4e45113bdfa91deb6cddf6579f40a2471ce152e3fb4b934ccae1a207a1cad724

Sharing

Copy URL

Twitter E-mail

General

Target

4e45113bdfa91deb6cddf6579f40a2471ce152e3fb4b934ccae1a207a1cad724
Size

1.9MB
MD5

7b3376f0f15617cffcdf40f38c1ad444
SHA1

c4bc4cf81d988ae74b10a6301df213c28e245ade
SHA256

4e45113bdfa91deb6cddf6579f40a2471ce152e3fb4b934ccae1a207a1cad724
SHA512

c2ce7ddf122f299cf29ae0437240ebccf9558040fcea7272f0dfa3ac1d0ad1d329114253bcbaacfa39f89950170c5461c4023f1e12a7aa59eb3fbe0e7ad3d42c
SSDEEP

49152:pHDT3829TpWSxW5M5hru+4FaewQ6VSVAhXANLzVV4j:RT3804JCtOaeH6Vyxs

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/变速精灵2.11免费版/BException.dll	acprotect
static1/unpack001/变速精灵2.11免费版/cooperate/LiveUpdate.dll	acprotect
static1/unpack001/变速精灵2.11免费版/dmshell.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/变速精灵2.11免费版/BException.dll	upx
static1/unpack001/变速精灵2.11免费版/dmshell.dll	upx

Files

4e45113bdfa91deb6cddf6579f40a2471ce152e3fb4b934ccae1a207a1cad724
.rar
变速精灵2.11免费版/BException.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

SetExceptionReport
SetSoftwareName

Sections

UPX0
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 898B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
变速精灵2.11免费版/NTPerf.dll
.dll windows x86

a7dd37121eb8a73b345e3b26b5a5608a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

pdh

PdhAddCounterA
PdhOpenQueryA
PdhCloseQuery
PdhGetRawCounterValue
PdhGetFormattedCounterValue
PdhCollectQueryData

mfc42

ord4622
ord3738
ord4424
ord1116
ord1176
ord1575
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3953
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord1570
ord1168
ord1577
ord561
ord825
ord815
ord6467
ord3663
ord823
ord5440
ord6383
ord5450
ord6394
ord1255
ord1578
ord1253
ord826
ord269
ord1182
ord1243
ord342
ord600
ord1197

msvcrt

free
_adjust_fdiv
malloc
_EH_prolog
_onexit
__CxxFrameHandler
??1type_info@@UAE@XZ
__dllonexit
_initterm

kernel32

LocalAlloc
LocalFree

Exports

Exports

GetCPU_NT
NTPerf_Initialize
NTPerf_Uninitialize

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 530B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
变速精灵2.11免费版/PSAPI.DLL
.dll windows x86

3b5b4bad881057af15fc35648ebcf206

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntdll

NtAllocateVirtualMemory
RtlNtStatusToDosError
_stricmp
RtlUnwind
atoi
_chkstk
NtStopProfile
sprintf
RtlMultiByteToUnicodeN
RtlAdjustPrivilege
RtlUnicodeToOemN
NtCreateProfile
NtSetIntervalProfile
NtStartProfile
DbgPrint
NtWriteFile
NtSetInformationProcess
NtQueryInformationProcess
NtQueryVirtualMemory
NtQuerySystemInformation

kernel32

MultiByteToWideChar
GetProcessWorkingSetSize
WideCharToMultiByte
ReadProcessMemory
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
CreateFileA
CloseHandle
DisableThreadLibraryCalls
lstrcpyA
GetProcessHeap
LocalFree
SetLastError
LocalAlloc
SetProcessWorkingSetSize
lstrlenA
GetSystemInfo
HeapAlloc

imagehlp

SymLoadModule
SymGetModuleInfo
SymGetSymFromAddr
SymUnloadModule
SymSetOptions
SymInitialize
SymGetSearchPath

Exports

Exports

EmptyWorkingSet
EnumDeviceDrivers
EnumProcessModules
EnumProcesses
GetDeviceDriverBaseNameA
GetDeviceDriverBaseNameW
GetDeviceDriverFileNameA
GetDeviceDriverFileNameW
GetMappedFileNameA
GetMappedFileNameW
GetModuleBaseNameA
GetModuleBaseNameW
GetModuleFileNameExA
GetModuleFileNameExW
GetModuleInformation
GetProcessMemoryInfo
GetWsChanges
InitializeProcessForWsWatch
QueryWorkingSet

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 914B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
变速精灵2.11免费版/SpeederXP.chm
.chm
变速精灵2.11免费版/WinIo.dll
.dll windows x86

158dcab1fb37b4f6f25a277f8037fe32

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateFileA
GetModuleFileNameA
GetVersionExA
DeviceIoControl
GetModuleHandleA
GetLastError
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind

advapi32

CloseServiceHandle
ControlService
StartServiceA
OpenServiceA
DeleteService
OpenSCManagerA
CreateServiceA

Exports

Exports

GetPhysLong
GetPortVal
InitializeWinIo
InstallWinIoDriver
MapPhysToLin
RemoveWinIoDriver
SetPhysLong
SetPortVal
ShutdownWinIo
UnmapPhysicalMemory

Sections

.text
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
变速精灵2.11免费版/WinIo.sys
.dll windows x86

58b7de1e5c7ec1edfceae28623c8e916

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

PsGetCurrentProcessId
DbgPrint
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IofCompleteRequest
MmFreeNonCachedMemory
Ke386SetIoAccessMap
NtOpenProcess
IoGetCurrentProcess
MmAllocateNonCachedMemory
IoDeleteSymbolicLink
ZwClose
ZwMapViewOfSection
ZwOpenSection
ZwUnmapViewOfSection
KeServiceDescriptorTable
ZwQuerySystemInformation
Ke386IoSetAccessProcess
ObReferenceObjectByHandle

hal

HalTranslateBusAddress

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
变速精灵2.11免费版/WinIo.vxd
变速精灵2.11免费版/activate.dat
变速精灵2.11免费版/cooperate/LiveUpdate.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

Install
Start

Sections

CODE
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
变速精灵2.11免费版/cooperate/liveupdate.dat
变速精灵2.11免费版/dmshell.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

registerMe
stopAd

Sections

UPX0
Size: - Virtual size: 684KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 425KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
变速精灵2.11免费版/hook.dll
.dll windows x86

dbd8eafb00402672ffc0a7c7afe52817

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QueryPerformanceCounter
ReadProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
GetTickCount
GetCurrentProcessId
MapViewOfFile
CreateFileMappingA
RtlUnwind
GetCommandLineA
GetVersion
GetModuleHandleA
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
ExitProcess
TerminateProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InterlockedDecrement
InterlockedIncrement
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
HeapAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

user32

FindWindowA
GetWindowThreadProcessId
GetDesktopWindow

winmm

timeGetTime

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
变速精灵2.11免费版/inproc.dll
.dll windows x86

b5197356fd1c99af0b3b46df8db413b6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeSetEvent
timeGetTime

mfc42

ord5307
ord5289
ord5714
ord3953
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4698
ord3738
ord815
ord561
ord825
ord1197
ord1570
ord1253
ord1243
ord1255
ord1578
ord600
ord826
ord269
ord342
ord1182
ord1577
ord1168
ord1575
ord1176
ord1116
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord6467
ord4424

msvcrt

??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
??2@YAPAXI@Z
_EH_prolog
__CxxFrameHandler
_except_handler3
time
srand
rand
wcsrchr
wcscpy
_ftol
wcscat

kernel32

LocalAlloc
LocalFree
Sleep
GetModuleHandleA
CreateMutexA
CloseHandle
GetCurrentProcessId
WaitForSingleObject
ReleaseMutex
QueryPerformanceCounter
GetTickCount
GetCurrentProcess
FlushInstructionCache
VirtualProtect
SetLastError

user32

FindWindowA
GetDesktopWindow
EnumWindows
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowThreadProcessId
PostThreadMessageA
PostMessageA
SendMessageA
CallNextHookEx
SetTimer

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SHARESEG
Size: 4KB - Virtual size: 125B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
变速精灵2.11免费版/skin/default/SkinEditor1.exe
.exe windows x86

