Virtual size: 648B

PAGE
Size: 5KB - Virtual size: 4KB

PAGE
Size: 128B - Virtual size: 4B

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 896B - Virtual size: 848B