48e9b3628ac2cb2e38a147cc860d29abf001f9690a84fa27da6402ef24e75be3

Sharing

Copy URL Twitter E-mail

General

Target

48e9b3628ac2cb2e38a147cc860d29abf001f9690a84fa27da6402ef24e75be3
Size

9.1MB
MD5

9450d25292c698d98b22c11b05040dd8
SHA1

a9b8672a506a9ea8c1a15068c5b2906f61aed739
SHA256

48e9b3628ac2cb2e38a147cc860d29abf001f9690a84fa27da6402ef24e75be3
SHA512

fa6bb40ae4b41539a658551a8587f99b4f958392363ee06a9f9b7b102f8b5eadea545f0afe3aef12e5cc510d03850682d81307c73fd1768a8b8b0cf066b630b0
SSDEEP

196608:txmTIG6mo1gNTlNPhsA64NeGPoUIthwXeuN4:txmT0mrTlPsE1xIDwZi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48e9b3628ac2cb2e38a147cc860d29abf001f9690a84fa27da6402ef24e75be3

Files

48e9b3628ac2cb2e38a147cc860d29abf001f9690a84fa27da6402ef24e75be3
.dll windows x86

58022d609ca06f3c4063dd455533f2e5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetPrivateProfileStringW
CloseHandle
CreateThread
WaitForSingleObject
GetModuleFileNameW
GetTickCount
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
GetACP
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
InitializeCriticalSection
GetFileAttributesExW
ConvertThreadToFiber
ConvertFiberToThread
FindFirstFileW
CreateFiber
DeleteFiber
SwitchToFiber
ReadConsoleA
SetConsoleMode
GetEnvironmentVariableW
LeaveCriticalSection
EnterCriticalSection
HeapFree
LoadLibraryExW
FreeLibrary
GetProcAddress
LoadLibraryW
OutputDebugStringW
WriteConsoleW
SetEndOfFile
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
SetConsoleCtrlHandler
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileSizeEx
GetConsoleCP
WriteFile
FlushFileBuffers
ReadConsoleW
GetConsoleMode
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
FormatMessageW
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
Sleep
SleepEx
GetTickCount64
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
VerSetConditionMask
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
VerifyVersionInfoA
GetSystemTime
SystemTimeToFileTime
RtlUnwind
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
CreateFileW

user32

GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW

utilities

?GetDataMd5@NanAoMd5@@YAXPBEHQAE@Z
?Md5ToString@NanAoMd5@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE@Z
?SystemTimeToTimet@BasicsTime@@YA_JAAU_SYSTEMTIME@@@Z
?Gb2312ToUnicode@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?UnicodeToGB2312@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?SplitW@BasicsString@@YAXPA_W0AAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@_N@Z
?Gb2312ToUnicode@BasicsString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PBD@Z
?UnicodeToUTF8@BasicsString@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W@Z
?UTF8ToUnicode@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?StrHasChina@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?StringToMd5@NanAoMd5@@YA_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAE@Z
?UTF8ToGb2312@BasicsString@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z
?GetLowerStringW@BasicsString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V23@@Z
?GetLocalConfigIniPathW@BasicsForIni@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?GetIntFromIniW@BasicsForIni@@YAHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0H0@Z
?GetErrLevel@@YAIXZ
?GetUseAddr@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@0@Z
?GetSoftUrl@@YA_NAAV?$vector@USUrlInfo@@V?$allocator@USUrlInfo@@@std@@@std@@@Z
?WriteLogFunction@@YAXHPB_WH0ZZ
?UnicodeToUtf8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?GetOssPath@@YA_NW4OssPathTypeENUM@@AAUSOssPathInfo@@@Z
?WriteData@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@0@Z
?UTF8ToUnicode@BasicsString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PBD@Z
?GetOssServer@@YA_NAAUSOssInfo@@@Z
?GetProcIdByProcName@BasicsProcess@@YAKV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?ReadData@@YA_NPBEHPAEAAH0H@Z
?GetMachineCode@BasicsSystem@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?Base64Decode@NanAoBase64@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAEAAH@Z
?GetFileNameW@BasicsFile@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_W@Z

