ceff382165b7423e9b7f7e73667da668ad2a01e9155e72819b76c4cee68c47b3

Sharing

Copy URL Twitter E-mail

General

Target

ceff382165b7423e9b7f7e73667da668ad2a01e9155e72819b76c4cee68c47b3
Size

3.8MB
MD5

5f805a44970354ff834bddf2112ab90a
SHA1

2e459b5d35ba84001f8de5aa0579621acd88c717
SHA256

ceff382165b7423e9b7f7e73667da668ad2a01e9155e72819b76c4cee68c47b3
SHA512

cb81d4758e9f70ec437805c20634787a51bb6192ee54b5867a41f901a4ba0bae76602060f5929788984664caed9b195f3d07142fefd995207e57a31a596b7b13
SSDEEP

98304:g39vypLUUdzXUyd3jdrvOqzPzEqEVtbe2sOwhW:g3W/X1ddvOOPzErtii9

Score

N/A

Malware Config

Signatures

Files

ceff382165b7423e9b7f7e73667da668ad2a01e9155e72819b76c4cee68c47b3
.rar
wangluoyougou_jb51/jb51.net.txt
wangluoyougou_jb51/去脚本之家看看.url
.url
wangluoyougou_jb51/服务器软件.url
.url
wangluoyougou_jb51/网络幽狗VIP版.EXE
.exe windows x86

e41c25ab7824b3df73334188c40518ae

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Imports

kernel32

lstrcpyA
GetCommandLineA
SetErrorMode
lstrlenA
MulDiv
GetTempFileNameA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
FormatMessageA
lstrcatA
GetLastError
_lwrite
_llseek
GlobalUnlock
_lopen
GlobalAlloc
GlobalFree
_lclose
_lcreat
LoadLibraryA
GetProcAddress
FreeLibrary
OpenFile
GetVersionExA
GetCurrentProcess
WinExec
ExitProcess
_lread
LocalFree
GetTempPathA
GlobalLock

user32

GetDC
BeginPaint
EndPaint
InvalidateRect
PostQuitMessage
SendMessageA
DefWindowProcA
GetClientRect
CreateWindowExA
DrawTextA
ReleaseDC
ShowWindow
SetWindowPos
UpdateWindow
SetTimer
LoadIconA
wsprintfA
MessageBoxA
ExitWindowsEx
RegisterClassA
LoadCursorA

gdi32

DeleteObject
GetStockObject
GetDeviceCaps
PatBlt
CreateSolidBrush
TextOutA
SetTextColor
SetBkMode
SelectObject
StretchDIBits
CreateFontA
RealizePalette
SelectPalette
CreatePalette

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

Exports

Exports

_MainWndProc@16
_StubFileWrite@12

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
wangluoyougou_jb51/网络幽狗VIP版破解补丁.exe
.exe windows x86

1c7f2ae176101fbbefc12a52372cd226

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wpcap

pcap_setfilter
pcap_compile
pcap_open_live
pcap_sendpacket
pcap_close
pcap_findalldevs
pcap_lookupnet
pcap_freealldevs
pcap_datalink

iphlpapi

SendARP
GetAdaptersInfo

ws2_32

htons
inet_addr

wininet

HttpQueryInfoA
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetGetConnectedState
InternetCheckConnectionA
InternetReadFile

winmm

timeGetTime

mfc42

ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord3597
ord641
ord567
ord324
ord825
ord693
ord2302
ord4234
ord3996
ord4710
ord800
ord5953
ord941
ord860
ord540
ord537
ord2379
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord3402
ord6741
ord616
ord6508
ord2289
ord2370
ord798
ord1997
ord6907
ord6877
ord3998
ord4129
ord6648
ord2764
ord5465
ord5194
ord3790
ord858
ord922
ord533
ord3337
ord6767
ord2818
ord1200
ord6669
ord3092
ord6334
ord1146
ord1168
ord3301
ord2367
ord2938
ord6241
ord1783
ord532
ord6335
ord535
ord3874
ord6199
ord924
ord3631
ord3716
ord790
ord683
ord2642
ord3097
ord3226
ord755
ord470
ord6407
ord3619
ord3721
ord795
ord3663
ord3626
ord2414
ord4275
ord2864
ord3797
ord5875
ord1641
ord2860
ord3610
ord656
ord1105
ord5572
ord2915
ord823
ord3317
ord6283
ord939
ord4224
ord926
ord940
ord2614
ord6366
ord4219
ord2581
ord3702
ord1771
ord2413
ord2024
ord4401
ord3639
ord692
ord501
ord773
ord5621
ord998
ord283
ord2380
ord5788
ord472
ord2754
ord2859
ord4124
ord1862
ord4220
ord2584
ord3654
ord640
ord323
ord2438
ord816
ord5789
ord562
ord2450
ord2971
ord1640
ord5785
ord4133
ord4297
ord2124
ord2863
ord3571
ord5787
ord2763
ord5710
ord5308
ord4779
ord5811
ord5482
ord2032
ord4411
ord4447
ord4335
ord4863
ord4975
ord5797
ord5479
ord1995
ord967
ord3717
ord523
ord791
ord4919
ord6197
ord6380
ord6888
ord6675
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord609
ord804
ord810
ord765
ord620
ord807
ord686
ord1247
ord2621
ord1134
ord2725
ord3584
ord543
ord803
ord348
ord663
ord3698
ord1576
ord3733
ord2575
ord4396
ord3574
ord2587
ord4406
ord3394
ord3729
ord384
ord554
ord6491
ord6215
ord6270
ord1644
ord6565
ord5884
ord2921
ord2012
ord6146
ord5885
ord5882
ord5883
ord4284
ord2453
ord2862
ord2096
ord4163
ord6625
ord6619
ord2077
ord518
ord1085
ord542
ord4160
ord5655
ord2777
ord4278
ord4000
ord3303
ord6929
ord536
ord5480
ord1138
ord5809
ord1175
ord5600
ord5601
ord5645
ord5583
ord3183
ord1979
ord6385
ord5442
ord2919
ord3318
ord665
ord5186
ord354
ord6392
ord3290
ord6008
ord5778
ord6567
ord6605
ord668
ord1980
ord3178
ord4058
ord2781
ord2770
ord356
ord5609
ord6569
ord3742
ord5821
ord3662
ord818
ord414
ord713
ord2393
ord5859
ord6141
ord3089
ord5440
ord6383
ord5450
ord6394
ord6453
ord5216
ord936
ord932
ord4243
ord3286
ord2408
ord801
ord541
ord6007
ord6143
ord2100
ord4299
ord5981
ord2089
ord6905
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4998
ord4853
ord4376
ord5265
ord3640
ord4424
ord3370
ord5290
ord4402
ord1776
ord6055
ord2582
ord4083
ord3398

