0ba645b8c0fe973d3935c759cee053b2d54157b40b30697923d86b59543700e6

Sharing

Copy URL Twitter E-mail

General

Target

0ba645b8c0fe973d3935c759cee053b2d54157b40b30697923d86b59543700e6
Size

14.0MB
MD5

bf9df20667b4e514d366b8dfe937b73c
SHA1

5dfd6832a128bb8cebf881f0b2583dfba5cff3b3
SHA256

0ba645b8c0fe973d3935c759cee053b2d54157b40b30697923d86b59543700e6
SHA512

f36300f623b2a46f4c8482c66daf1df7e99d581318abced3e55dc08348490fec67d0408d1c1db81870f15dbabf2ef306a09b515ef4d3ad39473d133f205b634d
SSDEEP

196608:9YxZsLwzV3OLXNnDP+OVIHuUpKEdKahfmq1EqGMNL4fEw2wo/YcnoI:9Y2wzqNtwdKATCGNL48w27/YooI

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

0ba645b8c0fe973d3935c759cee053b2d54157b40b30697923d86b59543700e6
.exe windows x86

26cc95f6ee7a785a6d193ed3fb9b75c7

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:ba:6d:5e:8a:52:ef:25:09:b1:a9:54:c2:7e:ac:e8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03/02/2021, 00:00

Not After

30/04/2024, 23:59

Subject

CN=Shenzhen Fortune Trend technology Co.\, Ltd,O=Shenzhen Fortune Trend technology Co.\, Ltd,L=Shenzhen,ST=guangdong province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

20:67:fc:13:9e:df:40:d1:db:60:22:eb:98:54:3a:aa:8a:59:e3:e1
Signer

Actual PE Digest

20:67:fc:13:9e:df:40:d1:db:60:22:eb:98:54:3a:aa:8a:59:e3:e1

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

taisafe

TAiSafe_Function

tbeauty

TBeauty_CreateTdxTab
DelTdxSkinTitle
NewTdxSkinTitle
TBeauty_DeleteTdxTab

tcalc

?GetIndexNum@CMainCalcInterface@@QAEJE@Z
?GetIndexNo@CMainCalcInterface@@QAEJEPAD@Z
?PopupDlg@CMainCalcInterface@@QAEHPAUHWND__@@EJ@Z
?GetCharFromPos@CMainCalcInterface@@QAEHPADJ@Z
?DelOneCalc@CMainCalcInterface@@QAEXAAPAVCCalcBase@@@Z
?NewOneCalc@CMainCalcInterface@@QAEPAVCCalcBase@@HJ@Z
?InitMain@CMainCalcInterface@@QAEHPAD000@Z
?RegisterCallBackFunc@CMainCalcInterface@@QAEXP6GJPADFFPAXFUtag_NTime@@2EK@ZP6GJ0F0JFFK@ZP6GJH1H1AAHJ@Z@Z
?SetSysLimited@CMainCalcInterface@@QAEXHHJJPAD0@Z
?GetTypeNum@CMainCalcInterface@@QAEJXZ
??1CMainCalcInterface@@UAE@XZ
?AutoImportExport@CMainCalcInterface@@QAEHHPBD0AAH1@Z
?TCalc_SendAsyCall@@YAHPAXHAAI@Z
?GetIndexDateInfo@CMainCalcInterface@@QAEPAUtagIndexDateInfo@@EPAD@Z
?PopupMainDlg@CMainCalcInterface@@QAEHPAUHWND__@@@Z
?StopAllCalc@CMainCalcInterface@@QAEXXZ
?GetTreeInfo@CMainCalcInterface@@QAEJPAXHH@Z
?CompileGSIndex@CMainCalcInterface@@QAEHPAUtag_INDEXINFO@@PADHHK@Z
?GetTypeName@CMainCalcInterface@@QAEPADJ@Z
?GetIndexInfo@CMainCalcInterface@@QAEPAUtag_INDEXINFO@@EJ@Z
?GetIndexInfo@CMainCalcInterface@@QAEPAUtag_INDEXINFO@@EPAD@Z
??0CMainCalcInterface@@QAE@XZ
??ACMainCalcInterface@@QAEPAUtag_INDEXINFO@@E@Z

tcontrol

??1CMarkup@@QAE@XZ
?GetAttrib@CMarkup@@QBE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@UMCD_CSTR@@@Z
?IntoElem@CMarkup@@QAE_NXZ
?FindChildElem@CMarkup@@QAE_NUMCD_CSTR@@@Z
?x_SetPos@CMarkup@@IAEXHHH@Z
?Load@CMarkup@@QAE_NUMCD_CSTR@@@Z
??0CMarkup@@QAE@XZ
??1CFastIni@@UAE@XZ
?WritePrivateProfileStringA@CFastIni@@QAEHPBD000@Z
?LoadIniFile@CFastIni@@QAEHPBD@Z
??0CFastIni@@QAE@H@Z
?GetPrivateProfileIntA@CFastIni@@QAEHPBD0H0@Z
?GetPrivateProfileStringA@CFastIni@@QAEKPBD00PADK0@Z
?FindElem@CMarkup@@QAE_NUMCD_CSTR@@@Z
?UnZipSomeFile_Detect@@YAHPBD0AAH11111111@Z
??1CIniFile@@UAE@XZ
?GetInt@CIniFile@@QAEHPBDH0@Z
?SetAppName@CIniFile@@QAEXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetFileName@CIniFile@@QAEXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
??0CIniFile@@QAE@XZ
?PutInt@CIniFile@@QAEXHPBD0@Z
?Save@CMarkup@@QAE_NUMCD_CSTR@@@Z
?SetAttrib@CMarkup@@QAE_NUMCD_CSTR@@HH@Z
?AddChildElem@CMarkup@@QAE_NUMCD_CSTR@@0H@Z
?SetAttrib@CMarkup@@QAE_NUMCD_CSTR@@0H@Z
?InsertChildElem@CMarkup@@QAE_NUMCD_CSTR@@0H@Z
?InsertElem@CMarkup@@QAE_NUMCD_CSTR@@0H@Z
?IsFileDigitallySigned@@YAHPBD@Z
?SetUnhandledException@@YAXPBD@Z
?GetString@CIniFile@@QAEXAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD11@Z
?OutOfElem@CMarkup@@QAE_NXZ

viewthem

?INFO_ReqGGCjzx@@YAHFFPADFF@Z
?INFO_GetMineNum@@YAHXZ
?INFO_GetMineTitle@@YAHFPAUext_info_title@@@Z
?INFO_AskMineTitle@@YAHFPADFQAJ1@Z
?INFO_GetMetaItem@@YAHPAUMETA_ITEM_INFO@@H@Z
?INFO_GetGGCjzxTitle@@YAHFFPAUext_info_title@@@Z
?INFO_HasNewMsg@@YAHXZ
?INFO_GetStatus@@YAXPAD0PAG0@Z
?INFO_ShowDlg@@YAHPAUHWND__@@FFFPADFPAUext_info_title@@PAUext_ggbw_title@@FJ@Z
?INFO_GetGGBWTitle@@YAHFPADPAUext_ggbw_title@@F@Z
?INFO_AskHqMineCount@@YAHHPAUsetcode_and_stockcode@@@Z
?INFO_AskZxgRealinfo@@YAXXZ
?INFO_OnTimer@@YAXH@Z
?INFO_Uninit@@YAHH@Z
?INFO_AllRegisterCallBack@@YAXP6GJPADFFPAXFUtag_NTime@@2EK@ZP6GJ0F0JFFK@ZP6GJH1H1AAHJ@Z@Z
?INFO_Init@@YAHPAUHWND__@@JPBD111IJHHH@Z
?INFO_SetLoginName@@YAXQADKD0@Z
?INFO_GetRollTitle@@YAHFFPAUext_info_title@@AAH@Z
?INFO_GetTopTitle@@YAHFFPAUext_info_title@@@Z
?INFO_GetHqMineCount@@YAHPAPAUstock_mine_info@@@Z
?INFO_Scheme@@YAXUtag_OP_Scheme_Color@@Utag_OP_Scheme_Font@@Utag_OP_Scheme_Menu@@H@Z
?INFO_GetMiniHQStatus@@YAHJ@Z
?INFO_ShowMiniHQFace@@YAHHJ@Z
?INFO_ProcessMsg@@YAHFPAUHWND__@@IIJ@Z
?INFO_ShowFunc@@YAHPAUHWND__@@JFPADFPAUext_info_title@@PAUext_ggbw_title@@FF@Z
?INFO_ShowMsgBox@@YAHJ@Z
?INFO_DisConnect@@YAXXZ
?INFO_IsConnect@@YAHXZ
?INFO_Connect@@YAHH@Z
?INFO_ShowSoftManager@@YAHJJ@Z
?INFO_NotifyToMsgBox@@YAHPAD@Z
?INFO_NotifyToMsgBox@@YAHJJ@Z
?INFO_Gen_GetZXGTitle@@YAHPAUHWND__@@IIJJJH@Z
?INFO_Gen_GetCJZXContent@@YAHPAUHWND__@@IIJFFJJF@Z
?INFO_Gen_GetCJZXTitle@@YAHPAUHWND__@@IIJDDPADQAJFFH@Z
?INFO_Gen_GetZXGTitleResult@@YAHPADAAHK@Z
?INFO_Gen_GetCJZXContentResult@@YAHPAD@Z
?INFO_Gen_GetCJZXTitleResult@@YAHPADAAHK@Z
?INFO_Set_TPTQLAnswer@@YAXPBD0@Z
?INFO_SetOpenRqinfo@@YAXJKQAD@Z
?INFO_CarryoutFunc@@YAHHPAXH0AAHJ@Z
?INFO_ShowGN@@YAHJPAXH0AAHJ@Z

