DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
a2c228ec18e58a3c2e22fb433d150543f0ece3448ba2f330c7f7322ebba2c8a3.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
a2c228ec18e58a3c2e22fb433d150543f0ece3448ba2f330c7f7322ebba2c8a3.exe
Resource
win10v2004-20230915-en
Target
a2c228ec18e58a3c2e22fb433d150543f0ece3448ba2f330c7f7322ebba2c8a3
Size
410KB
MD5
60e267bb609eaceb12b6e845a44cf5c6
SHA1
61da5fc9f8a9ec9e711840a32738d41da844f194
SHA256
a2c228ec18e58a3c2e22fb433d150543f0ece3448ba2f330c7f7322ebba2c8a3
SHA512
cc33c0bb836ae8eee95e06e729c3fad492a21a22dcb1b0612c0e06653c590ef39c20311d649afc204027e130670c54e1a481d8798fb98c4a2993d5f74f9f681d
SSDEEP
12288:JDhYJbfYYSq/Z44SHe777777777777777777WIP4i8sAVJs:JmtfYYSq/Z4THMRATs
Checks for missing Authenticode signature.
resource |
---|
a2c228ec18e58a3c2e22fb433d150543f0ece3448ba2f330c7f7322ebba2c8a3 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
??4CTXStringW@@QAEAAV0@ABV0@@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
?Format@CTXStringW@@QAAXPB_WZZ
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?ReleaseBuffer@CTXStringW@@QAEXH@Z
?IsEmpty@CTXStringW@@QBE_NXZ
?ReverseFind@CTXStringW@@QBEH_W@Z
?Left@CTXStringW@@QBE?AV1@H@Z
?GetBSTR@CTXStringW@@QBEPA_WXZ
??BCTXStringW@@QBEPB_WXZ
??0CTXBSTR@@QAE@XZ
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
??1CTXBSTR@@QAE@XZ
??BCTXBSTR@@QBEPA_WXZ
??ICTXBSTR@@QAEPAPA_WXZ
?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
?TXLoadString@@YAPB_WPB_W0@Z
??0CTXStringW@@QAE@PA_W@Z
??4CTXStringW@@QAEAAV0@PA_W@Z
??0CTXBSTR@@QAE@PB_W@Z
??0CTXStringW@@QAE@H@Z
??0CTXStringW@@QAE@PB_WH@Z
??0CTXStringW@@QAE@UtagGBK@@PBDH@Z
??YCTXStringW@@QAEAAV0@ABV0@@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
??YCTXStringW@@QAEAAV0@_W@Z
??H@YA?AVCTXStringW@@PB_WABV0@@Z
??9@YA_NABVCTXStringW@@0@Z
?GetString@CTXStringW@@QBEPB_WXZ
?GetLength@CTXStringW@@QBEHXZ
??ACTXStringW@@QBE_WH@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
?Delete@CTXStringW@@QAEHHH@Z
?Empty@CTXStringW@@QAEXXZ
?Replace@CTXStringW@@QAEH_W0@Z
?Replace@CTXStringW@@QAEHPB_W0@Z
?Find@CTXStringW@@QBEH_WH@Z
?Find@CTXStringW@@QBEHPB_WH@Z
?MakeLower@CTXStringW@@QAEAAV1@XZ
?Mid@CTXStringW@@QBE?AV1@H@Z
?Mid@CTXStringW@@QBE?AV1@HH@Z
?Right@CTXStringW@@QBE?AV1@H@Z
ord33
ord34
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
?Md5HashBuffer@@YAXPAEPBXK@Z
??0CTXStringA@@QAE@UtagGBK@@PB_WH@Z
??BCTXStringA@@QBEPBDXZ
??4CTXStringW@@QAEAAV0@PB_W@Z
??8@YA_NABVCTXStringW@@PB_W@Z
??8@YA_NABVCTXStringW@@0@Z
?GetBuffer@CTXStringW@@QAEPA_WXZ
?AllocSysString@CTXStringW@@QBEPA_WXZ
??4CTXBSTR@@QAEAAV0@ABV0@@Z
??4CTXBSTR@@QAEAAV0@PB_W@Z
?Length@CTXBSTR@@QBEIXZ
?Empty@CTXBSTR@@QAEXXZ
ord26
?oi_symmetry_encrypt2_len@@YAHH@Z
?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z
?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z
??0CTXStringW@@QAE@ABVCTXBSTR@@@Z
??9@YA_NABVCTXStringW@@_W@Z
?GetTickCount@CTXTime@@SA?AV1@XZ
?Format@CTXTime@@QBE?AVCTXStringW@@PB_W@Z
?OnUninitCom@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?OnExitCoreCenter@Misc@Util@@YAXXZ
?ClearDeadQueue@Misc@Util@@YAXXZ
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
DetourFunctionWrapper
??0CSafeHook@Misc@Util@@QAE@AAV?$vector@PAXV?$allocator@PAX@std@@@std@@@Z
??1CSafeHook@Misc@Util@@QAE@XZ
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
?CheckVistaAndStartSelfMediumLevel@Sys@Util@@YAHXZ
?InitPlatformFileSystem@Boot@Util@@YAHXZ
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?InitPlatformModeConfig@Boot@Util@@YAHXZ
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z
?CreateTXArray@Data@Util@@YAHPAPAUITXArray@@@Z
