Static task
static1
Behavioral task
behavioral1
Sample
人物设定及开发流程思路-.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
人物设定及开发流程思路-.exe
Resource
win10v2004-20230220-en
General
-
Target
Desktop.zip
-
Size
1.4MB
-
MD5
c83debd65bcc9370ccd8ae949f5cbf71
-
SHA1
f09fefd68cc2f19e777918d364438fdae901321a
-
SHA256
02411fb64f3096758c3b74913329ef29d2a501869df36d12c7138b75f5f4b6f6
-
SHA512
7adb94594d55675aaedf2431aff31a5f893c47bdc56e131c0dd32b1d1b63545ba6bdd361dff936ae935f913934febce560c30461d660f69b1e91f41ea0d284ca
-
SSDEEP
24576:JGccHO0y8KKkLEOECmaILi4g0nzGriVq1rwh+r5b3RTus7MJap4oYTnn44:JGIv33wLi49nzUkqW4r5b3CJIont
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/人物设定及开发流程思路-.exe
Files
-
Desktop.zip.zip
Password: infected
-
人物设定及开发流程思路-.exe.exe windows x86
28234ce05f876098631b57f080269eaa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareStringW
GetTimeZoneInformation
WriteConsoleW
CreateFileW
GetProcessHeap
SetEnvironmentVariableA
VirtualFreeEx
GetModuleFileNameA
lstrcpyA
lstrcatA
WritePrivateProfileStringA
WideCharToMultiByte
GetModuleHandleA
LCMapStringW
GetCurrentProcess
GetDriveTypeW
SetCurrentDirectoryW
GetCurrentDirectoryW
FindFirstFileExA
GetDriveTypeA
GetFileInformationByHandle
FreeEnvironmentStringsW
WaitForMultipleObjects
PeekNamedPipe
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
SleepEx
QueryPerformanceCounter
SetHandleCount
GetProcAddress
GetEnvironmentStringsW
HeapDestroy
HeapCreate
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
IsValidCodePage
GetStdHandle
GetLocaleInfoW
SetConsoleCtrlHandler
FatalAppExitA
GetConsoleMode
GetConsoleCP
TerminateProcess
RaiseException
CreateToolhelp32Snapshot
Process32First
Process32Next
GlobalMemoryStatusEx
GetSystemInfo
DeleteFileA
CreateFileA
CreateFileMappingA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
CloseHandle
FindFirstFileA
FindClose
GetLastError
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetFileType
SetStdHandle
GetSystemTimeAsFileTime
VirtualQuery
VirtualAlloc
HeapSize
HeapQueryInformation
HeapReAlloc
CreateThread
ExitThread
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapAlloc
HeapFree
EncodePointer
DecodePointer
ExitProcess
RtlUnwind
LocalLock
LocalUnlock
FindResourceExW
GetDiskFreeSpaceA
ReplaceFileA
GetUserDefaultLCID
VirtualProtect
SearchPathA
GetProfileIntA
GetTickCount
InitializeCriticalSectionAndSpinCount
GetNumberFormatA
GetWindowsDirectoryA
GetTempPathA
GetTempFileNameA
GetFileTime
GetFileSizeEx
FileTimeToLocalFileTime
SetFileAttributesA
GetFileAttributesExA
SetErrorMode
GetOEMCP
GetCPInfo
GetACP
FileTimeToSystemTime
GetAtomNameA
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
MoveFileA
lstrcmpiA
GetThreadLocale
GetStringTypeExA
InterlockedIncrement
CopyFileA
GlobalSize
FormatMessageA
lstrlenW
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalFree
LocalAlloc
GlobalFlags
InterlockedDecrement
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
GlobalGetAtomNameA
GlobalFindAtomA
GetVersionExA
LoadLibraryW
lstrcmpW
GlobalFree
FindResourceA
FreeResource
GlobalUnlock
MulDiv
GetCurrentProcessId
GlobalAddAtomA
GetPrivateProfileStringA
GetPrivateProfileIntA
CreateEventA
SuspendThread
SetEvent
WaitForSingleObject
ResumeThread
SetThreadPriority
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
MultiByteToWideChar
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoA
CompareStringA
ActivateActCtx
LoadLibraryA
DeactivateActCtx
SetLastError
InterlockedExchange
GlobalLock
lstrcmpA
GlobalAlloc
GetModuleHandleW
FreeLibrary
SetFileTime
GetCurrentDirectoryA
GetFileAttributesA
CreateDirectoryA
LocalFileTimeToFileTime
lstrlenA
SystemTimeToFileTime
SetFilePointer
ReadFile
ClearCommError
GetCommTimeouts
SetCommTimeouts
