a7971bce47584535e9033f9d72d8f6f386c7d8deef3b93e11de50cf9574f7413

Sharing

Copy URL

Twitter E-mail

General

Target

a7971bce47584535e9033f9d72d8f6f386c7d8deef3b93e11de50cf9574f7413
Size

3.6MB
MD5

91153d3fc0b835b072aeebc4d8837faf
SHA1

1e1e524be7c69077229973e385c447d9692ad937
SHA256

a7971bce47584535e9033f9d72d8f6f386c7d8deef3b93e11de50cf9574f7413
SHA512

2b49c6d701cc6f0d25a81258dcec2159ab3ea30389d18aadcc486c540f5daf6adedf998def1bf5c5fb4a5712755dbca710387c862a89138b23ec081682e835ec
SSDEEP

49152:IBTaBlUSRRWRgyuHaLF12pv55EW4AXO/hPsQIYmSXyfgY2YBlWPRGtTLJMK+u8GJ:IBTaBzIguwv/ShTXyfgClmG13+dTW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a7971bce47584535e9033f9d72d8f6f386c7d8deef3b93e11de50cf9574f7413

Files

a7971bce47584535e9033f9d72d8f6f386c7d8deef3b93e11de50cf9574f7413
.dll windows:6 windows x86

5995151564a62f9c309819723f006513

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

getnameinfo
shutdown
gethostname
ioctlsocket
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
socket
WSAGetLastError

kernel32

FreeLibrary
LockResource
FindResourceExW
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
VerSetConditionMask
VerifyVersionInfoW
GetNativeSystemInfo
GetModuleHandleA
GetSystemInfo
GetVersionExW
UnmapViewOfFile
GetSystemTime
GetTimeZoneInformation
GetSystemDirectoryW
GetPrivateProfileStringW
InitializeCriticalSectionEx
RaiseException
DecodePointer
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
WaitForSingleObject
Process32NextW
GetSystemDefaultUILanguage
lstrcmpiW
GetWindowsDirectoryW
CreateProcessW
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
LoadLibraryA
VerifyVersionInfoA
QueryPerformanceCounter
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
SetLastError
FormatMessageA
SystemTimeToFileTime
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
GetModuleHandleExW
FormatMessageW
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
SwitchToThread
CreateThread
GetThreadId
CreateSemaphoreA
CreateEventA
ReleaseSemaphore
DuplicateHandle
SetEvent
LocalFree
CreateFileA
MapViewOfFileEx
GetCurrentProcessId
GetCurrentDirectoryW
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileInformationByHandle
GetFileTime
GetFullPathNameW
SetFilePointerEx
SetFileTime
DeviceIoControl
MoveFileExW
SetWaitableTimer
CreateWaitableTimerW
OpenEventA
WaitForMultipleObjectsEx
ResetEvent
Thread32First
Thread32Next
AreFileApisANSI
WriteConsoleW
FindFirstFileExW
FlushFileBuffers
SetStdHandle
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetDateFormatW
GetConsoleOutputCP
SetConsoleCtrlHandler
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
InterlockedFlushSList
RtlUnwind
InitializeSListHead
GetStartupInfoW
CreateEventW
IsProcessorFeaturePresent
UnhandledExceptionFilter
OutputDebugStringW
IsDebuggerPresent
GetCPInfo
CompareStringEx
GetStringTypeW
GetLocaleInfoEx
LCMapStringEx
EncodePointer
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
lstrcpynW
lstrcpyW
DosDateTimeToFileTime
GetACP
MulDiv
SetEnvironmentVariableW
FreeEnvironmentStringsW
TerminateProcess
GetProcAddress
LoadLibraryW
GetCurrentProcess
SetUnhandledExceptionFilter
GetLocalTime
WideCharToMultiByte
SetFileAttributesW
SetEndOfFile
SetFilePointer
GetFileSize
DeleteFileW
WinExec
Sleep
GetShortPathNameW
CreateDirectoryW
RemoveDirectoryW
FindFirstFileA
GetModuleFileNameW
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesW
GetTimeFormatW
GetLastError
ExitProcess
GetModuleHandleW
FreeResource
LoadResource
SizeofResource
FindResourceW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThreadId
ReadFile
GetEnvironmentStringsW
CloseHandle
WriteFile
CreateFileW
GetTickCount
MultiByteToWideChar
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
CreateFileMappingA

user32

GetClientRect
InvalidateRect
DefWindowProcW
GetCaretPos
SetWindowPos
NotifyWinEvent
CreateAcceleratorTableW
InvalidateRgn
ReleaseCapture
SetCapture
ValidateRect
GetGUIThreadInfo
EndPaint
BeginPaint
GetUpdateRect
GetClassInfoExW
LoadImageW
wvsprintfW
InflateRect
SetWindowLongW
SetLayeredWindowAttributes
MonitorFromRect
GetWindowPlacement
CharPrevW
SetRect
IsRectEmpty
GetSysColor
SetCaretPos
HideCaret
GetCursorPos
CreateCaret
GetWindow
GetParent
GetSystemMetrics
GetWindowRect
MoveWindow
GetDC
ReleaseDC
GetWindowLongW
EnableWindow
SetWindowTextW
SendMessageW
GetWindowTextW
GetWindowTextLengthW
KillTimer
SetTimer
OffsetRect
ShowWindow
PtInRect
GetFocus
SetCursor
LoadCursorW
MonitorFromWindow
GetMonitorInfoW
GetMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
IntersectRect
IsWindow
PostThreadMessageW
DrawTextW
PostMessageW
CreateWindowExW
IsIconic
IsZoomed
EqualRect
UpdateLayeredWindow
SetFocus
CharNextW
FillRect
ShowCaret
MessageBoxW
SetWindowRgn
GetUserObjectInformationW
GetProcessWindowStation
GetWindowThreadProcessId
FindWindowExW
CallWindowProcW
BringWindowToTop
SwitchToThisWindow
FindWindowW
ClientToScreen
DestroyWindow
GetKeyState
UnregisterClassW
RegisterClassW
wsprintfW
GetPropW
SetPropW
RegisterClassExW
MapWindowPoints
ScreenToClient

gdi32

GetClipBox
ExtSelectClipRgn
StretchBlt
SetStretchBltMode
SetBkColor
ExtTextOutW
CreatePenIndirect
MoveToEx
LineTo
GetTextExtentPoint32W
TextOutW
GetCharABCWidthsW
SaveDC
RestoreDC
SetWindowOrgEx
GetTextMetricsW
GetObjectA
CreateFontIndirectW
SelectClipRgn
CreateRoundRectRgn
CombineRgn
CreateRectRgnIndirect
CreateCompatibleBitmap
SetDIBColorTable
CreateDIBSection
SetTextColor
SetBkMode
BitBlt
Rectangle
DeleteObject
RoundRect
GetStockObject
CreateSolidBrush
CreatePen
DeleteDC
GetObjectW
SelectObject
CreateCompatibleDC
GetDeviceCaps

advapi32

CryptDestroyKey
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
DuplicateTokenEx
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptGenRandom

shell32

SHGetPathFromIDListW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
SHBrowseForFolderW
SHGetFolderPathW
ShellExecuteW

ole32

CoTaskMemFree
CoCreateInstance
CreateStreamOnHGlobal
CoUninitialize
CLSIDFromProgID
CoInitialize
OleInitialize
OleUninitialize
CoInitializeEx
OleLockRunning
CLSIDFromString

oleaut32

SysStringLen
VariantInit
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
SysAllocString
SysFreeString

gdiplus

GdipFree
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipDrawString
GdipCreateLineBrushI
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipGetImageHeight
GdipCreateStringFormat
GdipSetTextRenderingHint
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipCreateBitmapFromStream
GdiplusShutdown
GdiplusStartup
GdipCloneBrush
GdipDeleteBrush
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetImageWidth

shlwapi

StrCmpW
PathFileExistsW

imm32

ImmNotifyIME
ImmSetCompositionFontW
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

msimg32

AlphaBlend

bcrypt

BCryptGenRandom

winhttp

WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpSetTimeouts

crypt32

CertOpenStore
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertCloseStore

comctl32

_TrackMouseEvent
ord17

oleacc

CreateStdAccessibleObject
LresultFromObject

wldap32

ord41
ord50
ord60
ord211
ord22
ord217
ord143
ord27
ord30
ord26
ord46
ord32
ord33
ord35
ord79
ord301
ord200

Exports

Exports

AlertBox
BrowseUrl
ConfirmBox
ConfirmBoxEx
DeElevateStartProcess
DeleteWeChatDir
ExitTBCIASkinEngine
FindAllProcAndKill
FindControl
GetAllProcessIdFromProcessName
GetChannelIdFromFileVersion
GetControlData
GetCurProcessId
GetFileNameFromPath
GetHexVerFromFileVersion
GetParameters
GetWeChatConfigPath
GetWeChatDataPath
InitTBCIAMessageBox
InitTBCIASkinEngine
InstPathIsEndWeChat
IsFileExisted
IsRegKeyExisted
IsWindowExisted
MMLogE
MMLogI
NotifyProcessDestroy
OnControlBindNSISScript
ReadFileOneLine
SelectFolderDialog
SetControlData
SetFireWallAllow
SetInstallMoreOptionVisible
SetLanguage
ShowLicense
ShowPage
StartInstall
StartUninstall
TBCIAKillTimer
TBCIASendMessage
TestCase
__ASSERT
cleanInstallDir
clearAppletLnk
getVersionDirsAndRename
isGeWin7
onError
pluginInstall
setAutoRun
setVersion
test

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 652KB - Virtual size: 652KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 521KB - Virtual size: 520KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5995151564a62f9c309819723f006513

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

shlwapi

imm32

msimg32

bcrypt

winhttp

crypt32

comctl32

oleacc

wldap32

Exports

Exports

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 652KB - Virtual size: 652KB

.data Size: 28KB - Virtual size: 68KB

.rsrc Size: 521KB - Virtual size: 520KB

.reloc Size: 113KB - Virtual size: 113KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 652KB - Virtual size: 652KB

.data
Size: 28KB - Virtual size: 68KB

.rsrc
Size: 521KB - Virtual size: 520KB

.reloc
Size: 113KB - Virtual size: 113KB