371f5c9f7d3244514204c2f8c2eb9228

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord3079
ord4080
ord3825
ord3831
ord4627
ord3574
ord3571
ord3619
ord800
ord4424
ord860
ord540
ord825
ord3626
ord3663
ord2414
ord858
ord6199
ord2859
ord535
ord1641
ord640
ord755
ord5875
ord939
ord926
ord6648
ord1640
ord323
ord470
ord2575
ord5290
ord5277
ord3402
ord609
ord556
ord567
ord809
ord4275
ord2405
ord4284
ord2379
ord6172
ord2122
ord6358
ord1088
ord2864
ord3716
ord790
ord3797
ord823
ord1907
ord5161
ord5162
ord5160
ord4905
ord4742
ord4976
ord4948
ord4358
ord5265
ord4377
ord4854
ord4998
ord4710
ord2514
ord6052
ord1775
ord5287
ord4835
ord4425
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord768
ord489
ord692
ord2302
ord4258
ord4055
ord2818
ord4407
ord1779
ord5953
ord3986
ord3803
ord5606
ord801
ord5860
ord2976
ord3830
ord772
ord3701
ord500
ord6142
ord4204
ord5861
ord6143
ord1168
ord923
ord6663
ord6283
ord6282
ord2764
ord4234
ord4376
ord4853
ord5280
ord3597
ord641
ord6055
ord4224
ord6197
ord6379
ord922
ord2078
ord2113
ord2243
ord4220
ord2584
ord3654
ord2438
ord6270
ord2863
ord1644
ord1146
ord2642
ord4694
ord5148
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2621
ord4287
ord2109
ord3092
ord1008
ord497
ord4160
ord5850
ord2516
ord361
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord4353
ord6374
ord5163
ord2385
ord5241
ord4396
ord1776
ord4078
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord2124
ord2446
ord5261
ord537
ord541
ord3097
ord324
ord1576

msvcrt

_except_handler3
__set_app_type
__p__fmode
__dllonexit
__CxxFrameHandler
_mbscmp
atol
atoi
sprintf
_access
_setmbcp
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
_controlfp

kernel32

ReadFile
GetFullPathNameA
GlobalReAlloc
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
WritePrivateProfileStringA
GetPrivateProfileStringA
GetFileSize
CreateFileA
GetModuleHandleA
GetStartupInfoA
CloseHandle

user32

PostMessageA
GetWindowRect
GetActiveWindow
LoadMenuA
AppendMenuA
GetSystemMenu
DrawIcon
GetSystemMetrics
IsIconic
SetRect
PtInRect
SetWindowRgn
GetParent
GetCapture
SetCapture
ClientToScreen
WindowFromPoint
ReleaseCapture
GetWindowLongA
SendMessageA
EnableWindow
DrawTextA
KillTimer
GetClientRect
GetDC
SetTimer
InvalidateRect
GetSubMenu
GetCursorPos
LoadIconA

gdi32

DeleteDC
CreateFontIndirectA
GetObjectA
GetStockObject
GetTextExtentPoint32A
BitBlt
SelectObject
CreateCompatibleDC
DeleteObject
CombineRgn
ExtCreateRegion
CreateDIBSection
StretchBlt
CreateCompatibleBitmap

comdlg32

GetOpenFileNameA

ole32

CreateStreamOnHGlobal

olepro32

ord251

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cas
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
变速精灵2.11免费版/skin/default/clock.gif
.gif
变速精灵2.11免费版/skin/default/clock1.gif
.gif
变速精灵2.11免费版/skin/default/down.bmp
变速精灵2.11免费版/skin/default/main.bmp
变速精灵2.11免费版/skin/default/mask.bmp
变速精灵2.11免费版/skin/default/over.bmp
变速精灵2.11免费版/skin/default/skin.ini
变速精灵2.11免费版/skin/default/trackmove.bmp
变速精灵2.11免费版/skin/default/trackstop.bmp
变速精灵2.11免费版/skin/default/皮肤制作工具.exe
.exe windows x86

371f5c9f7d3244514204c2f8c2eb9228

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord3079
ord4080
ord3825
ord3831
ord4627
ord3574
ord3571
ord3619
ord800
ord4424
ord860
ord540
ord825
ord3626
ord3663
ord2414
ord858
ord6199
ord2859
ord535
ord1641
ord640
ord755
ord5875
ord939
ord926
ord6648
ord1640
ord323
ord470
ord2575
ord5290
ord5277
ord3402
ord609
ord556
ord567
ord809
ord4275
ord2405
ord4284
ord2379
ord6172
ord2122
ord6358
ord1088
ord2864
ord3716
ord790
ord3797
ord823
ord1907
ord5161
ord5162
ord5160
ord4905
ord4742
ord4976
ord4948
ord4358
ord5265
ord4377
ord4854
ord4998
ord4710
ord2514
ord6052
ord1775
ord5287
ord4835
ord4425
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord768
ord489
ord692
ord2302
ord4258
ord4055
ord2818
ord4407
ord1779
ord5953
ord3986
ord3803
ord5606
ord801
ord5860
ord2976
ord3830
ord772
ord3701
ord500
ord6142
ord4204
ord5861
ord6143
ord1168
ord923
ord6663
ord6283
ord6282
ord2764
ord4234
ord4376
ord4853
ord5280
ord3597
ord641
ord6055
ord4224
ord6197
ord6379
ord922
ord2078
ord2113
ord2243
ord4220
ord2584
ord3654
ord2438
ord6270
ord2863
ord1644
ord1146
ord2642
ord4694
ord5148
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2621
ord4287
ord2109
ord3092
ord1008
ord497
ord4160
ord5850
ord2516
ord361
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord4353
ord6374
ord5163
ord2385
ord5241
ord4396
ord1776
ord4078
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord2124
ord2446
ord5261
ord537
ord541
ord3097
ord324
ord1576

msvcrt

_except_handler3
__set_app_type
__p__fmode
__dllonexit
__CxxFrameHandler
_mbscmp
atol
atoi
sprintf
_access
_setmbcp
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
_controlfp

kernel32

ReadFile
GetFullPathNameA
GlobalReAlloc
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
WritePrivateProfileStringA
GetPrivateProfileStringA
GetFileSize
CreateFileA
GetModuleHandleA
GetStartupInfoA
CloseHandle

user32

PostMessageA
GetWindowRect
GetActiveWindow
LoadMenuA
AppendMenuA
GetSystemMenu
DrawIcon
GetSystemMetrics
IsIconic
SetRect
PtInRect
SetWindowRgn
GetParent
GetCapture
SetCapture
ClientToScreen
WindowFromPoint
ReleaseCapture
GetWindowLongA
SendMessageA
EnableWindow
DrawTextA
KillTimer
GetClientRect
GetDC
SetTimer
InvalidateRect
GetSubMenu
GetCursorPos
LoadIconA

gdi32

DeleteDC
CreateFontIndirectA
GetObjectA
GetStockObject
GetTextExtentPoint32A
BitBlt
SelectObject
CreateCompatibleDC
DeleteObject
CombineRgn
ExtCreateRegion
CreateDIBSection
StretchBlt
CreateCompatibleBitmap

comdlg32

GetOpenFileNameA

ole32

CreateStreamOnHGlobal

olepro32

ord251

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cas
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
变速精灵2.11免费版/speeder.ini
变速精灵2.11免费版/tips.txt
变速精灵2.11免费版/了解更多.txt
变速精灵2.11免费版/传奇诚信一条龙.htm
.html
变速精灵2.11免费版/变速精灵.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

CODE
Size: - Virtual size: 276KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 109KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
变速精灵2.11免费版/启动变速精灵.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 13KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

45vip
Size: 115KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
变速精灵2.11免费版/私服资源网.htm
.html
变速精灵2.11免费版/诚信支付平台.htm
.html
变速精灵2.11免费版/说明.txt

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 28KB

UPX1 Size: 5KB - Virtual size: 8KB

.rsrc Size: 1KB - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 8KB - Virtual size: 4KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 898B

a7dd37121eb8a73b345e3b26b5a5608a

Headers

File Characteristics

Imports

pdh

mfc42

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 4KB - Virtual size: 1KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 832B

.reloc Size: 4KB - Virtual size: 530B

3b5b4bad881057af15fc35648ebcf206

Headers

File Characteristics

Imports

ntdll

kernel32

imagehlp

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 12KB

.rsrc Size: 1024B - Virtual size: 904B

.reloc Size: 1024B - Virtual size: 914B

158dcab1fb37b4f6f25a277f8037fe32

Headers

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 12KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 936B

.reloc Size: 4KB - Virtual size: 1KB

58b7de1e5c7ec1edfceae28623c8e916

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 244B

.reloc Size: 1KB - Virtual size: 1KB

Headers

File Characteristics

Exports

UPX0
Size: - Virtual size: 28KB

UPX1
Size: 5KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 4KB

.text
Size: 8KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 898B

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 832B

.reloc
Size: 4KB - Virtual size: 530B

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 12KB

.rsrc
Size: 1024B - Virtual size: 904B

.reloc
Size: 1024B - Virtual size: 914B

.text
Size: 16KB - Virtual size: 12KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 936B

.reloc
Size: 4KB - Virtual size: 1KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 244B

.reloc
Size: 1KB - Virtual size: 1KB

CODE
Size: - Virtual size: 76KB

DATA
Size: 30KB - Virtual size: 32KB

.rsrc
Size: 2KB - Virtual size: 4KB

UPX0
Size: - Virtual size: 684KB

UPX1
Size: 425KB - Virtual size: 428KB

.rsrc
Size: 512B - Virtual size: 4KB

.text
Size: 28KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 5KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 12KB - Virtual size: 8KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 4KB

SHARESEG
Size: 4KB - Virtual size: 125B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 2KB

.text
Size: 56KB - Virtual size: 56KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 24KB - Virtual size: 24KB

.cas
Size: 2KB - Virtual size: 4KB