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
?terminate@@YAXXZ
_except_handler3
??1type_info@@UAE@XZ
_onexit
__dllonexit
strtoul
strtod
memmove
_beginthreadex
_mbsnbcpy
_CIasin
_ftol
sprintf
malloc
free
exit
_mbscmp
atof
atoi
__CxxFrameHandler
_setmbcp
_itoa

kernel32

DeleteFileA
GetStartupInfoA
GetModuleHandleA
FindResourceA
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
GetCurrentDirectoryA
lstrlenA
lstrcpyA
MulDiv
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateMutexA
OpenMutexA
ReleaseMutex
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
lstrcpynA
CreateEventA
CreateDirectoryA
MoveFileA
SetEvent
GetLocalTime
ResetEvent
CopyFileA
RemoveDirectoryA
GlobalFree
GlobalUnlock
GlobalLock
ResumeThread
GlobalAlloc
LockResource
SizeofResource
LoadResource
CloseHandle

user32

PtInRect
GetClientRect
SetWindowLongA
SetCursor
SetTimer
GetParent
GetKeyNameTextA
MapVirtualKeyA
FillRect
OffsetRect
InflateRect
DrawIcon
DrawEdge
CopyRect
GetSysColor
SystemParametersInfoA
GetSystemMetrics
DrawIconEx
GetSubMenu
GetMenuItemInfoA
GetMenuItemCount
SetCapture
DestroyIcon
SetWindowPos
SetForegroundWindow
GetWindowRect
GetCursorPos
CreatePopupMenu
LoadBitmapA
GetSystemMenu
IsIconic
FindWindowA
mouse_event
IsWindowVisible
RegisterHotKey
UnregisterHotKey
RegisterClassA
DefWindowProcA
SetRect
ReleaseDC
GetDC
LockWindowUpdate
GetWindowLongA
InvalidateRect
ReleaseCapture
LoadIconA
EnableWindow
SendMessageA
AppendMenuA
KillTimer
LoadCursorA

gdi32

GetDeviceCaps
CreateSolidBrush
DeleteDC
Ellipse
GetPixel
FloodFill
CreateDCA
GetStockObject
CreateDIBitmap
CreateCompatibleBitmap
CreateBitmap
PatBlt
CreateCompatibleDC
SelectObject
DeleteObject
CreateFontA
GetTextColor
BitBlt
Rectangle
GetObjectA
CreateFontIndirectA

comdlg32

GetSaveFileNameA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

shell32

Shell_NotifyIconA
ShellExecuteA

comctl32

ImageList_ReplaceIcon
ImageList_SetBkColor

ole32

CreateStreamOnHGlobal

olepro32

ord251

skinmagictrial

ord8
ord4
ord1
ord2

Sections

.text
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 492KB - Virtual size: 489KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
wangluoyougou_jb51/街机游戏说明.txt

Sharing

General

Malware Config

Signatures

Files

e41c25ab7824b3df73334188c40518ae

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

1c7f2ae176101fbbefc12a52372cd226

Headers

File Characteristics

Imports

wpcap

iphlpapi

ws2_32

wininet

winmm

mfc42

msvcrt

kernel32

user32

gdi32

comdlg32

advapi32

shell32

comctl32

ole32

olepro32

skinmagictrial

Sections

.text Size: 176KB - Virtual size: 175KB

.rdata Size: 40KB - Virtual size: 36KB

.data Size: 12KB - Virtual size: 40KB

.rsrc Size: 492KB - Virtual size: 489KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.text
Size: 176KB - Virtual size: 175KB

.rdata
Size: 40KB - Virtual size: 36KB

.data
Size: 12KB - Virtual size: 40KB

.rsrc
Size: 492KB - Virtual size: 489KB