0edeb9d36c88f6a79efe618a3049ec98f86bcd0d69e88ef2bd4ad67087c056d2

Sharing

Copy URL Twitter E-mail

General

Target

0edeb9d36c88f6a79efe618a3049ec98f86bcd0d69e88ef2bd4ad67087c056d2
Size

884KB
MD5

a0eb95fe22c0f30f5f59b89d68e207a3
SHA1

154ab1986f2c1793f826364c821dedc76750090d
SHA256

0edeb9d36c88f6a79efe618a3049ec98f86bcd0d69e88ef2bd4ad67087c056d2
SHA512

6dcc8c5617c649cd0ab5e747918238f7aef31938740d5678b6936d477ad858162c3fd21b4918e99138b2506e7df2d7f917e224281f2af20b7b876cd9d1e105d2
SSDEEP

24576:mW7Whsw1mW1IB7XnDDL/aQiw5XwDfEdot/QFKcv7zbLMUZLfP:r1hgIBLDDLkw5Xqfw7/LMkLn

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack002/defpix_CHS.exe
unpack003/displayx/DisplayX.exe

Files

0edeb9d36c88f6a79efe618a3049ec98f86bcd0d69e88ef2bd4ad67087c056d2
.zip
新建文件夹/Display-Test(液晶显示器测试软件)_1007_200df.exe
.exe windows:5 windows x86

f4a7bb88465d097e66879c68d64a05a2

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0b
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

05/01/2022, 09:58

Not After

06/01/2024, 09:58

Subject

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

94:e9:86:f1:c8:6e:b3:5a:c8:62:ed:1b:4f:3c:53:f1:ce:4a:3b:12:53:a5:6b:0d:a4:5b:06:0d:37:31:36:71
Signer

Actual PE Digest

94:e9:86:f1:c8:6e:b3:5a:c8:62:ed:1b:4f:3c:53:f1:ce:4a:3b:12:53:a5:6b:0d:a4:5b:06:0d:37:31:36:71

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
ReadFile
GetCurrentProcessId
GlobalAlloc
lstrlenA
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetWindowsDirectoryW
GetTickCount
ReleaseMutex
lstrcmpiW
FormatMessageA
ExpandEnvironmentStringsA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
SleepEx
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
InitializeCriticalSection
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
InterlockedExchange
SetConsoleCtrlHandler
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
SetFilePointer
FlushFileBuffers
LeaveCriticalSection
EnterCriticalSection
FlushInstructionCache
GetCurrentThreadId
InterlockedCompareExchange
Sleep
LoadLibraryW
LoadLibraryExW
FreeResource
FreeLibrary
GetSystemWindowsDirectoryW
GetVersionExW
lstrcpyW
MultiByteToWideChar
GetCurrentDirectoryA
LoadResource
LockResource
SizeofResource
FindResourceW
GetDriveTypeW
QueryDosDeviceW
DeviceIoControl
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetFileAttributesW
SetFileAttributesW
LocalFree
CreateFileW
WriteFile
DeleteFileW
WideCharToMultiByte
GetModuleFileNameA
GetStdHandle
FatalAppExitA
HeapCreate
LCMapStringW
LCMapStringA
GetCurrentThread
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleHandleA
GetStartupInfoW
ExitProcess
CreateThread
ExitThread
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
lstrcmpiA
lstrcmpA
TlsFree
TlsAlloc
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
CreateProcessW
WaitForSingleObject
OutputDebugStringW
TlsGetValue
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
CreateMutexW
OpenMutexW
GetTempPathW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetFileAttributesA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
FindResourceExW
SetCurrentDirectoryA
GetExitCodeProcess
lstrlenW
GetFullPathNameW
GetSystemDirectoryW
GetLastError
CloseHandle
FindFirstFileW
FindNextFileW
FindClose
SetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetCurrentProcess
GetCommandLineW
RaiseException

user32

PtInRect
wsprintfW
SetPropW
GetWindowRect
ReleaseDC
GetDC
SetWindowLongW
GetWindowLongW
RemovePropW
GetPropW
CallWindowProcW
UnregisterClassA
IsWindowVisible
MoveWindow
SetWindowPos
DefWindowProcW
CreateWindowExW
GetClassInfoExW
LoadCursorW
RegisterClassExW
SetCursor
SendMessageTimeoutW
FindWindowW
CreateDialogParamW
PeekMessageW
DestroyWindow
ShowWindow
CharNextW
LoadImageW
GetSystemMetrics
GetMonitorInfoW
MonitorFromWindow
GetClientRect
PostQuitMessage
EndPaint
BeginPaint
KillTimer
ScreenToClient
GetCursorPos
CopyRect
SetWindowTextW
SetTimer
SendMessageW
IsDialogMessageW
MessageBoxW
GetActiveWindow
InvalidateRect
TranslateMessage
DispatchMessageW
PostMessageW
IsWindow
GetCapture
SetCapture
GetMessageW
ReleaseCapture

