0cfaf0304764de72ccdf0f4e88e891f31fb148dc3230ae8f9333c50634fa17d1

Sharing

Copy URL Twitter E-mail

General

Target

0cfaf0304764de72ccdf0f4e88e891f31fb148dc3230ae8f9333c50634fa17d1
Size

483KB
MD5

5580f65facef28ec7ebc3ecf09f01f62
SHA1

8993c3d238aa22c8cd8832fc8e94ba7f45950014
SHA256

0cfaf0304764de72ccdf0f4e88e891f31fb148dc3230ae8f9333c50634fa17d1
SHA512

505cf5c3fe845a54897f3f9717e9e408c5ea9b5224e6539d6500262923e59bde3702bce60b9fc06c35b6957c16d6328183b2389ff0d75d39c6411fc923cfd065
SSDEEP

12288:3L8U5WmwVV1UxrulxAyOGE/g0FjcARxGBtG6U4SF:bqV1Uxm2GE/g09cuEBMHF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MouseInc.exe

Files

0cfaf0304764de72ccdf0f4e88e891f31fb148dc3230ae8f9333c50634fa17d1
.zip
MouseInc.exe
.exe windows:6 windows x86

2ecdb9637b85c4990416c47f878d603b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipAddPathArcI
GdipGetImageEncoders
GdipGetImageHeight
GdipDeleteFontFamily
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromStream
GdipCreateFontFamilyFromName
GdipDrawImageRectRect
GdipCloneImage
GdipSetCustomLineCapBaseCap
GdipSetPenStartCap
GdipBitmapUnlockBits
GdipDeleteBrush
GdipCreateAdjustableArrowCap
GdipAlloc
GdipDrawImageRectI
GdipCreateBitmapFromHBITMAP
GdipDeletePath
GdipDisposeImage
GdipSetPenBrushFill
GdipSetSmoothingMode
GdipCreatePath
GdipSetStringFormatLineAlign
GdipCreateLineBrushFromRectI
GdipCreateFont
GdipCreateSolidFill
GdipFillPath
GdipGraphicsClear
GdipAddPathStringI
GdipSetPenCustomEndCap
GdipDeleteCustomLineCap
GdipAddPathLineI
GdipDrawRectangle
GdipFillRectangle
GdipClosePathFigure
GdipFree
GdipDrawPath
GdipDrawString
GdipBitmapLockBits
GdipSetPenLineJoin
GdipCreateFromHDC
GdipSetTextRenderingHint
GdipDrawCurveI
GdipCloneBrush
GdipMeasureString
GdipGetImageGraphicsContext
GdipFillRectangleI
GdipGetImageEncodersSize
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDeleteFont
GdipDrawLines
GdipGetImageWidth
GdipSaveImageToStream
GdipDeletePen
GdipDrawImagePointRectI
GdipCreateBitmapFromScan0
GdipCreatePen1
GdipSetStringFormatAlign
GdipSaveImageToFile
GdipCreateStringFormat

kernel32

EncodePointer
LCMapStringEx
GetLocaleInfoEx
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
InitializeCriticalSectionAndSpinCount
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
LCIDToLocaleName
GetSystemTimeAsFileTime
ReadFile
GetModuleFileNameA
SizeofResource
SetHandleInformation
CreateSemaphoreExW
HeapFree
SetLastError
SetPriorityClass
EnterCriticalSection
GetCommandLineW
GetCurrentProcess
ReleaseSemaphore
Wow64DisableWow64FsRedirection
GetModuleHandleExW
ExpandEnvironmentStringsW
TerminateProcess
GetModuleFileNameW
WaitForMultipleObjects
GetUserDefaultUILanguage
LeaveCriticalSection
SetFilePointer
GetTempPathW
CreateMutexW
InitializeCriticalSectionEx
GetLocaleInfoW
WaitForSingleObject
CreateFileW
GetCurrentThreadId
ReleaseMutex
UnmapViewOfFile
FreeResource
OpenProcess
HeapSize
CreateToolhelp32Snapshot
CreateEventW
MultiByteToWideChar
Sleep
FormatMessageW
GetLastError
Process32NextW
OutputDebugStringW
GlobalSize
SetEvent
WaitForSingleObjectEx
LockResource
GlobalAlloc
DeleteFileW
OpenSemaphoreW
Process32FirstW
GlobalFree
HeapReAlloc
CloseHandle
RaiseException
LoadResource
HeapAlloc
GetLocalTime
GetCurrentDirectoryW
DecodePointer
HeapDestroy
GetProcAddress
GlobalLock
CreateMutexExW
LocalFree
MoveFileExW
GetFileSize
DeleteCriticalSection
ExitProcess
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
CopyFileW
WideCharToMultiByte
QueryFullProcessImageNameW
GetTempFileNameW
DebugBreak
CreateFileMappingW
DosDateTimeToFileTime
MapViewOfFile
GlobalUnlock
lstrcmpW
MoveFileW
IsDebuggerPresent
GetFileAttributesW
GetEnvironmentVariableW
LoadLibraryW
FreeLibrary
GetExitCodeThread
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
QueryPerformanceFrequency
FindResourceA
QueryPerformanceCounter

