gh0strat | 00573d6dc3551dbf92af4a306e4678bab28a3ace71ad87b9027f6806d88255d2

Sharing

Copy URL Twitter E-mail

General

Target

00573d6dc3551dbf92af4a306e4678bab28a3ace71ad87b9027f6806d88255d2
Size

939KB
MD5

4da15e8006f400ca43335206f60420b8
SHA1

1a05fc3c0a297d910e0036f8d16591decfe64438
SHA256

00573d6dc3551dbf92af4a306e4678bab28a3ace71ad87b9027f6806d88255d2
SHA512

fd18b29b84f333eac72c9fd9d2cc8e05823529bbfc70a532daade7b893a78c9a04608ef7e7c967176fb9f283430bdc367ae42ca001d18aec0133a64548dc5e55
SSDEEP

12288:udlQpLfnJBI2SQ2wSHmItLWxf4PfGmoB6NeYf29PqqKfMDlGEkT3lLSj2fTGxXaK:mlQLOXGMql43XoSf24ffMDlii2C4PGj

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
static1/unpack001/Bin/update/server.dat	family_gh0strat

Gh0strat family
gh0strat

Files

00573d6dc3551dbf92af4a306e4678bab28a3ace71ad87b9027f6806d88255d2
.rar
Bin/QQ38371675.exe
.exe windows x86

6412357968d0be4d6f4a76b17febf2d2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRemoveFileSpecA
SHAutoComplete

winmm

PlaySoundA
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveOutWrite
waveInStop
waveInReset
waveInUnprepareHeader
waveInClose
waveOutReset
waveOutUnprepareHeader
waveOutClose

kernel32

GetCurrentDirectoryA
SetErrorMode
SetFileAttributesA
SystemTimeToFileTime
LocalFileTimeToFileTime
GetOEMCP
GetCPInfo
GetProcessVersion
GetProfileIntA
GetProfileStringA
SetEnvironmentVariableA
CompareStringW
SetStdHandle
IsBadCodePtr
IsBadReadPtr
GetDriveTypeA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
TlsGetValue
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
HeapReAlloc
ExitThread
TerminateProcess
GetACP
GetSystemTime
GetTimeZoneInformation
HeapFree
HeapAlloc
ExitProcess
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
CompareStringA
GetTempPathA
GetPrivateProfileSectionNamesA
GetExitCodeThread
ResetEvent
GetVersionExA
EnumResourceLanguagesA
EnumResourceTypesA
EnumResourceNamesA
GetLocalTime
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
GlobalFlags
MulDiv
GetDiskFreeSpaceA
GetFileTime
SetFileTime
GetTempFileNameA
SetThreadPriority
GetCurrentThread
lstrcmpA
SetLastError
GetShortPathNameA
GetThreadLocale
GetStringTypeExA
GetFullPathNameA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetCurrentProcess
DuplicateHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrlenW
FormatMessageA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetVersion
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetModuleHandleA
LockResource
LocalSize
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetSystemDirectoryA
lstrcatA
CopyFileA
DeleteCriticalSection
CancelIo
GetTickCount
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
GetQueuedCompletionStatus
CreateIoCompletionPort
GetSystemInfo
EnterCriticalSection
PostQueuedCompletionStatus
LeaveCriticalSection
InitializeCriticalSection
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetModuleFileNameA
SetUnhandledExceptionFilter
FindResourceA
LoadResource
SizeofResource
LoadLibraryA
GetProcAddress
lstrcpyA
CreateDirectoryA
GetLastError
MoveFileA
RemoveDirectoryA
ReadFile
DeleteFileA
SetFilePointer
WriteFile
CreateFileA
GetFileSize
FindFirstFileA
FindNextFileA
FindClose
lstrcpynA
LocalAlloc
LocalFree
GetLogicalDriveStringsA
lstrlenA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetFileAttributesA
VirtualAlloc
VirtualFree
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
TerminateThread
CloseHandle
CreateEventA
Sleep
SetHandleCount