invest

?SetPrivateInvestDir@@YAXPAD@Z
?PopupInvestDlg@@YAXXZ
?SetCallBackToInvest@@YAXP6GJPBDFPADPAM2PAFNPAN4@Z@Z

tmarquee

NewMarquee
DelMarquee

tjyaid

GetWtDefInfoFromETradeXML_More
ProcessHostFromETradeXML

tqqcalc

TQQCalc_Index
TQQCalc_Yhbdl
TQQCalc_Lsbdl

tqqanaly

TQQAnaly_RegisterCallBack
TQQAnaly_Exit
TQQAnaly_PopWnd
TQQAnaly_SetScheme

mfc100

ord3548
ord3892
ord3890
ord3489
ord5612
ord8391
ord5035
ord11114
ord6693
ord2119
ord1315
ord7474
ord3363
ord4464
ord7871
ord7892
ord12740
ord6699
ord475
ord5871
ord8311
ord11044
ord8334
ord11117
ord3392
ord7523
ord4431
ord1524
ord12489
ord12487
ord5273
ord8442
ord10755
ord10749
ord3402
ord2855
ord6959
ord8392
ord8516
ord9741
ord8087
ord10510
ord7855
ord1230
ord3636
ord12806
ord1639
ord822
ord12068
ord9855
ord7513
ord12132
ord2068
ord394
ord6510
ord6961
ord12862
ord13304
ord5688
ord12145
ord12148
ord4435
ord3491
ord1878
ord8003
ord2770
ord12577
ord5580
ord12415
ord8271
ord10729
ord900
ord290
ord8504
ord947
ord384
ord5804
ord12532
ord2289
ord2753
ord5272
ord9602
ord7458
ord6679
ord2759
ord5809
ord2291
ord10707
ord3641
ord7313
ord2756
ord4796
ord953
ord2031
ord6683
ord10705
ord6047
ord11943
ord12258
ord4738
ord3251
ord909
ord2514
ord325
ord12694
ord6131
ord865
ord6091
ord11057
ord8232
ord2305
ord2309
ord8090
ord2839
ord2937
ord3756
ord1264
ord10547
ord6822
ord2092
ord4265
ord4105
ord307
ord311
ord2020
ord6826
ord877
ord6103
ord10671
ord4397
ord2306
ord2282
ord8091
ord2842
ord2940
ord5167
ord1276
ord10727
ord12152
ord4514
ord5171
ord2902
ord6829
ord7266
ord9172
ord2864
ord3184
ord3183
ord11033
ord8332
ord12988
ord2896
ord2897
ord7302
ord1297
ord1890
ord1295
ord734
ord5782
ord9281
ord5279
ord2871
ord2870
ord3467
ord3671
ord7267
ord12630
ord7264
ord5663
ord12627
ord11792
ord6211
ord4888
ord7888
ord7891
ord12867
ord6968
ord4781
ord12280
ord7932
ord12864
ord12960
ord7473
ord3969
ord12342
ord12343
ord3901
ord2223
ord2233
ord11269
ord2877
ord3163
ord3164
ord1184
ord6690
ord6787
ord6786
ord6521
ord11512
ord4149
ord6386
ord826
ord6063
ord1231
ord4347
ord1977
ord1014
ord6379
ord1164
ord6344
ord6382
ord6515
ord2146
ord7192
ord465
ord5861
ord7618
ord11557
ord1711
ord11608
ord1232
ord827
ord6064
ord1426
ord12719
ord12094
ord1438
ord8511
ord3426
ord2185
ord4511
ord2574
ord9917
ord12090
ord301
ord11511
ord6867
ord1859
ord1168
ord715
ord8306
ord7588
ord4952
ord5501
ord1588
ord11534
ord4808
ord7853
ord2997
ord2998
ord7135
ord11805
ord2544
ord10920
ord14073
ord12267
ord9446
ord712
ord5999
ord11051
ord11112
ord7520
ord11362
ord10751
ord2805
ord2927
ord2804
ord713
ord6000
ord433
ord5833
ord11038
ord6144
ord12704
ord2219
ord3988
ord2777
ord12586
ord5598
ord4499
ord6160
ord6584
ord6369
ord3360
ord8463
ord3242
ord722
ord6009
ord12002
ord1173
ord12718
ord12093
ord1260
ord6088
ord2836
ord2936
ord11916
ord13136
ord6083
ord2828
ord2935
ord3356
ord12664
ord6627
ord893
ord11153
ord11184
ord9450
ord7355
ord11181
ord11172
ord5238
ord3409
ord1291
ord4080
ord6671
ord11917
ord13048
ord11471
ord5176
ord12797
ord6838
ord12657
ord5843
ord2764
ord2917
ord996
ord5032
ord7490
ord6694
ord888
ord6112
ord11787
ord11180
ord13481
ord13484
ord13482
ord13485
ord13480
ord13483
ord7144
ord11413
ord13181
ord10922
ord14075
ord1732
ord7091
ord11806
ord3618
ord3676
ord8486
ord13299
ord7073
ord13301
ord11421
ord11420
ord2163
ord4724
ord13767
ord11726
ord7510
ord7584
ord1288
ord9449
ord10030
ord4078
ord6835
ord9185
ord9188
ord9192
ord921
ord10489
ord10967
ord345
ord8394
ord7576
ord9094
ord1951
ord1985
ord11915
ord314
ord2371
ord6111
ord7835
ord1480
ord1314
ord13125
ord1025
ord3490
ord5212
ord13316
ord11243
ord11240
ord4032
ord11242
ord10936
ord481
ord2528
ord11513
ord6195
ord13047
ord7012
ord12479
ord5252
ord11042
ord3483
ord8308
ord5868
ord472
ord8441
ord10508
ord2778
ord10596
ord985
ord6696
ord11439
ord12716
ord383
ord3488
ord6314
ord14119
ord14120
ord11318
ord7322
ord868
ord10915
ord13348
ord5639
ord12453
ord2538
ord1266
ord3373
ord3234
ord7211
ord4344
ord3475
ord7863
ord3746
ord5875
ord344
ord3619
ord337
ord796
ord11940
ord11939
ord8136
ord10006
ord5280
ord5786
ord4340
ord5776
ord6054
ord3429
ord2613
ord7861
ord3741
ord2744
ord7590
ord5784
ord4144
ord422
ord5627
ord11627
ord13312
ord4589
ord11878
ord12857
ord11875
ord12847
ord7994
ord12850
ord12124
ord11949
ord11728
ord11812
ord11455
ord11437
ord12552
ord12099
ord5801
ord12473
ord12861
ord4131
ord4345
ord8554
ord7933
ord1906
ord1973
ord12344
ord13095
ord13306
ord2187
ord6969
ord13137
ord3970
ord3253
ord4060
ord374
ord12128
ord11941

msvcr100

atol
__CxxFrameHandler3
_time32
_gmtime32
_localtime32
_findfirst32
_findnext32
_mktime32
_filelength
_access
_strdup
_ismbcdigit
_mbclen
vsprintf
_mbsrchr
_ismbcspace
_mbschr
_mbsinc
_mbsrev
_mbslwr
_mbsupr
_mbscspn
_mbsspn
isxdigit
__CxxFrameHandler
ceil
wcslen
toupper
_ftol
fprintf
_mbspbrk
_timezone
signal
_setmbcp
_strlwr
_memicmp
_fileno
_chsize
_write
_close
_sopen
_lseek
_read
_unlink
_stricmp
_strnicmp
strncpy
sprintf
memmove
memset
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
memcpy
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
atof
_localtime64_s
_time64
fclose
fread
fopen
fwrite
strncmp
strrchr
strstr
fflush
realloc
free
isalnum
rewind
feof
_fsopen
fgets
isalpha
atoi
_purecall
memcpy_s
fseek
qsort
_mbsnbcmp
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
strpbrk
sprintf_s
setlocale
wcstombs
floor
_getdrive
_getdiskfree
_beginthreadex
wcsncpy
wcsstr
_mbscmp
strftime
_strupr_s
_mbsstr
srand
_vsnprintf
_CIexp
_snprintf
printf
_mbsnbicmp
sscanf
fputs
rand
_CIlog
memmove_s
ldiv
_atoi64
_strupr
ftell
_findfirst64i32
_findnext64i32
_findclose
strchr
isprint
_mktime64
strtok
_CIpow
_CIsin
_CIcos
_CIsqrt
_CIlog10
_CIacos
_localtime64
malloc
isdigit