shlwapi

PathFileExistsW
PathRemoveFileSpecW

ws2_32

sendto
htons
recvfrom
socket
WSAStartup
inet_pton
closesocket
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
recv
send
bind
connect
getpeername
getsockname
getsockopt
ntohs
WSAIoctl
getaddrinfo
freeaddrinfo
accept
listen
ioctlsocket
gethostname
WSACleanup
shutdown
getnameinfo
setsockopt

urlmon

URLDownloadToFileW

wininet

DeleteUrlCacheEntryW

wldap32

ord41
ord143
ord211
ord60
ord50
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord46

crypt32

CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

bcrypt

BCryptGenRandom

advapi32

CryptDestroyKey
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptSetHashParam
CryptGetProvParam

Exports

Exports

??0CMarkup@@QAE@ABV0@@Z
??0CMarkup@@QAE@H@Z
??0CMarkup@@QAE@UMCD_CSTR@@@Z
??0CMarkup@@QAE@XZ
??0MCD_CSTR@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0MCD_CSTR@@QAE@PBD@Z
??0MCD_CSTR@@QAE@XZ
??1CMarkup@@QAE@XZ
??4CMarkup@@QAEXABV0@@Z
??4MCD_CSTR@@QAEAAU0@$$QAU0@@Z
??4MCD_CSTR@@QAEAAU0@ABU0@@Z
??BMCD_CSTR@@QBEPBDXZ
?AToUTF8@CMarkup@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UMCD_CSTR@@@Z
?AddAttrib@CMarkup@@QAE_NUMCD_CSTR@@0@Z
?AddAttrib@CMarkup@@QAE_NUMCD_CSTR@@H@Z
?AddChildAttrib@CMarkup@@QAE_NUMCD_CSTR@@0@Z
?AddChildAttrib@CMarkup@@QAE_NUMCD_CSTR@@H@Z
?AddChildElem@CMarkup@@QAE_NUMCD_CSTR@@0H@Z
?AddChildElem@CMarkup@@QAE_NUMCD_CSTR@@HH@Z
?AddChildSubDoc@CMarkup@@QAE_NUMCD_CSTR@@@Z
?AddElem@CMarkup@@QAE_NUMCD_CSTR@@0H@Z
?AddElem@CMarkup@@QAE_NUMCD_CSTR@@HH@Z
?AddNode@CMarkup@@QAE_NHUMCD_CSTR@@@Z
?AddSubDoc@CMarkup@@QAE_NUMCD_CSTR@@@Z
?CloseAllUdpThread@@YAXXZ
?CurlPostDataWithSign@@YA?AW4HTTPRETDATAENUM@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV23@V?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@1H0@Z
?DecodeCharUTF16@CMarkup@@SAHAAPBGPBG@Z
?DecodeCharUTF8@CMarkup@@SAHAAPBDPBD@Z
?DetectUTF8@CMarkup@@SA_NPBDHPAHPA_N@Z
?DownFromHttpData@CHttpDownloadFunc@@QAEJV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AAKH@Z
?EncodeCharUTF16@CMarkup@@SAXHPAGAAH@Z
?EncodeCharUTF8@CMarkup@@SAXHPADAAH@Z
?EscapeText@CMarkup@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UMCD_CSTR@@H@Z
?FindChildElem@CMarkup@@QAE_NUMCD_CSTR@@@Z
?FindElem@CMarkup@@QAE_NUMCD_CSTR@@@Z
?FindNode@CMarkup@@QAEHH@Z
?GetAlyInstance@@YAPAVAlyFunction@@XZ
?GetAttrib@CMarkup@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UMCD_CSTR@@@Z
?GetAttribName@CMarkup@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?GetCFTierData@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AAV?$vector@USMapRecResult@@V?$allocator@USMapRecResult@@@std@@@2@@Z
?GetChildAttrib@CMarkup@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UMCD_CSTR@@@Z
?GetChildData@CMarkup@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetChildSubDoc@CMarkup@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetChildTagName@CMarkup@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetData@CMarkup@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetDeclaredEncoding@CMarkup@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UMCD_CSTR@@@Z
?GetDoc@CMarkup@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetDocFlags@CMarkup@@QBEHXZ
?GetElemContent@CMarkup@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetEncodingCodePage@CMarkup@@SAHUMCD_CSTR@@@Z
?GetError@CMarkup@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetLolTierData@@YA_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H0AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?GetNodeType@CMarkup@@QAEHXZ
?GetNthAttrib@CMarkup@@QBE_NHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?GetPubgRunTimeHtmlContent@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@Z
?GetResult@CMarkup@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetSteamVacHtmlContent@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@Z
?GetSubDoc@CMarkup@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetTagName@CMarkup@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetWegameBanInf@@YA_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@USWegameBanInf@@V?$allocator@USWegameBanInf@@@std@@@2@@Z
?HttpCanUseIpProxyInLogin@@YA_NW4EProxyType@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?HttpClientActionConfig@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AAUSClientActionConfig@@@Z
?HttpDepandFileNeedUpload@@YA_NQBEAAHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?HttpGetAddScreenShot@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00@Z
?HttpGetClientInf@@YA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?HttpGetCloseSHQ@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?HttpGetData@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@H@Z
?HttpGetGameModuleInf@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$vector@USGameBlackModuleInf@@V?$allocator@USGameBlackModuleInf@@@std@@@2@AAV?$vector@USGameNormalModuleInf@@V?$allocator@USGameNormalModuleInf@@@std@@@2@AAV?$vector@USGameWhiteModuleInf@@V?$allocator@USGameWhiteModuleInf@@@std@@@2@@Z
?HttpGetGamePlugInfo@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00AAUSGamePlugInfo@@AAUSoftConfig@@@Z
?HttpGetGameZoneInf@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$vector@USGameZoneInf@@V?$allocator@USGameZoneInf@@@std@@@2@@Z
?HttpGetInfForBlacklist@@YA?AW4HttpLoginState@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@HAAV23@1@Z
?HttpGetLoginCount@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0000AAH1@Z
?HttpGetOrder@@YA?AW4HttpLoginState@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@000H_N11AAUOrderInfo@@@Z
?HttpGetOrderForHaoYou@@YA?AW4HttpLoginState@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0_N00AAHAAV23@@Z
?HttpGetPunish@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AAV12@@Z
?HttpGetSoftUpdateInfo@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AAV12@1@Z
?HttpGetUserLogin@@YAHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0_NAAV?$vector@UUserCodeInfo@@V?$allocator@UUserCodeInfo@@@std@@@2@@Z
?HttpGetWhiteList@@YAHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAUNewWhiteListInfoVec@@@Z
?HttpPostAddHijackBlankForTools@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00AAV12@@Z
?HttpPostData@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@H@Z
?HttpPostDriverMajorInf@@YA_NAAUSPostDriverMajorInfEx@@@Z
?HttpPostGameLoginResult@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?HttpPostGameTierInf@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@000@Z
?HttpPostGetOrderInfo@@YA_NHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@000AA_N@Z
