c2c9563de90fa7cf3a52683c93b43cde617df0381961cfd2deb021ce5585a39d

Sharing

Copy URL Twitter E-mail

General

Target

c2c9563de90fa7cf3a52683c93b43cde617df0381961cfd2deb021ce5585a39d
Size

3.1MB
MD5

bea2cf74cac3b3495e7b19943cbc9cf7
SHA1

fbca8233e78e556ef67f62be3a2c09a43833e7f7
SHA256

c2c9563de90fa7cf3a52683c93b43cde617df0381961cfd2deb021ce5585a39d
SHA512

6fca45b9627bb9bd59c697e36d59fa686639b471450c9985ba35fcd65c56466c6bc60eb2d08fcbfa21c1b3e3f0bf48c7e0038d4355eb134353f68a8e4ec02ec6
SSDEEP

98304:g5RkQOSO1GpD8wIn9VKNgohq4ik38sj3lGqiS:aRpOSO1ED8z6NgoU4i68sj3Z

Score

1^/10

Malware Config

Signatures

Files

c2c9563de90fa7cf3a52683c93b43cde617df0381961cfd2deb021ce5585a39d
.dll windows x86

6849349bd5a478e398490da33e56e903

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
RemoveVectoredExceptionHandler
VirtualAlloc
VirtualProtect
HeapFree
VirtualFree
HeapAlloc
GetProcessHeap
IsBadReadPtr
lstrcmpiW
AddVectoredExceptionHandler
IsDebuggerPresent
ResumeThread
EnterCriticalSection
LeaveCriticalSection
IsWow64Process
GetSystemDirectoryA
GetSystemInfo
GetThreadContext
VirtualAllocEx
VirtualFreeEx
GetTickCount
CheckRemoteDebuggerPresent
SetEndOfFile
WritePrivateProfileStringA
DeleteFileA
Sleep
DuplicateHandle
IsBadWritePtr
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
ReadProcessMemory
SetLastError
GetCurrentProcessId
GetModuleFileNameA
lstrcmpiA
VirtualQuery
GetPrivateProfileStringA
FreeLibrary
GetModuleFileNameW
LoadLibraryW
GetSystemDirectoryW
MultiByteToWideChar
WideCharToMultiByte
GetLastError
GetCurrentProcess
GetFileAttributesA
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileA
GetModuleHandleW
GetModuleHandleA
GetProcAddress
CloseHandle
WaitForSingleObject
CreateThread
VirtualQueryEx
HeapSize
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
GetCurrentDirectoryW
GetConsoleOutputCP
FlushFileBuffers
GetFileSizeEx
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EncodePointer
DecodePointer
InitializeCriticalSectionEx
DeleteCriticalSection
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
InterlockedCompareExchange
FlushInstructionCache
SetThreadContext
SuspendThread
GetCurrentThread
LoadLibraryExW
RtlUnwind
RaiseException
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFullPathNameW
QueryPerformanceFrequency
LCMapStringW
GetStdHandle
GetFileType
WriteConsoleW

hg

ord34
ord33
ord31
ord30
ord29
ord28
ord27
ord26
ord25
ord24
ord23
ord22
ord21
ord19
ord18
ord37
ord16
ord15
ord14
ord13
ord12
ord11
ord10
ord9
ord8
ord7
ord6
ord5
ord4
ord3
ord2
ord1
ord36
ord38
ord17
ord32

tgear

ord36
ord35
ord53
ord45
ord38
ord8
ord24

shlwapi

StrCmpIW
PathStripPathW
PathFindFileNameA
ord215

wintrust

WinVerifyTrust

tmarquee

DelMarquee
NewMarquee

Exports

Exports

DelMarquee
HIB
NewMarquee
TAiSafe_Function
TCChrom_SendAsyCall
TCUnit_Create
TCUnit_PreTranslateMessage
TCUnit_ProcessMsg
TCUnit_SendAsyCall
TCUnit_SetParamStr
TCUnit_SetScheme
TC_AfterStatusChange
TC_ArrangeWnd
TC_BeforeHideWT
TC_CORE_MESSAGE
TC_CallExtrenURL
TC_CreateAll
TC_CreateToolWnd
TC_DoGridJy
TC_DoLevinGN
TC_DoLevinJy
TC_GetClientInfo
TC_GetDlg
TC_GetFlag
TC_GetJyStatus
TC_GetL2Info
TC_GetLoginRet
TC_GetRightInfo
TC_GetTCInfo
TC_GetVersion
TC_Init_Environ
TC_Login
TC_Login2
TC_OperateUser
TC_PreTransMsg
TC_RegisterCallBack
TC_RegisterCallBack2
TC_SetFeedBackMsg
TC_SetFlag
TC_SetL2UserInfo
TC_SetVersionInfo
TC_Uninit
_ImageNtHeader@4
_ImageRvaToSection@12

Sections

.text
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.HeiGe0
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HeiGe1
Size: 279KB - Virtual size: 278KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6849349bd5a478e398490da33e56e903

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

hg

tgear

shlwapi

wintrust

tmarquee

Exports

Exports

Sections

.text Size: 186KB - Virtual size: 185KB

.rdata Size: 2.6MB - Virtual size: 2.6MB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 1KB - Virtual size: 1KB

.HeiGe0 Size: 10KB - Virtual size: 9KB

.HeiGe1 Size: 279KB - Virtual size: 278KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 186KB - Virtual size: 185KB

.rdata
Size: 2.6MB - Virtual size: 2.6MB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 1KB - Virtual size: 1KB

.HeiGe0
Size: 10KB - Virtual size: 9KB

.HeiGe1
Size: 279KB - Virtual size: 278KB

.reloc
Size: 10KB - Virtual size: 9KB