kernel32

LocalFree
FormatMessageA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
ReadFile
GetFileSize
CreateFileA
ResetEvent
CreateEventA
GlobalFree
ResumeThread
GlobalReAlloc
GlobalMemoryStatusEx
IsDebuggerPresent
GetSystemTime
GetWindowsDirectoryA
OutputDebugStringA
GetFileAttributesA
LocalAlloc
EncodePointer
DecodePointer
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
MulDiv
LockResource
LCMapStringA
InitializeCriticalSection
WriteProcessMemory
SetFileAttributesA
FileTimeToSystemTime
RemoveDirectoryA
ExitThread
WaitForMultipleObjects
GetExitCodeThread
InterlockedExchangeAdd
SetEvent
lstrcpynA
GetVersionExA
OpenProcess
GetLogicalDriveStringsA
QueryDosDeviceA
lstrcpyA
lstrcatA
WritePrivateProfileStructA
GetPrivateProfileStructA
lstrcmpiA
GetModuleHandleA
GetProcAddress
SetLastError
DeactivateActCtx
GetLastError
GetCurrentProcessId
GlobalSize
GetSystemTimeAsFileTime
ActivateActCtx
EnterCriticalSection
LeaveCriticalSection
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
InterlockedExchange
CloseHandle
TerminateThread
LoadLibraryA
WaitForSingleObject
GetCurrentThreadId
InterlockedCompareExchange
ReleaseMutex
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateMutexA
Sleep
CreateProcessA
WinExec
CreateThread
GlobalUnlock
GlobalLock
GlobalAlloc
CreateDirectoryA
CopyFileA
GetCurrentProcess
FreeLibrary
GetStartupInfoA
GetModuleFileNameA
SetThreadContext
GetThreadContext
GetCurrentThread
InterlockedIncrement
InterlockedDecrement
GetTickCount
FindClose
FindNextFileA
FindFirstFileA
LoadLibraryExA
SetCurrentDirectoryA
SetEnvironmentVariableA
GetEnvironmentVariableA
DeleteFileA
IsDBCSLeadByte
Module32Next
Module32First
GetPrivateProfileSectionA
MultiByteToWideChar
lstrlenA
FreeResource
LoadResource
SizeofResource
FindResourceA
WideCharToMultiByte
lstrlenW
GetSystemInfo
GetVersion
Process32Next
Process32First
CreateToolhelp32Snapshot
GetLocalTime
GetCurrentDirectoryA

user32

LoadCursorW
InvalidateRect
SetWindowRgn
EmptyClipboard
IsIconic
SetTimer
GetParent
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
SetCursor
KillTimer
GetDC
ReleaseDC
AppendMenuA
GetSubMenu
CreatePopupMenu
GetFocus
OffsetRect
GetWindowDC
SetCapture
GetCursorPos
ReleaseCapture
GetSystemMetrics
GetWindowLongA
GetWindow
IsChild
GetSystemMenu
MenuItemFromPoint
SetWindowLongA
GetKeyState
LoadBitmapA
SetRectEmpty
SetRect
PtInRect
GetClientRect
GetWindowRect
OpenClipboard
CloseClipboard
SetClipboardData
LoadMenuW
InflateRect
LoadIconA
EnableWindow
SendMessageA
GetMessagePos
GetKeyNameTextA
MapVirtualKeyExA
SetWindowPos
SetCursorPos
SetClassLongA
SetActiveWindow
EnableMenuItem
MonitorFromWindow
GetKeyboardLayout
DestroyCaret
IsClipboardFormatAvailable
ShowCaret
HideCaret
SetCaretPos
GetCaretPos
CreateCaret
ValidateRect
RegisterClassA
GetNextDlgTabItem
SetWindowsHookExA
CallNextHookEx
SetPropA
CallWindowProcA
PostMessageA
GetPropA
RemovePropA
UnhookWindowsHookEx
WindowFromDC
GetIconInfo
GetMenuState
DeleteMenu
DrawEdge
DestroyMenu
LoadMenuA
IsMenu
DrawStateA
DestroyIcon
ShowScrollBar
GetWindowRgn
EnumDisplayMonitors
GetMonitorInfoA
RegisterHotKey
ClipCursor
GetPriorityClipboardFormat
GetClipboardData
GetClassInfoA
AdjustWindowRect
GetMenuItemRect
UnregisterHotKey
GetActiveWindow
SetClipboardViewer
ChangeClipboardChain
keybd_event
EnumWindows
ShowWindow
IntersectRect
RemoveMenu
InsertMenuA
PostQuitMessage
DrawFocusRect
LoadBitmapW
MessageBeep
WindowFromPoint
GetMenu
IsZoomed
UpdateWindow
SetWindowTextW
SystemParametersInfoA
GetDesktopWindow
FindWindowA
IsRectEmpty
GetLastActivePopup
ToAsciiEx
GetForegroundWindow
GetWindowThreadProcessId
PeekMessageA
TranslateMessage
DispatchMessageA
RegisterWindowMessageA
FlashWindow
GetMenuItemInfoA
SetMenuItemInfoA
GetClassNameA
MessageBoxA
LoadImageA
BringWindowToTop
DrawIcon
GetAsyncKeyState
EndPaint
BeginPaint
wsprintfA
GetMenuStringA
GetMenuItemID
GetMenuItemCount
FrameRect
SetFocus
IsWindow
ModifyMenuA
EqualRect
ScreenToClient
CheckMenuItem
GetSysColorBrush
DefWindowProcA
LoadCursorA
RedrawWindow
LockWindowUpdate
GetDCEx
IsWindowVisible
ClientToScreen
FillRect
DrawIconEx
CopyRect
GetSysColor
LoadIconW
SetForegroundWindow