user32

DrawMenuBar
TranslateMDISysAccel
DefFrameProcA
ExcludeUpdateRgn
DefDlgProcA
PostThreadMessageA
FillRect
InvertRect
IsRectEmpty
SetParent
RegisterClipboardFormatA
LockWindowUpdate
GetDCEx
GetNextDlgGroupItem
CopyAcceleratorTableA
GetClipboardFormatNameA
GetTabbedTextExtentA
SendMessageTimeoutA
IsWindowUnicode
GetWindowLongW
SetWindowLongW
UnionRect
GetDoubleClickTime
SetCursorPos
GetWindowRgn
IsMenu
GetMenuDefaultItem
GetMenuItemInfoA
SetWindowRgn
DispatchMessageA
TranslateMessage
GetMessageA
LoadIconA
SendMessageA
EnableWindow
RegisterWindowMessageA
SetRect
GetWindow
GetClientRect
SetCapture
LoadCursorA
SetCursor
ScreenToClient
UpdateWindow
ClientToScreen
ReleaseCapture
GetParent
IsWindowVisible
SetWindowPos
GetDlgCtrlID
wsprintfA
DestroyIcon
GetMenuStringA
InsertMenuA
GetSysColorBrush
GetClassNameA
KillTimer
SetTimer
GrayStringA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
BringWindowToTop
UnpackDDElParam
ReuseDDElParam
SetMenu
TranslateAcceleratorA
LoadAcceleratorsA
MapDialogRect
SetWindowContextHelpId
ValidateRect
ShowOwnedPopups
PostQuitMessage
DestroyMenu
LoadStringA
PtInRect
InvalidateRect
IsZoomed
SetRectEmpty
CharUpperA
wvsprintfA
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
WindowFromPoint
IsWindow
MessageBoxA
GetFocus
GetCursorPos
EnableMenuItem
GetMenuItemCount
DeleteMenu
GetSubMenu
LoadMenuA
CharNextA
PostMessageA
OffsetRect
GetSystemMetrics
InflateRect
MessageBeep
AppendMenuA
GetSystemMenu
GetDesktopWindow
RedrawWindow
FindWindowA
DestroyCursor
SetClassLongA
ReleaseDC
GetDC
GetIconInfo
UnregisterClassA
SetMenuItemBitmaps
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
GetDlgItemTextA
SendDlgItemMessageA
MapWindowPoints
GetSysColor
PeekMessageA
SetFocus
AdjustWindowRectEx
EqualRect
GetCursor
DeferWindowPos
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
GetScrollInfo
SetScrollRange
SetScrollPos
GetTopWindow
IsChild
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemID
TrackPopupMenu
GetWindowTextLengthA
GetWindowTextA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
SetWindowLongA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
LoadImageA
GetKeyState
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
DrawTextA
CheckMenuItem
GetMenuState
ShowScrollBar
DrawIconEx
IntersectRect
GetWindowRect
CheckMenuRadioItem
DrawFocusRect
DrawStateA
DrawFrameControl
DrawEdge
ShowCaret
HideCaret
SetMenuDefaultItem
EnumChildWindows
DrawAnimatedRects
CreatePopupMenu
MapVirtualKeyA
WaitMessage
IsCharLowerA
GetKeyNameTextA
MapVirtualKeyExA
GetKeyboardLayout
ToAsciiEx
GetKeyboardState
GetKeyboardLayoutList
IsClipboardFormatAvailable
CreateIconFromResourceEx
CreateIconIndirect
CopyIcon
LookupIconIdFromDirectoryEx
GetMenuStringW

gdi32

SetTextColor
ExtTextOutA
BitBlt
StretchDIBits
CreateCompatibleDC
CreateDIBSection
SelectObject
DeleteObject
SetBkColor
CreateSolidBrush
GetObjectA
TextOutA
SetBkMode
GetClipBox
CreateBitmap
PatBlt
CreateRectRgnIndirect
GetTextExtentPoint32A
GetTextMetricsA
DeleteDC
SetWindowExtEx
ScaleWindowExtEx
CreateCompatibleBitmap
ExcludeClipRect
IntersectClipRect
MoveToEx
LineTo
SetTextAlign
GetCharWidthA
GetCurrentPositionEx
PolyBezierTo
GetClipRgn
CreateRectRgn
ExtSelectClipRgn
GetDeviceCaps
GetViewportExtEx
GetWindowExtEx
CreatePen
CreatePatternBrush
PtVisible
CreateFontA
SaveDC
RestoreDC
GetStockObject
RectVisible
Escape
GetMapMode
SetRectRgn
CombineRgn
CreateFontIndirectA
DPtoLP
CopyMetaFileA
GetTextColor
SetStretchBltMode
GetBkColor
LPtoDP
SetPixel
GetPixel
Polygon
GetWindowOrgEx
GetCurrentObject
StretchBlt
GetTextAlign
EnumFontFamiliesExA
GetDIBits
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SelectClipRgn
CreateDIBitmap
GetTextExtentPointA
ExtFloodFill
ExtTextOutW
GetTextExtentPoint32W
BeginPath
CloseFigure
EndPath
StrokeAndFillPath
FillPath
StrokePath
Ellipse
GetViewportOrgEx
Polyline
PtInRegion
RoundRect
CreatePolygonRgn
GetRgnBox
ExtCreateRegion
GetBitmapBits

comdlg32

GetSaveFileNameA
GetOpenFileNameA
GetFileTitleA
ChooseColorA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegQueryValueExA
RegCreateKeyA
RegCloseKey
RegOpenKeyA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegSetValueA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegDeleteValueA
GetFileSecurityA
SetFileSecurityA

shell32

ord71
DragQueryFileA
SHGetMalloc
DragFinish
ExtractIconA
ShellExecuteA
Shell_NotifyIconA
SHAppBarMessage
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetFileInfoA

comctl32

ImageList_GetIcon
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_Remove
ImageList_GetImageCount
ImageList_Draw
ImageList_GetIconSize
ImageList_Add
ImageList_ReplaceIcon
ImageList_DrawEx
ImageList_LoadImageA
ImageList_Create
ImageList_Destroy
ord17
ImageList_AddMasked

oledlg

ord1
ord8

ole32

OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
OleRun
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoInitialize
StgOpenStorageOnILockBytes
CoGetClassObject
ReleaseStgMedium
CoTaskMemFree
CoTaskMemAlloc
OleDuplicateData
CoDisconnectObject
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CoUninitialize
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleGetClipboard

olepro32

ord253

oleaut32

VariantChangeType
SysStringByteLen
VarDateFromStr
VarBstrFromDate
SysAllocStringByteLen
SysFreeString
SysAllocStringLen
VariantTimeToSystemTime
SysStringLen
LoadTypeLi
SysAllocString
VariantCopy
VariantClear
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
OleLoadPicturePath
VariantChangeTypeEx
SafeArrayUnaccessData

skinh

SkinH_AttachRes

ws2_32

listen
getpeername
closesocket
WSAStartup
WSACleanup
bind
gethostname
gethostbyname
WSACloseEvent
WSASend
WSARecv
socket
accept
WSAGetLastError
setsockopt
WSAIoctl
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSASocketA
WSACreateEvent
WSAEventSelect
htons
inet_ntoa

pdh

PdhCloseQuery
PdhAddCounterA
PdhOpenQueryA
PdhGetFormattedCounterValue
PdhCollectQueryData

avifil32

AVIFileExit
AVIStreamSetFormat
AVIFileCreateStreamA
AVIFileOpenA
AVIStreamWrite
AVIFileRelease
AVIStreamRelease
AVIFileInit

msvfw32

DrawDibDraw
ICSeqCompressFrameEnd
ICCompressorFree
ICClose
ICOpen
ICSendMessage
ICSeqCompressFrameStart
ICDecompress
DrawDibOpen
DrawDibClose

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 252KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 88KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 152KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Bin/SkinH.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

SkinH_AdjustAero
SkinH_AdjustHSV
SkinH_Attach
SkinH_AttachEx
SkinH_AttachExt
SkinH_AttachRes
SkinH_AttachResEx
SkinH_Detach
SkinH_DetachEx
SkinH_GetColor
SkinH_LockUpdate
SkinH_Map
SkinH_NineBlt
SkinH_SetAero
SkinH_SetBackColor
SkinH_SetFont
SkinH_SetFontEx
SkinH_SetForeColor
SkinH_SetMenuAlpha
SkinH_SetTitleMenuBar
SkinH_SetWindowAlpha
SkinH_SetWindowMovable
SkinH_VerifySign

Sections

.Hmily
Size: - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.52PoJie
Size: 95KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Bin/update/server.dat
.exe windows x86

2786d681aa9533253cbef09e5cff80ae

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
SetFilePointer
WriteFile
MoveFileA
GetProcAddress
LoadLibraryA
GetModuleFileNameA
SetLastError
GetCurrentProcess
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
FreeLibrary
OpenProcess
ExitProcess
GetSystemDirectoryA
GetWindowsDirectoryA
HeapFree
HeapAlloc
CreateFileA
LocalAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
PeekNamedPipe
WaitForMultipleObjects
GlobalMemoryStatusEx
GetVersionExA
OpenEventA
SetErrorMode
LocalSize
Process32Next
Process32First
lstrcmpiA
GetCurrentThreadId
GetFileSize
GetProcessHeap
RemoveDirectoryA
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
lstrcatA
CreateProcessA
lstrlenA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
CancelIo
InterlockedExchange
lstrcpyA
ResetEvent
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
TerminateThread
Sleep
CloseHandle
CreateEventA
GlobalFree

user32

GetSystemMetrics
SetRect
GetDesktopWindow
ReleaseDC
GetCursorInfo
GetCursorPos
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
ExitWindowsEx
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
GetClipboardData
OpenClipboard
CloseDesktop
EmptyClipboard
CloseWindow
SetClipboardData
CloseClipboard
SetCursorPos
DispatchMessageA
WindowFromPoint
CharNextA
wsprintfA
GetWindowTextA
GetForegroundWindow
GetAsyncKeyState
LoadCursorA
TranslateMessage
GetMessageA
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
PostMessageA
CreateWindowExA
IsWindow
SendMessageA
DestroyCursor

advapi32

CloseServiceHandle
RegQueryValueA
RegOpenKeyExA
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
RegSetValueExA
RegCreateKeyA
SetNamedSecurityInfoA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetEntriesInAclA
RegQueryValueExA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
FreeSid
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
LookupAccountSidA
GetTokenInformation
RegCloseKey

shell32

SHGetFileInfoA

msvcrt

_strnicmp
calloc
_beginthreadex
atoi
realloc
strncat
strchr
strncpy
putchar
strrchr
_except_handler3
malloc
free
strstr
_ftol
ceil
memmove
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
_strcmpi

shlwapi

SHDeleteKeyA

winmm

waveInReset
waveInStop
waveOutWrite
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInUnprepareHeader
waveInGetNumDevs
waveOutPrepareHeader
waveOutOpen
waveOutGetNumDevs
waveInClose
waveOutUnprepareHeader
waveOutClose
waveOutReset
waveInOpen

ws2_32

WSAStartup
WSACleanup
WSAIoctl
setsockopt
connect
htons
gethostbyname
socket
ntohs
recv
getsockname
gethostname
send
select
closesocket

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

avicap32

capGetDriverDescriptionA
capCreateCaptureWindowA

msvfw32

ICSeqCompressFrame
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICCompressorFree
ICSeqCompressFrameEnd

psapi

EnumProcessModules
GetModuleFileNameExA

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Bin/update/server.map

Sharing

General

Malware Config

Signatures

Files

6412357968d0be4d6f4a76b17febf2d2

Headers

File Characteristics

Imports

shlwapi

winmm

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

skinh

ws2_32

pdh

avifil32

msvfw32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 252KB - Virtual size: 248KB

.data Size: 88KB - Virtual size: 110KB

.rsrc Size: 152KB - Virtual size: 149KB

Headers

File Characteristics

Exports

Exports

Sections

.Hmily Size: - Virtual size: 220KB

.52PoJie Size: 95KB - Virtual size: 111KB

2786d681aa9533253cbef09e5cff80ae

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcrt

shlwapi

winmm

ws2_32

msvcp60

wininet

avicap32

msvfw32

psapi

wtsapi32

Sections

.text Size: 72KB - Virtual size: 71KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 10KB

.rsrc Size: 8KB - Virtual size: 7KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 252KB - Virtual size: 248KB

.data
Size: 88KB - Virtual size: 110KB

.rsrc
Size: 152KB - Virtual size: 149KB

.Hmily
Size: - Virtual size: 220KB

.52PoJie
Size: 95KB - Virtual size: 111KB

.text
Size: 72KB - Virtual size: 71KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 10KB

.rsrc
Size: 8KB - Virtual size: 7KB