gdi32

CreateCompatibleDC
SelectObject
GetObjectW
DeleteObject
EnumFontsW
GetDeviceCaps
DeleteDC
SetViewportOrgEx
CreateCompatibleBitmap
BitBlt
ExtTextOutW
SetBkColor
CreateDIBSection

advapi32

AdjustTokenPrivileges
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetTokenInformation
RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExA
IsValidSid
LookupAccountNameW
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
GetUserNameW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
OpenProcessToken
LookupPrivilegeValueW
CryptCreateHash

shell32

ShellExecuteW
ord165
SHGetSpecialFolderPathW
ShellExecuteExW

ole32

CoInitializeSecurity
CoSetProxyBlanket
CoCreateGuid
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CreateStreamOnHGlobal
CoInitializeEx

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit
VarUI4FromStr

shlwapi

StrCmpNIW
StrCmpIW
StrStrIA
StrTrimA
SHSetValueA
PathIsDirectoryW
PathRemoveFileSpecW
PathAppendW
SHGetValueW
PathCombineW
SHSetValueW
SHDeleteValueW
StrCpyW
StrStrIW
PathFindFileNameW
PathStripToRootW
PathRemoveExtensionW
StrToIntExW
PathFileExistsW
SHGetValueA

comctl32

_TrackMouseEvent

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

gdiplus

GdipCreateStringFormat
GdipFree
GdipSetStringFormatAlign
GdipAlloc
GdipDeleteFontFamily
GdipCreateBitmapFromStreamICM
GdipCreateSolidFill
GdipDrawImageRectRectI
GdipGraphicsClear
GdipSetInterpolationMode
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRect
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipCreateFont
GdipMeasureString
GdipDrawString
GdipSetTextRenderingHint
GdipCreateBitmapFromStream
GdipCloneImage
GdipDisposeImage
GdipDeleteStringFormat
GdipDrawImageRect
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdiplusStartup
GdiplusShutdown
GdipCloneBrush
GdipDeleteFont
GdipSetStringFormatLineAlign
GdipDeleteBrush

wininet

InternetCrackUrlW
HttpOpenRequestW
InternetQueryOptionW
HttpQueryInfoW
InternetSetOptionW
InternetConnectW
InternetOpenW
HttpSendRequestW
InternetReadFile
InternetCloseHandle

imm32

ImmDisableIME

crypt32

CertCreateCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertAddCertificateContextToStore
CryptQueryObject
CertGetNameStringA
CertFreeCertificateChain
CryptBinaryToStringA
CryptStringToBinaryA

urlmon

URLDownloadToCacheFileW

setupapi

SetupIterateCabinetW

iphlpapi

GetAdaptersInfo

ws2_32

getaddrinfo
gethostbyname
WSACleanup
inet_ntoa
WSASetLastError
__WSAFDIsSet
WSAGetLastError
select
recv
send
WSAIoctl
setsockopt
getsockname
ntohs
bind
htons
getsockopt
getpeername
closesocket
socket
connect
freeaddrinfo
ioctlsocket
WSAStartup

Sections

.text
Size: 759KB - Virtual size: 759KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
新建文件夹/defpix_CHS.zip
.zip
defpix_CHS.exe
.exe windows:5 windows x86

233b69a9895bdb41d70de03dd0ec79de

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey

user32

LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoW
ShowWindow
ShowScrollBar
ShowOwnedPopups
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetMenu
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClassLongW
SetCapture
SetActiveWindow
SendMessageA
SendMessageW
ScrollWindow
ScreenToClient
RemovePropW
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassW
RedrawWindow
PostQuitMessage
PostMessageW
PeekMessageA
PeekMessageW
OffsetRect
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
MapWindowPoints
MapVirtualKeyW
LoadStringW
LoadKeyboardLayoutW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsIconic
IsDialogMessageA
IsDialogMessageW
IsChild
InvalidateRect
InsertMenuItemW
InsertMenuW
InflateRect
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropW
GetParent
GetWindow
GetMessagePos
GetMessageExtraInfo
GetMenuStringW
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassLongW
GetClassInfoW
GetCapture
GetActiveWindow
FrameRect
FindWindowExW
FindWindowW
FillRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EndMenu
EnableWindow
EnableScrollBar
EnableMenuItem
DrawTextExW
DrawTextW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageA
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreatePopupMenu
CreateMenu
CreateIcon
CreateAcceleratorTableW
CopyIcon
ClientToScreen
CheckMenuItem
CharUpperW
CharNextW
CharLowerBuffW
CharLowerW
CallWindowProcW
CallNextHookEx
BeginPaint
AdjustWindowRectEx
ActivateKeyboardLayout
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow

kernel32

lstrcmpiA
LoadLibraryA
LocalFree
LocalAlloc
Sleep
VirtualFree
VirtualAlloc
SwitchToThread
GetACP
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
IsValidLocale
GetSystemDefaultUILanguage
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetUserDefaultUILanguage
GetLocaleInfoW
GetLastError
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
ExitThread
CreateThread
CompareStringW
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualFree
VirtualAlloc
UnmapViewOfFile
TryEnterCriticalSection
SwitchToThread
SuspendThread
Sleep
SizeofResource
SetThreadPriority
SetThreadLocale
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
RaiseException
QueryDosDeviceW
IsDebuggerPresent
MulDiv
MapViewOfFile
LockResource
LocalFree
LoadResource
LoadLibraryW
LeaveCriticalSection
IsValidLocale
InitializeCriticalSection
GlobalUnlock
GlobalLock
GlobalFree
GlobalFindAtomW
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomW
GetVersionExW
GetVersion
GetTickCount
GetThreadPriority
GetThreadLocale
GetSystemDefaultLangID
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLogicalDriveStringsW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesExW
GetFileAttributesW
GetExitCodeThread
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCPInfoExW
GetCPInfo
GetACP
FreeResource
InterlockedExchangeAdd
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
EnumSystemLocalesW
EnumCalendarInfoW
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateFileMappingW
CreateFileW
CreateEventW
CompareStringW
CloseHandle
Sleep

msimg32

AlphaBlend

gdi32

UnrealizeObject
StretchDIBits
StretchBlt
StartPage
StartDocW
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SetAbortProc
SelectPalette
SelectObject
SaveDC
RoundRect
RestoreDC
Rectangle
RectVisible
RealizePalette
Polyline
Polygon
PolyBezierTo
PolyBezier
PlayEnhMetaFile
Pie
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsW
GetTextExtentPoint32W
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectW
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionW
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
FrameRgn
ExtTextOutW
ExtFloodFill
ExcludeClipRect
EnumFontsW
EnumFontFamiliesExW
EndPage
EndDoc
Ellipse
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePenIndirect
CreatePalette
CreateICW
CreateHalftonePalette
CreateFontIndirectW
CreateDIBitmap
CreateDIBSection
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileW
Chord
BitBlt
ArcTo
Arc
AngleArc
AbortDoc

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ole32

OleUninitialize
OleInitialize
CoCreateInstance
IsEqualGUID

comctl32

InitializeFlatSB
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Copy
ImageList_LoadImageW
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_SetOverlayImage
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create

winspool.drv

OpenPrinterW
EnumPrintersW
DocumentPropertiesW
ClosePrinter
GetDefaultPrinterW

shell32

ShellExecuteW

Sections

.text
Size: 785KB - Virtual size: 785KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 20KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 60B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ʹø˵.txt
Ļ⹤(Defpix) V1.3.7.13ɫİ_Ļ - pc6վ.url
.url .js
新建文件夹/jfsky.com-displayx.rar
.rar
displayx/DisplayX.exe
.exe windows:4 windows x86

17e80ea3e0a1d5d0d7bd139997dfdd9d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyA
WideCharToMultiByte
GetStartupInfoA
GetModuleHandleA
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
FreeResource
FindFirstFileA
FindNextFileA
FindClose
GetTickCount
GetModuleFileNameA

user32

SetDlgItemTextA
GetDlgItem
SetWindowTextA
DialogBoxParamA
EndDialog
InflateRect
DrawTextA
KillTimer
SendMessageA
GetParent
ClientToScreen
ScreenToClient
SetWindowLongA
MessageBoxA
CallWindowProcA
DispatchMessageA
TranslateMessage
OffsetRect
EnableWindow
SetForegroundWindow
SetTimer
GetDC
ReleaseDC
BeginPaint
GetClientRect
FillRect
EndPaint
PostQuitMessage
DefWindowProcA
CheckMenuItem
DestroyWindow
CreatePopupMenu
GetMenuItemCount
InsertMenuItemA
GetMenu
GetMenuItemRect
TrackPopupMenu
InvalidateRect
SetMenu
SetWindowPlacement
SetWindowPos
GetWindowPlacement
GetWindowLongA
AdjustWindowRect
GetSystemMetrics
MonitorFromWindow
GetMonitorInfoA
CopyRect
LoadStringA
CreateWindowExA
ShowWindow
UpdateWindow
LoadIconA
LoadCursorA
RegisterClassExA
LoadAcceleratorsA
GetMessageA
GetCursorPos

gdi32

GetStockObject
GetDeviceCaps
Ellipse
CreatePen
MoveToEx
LineTo
CreateSolidBrush
CreateFontA
SetPixel
DeleteObject
Rectangle
SetTextColor
SetBkColor
TextOutA
SelectObject
SetBkMode

shell32

SHGetPathFromIDListA
SHGetDesktopFolder
SHGetMalloc
SHGetFileInfoA

ole32

CreateStreamOnHGlobal

oleaut32

OleLoadPicture

msvcrt

fopen
fseek
ftell
fread
fclose
malloc
free
??3@YAXPAX@Z
strcpy
_except_handler3
strcmp
pow
_ftol
_snprintf
memset
strchr
strlen
memcpy
strrchr
strcat
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp

Sections

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f4a7bb88465d097e66879c68d64a05a2

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0bCertificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

94:e9:86:f1:c8:6e:b3:5a:c8:62:ed:1b:4f:3c:53:f1:ce:4a:3b:12:53:a5:6b:0d:a4:5b:06:0d:37:31:36:71Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

gdiplus

wininet

imm32

crypt32

urlmon

setupapi

iphlpapi

ws2_32

Sections

.text Size: 759KB - Virtual size: 759KB

.rdata Size: 97KB - Virtual size: 96KB

.data Size: 17KB - Virtual size: 30KB

.rsrc Size: 31KB - Virtual size: 30KB

.reloc Size: 27KB - Virtual size: 27KB

233b69a9895bdb41d70de03dd0ec79de

Headers

File Characteristics

Imports

oleaut32

advapi32

user32

kernel32

msimg32

gdi32

version

ole32

comctl32

winspool.drv

shell32

Sections

.text Size: 785KB - Virtual size: 785KB

.itext Size: 3KB - Virtual size: 3KB

.data Size: 10KB - Virtual size: 10KB

.bss Size: - Virtual size: 20KB

.idata Size: 13KB - Virtual size: 13KB

.didata Size: 1024B - Virtual size: 1024B

.tls Size: - Virtual size: 60B

.rdata Size: 512B - Virtual size: 512B

.reloc Size: 68KB - Virtual size: 68KB

.rsrc Size: 29KB - Virtual size: 29KB

17e80ea3e0a1d5d0d7bd139997dfdd9d

Headers

File Characteristics

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0b
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

94:e9:86:f1:c8:6e:b3:5a:c8:62:ed:1b:4f:3c:53:f1:ce:4a:3b:12:53:a5:6b:0d:a4:5b:06:0d:37:31:36:71
Signer

.text
Size: 759KB - Virtual size: 759KB

.rdata
Size: 97KB - Virtual size: 96KB

.data
Size: 17KB - Virtual size: 30KB

.rsrc
Size: 31KB - Virtual size: 30KB

.reloc
Size: 27KB - Virtual size: 27KB

.text
Size: 785KB - Virtual size: 785KB

.itext
Size: 3KB - Virtual size: 3KB

.data
Size: 10KB - Virtual size: 10KB

.bss
Size: - Virtual size: 20KB

.idata
Size: 13KB - Virtual size: 13KB

.didata
Size: 1024B - Virtual size: 1024B

.tls
Size: - Virtual size: 60B

.rdata
Size: 512B - Virtual size: 512B

.reloc
Size: 68KB - Virtual size: 68KB

.rsrc
Size: 29KB - Virtual size: 29KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 14KB - Virtual size: 16KB

.rsrc
Size: 24KB - Virtual size: 24KB