gdi32

GetObjectA
DeleteObject
GetStockObject
PatBlt
SelectObject
CreateFontA
StretchBlt
SetPixel
Arc
GetTextExtentPoint32A
CreatePen
CreateSolidBrush
Ellipse
BeginPath
EndPath
StrokeAndFillPath
CreateDIBSection
DeleteDC
CreateDCA
GetDeviceCaps
CreateEllipticRgn
FillRgn
Polyline
LineTo
MoveToEx
Rectangle
Escape
ExtTextOutA
CreateFontIndirectA
GetTextMetricsA
CreateRectRgn
PtInRegion
CreateBitmapIndirect
GetBitmapBits
CombineRgn
OffsetRgn
GetBkMode
CreateBitmap
CreatePalette
ExtCreateRegion
RealizePalette
RoundRect
SetStretchBltMode
CreateDIBitmap
GetPixel
CreateHatchBrush
CreateRectRgnIndirect
GetNearestColor
SelectClipRgn
Pie
CreatePolygonRgn
FrameRgn
FillPath
PolyBezier
SetBitmapBits
TextOutA
RectVisible
PtVisible
LPtoDP
DPtoLP
GetViewportExtEx
GetMapMode
GetBkColor
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
GetWindowExtEx

msimg32

AlphaBlend

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueExA
RegQueryValueA
RegEnumValueA
RegCreateKeyExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
OpenProcessToken

shell32

DragAcceptFiles
SHGetFileInfoA
Shell_NotifyIconA
SHGetSpecialFolderPathA
SHChangeNotify
ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA

comctl32

ImageList_GetIconSize
_TrackMouseEvent

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CreateStreamOnHGlobal
CoCreateGuid

oleaut32

SysReAllocStringLen
OleLoadPicture
VariantInit
SysAllocStringLen
SysFreeString

gdiplus

GdipAlloc
GdipSetPenDashStyle
GdipDeleteGraphics
GdipDrawImageRectRect
GdiplusStartup
GdiplusShutdown
GdipDrawLines
GdipSetPenDashOffset
GdipFree
GdipDeletePen
GdipCreatePen1
GdipDrawImagePointsI
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipCloneImage
GdipDrawImageRectI
GdipReleaseDC
GdipCreateFromHDC
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipLoadImageFromFileICM
GdipLoadImageFromFile

wsock32

WSAGetLastError
ioctlsocket
ntohs
WSAStartup
WSACleanup
gethostbyname
select
recv

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xout_of_range@std@@YAXPBD@Z
??1_Container_base12@std@@QAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?_Orphan_all@_Container_base12@std@@QAEXXZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
??0_Container_base12@std@@QAE@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?setf@ios_base@std@@QAEHHH@Z
?setf@ios_base@std@@QAEHH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_BADOFF@std@@3_JB
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?width@ios_base@std@@QAE_J_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ

winmm

PlaySoundA

imm32

ImmSimulateHotKey
ImmIsIME

tgear

CloseTdxIni
GetTDXProfileInt
OpenTdxIni
TestFileExist_Ex
GetYear1st
GetSeason1st
GetMonth1st
GetFriday
TimeToLong
RejustDateCtrlRange
AllTrim
TrimString
ParseMessageStr
LongToTime
AllTrimEx
ListCtrl2Txt
MD5_Buffer
tdx_filelength
TestFileExist
GetTdxPYStr
MD5_String
ClassXP
GetNetCardStr
BufToDouble
SoftKey_Switch
SoftKey_Close
SaveToBMPFile
UrlDecode
MakeBuildNo
DeleteMatchFile
GetFileMD5Str
IsRecentFile
CopyIt
Tdx_OutputDebugString
Base64Encode
RemoveReadOnlyStatus
AddLongTime_ExceptWeekend
TDXBeep
GetWeek
DeleteDirInfo
GetBackDate
GetCmdLine
FormatFloat_XS
IsValidFileName
SubLongTime
GetForwardDate
AddLongTime
GetTDXProfileString

