General

Malware Config

Signatures

Files

• °²È«²¹¶¡.zip

  .zip
• 安全补丁.exe

  .exe windows x64

  a679745234d5b98528223a44db33029b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  RtlCaptureContext

  UnhandledExceptionFilter

  GetModuleHandleA

  TlsAlloc

  InitializeSListHead

  GetModuleHandleW

  GetModuleHandleExW

  TlsFree

  SetFilePointerEx

  ExitProcess

  WideCharToMultiByte

  TlsSetValue

  IsProcessorFeaturePresent

  GetProcessHeap

  RtlLookupFunctionEntry

  FindFirstFileExW

  GetCurrentProcess

  GetOEMCP

  EnterCriticalSection

  RtlVirtualUnwind

  GetStartupInfoW

  GetModuleFileNameW

  GetConsoleMode

  LeaveCriticalSection

  RtlUnwindEx

  CreateFileW

  TlsGetValue

  GetCommandLineW

  GetCPInfo

  SetLastError

  WriteFile

  HeapAlloc

  GetEnvironmentStringsW

  CloseHandle

  FreeLibrary

  SetUnhandledExceptionFilter

  FreeEnvironmentStringsW

  LoadLibraryExW

  TerminateProcess

  FindNextFileW

  HeapFree

  MultiByteToWideChar

  WaitForSingleObject

  GetCurrentProcessId

  FlushFileBuffers

  LCMapStringW

  SetEnvironmentVariableW

  GetLastError

  CreateThread

  GetSystemTimeAsFileTime

  IsValidCodePage

  InitializeCriticalSectionAndSpinCount

  CompareStringW

  GetACP

  GetStringTypeW

  HeapReAlloc

  GetCurrentThreadId

  GetFileType

  WriteConsoleW

  GetProcAddress

  SetStdHandle

  DeleteCriticalSection

  RaiseException

  GetCommandLineA

  GetStdHandle

  IsDebuggerPresent

  HeapSize

  QueryPerformanceCounter

  GetConsoleOutputCP

  FindClose

  Sections

  .adata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .text

  Size: 86KB - Virtual size: 85KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 46KB - Virtual size: 45KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .kmdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