281a6348b779fd453004e41aca28bdb1a1cdb1c4de65f620cc66f7216be9dbc3

Sharing

Copy URL Twitter E-mail

General

Target

281a6348b779fd453004e41aca28bdb1a1cdb1c4de65f620cc66f7216be9dbc3
Size

716KB
MD5

7ffdf02c609b23c919557cb02a1e6fa0
SHA1

7bc80bfbd738fe60ab9a17af4f6b1918d073bd82
SHA256

281a6348b779fd453004e41aca28bdb1a1cdb1c4de65f620cc66f7216be9dbc3
SHA512

b9a9d77c6ede7972bdf5397947096f3807c97b8bad08197e980945803058414a4faf25b7119c7b3349fb28030a84ce20ec84cfbf0b99a28c90c0736705cbc97b
SSDEEP

12288:I6ocUBCUKzbxZC1enuxidx6IkmA0dMKysuTGffLcUBCUKzbxZC1enuxidx6IkmA6:I6oc8nKX3C13xi2qA0iBsuyTc8nKX3CW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
281a6348b779fd453004e41aca28bdb1a1cdb1c4de65f620cc66f7216be9dbc3

Files

281a6348b779fd453004e41aca28bdb1a1cdb1c4de65f620cc66f7216be9dbc3
.exe windows:5 windows x86

b3ad991cc2230dd5accb8d7cf70bc1c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

king

?ShowWindow@CWindowUI@@UAE_NPAVWindowAnimation@@@Z
?PreMessageHandler@CWindowUI@@UAE_NQAUtagMSG@@AAJ@Z
?GetWindowClassName@CWindowBase@@UAEPB_WXZ
?GetClassStyle@CWindowBase@@UAEIXZ
?OnInactiveApp@CWindowBase@@UAEXXZ
?OnQueryEndSession@CWindowBase@@UAE_NXZ
?SetAttribute@CWindowUI@@UAEXPB_W0@Z
?GetItem@CWindowUI@@QAEPAVCControlUI@@PB_W@Z
?GetHWND@CWindowBase@@QAEPAUHWND__@@XZ
?OnCreate@CWindowUI@@UAEXXZ
GetUIEngine
?SetFocusWnd@CWindowUI@@UAEXPAUHWND__@@@Z
?UIMessageBox@@YAIPAUHWND__@@PB_W11W4_tagMessageBoxType@CMessageBoxUI@@I1HH@Z
?OnClose@CWindowBase@@UAEXXZ
I18NSTR
?SetTitle@CWindowUI@@QAEXPB_W@Z
?Create@CWindowUI@@QAEXPAUHWND__@@PB_WHHHH@Z
?SetWindowClassName@CWindowBase@@UAEXPB_W@Z
??1INotifyUI@@UAE@XZ
??0INotifyUI@@QAE@XZ
??1CWindowUI@@UAE@XZ
??0CWindowUI@@QAE@XZ
GetUIRes
?OnOk@CWindowUI@@UAEXXZ
?OnCancel@CWindowUI@@UAEXXZ
?OnMinimize@CWindowUI@@UAEXXZ
?OnMaximize@CWindowUI@@UAEXXZ
?OnRestored@CWindowUI@@UAEXXZ
?OnWindowInit@CWindowUI@@UAEXXZ
?OnLanguageChange@CWindowUI@@UAEXXZ
?OnSkinChange@CWindowUI@@UAEX_N@Z
?Notify@CWindowUI@@UAEXPAUtagTNotifyUI@@@Z
?PostDeviceInfo@CWindowUI@@UAEXXZ
?CloseAllChildWindows@CWindowUI@@UAEXXZ
?OnShowFristSide@CWindowUI@@UAEXXZ
?OnShowSecondSide@CWindowUI@@UAEXXZ
?EnableIME@CWindowUI@@UAEXXZ
?DisableIME@CWindowUI@@UAEXXZ
?OnActiveApp@CWindowUI@@MAEXIIJ@Z
?SetAutoDel@CWindowBase@@QAEX_N@Z
?CenterWindow@CWindowUI@@QAEXPAUHWND__@@@Z
?ShowWindow@CWindowUI@@QAE_NH@Z
?WindowProc@CWindowUI@@UAEJIIJ@Z