tdxasiocomm

?MakeUserCommModule@@YAPAVVUserComm@@XZ
?DelUserCommModule@@YAXAAPAVVUserComm@@@Z

ribbonbar

?ReLoadUserCfg@@YAXJ@Z
?GetDataFromRibbonBarDLL@@YAXHPAK0PAXJ@Z
?SetKeyGuyFocusToRibbonBarDLL@@YAXPADJ@Z
?SetPathInfoToRibbonBarDLL@@YAXPBD00J@Z
?RegisterCallBackToRibbonBarDLL@@YAXP6GJPADFFPAXFUtag_NTime@@2EK@ZP6GJ0F0JFFK@ZP6GJH1H1AAHJ@Z@Z
?RibbonBarFunction@@YAHPAVVRibbonBar@@HIJ@Z
?OutLookBarFunction@@YAHPAVVOutLookBar@@HPBD@Z
?CreateOutLookBar@@YAPAVVOutLookBar@@PAUHWND__@@IIIIIPBD@Z
?CreateRibbonBar@@YAPAVVRibbonBar@@PAUHWND__@@IIIIIPBD@Z
?ExitRibbonBarDLL@@YAXXZ
?DeleteOutLookBar@@YAXAAPAVVOutLookBar@@@Z
?DeleteRibbonBar@@YAXAAPAVVRibbonBar@@@Z
?DeleteSControlBar@@YAXAAPAVVSControlBar@@@Z
?CreateSControlBar@@YAPAVVSControlBar@@PAUHWND__@@IIIIIPBD@Z

psapi

GetProcessImageFileNameA
EnumProcessModules
GetProcessMemoryInfo
GetModuleFileNameExA

