3709023ac68890c1578cb1e301b18a7c0fbb85b96ec9d873596f5dc1d6579517

Sharing

Copy URL Twitter E-mail

General

Target

3709023ac68890c1578cb1e301b18a7c0fbb85b96ec9d873596f5dc1d6579517
Size

27.7MB
MD5

8f1ac834a2479f46c0c88eec4c52a1a8
SHA1

4794631a3b9be8056233c032f3800eb628608769
SHA256

3709023ac68890c1578cb1e301b18a7c0fbb85b96ec9d873596f5dc1d6579517
SHA512

3db907a3382012fa55805155f5657e1775721f65bbb2fb49850f53734688c31816f84868396ce79022c50949cc98e3807c5d285f91ff0c720f1e3f835da7f127
SSDEEP

786432:wIQ896UrSGkrHjuJD1RdVaTuJhiQdjNYtqrT6FZ8a+Rk/:wIn7rS9HMRd6uJhNrY0mXEk/

Score

N/A

Malware Config

Signatures

Files

3709023ac68890c1578cb1e301b18a7c0fbb85b96ec9d873596f5dc1d6579517
.rar
作文克星 II/000.chm
.chm
作文克星 II/0073/007301.mb
作文克星 II/0073/007301.wks
作文克星 II/0073/0093.ini
作文克星 II/0073/1098.ini
作文克星 II/0073/兰色多瑙河.mid
作文克星 II/0073/圣诞快乐.mid
作文克星 II/0073/高山流水.mid
作文克星 II/0081/0080.img
作文克星 II/0081/0081.mb
作文克星 II/0081/0081.wks
作文克星 II/0081/0125.dat
作文克星 II/0081/0125.mb
作文克星 II/0081/0141.dat
作文克星 II/0081/0141.mb
作文克星 II/0081/0181.mb
作文克星 II/0081/0181.wks
作文克星 II/0081/0287.dat
作文克星 II/0081/0287.mb
作文克星 II/0081/0681.dat
作文克星 II/0081/0682.dat
作文克星 II/0081/0693.dat
作文克星 II/0081/0702.dat
作文克星 II/0081/0703.dat
作文克星 II/0081/1021.mb
作文克星 II/0081/1021.wks
作文克星 II/0081/1025.dat
作文克星 II/0081/1026.dat
作文克星 II/0081/1054.mb
作文克星 II/0081/1054.wks
作文克星 II/0081/1055.dat
作文克星 II/0081/1056.dat
作文克星 II/0081/1057.dat
作文克星 II/0081/1057.mb
作文克星 II/0081/1058.dat
作文克星 II/0081/1059.mb
作文克星 II/0081/1059.wks
作文克星 II/0081/1067.mb
作文克星 II/0081/1067.wks
作文克星 II/0081/2011.dat
作文克星 II/0081/2011.mb
作文克星 II/0081/2012.dat
作文克星 II/0081/2013.dat
作文克星 II/0081/2013.mb
作文克星 II/0081/2014.dat
作文克星 II/0081/2014.mb
作文克星 II/0081/2015.dat
作文克星 II/0081/2015.mb
作文克星 II/0081/2016.dat
作文克星 II/0081/2017.dat
.ps1
作文克星 II/0081/2017.mb
作文克星 II/0081/2018.dat
作文克星 II/0081/2018.mb
作文克星 II/0081/2020.dat
作文克星 II/Advpak.dll
作文克星 II/Asetup.gif
.gif
作文克星 II/Autowms.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 543KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 828KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ODATAE
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
作文克星 II/BASSMOD.dll
.dll windows x86

cb648629db2ccb75366a01b3c8903be4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
CloseHandle
CreateThread
SetThreadPriority
HeapAlloc
HeapCreate
HeapDestroy
Sleep
CreateFileA
ReadFile
SetFilePointer
FindResourceA
LoadResource
SizeofResource

winmm

waveOutClose
waveOutGetPosition
waveOutOpen
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite
waveOutPause
waveOutRestart

Exports

Exports

BASSMOD_Free
BASSMOD_Init
BASSMOD_MusicFree
BASSMOD_MusicLoad
BASSMOD_MusicPlay

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 875B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
作文克星 II/Help/000.chm
.chm
作文克星 II/Help/1.css
作文克星 II/Help/201.html
.html
作文克星 II/Help/202.html
.html
作文克星 II/Help/aaa.gif
.gif
作文克星 II/Help/button1.gif
.gif
作文克星 II/Help/button2.gif
.gif
作文克星 II/Help/button3.gif
.gif
作文克星 II/Help/button4.gif
.gif
作文克星 II/Help/button5.gif
.gif
作文克星 II/Help/button6.gif
.gif
作文克星 II/Help/button7.gif
.gif
作文克星 II/Help/logo.gif
.gif
作文克星 II/Help/xin.gif
.gif
作文克星 II/Help/ys.gif
.gif
作文克星 II/Help/yx.gif
.gif
作文克星 II/Help/zs.gif
.gif
作文克星 II/Help/zx.gif
.gif
作文克星 II/Help/汇款地址.txt
作文克星 II/INSTALL.LOG
作文克星 II/Idapi32.dll
.dll regsvr32 windows x86