user32

OpenClipboard
GetAsyncKeyState
ShowWindow
TrackPopupMenu
DestroyCursor
WindowFromPoint
RegisterClassExW
CreatePopupMenu
MessageBeep
SetWindowTextW
UnregisterClassW
GetSystemMetrics
CallNextHookEx
SendMessageW
ScreenToClient
GetIconInfo
CreateWindowExW
EnumChildWindows
GetMenuItemCount
MonitorFromWindow
MessageBoxW
EqualRect
SetWindowPos
IsWindowVisible
GetDC
InflateRect
DestroyWindow
SendMessageTimeoutW
GetMenu
GetWindowRect
MonitorFromPoint
PostMessageW
SetTimer
GetKeyState
UnregisterHotKey
AdjustWindowRectEx
DefWindowProcW
GetMenuItemInfoW
GetMessageW
GetWindowTextLengthW
GetWindowThreadProcessId
GetWindowLongW
DispatchMessageW
GetClassLongW
IsClipboardFormatAvailable
UpdateLayeredWindow
DrawIconEx
GetKeyNameTextW
KillTimer
PostQuitMessage
SystemParametersInfoW
GetClassInfoExW
GetParent
RegisterWindowMessageW
PtInRect
SetForegroundWindow
LoadImageW
InvalidateRect
GetAncestor
SetCursorPos
GetCursorInfo
ReleaseDC
GetCursorPos
BeginPaint
EndPaint
SendInput
GetWindowTextW
DestroyIcon
AppendMenuW
GetMonitorInfoW
CreateIconIndirect
ClientToScreen
CloseClipboard
EmptyClipboard
PeekMessageW
CountClipboardFormats
GetDoubleClickTime
AttachThreadInput
RegisterHotKey
GetForegroundWindow
MoveWindow
UnhookWindowsHookEx
EnumWindows
GetMessageTime
DestroyMenu
IsRectEmpty
SetFocus
BringWindowToTop
VkKeyScanW
TranslateMessage
GetClipboardData
LoadIconW
FindWindowW
LoadCursorW
GetClassNameW
SetWindowsHookExW
SetClipboardData
SetCursor
wsprintfW
SetWindowLongW
CallWindowProcW
GetClientRect

gdi32

CreateDIBSection
SetDeviceGammaRamp
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
StretchBlt
GetStockObject
GetDIBits
GetDeviceCaps
DeleteDC
GetObjectW
SetDIBits
DeleteObject
CreateFontIndirectW
SelectObject

comdlg32

GetSaveFileNameW

advapi32

RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
RegGetValueW
RegDeleteValueW
RegOpenKeyExW

shell32

ShellExecuteW
CommandLineToArgvW
SHOpenFolderAndSelectItems
ord155
Shell_NotifyIconW
SHEmptyRecycleBinW
ShellExecuteA
GetCurrentProcessExplicitAppUserModelID
ord190
ShellExecuteExW
ord171
ord680

ole32

CoCreateInstance
CoUninitialize
CreateStreamOnHGlobal
CoInitializeSecurity
CoInitializeEx
CoTaskMemAlloc
CoInitialize
CoTaskMemFree
CoSetProxyBlanket

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear

dwmapi

DwmUnregisterThumbnail
DwmRegisterThumbnail
DwmUpdateThumbnailProperties

winmm

mciSendStringW
mmioInstallIOProcW

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
ord213
PathCanonicalizeW
PathFileExistsW
ord184
ord176
ord214
ord12
PathRenameExtensionW
PathQuoteSpacesW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetCloseHandle
InternetReadFile
InternetConnectA
HttpAddRequestHeadersA
HttpQueryInfoW
InternetSetOptionA
InternetCrackUrlA
HttpOpenRequestA
InternetQueryOptionA
InternetOpenA
HttpSendRequestA
InternetQueryDataAvailable

ws2_32

__WSAFDIsSet
accept
bind
closesocket
select
listen
WSAStartup
getpeername
getsockname
send
htonl
ntohs
WSAGetLastError
setsockopt
ioctlsocket
sendto
htons
connect
getsockopt
recv
recvfrom
inet_ntoa
socket

msvcrt

isupper
___lc_codepage_func
_wcsdup
___mb_cur_max_func
islower
__strncnt
_callnewh
_initterm
_initterm_e
_set_fmode
__p__commode
_controlfp_s
strcpy_s
strnlen
_mbtowc_l
wctomb_s
_strtoi64
?terminate@@YAXXZ
_iob
_strtoui64
_lock
_unlock
___lc_handle_func
__wgetmainargs
_msize
_XcptFilter
__set_app_type
_wcmdln
?_set_new_mode@@YAHH@Z
_isatty
fflush
_fileno
_CIlog10
ceil
_clearfp
_ultow_s
wcstol
isspace
_atoi64
strncmp
_strdup
realloc
isprint
abort
malloc
towupper
isdigit
frexp
atoi
free
_time64
strtol
_wfopen
_errno
isalnum
isxdigit
strncpy
_memicmp
strcspn
rand
_gmtime64
wcscpy_s
tolower
_beginthreadex
fclose
strtod
_wcsicmp
toupper
towlower
srand
calloc
wcsnlen
sqrt
_amsg_exit
_except_handler4_common
memcmp
memchr
__uncaught_exception
memset
memmove
memcpy
_CxxThrowException
wcsrchr
strchr
wcsstr
__CxxFrameHandler3
floor
_CIatan2
strrchr
__pctype_func
pow

Sections

.text
Size: 465KB - Virtual size: 465KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
使用说明.txt
有问题点我！安装教程！.png
.png

Sharing

General

Malware Config

Signatures

Files

2ecdb9637b85c4990416c47f878d603b

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

dwmapi

winmm

shlwapi

version

wininet

ws2_32

msvcrt

Sections

.text Size: 465KB - Virtual size: 465KB

.rdata Size: 104KB - Virtual size: 104KB

.data Size: 4KB - Virtual size: 13KB

.rsrc Size: 196KB - Virtual size: 196KB

.reloc Size: 22KB - Virtual size: 21KB

.text
Size: 465KB - Virtual size: 465KB

.rdata
Size: 104KB - Virtual size: 104KB

.data
Size: 4KB - Virtual size: 13KB

.rsrc
Size: 196KB - Virtual size: 196KB

.reloc
Size: 22KB - Virtual size: 21KB