ws2_32

htons
getaddrinfo

Exports

Exports

��j��rBiO��-y��\k��h!��e=N�Ij��M2��]>D+��`�s��CB�($ݎK>�%MJO��v�`�k��6t�j��՘*��?\��U��^�=��:!�#C�"*'boR��{4��Q˷mb��J��L�Y �v4��2�֬m� �@6��K@��(JV�l�}3F��5/Ű��_l�Q�E�s��ꐤ��<z��-_��'¢��X�]!n��h�6~�8e}�4F�zI��W�f�C�}�W��t+(��o'��=;�r��S��d96��߯w��C��F$[ �sM��)w^�̅)$� (��-�J��f��t�z4ڣ1��j�jX�}�UT�^@tt� �VOt�f:H6 ��g��d �O�~jݣ�N��TVKg��k �v��Q�ɔ��8��Y̅��0��q4<\��Ggb0<�۵�{a��f~6'�F&�~��U�� ;�?v�-��E�m�J�� [v�Q.&�7T��ӹ�O�h��Bt�S�)o*�ռ�Ŧ��@��z�|��N�nQ�M)��h6�V��Ư%��ˇ�hӰO��N�U��8B��:kw�[�2{3��2o��]�;�y$ސ_��8I�jm64�<X�h�`�q��' +|rZ��M�!O#;�,VA�0K��ϴG��Ye��@�'��M��B�8��8�<��?��P�&\�eo��k�͙D[�G�`�5��.�x��ʖ�i>D��R�#(��F��ۜ� oX��,�=j��˟�=O�"%#�JW h��1�p��_�b#Q!ϐ3�&�t/O8d�IY򧡶<À��ST��A��;\��E�Q�c-u��we��;;�Q��3v\=/�dWvK��z�D�D�\�6��7J��9a4v��@��6�%X�L��E��;v?L�!~�p�Pf�=kf��;Y[G�Nj�rk�Pf>Z��R�=F�I,�F�+"-��ʜ��fw�gw��h�PHV��~�d��9|�uWeˤ��׃�E<�P�`��e��Q��P��ޓd��d�t�c��}��':�e�;�a)p��I��ī��j�|-:Ԣh�R��^]�>��N��k7��[�`]�X�|��m 2�A�ӕS�_��x�S~+�rD-&�IL$*�4ΙO��}\��?&�pZ�L��zb��h(Us/�m*��}n��fGM9𩗖�� q��\�{��f�dʡ�ߪ2��qͿՌa~�1X��m��~��WGpmm��0�&� �LK��@Zꩺ��w�m��hrf�;,��u6`AM�|��ꈿ��w�^8�T4�J��ک� u(�Z5��֔��os�/�$2��(��Oi�U��E��8o`l׋U4��*�2Vxj;�o�'��\l�λ��gܭ��60�@l��~f��>^znAj84��"k�,��J�ڡ��m��̡��]:]=\�k�F��t,��m�* T�� .��'2�f��} -K��T��pd�׍�kdx�T�X[��RM��c��X��A��f��̜�J[� ��2��2��!�WJKP��<�%J��bѽF�E�J��]0�O��H��;�lw!%�9Gi�=�5��P��}'z�;�Tkgd�/�.�/�xv�~��o=�� e.$��[ބ��M "�:C H�C�ϏK��&q��CQ�LfC~��;�c��t��xHF�K�ѴC�u��Een�h�'�޻�u k�ꁀJ.�e�f]S�r�:�x,��i�~Z�=�l&Ք$&��.��'��Kb^�=J��>�a��;�`��6�Z��Sf�н[�u��b�tٗ淾KYv)��L�s�k�?f�A�g�P͌ ]֊4lY��L�V�hR!�Pu�o��\�� fdĳ��)S�l��žɩ �N��I��akK��%��8j¾�-��^��j|�S^�E%[#�儛G�o��L5r��`��?䫯Re$��-�1{��û ��_┻�( q��{��cH��D��Q�o.�m�c r��m��4a�t��ڋ��񏊶�DQ��x��t�s�t��xUnN��?��H$��f_ݤ�u銄�f $��pw��-J��NMwj��Z�ɜ��/�x�+~�uj��%�>��0��M�G�Z��M��~�^��X�p7��:?G�yV0<��@��,6��b�*9?��#�:�d�N��پ W�U��w�#�h�� ˼��5t��k� aGؔ3�ϡ��¯^�<��o�w��s��l7��L?孫F>�-�?�cڋy�y,"=�cq��*�I>GeT��t��A�B�/��Y%�Mc��h�e�� mq`��-J��p��/.�54�V��<"A�`m`��0�!Dٛ ��H�U�y,K#��e��7y��Q��$*4��貴�VO@G�2��cStJ�m��e��'��?�W~��N*L� ��7��J�`Y�K��ZNni+@^e�R��E��-�g�jib��L�;��ɽ �c�w��@��f\O��E��1�q��`��<ц��O�<��Y��<��Gs��V��D�ճG薴��@��H��6�`.��s�Xd7�:�i��a�Y�yH.��e�1��A1�)&@��ET�QgL��;��l�U��~�%D`~ohl��6π�LRVQ&o-��ϙ��;3pk6��6��.�Nl�*�~|�3o��d�p��:��sjf䖸CW�0I=J0A��c�)d�u�Nr��Z�Vu�,;Q��.��7P5!�=�)gj �j}LK��r�}�}�l��+�ْimTsOo�<��Ll��r��Y��|U/��!��

Sections

.text
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 974KB - Virtual size: 973KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 233KB - Virtual size: 7.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

26cc95f6ee7a785a6d193ed3fb9b75c7

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0d:ba:6d:5e:8a:52:ef:25:09:b1:a9:54:c2:7e:ac:e8Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

20:67:fc:13:9e:df:40:d1:db:60:22:eb:98:54:3a:aa:8a:59:e3:e1Signer

Headers

DLL Characteristics

File Characteristics

Imports

taisafe

tbeauty

tcalc

tcontrol

viewthem

invest

tmarquee

tjyaid

tqqcalc

tqqanaly

mfc100

msvcr100

kernel32

user32

gdi32

msimg32

advapi32

shell32

comctl32

ole32

oleaut32

gdiplus

wsock32

msvcp100

winmm

imm32

tgear

tdxasiocomm

ribbonbar

psapi

ws2_32

Exports

Exports

Sections

.text Size: 6.6MB - Virtual size: 6.6MB

.rdata Size: 974KB - Virtual size: 973KB

.data Size: 233KB - Virtual size: 7.0MB

.vmp0 Size: 1.8MB - Virtual size: 1.8MB

.vmp1 Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 3.1MB - Virtual size: 3.1MB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0d:ba:6d:5e:8a:52:ef:25:09:b1:a9:54:c2:7e:ac:e8
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

20:67:fc:13:9e:df:40:d1:db:60:22:eb:98:54:3a:aa:8a:59:e3:e1
Signer

.text
Size: 6.6MB - Virtual size: 6.6MB

.rdata
Size: 974KB - Virtual size: 973KB

.data
Size: 233KB - Virtual size: 7.0MB

.vmp0
Size: 1.8MB - Virtual size: 1.8MB

.vmp1
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 3.1MB - Virtual size: 3.1MB