ac24d2585411ea8a1d33653136dd11ed

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

UnmapViewOfFile
TlsFree
VirtualQuery
VirtualAlloc
UnlockFile
TlsGetValue
WriteFile
WaitForSingleObject
lstrcatA
VirtualFree
FindClose
WritePrivateProfileStringA
GetTimeZoneInformation
TlsSetValue
lstrcpyA
WriteProfileStringA
WideCharToMultiByte
CloseHandle
CreateFileA
CreateFileMappingA
CreateMutexA
CreateSemaphoreA
DeleteCriticalSection
DeleteFileA
DuplicateHandle
EnterCriticalSection
ExitProcess
FatalAppExitA
FileTimeToDosDateTime
UnhandledExceptionFilter
lstrlenA
GetSystemDirectoryA
GetStartupInfoA
FindNextFileA
FindResourceA
FlushFileBuffers
FreeEnvironmentStringsA
FreeLibrary
GetACP
GetCommandLineA
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDriveTypeA
GetEnvironmentStrings
GetFileAttributesA
GetFileSize
GetFileTime
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetPrivateProfileStringA
GetProcAddress
GetProfileStringA
FileTimeToLocalFileTime
FindFirstFileA
GetShortPathNameA
GetTickCount
GetTempPathA
FileTimeToSystemTime
GetStdHandle
GetVersion
GetVersionExA
GetVolumeInformationA
GlobalAddAtomA
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomA
GlobalFree
GlobalHandle
GlobalLock
GlobalMemoryStatus
GlobalUnlock
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsBadCodePtr
IsBadReadPtr
IsDBCSLeadByte
LeaveCriticalSection
LoadLibraryA
LoadResource
LockFile
LockResource
MapViewOfFileEx
MoveFileA
MultiByteToWideChar
RaiseException
ReadFile
ReleaseMutex
ReleaseSemaphore
RtlUnwind
SearchPathA
SetConsoleCtrlHandler
SetCurrentDirectoryA
SetEndOfFile
SetErrorMode
SetFilePointer
SetHandleCount
Sleep
TlsAlloc

advapi32

RegOpenKeyExA
InitializeSecurityDescriptor
RegOpenKeyA
RegEnumValueA
RegEnumKeyA
RegDeleteKeyA
RegCreateKeyExA
SetSecurityDescriptorDacl
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegQueryValueExA

ole32

StringFromGUID2
CoCreateInstance
OleInitialize

user32

OemToCharA
MessageBoxA
LoadStringA
CharUpperA
CharToOemBuffA
CharToOemA
OemToCharBuffA
EnumThreadWindows