common

?IsFileExist@CFileOperation@@SA_NPB_W@Z
?GetCurrWorkingDir@CFileOperation@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?InitExceptionHandler@@YAXXZ
?getSingleton@?$CSingleton@VCCommonManager@@@@SAAAVCCommonManager@@XZ
?getSingletonPtr@?$CSingleton@VCCommonManager@@@@SAPAVCCommonManager@@XZ
??1CCommonManager@@QAE@XZ
?Init@CCommonManager@@QAEXXZ
??0CCommonManager@@QAE@XZ
?ExceptionLogSave@base@@YA_NPB_WZZ
?UnhandledExceptionDump@base@@YGJPAU_EXCEPTION_POINTERS@@@Z
?DumpFuncAddress@base@@YAPAEHPA_WPAU_EXCEPTION_POINTERS@@@Z
?IsDirExist@CFileOperation@@SA_NPB_W@Z

farmwork

?Detach@CMessageCenter@@QAEXPAVIHandler@@@Z
?Attach@CMessageCenter@@QAEXPAVIHandler@@@Z
?GetSystemExitFlag@CSystemExistEvent@@QAE_NXZ
?RecordHandle@CMessageCenter@@QBEXPAVIHandler@@PBVIMessage@@@Z
?GetData@CMessageCenter@@QAEXPAVIMessage@@@Z
?GetGUID@CSystemThreadManager@@QAEHXZ
?GetFileVersion@CConfig@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?Send@CMessageCenter@@QAE_NPBVIMessage@@@Z
?End@CMessageCenter@@QAEXPBVIMessage@@@Z
?Begin@CMessageCenter@@QAEXPBVIMessage@@@Z
?getSingleton@?$CSingleton@VCSystemThreadManager@@@@SAAAVCSystemThreadManager@@XZ
??_7IAvailable@@6B@
?getSingleton@?$CSingleton@VCModuleManager@@@@SAAAVCModuleManager@@XZ
?getSingleton@?$CSingleton@VCConfig@@@@SAAAVCConfig@@XZ
?SaveConfig@CConfig@@QAEXXZ
??_7IHandler@@6B0@@
?GetModuleName@CModuleManager@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4ModuleType@@@Z
?GetLanguage@CConfig@@QAE?AW4Language@@XZ
?getSingleton@?$CSingleton@VCFarmworkManager@@@@SAAAVCFarmworkManager@@XZ
?getSingletonPtr@?$CSingleton@VCFarmworkManager@@@@SAPAVCFarmworkManager@@XZ
?Init@CFarmworkManager@@QAEXXZ
??1CFarmworkManager@@QAE@XZ
?DestroySystemThreadManager@CFarmworkManager@@QAEXXZ
??0CFarmworkManager@@QAE@XZ
?getSingleton@?$CSingleton@VCSystemExistEvent@@@@SAAAVCSystemExistEvent@@XZ
?getSingleton@?$CSingleton@VCMessageCenter@@@@SAAAVCMessageCenter@@XZ
?IsAsync@IHandler@@UAE_NXZ
?Available@IAvailable@@UAE_NXZ
?AddStaticModule@CModuleManager@@QAEHW4ModuleType@@PAVBaseModule@@AAUAddModuleArgs@@@Z
??_7IHandler@@6BIAvailable@@@
?ExistSystem@CSystemExistEvent@@QAEXXZ

duicontrol

?InitDuiControl@@YAXXZ

kernel32

InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
EncodePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DecodePointer
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
CloseHandle
CreateMutexW
GetLastError
Sleep

user32

FindWindowW
PostQuitMessage
PostMessageW
SendMessageW
ShowWindow
SwitchToThisWindow

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

msvcr100

__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_crt_debugger_hook
_amsg_exit
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_invoke_watson
_controlfp_s
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
??3@YAXPAX@Z
??2@YAPAXI@Z
?raw_name@type_info@@QBEPBDXZ
_purecall
memmove
memset
__CxxFrameHandler3
__RTDynamicCast
memcpy
_CxxThrowException

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 682KB - Virtual size: 682KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b3ad991cc2230dd5accb8d7cf70bc1c3

Headers

DLL Characteristics

File Characteristics

Imports

king

common

farmwork

duicontrol

kernel32

user32

msvcp100

msvcr100

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 682KB - Virtual size: 682KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 682KB - Virtual size: 682KB

.reloc
Size: 4KB - Virtual size: 4KB