?HttpPostInfoForBlacklist@@YA_NHUInfoForBlacklist@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?HttpPostIpProxyInfInLogin@@YA_NW4EProxyType@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4EIpProxyResultType@@1@Z
?HttpPostJsonData@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@H@Z
?HttpPostLoginInfo@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H00@Z
?HttpPostLoginStatusForHaoYou@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00HHH@Z
?HttpPostNormalGameModuleInf@@YA_NUSPostGameModuleInf@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?HttpPostScreenShotInfo@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00_N@Z
?HttpPostShqOpeTypeInfo@@YA_NW4SHQOPETYPTEENUM@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@1H1@Z
?HttpPostShqOpeTypeInfo@@YA_NW4SHQOPETYPTEENUM@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H1@Z
?HttpPostStartGameState@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H@Z
?HttpPostSteamAccountStatus@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4EAccountStatusType@@00000@Z
?HttpPostTQBlack@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?HttpPostUserInf@@YA_NHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?HttpPostWarningGameModuleInf@@YA_NUSPostGameModuleInf@@@Z
?HttpRefundBooster@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?HttpSendComplaint@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H00AAV12@@Z
?HttpSendFileUploadInfo@@YA_NABUUploadFileInfo@@@Z
?HttpSendGameTime@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H@Z
?HttpSendLoginInfo@@YA_NULoginInfo@@@Z
?HttpSendOpenPlug@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0000HHH000_N@Z
?HttpSendProcEndInfo@@YA_NUProcEndInfo@@@Z
?HttpSendProcInitInfo@@YA_NABV?$vector@UProcInitInfo@@V?$allocator@UProcInitInfo@@@std@@@std@@@Z
?IncludeChinese@CHttpDownloadFunc@@QAEHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?InsertChildElem@CMarkup@@QAE_NUMCD_CSTR@@0H@Z
?InsertChildElem@CMarkup@@QAE_NUMCD_CSTR@@HH@Z
?InsertChildSubDoc@CMarkup@@QAE_NUMCD_CSTR@@@Z
?InsertElem@CMarkup@@QAE_NUMCD_CSTR@@0H@Z
?InsertElem@CMarkup@@QAE_NUMCD_CSTR@@HH@Z
?InsertNode@CMarkup@@QAE_NHUMCD_CSTR@@@Z
?InsertSubDoc@CMarkup@@QAE_NUMCD_CSTR@@@Z
?IntoElem@CMarkup@@QAE_NXZ
?IsWellFormed@CMarkup@@QAE_NXZ
?Load@CMarkup@@QAE_NUMCD_CSTR@@@Z
?OutOfElem@CMarkup@@QAE_NXZ
?ReadTextFile@CMarkup@@SA_NUMCD_CSTR@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAV34@PAH2@Z
?RegisterUdpCallBackFun@@YAHEV?$function@$$A6A_NPAX@Z@std@@_N@Z
?RemoveChildElem@CMarkup@@QAE_NXZ
?RemoveElem@CMarkup@@QAE_NXZ
?RemoveNode@CMarkup@@QAE_NXZ
?ResetChildPos@CMarkup@@QAEXXZ
?ResetMainPos@CMarkup@@QAEXXZ
?ResetPos@CMarkup@@QAEXXZ
?RestorePos@CMarkup@@QAE_NUMCD_CSTR@@H@Z
?Save@CMarkup@@QAE_NUMCD_CSTR@@@Z
?SavePos@CMarkup@@QAE_NUMCD_CSTR@@H@Z
?SendUdpData@@YAHPBDG0K@Z
?SetAttrib@CMarkup@@QAE_NUMCD_CSTR@@0H@Z
?SetAttrib@CMarkup@@QAE_NUMCD_CSTR@@HH@Z
?SetBattleLanguage@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AAV12@@Z
?SetChildAttrib@CMarkup@@QAE_NUMCD_CSTR@@0H@Z
?SetChildAttrib@CMarkup@@QAE_NUMCD_CSTR@@HH@Z
?SetChildData@CMarkup@@QAE_NH@Z
?SetChildData@CMarkup@@QAE_NUMCD_CSTR@@H@Z
?SetData@CMarkup@@QAE_NH@Z
?SetData@CMarkup@@QAE_NUMCD_CSTR@@H@Z
?SetDoc@CMarkup@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetDoc@CMarkup@@QAE_NPBD@Z