mpr

WNetCloseEnum
WNetOpenEnumA
WNetGetUserA
WNetGetConnectionA
WNetEnumResourceA

oleaut32

SysFreeString
SysAllocStringLen
SysAllocStringByteLen

Exports

Exports

@__lockDebuggerData$qv
@__unlockDebuggerData$qv
ADDELT
CfgComposeRec
CfgGetField
CfgGetOLEDBParseDN
CliGetDriver
CloseCallBack
CreateDbObj
CreateDrvObj
CreateUniqFldNames
CreateVtObj
CreateXltRecCurs
DLLEXITFUNCTION2
DLLINITFUNCTION
DbiAcqPersistTableLock
DbiAcqTableLock
DbiActivateFilter
DbiAddAlias
DbiAddDriver
DbiAddFamilyMember
DbiAddFilter
DbiAddIndex
DbiAddPassword
DbiAddRepository
DbiAnsiToNative
DbiAppendRecord
DbiApplyDelayedUpdates
DbiBatchMove
DbiBatchMoveQuery
DbiBcdFromFloat
DbiBcdToFloat
DbiBeginBatch
DbiBeginConstraintLayer
DbiBeginDelayedUpdates
DbiBeginLinkMode
DbiBeginLrNavMode
DbiBeginTran
DbiBeginXlateMode
DbiCfgAddRecord
DbiCfgBuildPath
DbiCfgDropRecord
DbiCfgGetHelp
DbiCfgGetNextNode
DbiCfgGetRecord
DbiCfgImportToRegistry
DbiCfgInstallMerge
DbiCfgMerge
DbiCfgModifyRecord
DbiCfgPosition
DbiCfgSave
DbiCfgTranslate
DbiChangeDefXltFn
DbiCheckRefresh
DbiCheckSQLExpression
DbiClearStats
DbiCloneCursor
DbiCloseConfigFile
DbiCloseCursor
DbiCloseDatabase
DbiCloseFieldXlt
DbiCloseFileHandle
DbiCloseIndex
DbiCloseSession
DbiCompareBookMarks
DbiCompareKeys
DbiComposeCursor
DbiCopyTable
DbiCreateInMemTable
DbiCreateTable
DbiCreateTempTable
DbiDRAdd
DbiDRAddAttr
DbiDRClose
DbiDRCreate
DbiDRCreateEnumAttrDomain
DbiDRCreateObjectType
DbiDRCreateRelationType
DbiDRDelete
DbiDRDeleteEnumAttrDomain
DbiDRDeleteObjectType
DbiDRDeleteRelationType
DbiDRDrop
DbiDRDropAttr
DbiDRExportToFile
DbiDRGetAttrDescs
DbiDRGetDesc
DbiDRGetEnumAttrDomain
DbiDRGetObjID
DbiDRGetObjTypeInfo
DbiDRGetRelTypeInfo
DbiDRGetRelatedObject
DbiDRImportFromFile
DbiDRLoadDBObject
DbiDRModifyEnumAttrDomain
DbiDROpen
DbiDROpenAttrTypeList
DbiDROpenObjSet
DbiDROpenObjectTypeList
DbiDROpenRelSet
DbiDROpenRelTypeList
DbiDRSetToObjID
DbiDRSetToObjName
DbiDatabaseFlush
DbiDateDecode
DbiDateEncode
DbiDeComposeCursor
DbiDeactivateFilter
DbiDebugLayerOptions
DbiDeleteAlias
DbiDeleteDriver
DbiDeleteIndex
DbiDeleteRecord
DbiDeleteRepository
DbiDeleteTable
DbiDeregisterCursor
DbiDoRestructure
DbiDoSoftRestr
DbiDropFamilyMember
DbiDropFilter
DbiDropPassword
DbiDrvXlateFld
DbiEmptyTable
DbiEndBatch
DbiEndConstraintLayer
DbiEndDelayedUpdates
DbiEndLinkMode
DbiEndLrNavMode
DbiEndTran
DbiEndXlateMode
DbiEnlistMtsTransaction
DbiEnterRefresh
DbiExit
DbiExitRefresh
DbiExtractKey
DbiFlushFileHandleCache
DbiForceRecordReread
DbiForceReread
DbiFormFullName
DbiFreeBlob
DbiFreeSQLRequest
DbiGenSQLStatement
DbiGetBestRowIdentifier
DbiGetBlob
DbiGetBlobHeading
DbiGetBlobSize
DbiGetBookMark
DbiGetCallBack
DbiGetClientInfo
DbiGetCurrSession
DbiGetCurrXltFn
DbiGetCursorForTable
DbiGetCursorProps
DbiGetDatabaseDesc
DbiGetDatabaseParams
DbiGetDateFormat
DbiGetDefaultRepository
DbiGetDirectory
DbiGetDriverDesc
DbiGetDriverParams
DbiGetErrorContext
DbiGetErrorEntry
DbiGetErrorInfo
DbiGetErrorString
DbiGetExactRecordCount
DbiGetExtFldDesc
DbiGetField
DbiGetFieldDescs
DbiGetFieldTypeDesc
DbiGetFilterInfo
DbiGetIndexDesc
DbiGetIndexDescs
DbiGetIndexForField
DbiGetIndexSeqNo
DbiGetIndexTypeDesc
DbiGetLdName
DbiGetLdNameFromDb
DbiGetLdObj
DbiGetLinkStatus
DbiGetNetUserName
DbiGetNextRecord
DbiGetNumberFormat
DbiGetObjFromName
DbiGetObjFromObj
DbiGetObjectHandles
DbiGetPriorRecord
DbiGetProp
DbiGetRecord
DbiGetRecordCount
DbiGetRecordForKey
DbiGetRefreshDistance
DbiGetRelativeRecord
DbiGetRelativeRecordCnt
DbiGetRepositoryInfo
DbiGetRintDesc
DbiGetSQLRequest
DbiGetSeqNo
DbiGetSesInfo
DbiGetSysConfig
DbiGetSysInfo
DbiGetSysStats
DbiGetSysVersion
DbiGetTableClass
DbiGetTableOpenCount
DbiGetTableTypeDesc
DbiGetTimeFormat
DbiGetTranInfo
DbiGetVchkDesc
DbiHardInsertRecord
DbiImportODBC
DbiInitFn
DbiInitRecord
DbiInsertRecord
DbiIsLDID19As13
DbiIsLDID19As19
DbiIsLDIDUSAsLocal
DbiIsRecordLocked
DbiIsTableLocked
DbiIsTableShared
DbiJoinTables
DbiLinkDetail
DbiLinkDetailToExp
DbiLoadDriver
DbiMakePermanent
DbiMapRecStruct
DbiModifyRecord
DbiNativeToAnsi
DbiOpenBlob
DbiOpenCfgInfoList
DbiOpenConfigFile
DbiOpenDatabase
DbiOpenDatabaseList
DbiOpenDriverList
DbiOpenFamilyList
DbiOpenFieldList
DbiOpenFieldTypesList
DbiOpenFieldXlt
DbiOpenFileList
DbiOpenFunctionArgList
DbiOpenFunctionList
DbiOpenIndex
DbiOpenIndexList
DbiOpenIndexTypesList
DbiOpenLdList
DbiOpenLockList
DbiOpenNestedTable
DbiOpenRef
DbiOpenRepositoryList
DbiOpenRintList
DbiOpenSPList
DbiOpenSPParamList
DbiOpenSecurityList
DbiOpenSessionRepository
DbiOpenTable
DbiOpenTableList
DbiOpenTableTypesList
DbiOpenUserList
DbiOpenVchkList
DbiPackTable
DbiPrepareDelayedUpdates
DbiProcessSql
DbiPutBlob
DbiPutField
DbiQAlloc
DbiQExec
DbiQExecDirect
DbiQExecProcDirect
DbiQFree
DbiQGetBaseDescs
DbiQInstantiateAnswer
DbiQLowBuild
DbiQLowFieldExp
DbiQLowFieldName
DbiQLowGetName
DbiQLowGetPAL
DbiQLowGetPALLen
DbiQLowGetProps
DbiQLowIsExample
DbiQLowParse
DbiQLowPrepare
DbiQLowQA
DbiQLowSetName
DbiQLowSetProps
DbiQLowStart
DbiQLowTableInfo
DbiQLowTablesCount
DbiQPrepare
DbiQPrepareExt
DbiQPrepareProc
DbiQSetParams
DbiQSetProcParams
DbiQryExec
DbiQryExecDirect
DbiQryFormatAnswer
DbiQryFree
DbiQryGetAnsFormat
DbiQryGetCursorProps
DbiQryGetFieldDescs
DbiQryGetLogType
DbiQryInstantiateAnswer
DbiQryOpen
DbiQryPrepareCmd
DbiQryRegisterCallBack
DbiQrySqlGetStrLen
DbiQrySqlGetString
DbiReadBlock
DbiRecordFlushRef
DbiRegenIndex
DbiRegenIndexes
DbiRegister
DbiRegisterCallBack
DbiRegisterCursor
DbiRelPersistTableLock
DbiRelRecordLock
DbiRelTableLock
DbiReleaseMem
DbiRenameTable
DbiResetDetailLinks
DbiResetRange
DbiSQLTextToCanEx
DbiSaveChanges
DbiSchemaCacheFlush
DbiSetCurrSession
DbiSetDateFormat
DbiSetDefaultRepository
DbiSetDirectory
DbiSetFieldMap
DbiSetFieldMap2
DbiSetFilterProps
DbiSetLDID19As13
DbiSetLDID19As19
DbiSetLDIDUSAsLocal
DbiSetLockRetry
DbiSetNumberFormat
DbiSetPrivateDir
DbiSetProp
DbiSetRange
DbiSetRefreshRange
DbiSetStats
DbiSetTimeFormat
DbiSetToBegin
DbiSetToBookMark
DbiSetToCursor
DbiSetToEnd
DbiSetToKey
DbiSetToRecordNo
DbiSetToSeqNo
DbiSetupExprObj
DbiSortTable
DbiSortTable2
DbiStartSession
DbiSwitchToIndex
DbiTimeDecode
DbiTimeEncode
DbiTimeStampDecode
DbiTimeStampEncode
DbiTranslateField
DbiTranslateRecordStructure
DbiTruncateBlob
DbiUCloseSecurityFile
DbiUCreateSecurityFile
DbiUDeleteSecurityUser
DbiUGetLoginSecurity
DbiUGetSecurityUserInfo
DbiUGetTablePrivileges
DbiUJoinIndexes
DbiUOpenSecurityFile
DbiUReadTableHdr
DbiURegenBlobFile
DbiUSetLoginSecurity
DbiUSetSecurityUserInfo
DbiUSetTablePrivileges
DbiUValidateSecurityUser
DbiUWriteTableHdr
DbiUndeleteRecord
DbiUnlinkDetail
DbiUseIdleTime
DbiValidateName
DbiValidateProp
DbiValidateRecordStructure
DbiVerifyField
DbiWriteBlock
DllEntryPoint
DllRegisterServer
DllUnregisterServer
ExecCallBack
ExpGeneratePostFix
ExprGenPostFix
FAMILY
FreeVtObj
GetCallBack
GetExtFromTblType
GetLocalCp
GetSpc1
GetSpc2
GetTblTypeFromExt
GetTblTypeFromTblName
GetWorldFlags
GetszLDdb
GetszLDpx
ImltCreateTable
ImltCreateTable2
ImltExitSubSys
ImltInitSubSys
JapanStrCmp
JapanStrnCmp
JapanStrnCmpi
LBlobOpen
LISTLENGTH
LrNavCompSetup
LsDateDecode
LsDateEncode
LsGetDate
LsGetTime
LsGetTimeStampEncode
LsTimeDecode
LsTimeEncode
LsTimeStampDecode
LsTimeStampEncode
LsValidDate
MEMB
NCONC
NCONS
NULLP
OCCloseObjs
OCFindObj
OCRegisterObj
OCUnRegisterObj
OpenCallBack
OsAssert
OsChSize
OsClearError
OsClose
OsCloseForInstance
OsControlError
OsCopy
OsCopyShare
OsCreate
OsCreate2
OsCreateRWObj
OsCtxBegin
OsCtxClrStk
OsCtxCount
OsCtxEnd
OsCtxExit
OsCtxGetCur
OsCtxGetElem
OsCtxGetError
OsCtxGetSymStr
OsCtxInit
OsCtxPop
OsCtxPush
OsCtxSetFatal
OsCurrFile
OsDBGSaveError
OsDeleteRWObj
OsDirExists
OsDirFirst
OsDirNext
OsFileExists
OsFileExistsSearch
OsFileLength
OsFlushFileSize
OsFlushLocalBuf
OsFreeDll
OsFreeSharedSz
OsFreeSz
OsGetCodePage
OsGetCurDirEx
OsGetCurDrive
OsGetDate
OsGetDllFileName
OsGetFileTime
OsGetM
OsGetNetInMemFlag
OsGetOSType
OsGetPrivateProfileString
OsGetProcAddressByName
OsGetProcAddressByNum
OsGetProcessId
OsGetProfileString
OsGetSharedPtr
OsGetSystemTicks
OsGetTempDir
OsGetTempName
OsGetTime
OsIs386
OsIs386Enh
OsIsAlpha
OsIsDigit
OsIsFileLocal
OsIsFileOnCdRom
OsIsFileReadOnly
OsIsLocalDrive
OsIsLocalDrive_0
OsJLdCBtoM
OsJLdCMtoB
OsJLdCStrLen
OsJLdFBtoM
OsJLdFGetMinMax

Sections

CODE
Size: 429KB - Virtual size: 432KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 72KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

TLSCBA
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 51KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
作文克星 II/Idpdx32.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

@__lockDebuggerData$qv
@__unlockDebuggerData$qv
CRYPTAREA
OsLdMBRisCJKBlank
OsLdMBRisCJKKana
OsLdMBRisKana
OsLdMBRisLead
OsLdMBRisTrail
PDRVGETNETUSERLIST
PDrvGetFidInfo
PDrvIGetField
PDrvInit
PdrvInfo
WEP
__DebuggerHookData

Sections

CODE
Size: 219KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 17KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.INIT
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
作文克星 II/Idr20009.dll
.dll windows x86

ca7840dd8b852014c2f3a1872f9911d7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetVersionExA
EnterCriticalSection
CloseHandle
FreeEnvironmentStringsA
GetCommandLineA
GetCurrentThreadId
GetEnvironmentStrings
CreateFileA
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStdHandle
GetFileAttributesA
ExitProcess
GlobalMemoryStatus
InitializeCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WriteFile
GetVersion

user32

MessageBoxA
EnumThreadWindows

Exports

Exports

@__lockDebuggerData$qv
@__unlockDebuggerData$qv
WEP
__DebuggerHookData

Sections

CODE
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 5KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 81KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
作文克星 II/bantam.dll
.dll windows x86