?InitNetwork@Network@Util@@YAHXZ
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?GetCore@CoreCenter@Util@@YAHPA_WPAPAUITXCore@@@Z
?GetPlatformCore@CoreCenter@Util@@YAHPAPAUITXPlatformCore@@@Z
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
?AddFileSystem@FS@@YAJW4FILESYSTEM_TYPE@@PB_W1HHH@Z
?EnumDirectory@FS@@YAHPB_WPAPAUITXEnumDirectory@@@Z
?CreateFileW@FS@@YAHPB_WKPAPAUITXFile@@@Z
?DeleteFileW@FS@@YAHPB_W@Z
?IsFileSystemExist@FS@@YAHPB_W@Z
?IsDirectoryExist@FS@@YAHPB_W@Z
?CombineQNC@FS@@YA?AVCTXStringW@@PB_W0@Z
?GetParentDir@File@Util@@YA?AVCTXStringW@@ABV3@@Z
?GetTencentRootName@ProductConfig@Util@@YAHAAVCTXStringW@@@Z
?GetTencentProductName@ProductConfig@Util@@YAHAAVCTXStringW@@@Z
?OpenUrlWithTT@UrlBase@Util@@YAHABVCTXStringW@@@Z
??0CTXStringW@@QAE@ABV0@@Z
??0CTXStringW@@QAE@PB_W@Z
??M@YA_NABVCTXStringW@@0@Z
??0CTXStringW@@QAE@XZ
??1CTXStringW@@QAE@XZ
?Format@CTXStringA@@QAAXPBDZZ
??M@YA_NABVCTXStringA@@0@Z
??1CTXStringA@@QAE@XZ
??4CTXStringW@@QAEAAV0@ABVCTXBSTR@@@Z
??0CTXStringA@@QAE@XZ
?ScaleRECT@DPI@GF@Util@@YAXPAUtagRECT@@@Z
?SetCustomObjectFactory@GF@Util@@YAXP6AHABU_GUID@@0PAPAX@Z@Z
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@PAUITXCore@@H@Z
?CreateBitmapFromFile@GF@Util@@YAPAUHGBITMAP__@@ABVCTXStringW@@_N1@Z
ReleaseBitmap
DeleteBitmap
CanvasToTexture
DrawBitmap
DrawCircle
SetColor
GetBitmap
SetCanvasFilter
DeleteCanvas
CreateCanvas
DecodePointer
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetModuleFileNameW
GetProcAddress
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetPrivateProfileIntW
QueryPerformanceCounter
ReleaseMutex
IsProcessorFeaturePresent
GetFileSizeEx
WriteFile
ReadFile
SetEndOfFile
CloseHandle
WinExec
CreateMutexW
CreateProcessW
RemoveDirectoryW
CreateFileW
DeleteFileW
GetProcessTimes
OpenProcess
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
SetUnhandledExceptionFilter
ReleaseSemaphore
GetSystemTime
FileTimeToSystemTime
CreateSemaphoreW
OutputDebugStringW
CreateDirectoryW
GetFileAttributesW
GetVersionExW
EncodePointer
Sleep
GetThreadLocale
SetThreadLocale
GetStartupInfoW
UnhandledExceptionFilter
WaitForSingleObject
IsDebuggerPresent
InitializeSListHead
SetForegroundWindow
IsIconic
ShowWindow
PostMessageW
UnregisterClassW
IsWindow
SendMessageW
CharNextW
CreateWindowExW
RegisterClassExW
DefWindowProcW
GetWindow
GetDesktopWindow
GetPropW
GetStockObject
RegDeleteKeyW
RegSetValueExW
RegSetValueW
RegOpenKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
ShellExecuteExW
SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ShellExecuteW
SHGetMalloc
StringFromGUID2
CoCreateInstance
CoInitialize
VariantCopy
VariantClear
VariantInit
SysAllocString
LoadRegTypeLi
LoadTypeLi
SysStringLen
SysFreeString
RegisterTypeLi
UnRegisterTypeLi
?_Xlength_error@std@@YAXPBD@Z
PathRemoveFileSpecW
SHDeleteKeyW
PathFileExistsW
GetProcessImageFileNameW
__std_exception_copy
_except_handler4_common
memcpy
__CxxFrameHandler3
_CxxThrowException
memset
memmove
memcmp
_purecall
__std_type_info_destroy_list
__std_exception_destroy
terminate
_controlfp_s
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_invalid_parameter_noinfo_noreturn
__p___argc
__p___wargv
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_invalid_parameter_noinfo
_errno
exit
_set_app_type
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_seh_filter_exe
free
_callnewh
_set_new_mode
realloc
_recalloc
malloc
wcsncmp
wcscat_s
wcscpy_s
wcsncpy_s
wcsncpy
wcslen
_wtol
__p__commode
_set_fmode
__stdio_common_vsnwprintf_s
_flushall
_time64
__setusermatherr
_configthreadlocale
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE