56a07d6a6440c6d14007cc1c59593c5c802d3f8d6748fd902693b4cd982252e8

Sharing

Copy URL Twitter E-mail

General

Target

56a07d6a6440c6d14007cc1c59593c5c802d3f8d6748fd902693b4cd982252e8
Size

3.1MB
MD5

31863fbedfae75bdd7ddda0dd49b5c4d
SHA1

9fa24c634137f3275917332164c340a957ca1a17
SHA256

56a07d6a6440c6d14007cc1c59593c5c802d3f8d6748fd902693b4cd982252e8
SHA512

3fb8f93c3c5c89f742fa404001b28f4cdfa028fa17c19c67594433163e9332ba895eccf7d5cde80037bb82de7983628af8b1f50a5483508f3e2ff009739c1eab
SSDEEP

98304:niRkQOSO1GpD8wIn9VKNgohq4ik38sj3lGqiOvAjdQT:iRpOSO1ED8z6NgoU4i68sj3Ij

Score

1^/10

Malware Config

Signatures

Files

56a07d6a6440c6d14007cc1c59593c5c802d3f8d6748fd902693b4cd982252e8
.dll windows x86

0fcd02af39564d3c65e6801eb87eb983

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
RemoveVectoredExceptionHandler
VirtualAlloc
VirtualProtect
HeapFree
VirtualFree
HeapAlloc
GetProcessHeap
IsBadReadPtr
lstrcmpiW
AddVectoredExceptionHandler
IsDebuggerPresent
ResumeThread
EnterCriticalSection
LeaveCriticalSection
IsWow64Process
GetSystemDirectoryA
GetSystemInfo
GetThreadContext
VirtualAllocEx
VirtualFreeEx
GetTickCount
CheckRemoteDebuggerPresent
SetEndOfFile
WritePrivateProfileStringA
DeleteFileA
Sleep
DuplicateHandle
IsBadWritePtr
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
ReadProcessMemory
SetLastError
GetCurrentProcessId
GetModuleFileNameA
lstrcmpiA
VirtualQuery
GetPrivateProfileStringA
FreeLibrary
CreateThread
WaitForSingleObject
GetModuleFileNameW
LoadLibraryW
GetSystemDirectoryW
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
GetLastError
GetCurrentProcess
GetFileAttributesA
WriteFile
SetFilePointer
GetProcAddress
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetModuleHandleA
VirtualQueryEx
HeapSize
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
GetCurrentDirectoryW
LCMapStringW
EncodePointer
DecodePointer
InitializeCriticalSectionEx
DeleteCriticalSection
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
InterlockedCompareExchange
FlushInstructionCache
SetThreadContext
SuspendThread
GetCurrentThread
LoadLibraryExW
RtlUnwind
RaiseException
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFullPathNameW
QueryPerformanceFrequency
GetStdHandle
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileSizeEx
FlushFileBuffers
GetConsoleOutputCP
WriteConsoleW

hg

ord34
ord33
ord31
ord30
ord29
ord28
ord27
ord26
ord25
ord24
ord23
ord22
ord21
ord19
ord18
ord37
ord16
ord15
ord14
ord13
ord12
ord11
ord10
ord9
ord8
ord7
ord6
ord5
ord4
ord3
ord2
ord1
ord36
ord38
ord17
ord32

tgear

ord36
ord35
ord53
ord45
ord38
ord8
ord24

shlwapi

StrCmpIW
PathStripPathW
PathFindFileNameA
ord215

wintrust

WinVerifyTrust

tmarquee

DelMarquee
NewMarquee

Exports

Exports

DelMarquee
HIB
NewMarquee
TAiSafe_Function
TCChrom_SendAsyCall
TCUnit_Create
TCUnit_PreTranslateMessage
TCUnit_ProcessMsg
TCUnit_SendAsyCall
TCUnit_SetParamStr
TCUnit_SetScheme
TC_AfterStatusChange
TC_ArrangeWnd
TC_BeforeHideWT
TC_CORE_MESSAGE
TC_CallExtrenURL
TC_CreateAll
TC_CreateToolWnd
TC_DoGridJy
TC_DoLevinGN
TC_DoLevinJy
TC_GetClientInfo
TC_GetDlg
TC_GetFlag
TC_GetJyStatus
TC_GetL2Info
TC_GetLoginRet
TC_GetRightInfo
TC_GetTCInfo
TC_GetVersion
TC_Init_Environ
TC_Login
TC_Login2
TC_OperateUser
TC_PreTransMsg
TC_RegisterCallBack
TC_RegisterCallBack2
TC_SetFeedBackMsg
TC_SetFlag
TC_SetL2UserInfo
TC_SetVersionInfo
TC_Uninit
_ImageNtHeader@4
_ImageRvaToSection@12

Sections

.text
Size: 185KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.HG0
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.HG1
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0fcd02af39564d3c65e6801eb87eb983

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

hg

tgear

shlwapi

wintrust

tmarquee

Exports

Exports

Sections

.text Size: 185KB - Virtual size: 185KB

.rdata Size: 2.6MB - Virtual size: 2.6MB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 1KB - Virtual size: 1KB

.HG0 Size: 9KB - Virtual size: 9KB

.HG1 Size: 276KB - Virtual size: 275KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 185KB - Virtual size: 185KB

.rdata
Size: 2.6MB - Virtual size: 2.6MB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 1KB - Virtual size: 1KB

.HG0
Size: 9KB - Virtual size: 9KB

.HG1
Size: 276KB - Virtual size: 275KB

.reloc
Size: 10KB - Virtual size: 9KB