302e92a8b022643b516e70240a11b811

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

CreateFileA
GetCurrentThreadId
EnterCriticalSection
ExitProcess
CloseHandle
FileTimeToLocalFileTime
FindClose
FindFirstFileA
FindNextFileA
GetCommandLineA
CreateMutexA
GetEnvironmentStrings
GetFileAttributesA
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStdHandle
GetVersion
FileTimeToDosDateTime
GetVolumeInformationA
GlobalMemoryStatus
InitializeCriticalSection
IsDBCSLeadByte
LeaveCriticalSection
MultiByteToWideChar
RaiseException
ReadFile
ReleaseMutex
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
GetVersionExA

user32

MessageBoxA
EnumThreadWindows

Exports

Exports

@__lockDebuggerData$qv
@__unlockDebuggerData$qv
BT_BufferCollate
BT_BufferMatch
BT_ByteCount
BT_CharacterCount
BT_ClientToNative
BT_CloseLocale
BT_Ctype
BT_Exit
BT_FuzzyBufferComp
BT_FuzzyStrComp
BT_GetFoxSortKey
BT_GetIndexKey
BT_GetLastError
BT_GetLocaleInfo
BT_GetLocaleList
BT_GetMinMaxCollChar
BT_GetOwner
BT_Init
BT_IsLeadByte
BT_IsTrailByte
BT_NativeToClient
BT_OpenLocale
BT_SetLocaleToClient
BT_SetLocaleToNative
BT_SetLocaleToUnicode
BT_StrCollate
BT_StrLower
BT_StrMatch
BT_StrTransform
BT_StrUpper
BT_ToLower
BT_ToSoundex
BT_ToUpper
_OSLD_GetLdInfoFromBTID
_OSLD_GetLdInfoFromCodeSet
_OSLD_GetLdInfoFromID
_OSLD_GetLdInfoFromINDEX
_OSLD_GetLdInfoFromLCID
_OSLD_GetLdInfoFromName
_OSLD_IsLdAvailable
__DebuggerHookData

Sections

CODE
Size: 54KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 37KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
作文克星 II/blw32.dll
.dll windows x86

13d686cae91936e0544fbb42d1855ce5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetACP
VirtualQuery
CloseHandle
CreateFileA
CreateMutexA
WriteFile
EnterCriticalSection
ExitProcess
FatalAppExitA
FindClose
FindFirstFileA
FreeLibrary
GetVersion
GetCommandLineA
GetCurrentDirectoryA
GetCurrentThreadId
GetEnvironmentStrings
GetFileAttributesA
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStdHandle
DeleteCriticalSection
GetVersionExA
GlobalAlloc
GlobalLock
GlobalMemoryStatus
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsDBCSLeadByte
LeaveCriticalSection
LoadLibraryA
RaiseException
ReleaseMutex
RtlUnwind
SearchPathA
SetConsoleCtrlHandler
SetErrorMode
SetFilePointer
SetHandleCount
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree

user32

MessageBoxA
EnumThreadWindows

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

Exports

Exports

@__lockDebuggerData$qv
@__unlockDebuggerData$qv
BLM_BufferCollate
BLM_StrDbaseCompare
BLM_StrTranslation
BLM_ToSoundex
BLN_GetSysLocale
BLN_IsClass
BLN_QStrMatchi
BLN_QStrnMatchi
BLN_StrCollate
BLN_StrDbaseCompare
BLN_StrLower
BLN_StrTranslation
BLN_StrUpper
BLN_StrnLower
BLN_StrnUpper
BLN_ToLower
BLN_ToSoundex
BLN_ToUpper
BLW_GetSysLocale
BLW_StrTranslation
BL_BufferConvert
BL_CloseConversion
BL_CloseLocale
BL_CollationInfo
BL_Exit
BL_GetHlocaleCharacterSetName
BL_GetHlocaleInfo
BL_GetLDDescFromLDID
BL_GetLDIDFromHlocale
BL_GetTranslationCount
BL_GetTranslationInfo
BL_IsFirstByte
BL_OpenConversion
BL_OpenLocale
BL_OpenLocaleWithLDID
BL_OpenLocaleWithLDName
_BL_InitClient
__DebuggerHookData

Sections

CODE
Size: 28KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

TLSCBA
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
作文克星 II/charset.cvb
作文克星 II/fareast.btl
作文克星 II/html/1.css
作文克星 II/html/aaa.gif
.gif
作文克星 II/html/aaa1.gif
.gif
作文克星 II/html/button1.gif
.gif
作文克星 II/html/button2.gif
.gif
作文克星 II/html/button3.gif
.gif
作文克星 II/html/button4.gif
.gif
作文克星 II/html/button5.gif
.gif
作文克星 II/html/button6.gif
.gif
作文克星 II/html/button7.gif
.gif
作文克星 II/html/d-1.html
.html .js
作文克星 II/html/logo.gif
.gif
作文克星 II/html/r-1.html
.html
作文克星 II/html/ys.gif
.gif
作文克星 II/html/yx.gif
.gif
作文克星 II/html/zs.gif
.gif
作文克星 II/html/zx.gif
.gif
作文克星 II/idbat32.dll
.dll windows x86

a00ace465fd40f41da8cdf77cb078645

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetCurrentThreadId
SetConsoleCtrlHandler
LeaveCriticalSection
GetEnvironmentStrings
GetLastError
IsDBCSLeadByte
TlsGetValue
RaiseException
GetStartupInfoA
GetFileAttributesA
CreateFileA
GetCommandLineA
GetProcAddress
InitializeCriticalSection
VirtualFree
TlsSetValue
SetHandleCount
RtlUnwind
GlobalMemoryStatus
GetStdHandle
GetModuleFileNameA
GetFileType
ExitProcess
CloseHandle
EnterCriticalSection
FreeEnvironmentStringsA
GetLocalTime
GetModuleHandleA
GetVersion
GetVersionExA
WriteFile
VirtualQuery
VirtualAlloc
UnhandledExceptionFilter
TlsFree
TlsAlloc
SetFilePointer

idapi32

OsCopyShare
OsNmZapExt
OsFileExists
OsNmChgExt
OsLoadString
OsCopy
XLTCharMap
DbiEndXlateMode
DbiBeginXlateMode
OsUnlink
SvDrvGetSize
OsDirFirst
XltRecStruct
OsNmPrsFName
OsNmBldFName
OsNmChgDrive
OsIsLocalDrive
SysGetStdTran
GetWorldFlags
GetszLDpx
GetszLDdb
OsLdMBRStrICmp
OsLdMBRStrChr
OsLdMBRStrNICmp
XlateRecordStructure
SysYield
DbiGetLdNameFromDb
DbiGetCurrXltFn
DbiOpenTable
OsSaveErrorByLang
CreateXltRecCurs
GetExtFromTblType
DbiGetLdName
OsLdBuildCharSetXform
XlateBuild
OsLdUnloadObj
_OsFree
SysRegVt
SysClientEntry
OsLdGetSymbName
GetTblTypeFromExt
SysDropPassword
OsLdLoadBySymbName
_OsRealloc
XltBuild
SysAddPassword
SysSetEnv
OsGetCurDrive
SysSetActiveSes
SysLoadDriver
OsSaveError
_OsCalloc
SysGetDb
SysGetCallBack
OsClearError
SysGetActiveSes
SrtTable
OsGetTempName
_OsMalloc
DbiGetErrorString
DbiCloseCursor
SvDrvGet

user32

MessageBoxA
EnumThreadWindows

Exports

Exports

@__lockDebuggerData$qv
@__unlockDebuggerData$qv
BatchAppendTable
BatchDoRestructure
BatchEmptyTable
BatchMove
BatchMoveQuery
BatchPackTable
BatchSortOpenedTable
BatchSortOpenedTable2
BatchSortTable
BatchSortTable2
WEP
__DebuggerHookData

Sections

CODE
Size: 118KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 9KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
作文克星 II/iddr32.dll
.dll windows x86

ceddaa60de44e811575d1fb0298ed438

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

SetFilePointer
GetFileType
GetCurrentThreadId
SetConsoleCtrlHandler
GetVersionExA
ExitProcess
LeaveCriticalSection
GetEnvironmentStrings
GetLastError
IsDBCSLeadByte
VirtualQuery
TlsAlloc
GetLocalTime
CloseHandle
TlsGetValue
RaiseException
GetStartupInfoA
GetFileAttributesA
CreateFileA
GetCommandLineA
GetProcAddress
InitializeCriticalSection
UnhandledExceptionFilter
WriteFile
VirtualAlloc
TlsFree
GetVersion
GetModuleHandleA
FreeEnvironmentStringsA
EnterCriticalSection
VirtualFree
TlsSetValue
SetHandleCount
RtlUnwind
GlobalMemoryStatus
GetStdHandle
GetModuleFileNameA

idapi32

DbiQExecDirect
DbiFreeBlob
DbiSetRange
DbiTruncateBlob
DbiPutBlob
DbiDeleteRecord
DbiSetToBegin
DbiGetBlob
DbiGetBlobSize
DbiModifyRecord
OsSeek
OsWrite
DbiOpenBlob
OsClose
OsUnlink
OsFileLength
OsReadFromPos
OsWriteExactToPos
OsOpenR
OsNmValidateFldName
OsClearError
LsDateDecode
LsTimeDecode
ImltCreateTable
VtGenCreateObj
OsCreate
_OsFree
DbiOpenFieldTypesList
DbiInsertRecord
DbiCloseCursor
DbiOpenTable
_OsRealloc
_OsCalloc
DbiGetDatabaseDesc
_OsMalloc
DbiGetLdObj
DbiForceReread
DbiGetRecord
DbiGetRecordForKey
DbiDeleteTable
DbiRelTableLock
DbiGetProp
DbiAnsiToNative
DbiCreateTable
DbiNativeToAnsi
DbiSetProp
SysGetActiveClient
OsNmBldFName
DbiAddAlias
DbiAddRepository
DbiDeleteRepository
DbiGetRepositoryInfo
GetWorldFlags
SvAtoI
DbiInitRecord
DbiAcqTableLock
DbiGetPriorRecord
DbiGetFieldDescs
SysGetActiveSes
_SvStrPrintF
DbiCloneCursor
OsLoadString
OsSaveErrorByLang
DbiPutField
DbiCreateInMemTable
DbiRegisterCursor
DbiGetLdNameFromDb
DbiGetField
DbiEndTran
DbiBeginTran
DbiQAlloc
DbiOpenVchkList
DbiGetNextRecord
ExecCallBack
GetCallBack
DbiQFree
RegCallBack
OsLdIsDigit
DbiQSetParams
DbiOpenTableList
OsLdIsAlpha
DbiQExec
DbiCloseDatabase
DbiSetToEnd
DbiQPrepare
DbiGetCursorProps
DbiOpenDatabase
OsLdUnloadObj
DbiGetDirectory
OsLdLoadBySymbName
OsLdGetDefaultObj