?SetDocFlags@CMarkup@@QAEXH@Z
?SetElemContent@CMarkup@@QAE_NUMCD_CSTR@@@Z
?SetMapSize@CMarkup@@QAE_NHH@Z
?UTF16To8@CMarkup@@SAHPADPBGH@Z
?UTF8To16@CMarkup@@SAHPAGPBDH@Z
?UTF8ToA@CMarkup@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UMCD_CSTR@@PAH@Z
?UdpCleanFd@@YAXPBDG@Z
?UnescapeText@CMarkup@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UMCD_CSTR@@HH@Z
?WriteTextFile@CMarkup@@SA_NUMCD_CSTR@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAV34@PAH2@Z
?__autoclassinit2@CMarkup@@QAEXI@Z
?x_AddElem@CMarkup@@IAE_NPBD0H@Z
?x_AddElem@CMarkup@@IAE_NPBDHH@Z
?x_AddNode@CMarkup@@IAE_NHPBDH@Z
?x_AddSubDoc@CMarkup@@IAE_NPBDH@Z
?x_Adjust@CMarkup@@IAEXHH_N@Z
?x_AdjustForNode@CMarkup@@IAEXHHH@Z
?x_AllocElemPos@CMarkup@@IAE_NH@Z
?x_CheckSavedPos@CMarkup@@IAEXXZ
?x_CreateNode@CMarkup@@KA_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HPBD@Z
?x_DocChange@CMarkup@@IAEXHHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?x_EncodeCDATASection@CMarkup@@KA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z
?x_FindElem@CMarkup@@IBEHHHAAUPathPos@@@Z
?x_GetAttrib@CMarkup@@IBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HPBD@Z
?x_GetData@CMarkup@@IAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?x_GetElemContent@CMarkup@@IBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?x_GetFreePos@CMarkup@@IAEHXZ
?x_GetParent@CMarkup@@IAEHH@Z
?x_GetPath@CMarkup@@IBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?x_GetSubDoc@CMarkup@@IAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?x_GetTagName@CMarkup@@IBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?x_InitMarkup@CMarkup@@IAEXXZ
?x_InsertNew@CMarkup@@IAEHHAAHAAUNodePos@@@Z
?x_LinkElem@CMarkup@@IAEXHHH@Z
?x_ParseDoc@CMarkup@@IAE_NXZ
?x_ParseElem@CMarkup@@IAEHHAAUTokenPos@@@Z
?x_ReleasePos@CMarkup@@IAEHH@Z
?x_ReleaseSubDoc@CMarkup@@IAEHH@Z
?x_RemoveElem@CMarkup@@IAEHH@Z
?x_RemoveNode@CMarkup@@IAEXHAAH000@Z
?x_SetAttrib@CMarkup@@IAE_NHPBD0H@Z
?x_SetAttrib@CMarkup@@IAE_NHPBDHH@Z
?x_SetData@CMarkup@@IAE_NHH@Z
?x_SetData@CMarkup@@IAE_NHPBDH@Z
?x_SetElemContent@CMarkup@@IAE_NPBD@Z
?x_SetPos@CMarkup@@IAEXHHH@Z
?x_UnlinkElem@CMarkup@@IAEHH@Z
?x_UnlinkPrevElem@CMarkup@@IAEHHHH@Z

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 584KB - Virtual size: 584KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.GGZuhao
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.GGZuhao
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

58022d609ca06f3c4063dd455533f2e5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

utilities

shlwapi

ws2_32

urlmon

wininet

wldap32

crypt32

bcrypt

advapi32

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 584KB - Virtual size: 584KB

.data Size: 36KB - Virtual size: 36KB

.GGZuhao Size: 2.2MB - Virtual size: 2.2MB

.GGZuhao Size: 4.3MB - Virtual size: 4.3MB

.reloc Size: 36KB - Virtual size: 36KB

.rsrc Size: 1KB - Virtual size: 1KB

.l1 Size: 11KB - Virtual size: 11KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 584KB - Virtual size: 584KB

.data
Size: 36KB - Virtual size: 36KB

.GGZuhao
Size: 2.2MB - Virtual size: 2.2MB

.GGZuhao
Size: 4.3MB - Virtual size: 4.3MB

.reloc
Size: 36KB - Virtual size: 36KB

.rsrc
Size: 1KB - Virtual size: 1KB

.l1
Size: 11KB - Virtual size: 11KB