WriteFile
FindResourceW
LoadResource
LockResource
SizeofResource
OpenProcess
VirtualAllocEx
ExpandEnvironmentStringsA
ReadProcessMemory
Sleep
user32
UnionRect
IsRectEmpty
IsZoomed
GetAsyncKeyState
NotifyWinEvent
MessageBeep
RedrawWindow
SetWindowRgn
LoadMenuW
OffsetRect
GetDialogBaseUnits
IntersectRect
CharUpperA
DestroyIcon
WaitMessage
ReleaseCapture
WindowFromPoint
SetCapture
GetSysColorBrush
LoadCursorA
LoadCursorW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
RemoveMenu
RealChildWindowFromPoint
InsertMenuA
DeleteMenu
ScrollWindowEx
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
LoadIconW
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
EnableScrollBar
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SystemParametersInfoA
GetMenuStringA
DestroyMenu
GetMenuItemInfoA
InflateRect
CopyRect
GetClassNameA
UpdateWindow
DrawStateA
GetWindow
SetWindowContextHelpId
MapDialogRect
SetWindowPos
RegisterWindowMessageA
UnhookWindowsHookEx
PtInRect
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
UpdateLayeredWindow
MonitorFromPoint
IsMenu
GetSysColor
EndPaint
FindWindowExA
FindWindowA
SendMessageA
GetWindowThreadProcessId
DrawIcon
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
MessageBoxA
ShowOwnedPopups
CreatePopupMenu
SetMenuDefaultItem
GetMenuDefaultItem
CharNextA
CopyAcceleratorTableA
SetRect
InvalidateRgn
GetNextDlgGroupItem
UnregisterClassA
SetParent
DestroyAcceleratorTable
SetClassLongA
DrawIconEx
DrawEdge
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
TranslateAcceleratorA
DrawFrameControl
DrawFocusRect
ToAsciiEx
MapVirtualKeyA
GetKeyboardLayout
GetKeyboardState
LoadAcceleratorsW
AppendMenuA
GetSystemMenu
IsIconic
GetWindowRect
GetClientRect
InvalidateRect
SetTimer
KillTimer
EnableWindow
GetSystemMetrics
wsprintfA
PostQuitMessage
PostMessageA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetParent
GetFocus
LoadBitmapW
GetMenuCheckMarkDimensions
CreateAcceleratorTableA
SetCursorPos
BringWindowToTop
SetMenuItemBitmaps
ValidateRect
GetTabbedTextExtentA
GetTabbedTextExtentW
LockWindowUpdate
GetWindowRgn
WindowFromDC
EnumChildWindows
DestroyCursor
SubtractRect
MapVirtualKeyExA
GetKeyNameTextA
IsCharLowerA
GetDoubleClickTime
GetUpdateRect
SendNotifyMessageA
IsClipboardFormatAvailable
CreateMenu
InSendMessage
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
DefFrameProcA
PostThreadMessageA
CharUpperBuffA
CopyIcon
FrameRect
RegisterClipboardFormatA
LoadImageW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
CopyImage
GetIconInfo
HideCaret
InvertRect
UnpackDDElParam
ReuseDDElParam
LoadMenuA
GetMenuBarInfo
LoadImageA
LoadAcceleratorsA
InsertMenuItemA
GetDlgCtrlID
GetDCEx
gdi32
OffsetClipRgn
LineTo
MoveToEx
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetLayout
SetLayout
SetArcDirection
SetColorAdjustment
DeleteObject
SelectClipRgn
GetClipRgn
CreateRectRgn
SelectClipPath
GetObjectA
GetViewportExtEx
GetWindowExtEx
BitBlt
GetPixel
StartDocA
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
DeleteDC
CreateDIBPatternBrushPt
CreatePatternBrush
CreateCompatibleDC
GetStockObject
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
GetDeviceCaps
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
CreateFontIndirectA
GetTextExtentPoint32A
CopyMetaFileA
CreateDCA
CreateDIBitmap
CreateCompatibleBitmap
IntersectClipRect
GetTextMetricsA
EnumFontFamiliesA
GetTextCharsetInfo
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
CreateRoundRectRgn
CreateDIBSection
GetBkColor
GetTextColor
GetRgnBox
GetCharWidthA
CreateFontA
StretchDIBits
GetCurrentObject
CreatePolygonRgn
CreateEllipticRgn
Polyline
Ellipse
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
SetDIBColorTable
GetDIBits
StretchBlt
SetPixel
Rectangle
RoundRect
EnumFontFamiliesExA
ExtFloodFill
SetPaletteEntries
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceA
GetTextExtentPointA
GetTextExtentPoint32W
CreateMetaFileA
CloseMetaFile
DeleteMetaFile
SetPixelV
ExcludeClipRect
GetClipBox
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetTextColor
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
CreateRectRgnIndirect
CreateBitmap
SaveDC
msimg32
AlphaBlend
TransparentBlt
comdlg32
GetFileTitleA
winspool.drv
GetJobA
OpenPrinterA
DocumentPropertiesA
ClosePrinter
advapi32
CryptImportKey
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegSetValueA
RegEnumValueA
RegOpenKeyExW
RegEnumKeyExA
SetFileSecurityA
GetFileSecurityA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptDestroyKey
CryptEncrypt
shell32
ShellExecuteA
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteExA
SHAppBarMessage
DragQueryFileA
DragFinish
SHGetFileInfoA
ExtractIconA
SHAddToRecentDocs
SHBrowseForFolderA
SHGetPathFromIDListA
comctl32
ImageList_Create
ImageList_DrawEx
ImageList_Remove
ImageList_AddMasked
ImageList_Destroy
ImageList_GetImageCount
ImageList_GetIconSize
ImageList_GetIcon
ImageList_ReplaceIcon
InitCommonControlsEx
shlwapi
PathRemoveExtensionA
PathFindFileNameA
PathStripToRootA
PathRemoveFileSpecW
PathIsUNCA
PathFindExtensionA
PathStripPathA
ole32
OleSaveToStream
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreate
OleLoad
GetHGlobalFromILockBytes
OleSetContainedObject
OleCreateFromFile
OleCreateLinkToFile
OleGetIconOfClass
CreateItemMoniker
CreateGenericComposite
OleRegEnumVerbs
OleRegGetMiscStatus
WriteClassStm
OleSave
OleIsRunning
OleQueryLinkFromData
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
DoDragDrop
OleRun
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
StgCreateDocfile
CreateFileMoniker
StgOpenStorage
StgIsStorageFile
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
OleSetMenuDescriptor
OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CoRegisterClassObject
CoRevokeClassObject
CoRegisterMessageFilter
PropVariantCopy
CreateStreamOnHGlobal
CoInitializeEx
CoDisconnectObject
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
StringFromGUID2
CoInitialize
CoCreateInstance
CreateDataAdviseHolder
CoUninitialize
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoCreateGuid
CreateOleAdviseHolder
CoGetMalloc
GetRunningObjectTable
OleQueryCreateFromData
oleaut32
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
VariantInit
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysReAllocStringLen
VarDateFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarCyFromStr
VarBstrFromDate
OleCreateFontIndirect
SysAllocString
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
VariantChangeType
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
SafeArrayUnlock
SysFreeString
oledlg
ord8
gdiplus
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDrawImageI
GdipAlloc
GdipFree
wldap32
ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord200
ord32
ord35
ord79
ord33
ord301
ord27
ord41
ord46
ws2_32
ntohl
htonl
gethostname
ioctlsocket
listen
accept
recvfrom
sendto
getaddrinfo
freeaddrinfo
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSACleanup
WSAStartup
crypt32
CertFreeCertificateContext
oleacc
AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject
imm32
ImmReleaseContext
ImmGetContext
ImmGetOpenStatus
winmm
PlaySoundA
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 521KB - Virtual size: 520KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 33KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 405KB - Virtual size: 405KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