user32

OemToCharA
MessageBoxA
EnumThreadWindows
CharToOemA

Exports

Exports

@__lockDebuggerData$qv
@__unlockDebuggerData$qv
DRepCursorClose
DRepObjCursorOpen
DRepRelCursorOpen
DbiDRAdd
DbiDRAddAttr
DbiDRAnalyzeChange
DbiDRClose
DbiDRCreate
DbiDRCreateEnumAttrDomain
DbiDRCreateObjectType
DbiDRCreateRelationType
DbiDRDelete
DbiDRDeleteEnumAttrDomain
DbiDRDeleteObjectType
DbiDRDeleteRelationType
DbiDRDrop
DbiDRDropAttr
DbiDRExportToFile
DbiDRGetAttrDescs
DbiDRGetDesc
DbiDRGetEnumAttrDomain
DbiDRGetObjID
DbiDRGetObjTypeInfo
DbiDRGetRelTypeInfo
DbiDRGetRelatedObject
DbiDRImportFromFile
DbiDRLoadDBObject
DbiDRModifyEnumAttrDomain
DbiDROpen
DbiDROpenAttrTypeList
DbiDROpenObjSet
DbiDROpenObjectTypeList
DbiDROpenRelSet
DbiDROpenRelTypeList
DbiDRSetToObjID
DbiDRSetToObjName
OsLdMBRisCJKBlank
OsLdMBRisCJKKana
OsLdMBRisKana
OsLdMBRisLead
OsLdMBRisTrail
RepDrvInit
WEP
__DebuggerHookData

Sections

CODE
Size: 126KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 26KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
作文克星 II/readme.txt
作文克星 II/smartread.dll
.dll windows x86

8c07c4bf7172f3ce15561211ff191f81

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
GetTempPathA
lstrcmpiA
lstrcpynA
lstrlenA
SetFilePointer
ReadFile
GetFileSize
GlobalFree
GlobalAlloc
MultiByteToWideChar
CloseHandle
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
lstrcpyA
IsBadWritePtr
SetEndOfFile
GetLastError
GetModuleFileNameA
LoadLibraryW
GetProcAddress
FreeLibrary
GetVersionExA
GetUserDefaultLangID
lstrlenW
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
ExitProcess
WideCharToMultiByte
TerminateProcess
RtlUnwind
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
InterlockedDecrement
InterlockedIncrement
GetModuleHandleA
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
HeapReAlloc
HeapSize
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
WriteFile
LeaveCriticalSection
VirtualAlloc
GetFileType
SetHandleCount
GetStdHandle
GetStartupInfoA

user32

DialogBoxParamA
GetSystemMetrics
MessageBoxA
EndDialog
SetCursor
LoadCursorA
ShowWindow
CallWindowProcA
SetWindowTextA
GetClassNameA
SetWindowLongA
wsprintfA
MoveWindow
PtInRect
SendDlgItemMessageA
SetWindowPos
GetClientRect
GetDlgItem
GetWindowRect
SendMessageA
GetWindowLongA
GetCursorPos

gdi32

CreateFontIndirectA
SelectObject
GetStockObject
SetTextColor
SetBkMode

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

shell32

ShellExecuteA

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc

oleaut32

SysFreeString
SysAllocString

Exports

Exports

Dll_SmartRead_Close
Dll_SmartRead_Initial
Dll_SmartRead_OpenXSRFile
Dll_SmartRead_PauseXSRFile
Dll_SmartRead_ReadXSRFile
Dll_SmartRead_SetDialog
Dll_SmartRead_Speak
Dll_SmartRead_SpeakToWave
Dll_SmartRead_Stop
Dll_SmartRead_StopXSRFile
Dll_SmartRead_Version
SmartRead_Close
SmartRead_Initial
SmartRead_OpenXSRFile
SmartRead_PauseXSRFile
SmartRead_ReadXSRFile
SmartRead_SetDialog
SmartRead_Speak
SmartRead_SpeakToWave
SmartRead_Stop
SmartRead_StopXSRFile
SmartRead_Version

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
作文克星 II/usa.btl
作文克星 II/上网不会中毒的超强浏览器！.URL
.url
作文克星 II/下载安装说明.txt
作文克星 II/中文语音库.msi
.msi
作文克星 II/文档1.wps
作文克星 II/未来软件园-首页.url
.url
作文克星 II/绿化&卸载.exe
.exe windows x86

87b324a67e18fb2e1d12308b06fa8d4f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
SetFileSecurityA
SetFileSecurityW

kernel32

CloseHandle
CompareStringA
CreateDirectoryA
CreateDirectoryW
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW
DosDateTimeToFileTime
ExitProcess
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FindResourceA
FreeLibrary
GetCPInfo
GetCommandLineA
GetCurrentDirectoryA
GetCurrentProcess
GetDateFormatA
GetFileAttributesA
GetFileAttributesW
GetFileType
GetFullPathNameA
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetNumberFormatA
GetProcAddress
GetProcessHeap
GetStdHandle
GetTempPathA
GetTickCount
GetTimeFormatA
GetVersionExA
GlobalAlloc
HeapAlloc
HeapFree
HeapReAlloc
IsDBCSLeadByte
LoadLibraryA
LocalFileTimeToFileTime
MoveFileA
MoveFileExA
MultiByteToWideChar
ReadFile
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
Sleep
SystemTimeToFileTime
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcmpiA
lstrlenA

comctl32

ord17

comdlg32

CommDlgExtendedError
GetOpenFileNameA

gdi32

DeleteObject

shell32

SHBrowseForFolderA
SHChangeNotify
SHFileOperationA
SHGetFileInfoA
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA

user32

CharToOemA
CharToOemBuffA
CharUpperA
CopyRect
CreateWindowExA
DefWindowProcA
DestroyIcon
DestroyWindow
DialogBoxParamA
DispatchMessageA
EnableWindow
EndDialog
FindWindowExA
GetClassNameA
GetClientRect
GetDlgItem
GetDlgItemTextA
GetMessageA
GetParent
GetSysColor
GetSystemMetrics
GetWindow
GetWindowLongA
GetWindowRect
GetWindowTextA
IsWindow
IsWindowVisible
LoadBitmapA
LoadCursorA
LoadIconA
LoadStringA
MapWindowPoints
MessageBoxA
OemToCharA
OemToCharBuffA
PeekMessageA
PostMessageA
RegisterClassExA
SendDlgItemMessageA
SendMessageA
SetDlgItemTextA
SetFocus
SetMenu
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
TranslateMessage
UpdateWindow
WaitForInputIdle
wsprintfA
wvsprintfA

ole32

CLSIDFromString
CoCreateInstance
CreateStreamOnHGlobal
OleInitialize
OleUninitialize

Sections

.text
Size: 77KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
作文克星 II/访问网站.url
.url

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

CODE Size: 543KB - Virtual size: 1.7MB

DATA Size: 5KB - Virtual size: 12KB

BSS Size: - Virtual size: 96KB

.idata Size: 4KB - Virtual size: 12KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size: 140KB

.rsrc Size: 128KB - Virtual size: 828KB

.ODATAE Size: 7KB - Virtual size: 8KB

.data Size: 1KB - Virtual size: 5KB

cb648629db2ccb75366a01b3c8903be4

Headers

File Characteristics

Imports

kernel32

winmm

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 1024B - Virtual size: 875B

.data Size: - Virtual size: 201KB

.reloc Size: 1KB - Virtual size: 1KB

ac24d2585411ea8a1d33653136dd11ed

Headers

File Characteristics

Imports

kernel32

advapi32

ole32

user32

mpr

oleaut32

Exports

Exports

Sections

CODE Size: 429KB - Virtual size: 432KB

DATA Size: 72KB - Virtual size: 76KB

DATA Size: 512B - Virtual size: 4KB

TLSCBA Size: 512B - Virtual size: 24KB

.idata Size: 4KB - Virtual size: 4KB

.edata Size: 51KB - Virtual size: 52KB

.reloc Size: 15KB - Virtual size: 16KB

.rsrc Size: 1024B - Virtual size: 4KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 219KB - Virtual size: 220KB

DATA Size: 17KB - Virtual size: 32KB

.INIT Size: 3KB - Virtual size: 4KB

.idata Size: 1KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.reloc Size: 6KB - Virtual size: 8KB

.rsrc Size: 1024B - Virtual size: 4KB

ca7840dd8b852014c2f3a1872f9911d7

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

CODE Size: 23KB - Virtual size: 24KB

DATA Size: 5KB - Virtual size: 20KB

.idata Size: 1KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.reloc Size: 1KB - Virtual size: 4KB

.rsrc Size: 81KB - Virtual size: 84KB

302e92a8b022643b516e70240a11b811

CODE
Size: 543KB - Virtual size: 1.7MB

DATA
Size: 5KB - Virtual size: 12KB

BSS
Size: - Virtual size: 96KB

.idata
Size: 4KB - Virtual size: 12KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size: 140KB

.rsrc
Size: 128KB - Virtual size: 828KB

.ODATAE
Size: 7KB - Virtual size: 8KB

.data
Size: 1KB - Virtual size: 5KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 875B

.data
Size: - Virtual size: 201KB

.reloc
Size: 1KB - Virtual size: 1KB

CODE
Size: 429KB - Virtual size: 432KB

DATA
Size: 72KB - Virtual size: 76KB

DATA
Size: 512B - Virtual size: 4KB

TLSCBA
Size: 512B - Virtual size: 24KB

.idata
Size: 4KB - Virtual size: 4KB

.edata
Size: 51KB - Virtual size: 52KB

.reloc
Size: 15KB - Virtual size: 16KB

.rsrc
Size: 1024B - Virtual size: 4KB

CODE
Size: 219KB - Virtual size: 220KB

DATA
Size: 17KB - Virtual size: 32KB

.INIT
Size: 3KB - Virtual size: 4KB

.idata
Size: 1KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.reloc
Size: 6KB - Virtual size: 8KB

.rsrc
Size: 1024B - Virtual size: 4KB

CODE
Size: 23KB - Virtual size: 24KB

DATA
Size: 5KB - Virtual size: 20KB

.idata
Size: 1KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.reloc
Size: 1KB - Virtual size: 4KB

.rsrc
Size: 81KB - Virtual size: 84KB

CODE
Size: 54KB - Virtual size: 56KB

DATA
Size: 37KB - Virtual size: 52KB

.idata
Size: 1KB - Virtual size: 4KB

.edata
Size: 1KB - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB

CODE
Size: 28KB - Virtual size: 32KB

DATA
Size: 5KB - Virtual size: 8KB

DATA
Size: 512B - Virtual size: 4KB

TLSCBA
Size: 512B - Virtual size: 16KB

.idata
Size: 2KB - Virtual size: 4KB

.edata
Size: 3KB - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB

CODE
Size: 118KB - Virtual size: 120KB

DATA
Size: 9KB - Virtual size: 24KB

.idata
Size: 3KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB

CODE
Size: 126KB - Virtual size: 128KB

DATA
Size: 26KB - Virtual size: 40KB

.idata
Size: 3KB - Virtual size: 4KB

.edata
Size: 1KB - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB