4c8baec80393e53977c4f9441bf3eab65db88284f37943ff0601837d5a036773

Sharing

Copy URL Twitter E-mail

General

Target

4c8baec80393e53977c4f9441bf3eab65db88284f37943ff0601837d5a036773
Size

1.5MB
MD5

0708050b72659d46183f65454fdcca59
SHA1

8bc24793f7abaac0abe7f3e1572ef4b56a34243f
SHA256

4c8baec80393e53977c4f9441bf3eab65db88284f37943ff0601837d5a036773
SHA512

e75c0a3dcd306840e551be993e06cba2bd7972d0bf42e640a3d42429df87b16a185be5b116104387c301280baf4c200efc2b03bc2590cebfa56dfe14a7086c1e
SSDEEP

24576:F0xt3zskH/bvrfGdLGM42uYbjIKAB9sFG8B/sma4SdlSFDEsCYJEgFwr:F0xxskHjDfGdupkIKA3UGgCOJEsCmpwr

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/自动塞宝石/DmReg.dll
unpack001/自动塞宝石/a22eg.dll
unpack001/自动塞宝石/fcagh.dll
unpack001/自动塞宝石/hdjgd.dll
unpack001/自动塞宝石/自动塞宝石ver4.2-经验符.exe

Files

4c8baec80393e53977c4f9441bf3eab65db88284f37943ff0601837d5a036773
.zip
__MACOSX/._自动塞宝石
__MACOSX/自动塞宝石/._DmReg.dll
__MACOSX/自动塞宝石/._a22eg.dll
__MACOSX/自动塞宝石/._fcagh.dll
__MACOSX/自动塞宝石/._hdjgd.dll
__MACOSX/自动塞宝石/._orc
__MACOSX/自动塞宝石/._自动塞宝石ver4.2-经验符.exe
__MACOSX/自动塞宝石/orc/._丹1.bmp
__MACOSX/自动塞宝石/orc/._丹2.bmp
__MACOSX/自动塞宝石/orc/._丹3.bmp
__MACOSX/自动塞宝石/orc/._丹4.bmp
__MACOSX/自动塞宝石/orc/._丹5.bmp
__MACOSX/自动塞宝石/orc/._丹6.bmp
__MACOSX/自动塞宝石/orc/._主位.bmp
__MACOSX/自动塞宝石/orc/._主位1.bmp
__MACOSX/自动塞宝石/orc/._交易.bmp
__MACOSX/自动塞宝石/orc/._交易1.bmp
__MACOSX/自动塞宝石/orc/._关闭.bmp
__MACOSX/自动塞宝石/orc/._关闭1.bmp
__MACOSX/自动塞宝石/orc/._合成.bmp
__MACOSX/自动塞宝石/orc/._合成1.bmp
__MACOSX/自动塞宝石/orc/._多倍.bmp
__MACOSX/自动塞宝石/orc/._大礼包.bmp
__MACOSX/自动塞宝石/orc/._妖油.bmp
__MACOSX/自动塞宝石/orc/._宝石.bmp
__MACOSX/自动塞宝石/orc/._宝石1.bmp
__MACOSX/自动塞宝石/orc/._宝石2.bmp
__MACOSX/自动塞宝石/orc/._帽子.bmp
__MACOSX/自动塞宝石/orc/._打开铁匠.bmp
__MACOSX/自动塞宝石/orc/._提示.bmp
__MACOSX/自动塞宝石/orc/._村_1.bmp
__MACOSX/自动塞宝石/orc/._校准.bmp
__MACOSX/自动塞宝石/orc/._格1.bmp
__MACOSX/自动塞宝石/orc/._格2.bmp
__MACOSX/自动塞宝石/orc/._格3.bmp
__MACOSX/自动塞宝石/orc/._格4.bmp
__MACOSX/自动塞宝石/orc/._格5.bmp
__MACOSX/自动塞宝石/orc/._格6.bmp
__MACOSX/自动塞宝石/orc/._碧雪情天字体.txt
__MACOSX/自动塞宝石/orc/._空格.bmp
__MACOSX/自动塞宝石/orc/._空格1.bmp
__MACOSX/自动塞宝石/orc/._空格2.bmp
__MACOSX/自动塞宝石/orc/._精元.bmp
__MACOSX/自动塞宝石/orc/._背包.bmp
__MACOSX/自动塞宝石/orc/._背包1.bmp
__MACOSX/自动塞宝石/orc/._衣服.bmp
__MACOSX/自动塞宝石/orc/._通关.bmp
__MACOSX/自动塞宝石/orc/._鞋.bmp
自动塞宝石/DmReg.dll
.dll windows:4 windows x86 arch:x86

a6401b477c5abcd084d69b0577575fd8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42u

ord4616
ord4418
ord3733
ord561
ord825
ord815
ord2717
ord3948
ord540
ord4075
ord800
ord538
ord535
ord861
ord823
ord942
ord4273
ord4199
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord4269
ord3131
ord4459
ord3254
ord3142
ord2977
ord5710
ord5285
ord5303
ord1115
ord4692
ord4074
ord5298
ord5296
ord3341
ord2388
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord6371
ord1173
ord1568
ord1165
ord269
ord826
ord600
ord1571
ord6466
ord1250
ord1248
ord1563
ord1194
ord1240
ord342
ord1179
ord1570

msvcrt

_except_handler3
ftell
fopen
strchr
sprintf
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
memmove
fseek
fread
fclose
wcscat
wcscpy
wcslen
_wcsicmp
__CxxFrameHandler
_wfopen

kernel32

CreateFileA
LocalAlloc
LocalFree
MultiByteToWideChar
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
GetCurrentThread
InitializeCriticalSection
GetModuleHandleA
GetCurrentProcess
GetProcAddress
FreeLibrary
GetModuleFileNameW
LoadLibraryW
VirtualQuery
InterlockedCompareExchange
GetCurrentThreadId
ResumeThread
FlushInstructionCache
GetThreadContext
SetThreadContext
GetLastError
SuspendThread
VirtualAlloc
SetLastError
GetSystemDirectoryA
VirtualFree
CloseHandle
WriteFile

msvcp60

?_Xran@std@@YAXXZ
?_Xlen@std@@YAXXZ

Exports

Exports

SetDllPathA
SetDllPathW

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
自动塞宝石/a22eg.dll
.dll windows:4 windows x86 arch:x86

0b0c63422624d0fd8e6b4a44484d5bbe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
MapViewOfFile
UnmapViewOfFile
MultiByteToWideChar
SetLastError
OpenFileMappingA
VirtualFree
IsBadReadPtr
QueryPerformanceFrequency
ExitThread
InterlockedExchange
OpenEventA
OpenMutexA
WaitForSingleObject
SetEvent
ReleaseMutex
GetSystemDirectoryA
CreateFileMappingA
VirtualProtect
VirtualQuery
GetExitCodeThread
GetLastError
ResumeThread
InterlockedCompareExchange
GetThreadContext
SetThreadContext
SuspendThread
WriteFile
SetFilePointer
lstrcatA
lstrcpyA
FreeLibrary
FlushFileBuffers
SetStdHandle
ReadFile
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsBadCodePtr
SetUnhandledExceptionFilter
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsBadWritePtr
VirtualAlloc
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
TlsFree
GetCurrentThread
Sleep
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
GetProcAddress
GetCurrentProcessId
CloseHandle
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
CreateThread
TlsSetValue
TlsGetValue
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
RaiseException
ExitProcess
TerminateProcess
HeapSize
TlsAlloc

user32

TranslateAcceleratorA
GetForegroundWindow
GetWindow
CopyIcon
GetWindowTextA
EnumWindows
ScreenToClient
IsIconic
GetWindowPlacement
GetKeyState
SystemParametersInfoA
GetFocus
GetActiveWindow
GetCursorPos
GetWindowThreadProcessId
CallWindowProcA
CallNextHookEx
GetWindowRect
GetClassLongW
GetClassLongA
SetWindowLongW
SetWindowLongA
DefWindowProcA
GetClientRect
ClientToScreen
GetAsyncKeyState
ReleaseCapture
MapVirtualKeyA
SetFocus
TranslateMessage
DestroyCursor
GetIconInfo
IsWindowUnicode
GetWindowLongA
GetWindowLongW
SendMessageTimeoutA
PostMessageA
SendMessageA
GetMessageTime
DrawIcon
GetDC
ReleaseDC
GetParent
IsWindow
SetCursorPos

gdi32

DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetBkColor
ExtTextOutA
DeleteDC
GetObjectA
GetDIBits

Exports

Exports

Init
User32SetWindowLongA
User32SetWindowLongW

Sections

.text
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
自动塞宝石/fcagh.dll
.dll windows:4 windows x86 arch:x86

0b0c63422624d0fd8e6b4a44484d5bbe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
MapViewOfFile
UnmapViewOfFile
MultiByteToWideChar
SetLastError
OpenFileMappingA
VirtualFree
IsBadReadPtr
QueryPerformanceFrequency
ExitThread
InterlockedExchange
OpenEventA
OpenMutexA
WaitForSingleObject
SetEvent
ReleaseMutex
GetSystemDirectoryA
CreateFileMappingA
VirtualProtect
VirtualQuery
GetExitCodeThread
GetLastError
ResumeThread
InterlockedCompareExchange
GetThreadContext
SetThreadContext
SuspendThread
WriteFile
SetFilePointer
lstrcatA
lstrcpyA
FreeLibrary
FlushFileBuffers
SetStdHandle
ReadFile
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsBadCodePtr
SetUnhandledExceptionFilter
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsBadWritePtr
VirtualAlloc
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
TlsFree
GetCurrentThread
Sleep
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
GetProcAddress
GetCurrentProcessId
CloseHandle
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
CreateThread
TlsSetValue
TlsGetValue
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
RaiseException
ExitProcess
TerminateProcess
HeapSize
TlsAlloc

user32

TranslateAcceleratorA
GetForegroundWindow
GetWindow
CopyIcon
GetWindowTextA
EnumWindows
ScreenToClient
IsIconic
GetWindowPlacement
GetKeyState
SystemParametersInfoA
GetFocus
GetActiveWindow
GetCursorPos
GetWindowThreadProcessId
CallWindowProcA
CallNextHookEx
GetWindowRect
GetClassLongW
GetClassLongA
SetWindowLongW
SetWindowLongA
DefWindowProcA
GetClientRect
ClientToScreen
GetAsyncKeyState
ReleaseCapture
MapVirtualKeyA
SetFocus
TranslateMessage
DestroyCursor
GetIconInfo
IsWindowUnicode
GetWindowLongA
GetWindowLongW
SendMessageTimeoutA
PostMessageA
SendMessageA
GetMessageTime
DrawIcon
GetDC
ReleaseDC
GetParent
IsWindow
SetCursorPos

gdi32

DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetBkColor
ExtTextOutA
DeleteDC
GetObjectA
GetDIBits

Exports

Exports

Init
User32SetWindowLongA
User32SetWindowLongW

Sections

.text
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
自动塞宝石/hdjgd.dll
.dll windows:4 windows x86 arch:x86

0b0c63422624d0fd8e6b4a44484d5bbe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
MapViewOfFile
UnmapViewOfFile
MultiByteToWideChar
SetLastError
OpenFileMappingA
VirtualFree
IsBadReadPtr
QueryPerformanceFrequency
ExitThread
InterlockedExchange
OpenEventA
OpenMutexA
WaitForSingleObject
SetEvent
ReleaseMutex
GetSystemDirectoryA
CreateFileMappingA
VirtualProtect
VirtualQuery
GetExitCodeThread
GetLastError
ResumeThread
InterlockedCompareExchange
GetThreadContext
SetThreadContext
SuspendThread
WriteFile
SetFilePointer
lstrcatA
lstrcpyA
FreeLibrary
FlushFileBuffers
SetStdHandle
ReadFile
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsBadCodePtr
SetUnhandledExceptionFilter
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsBadWritePtr
VirtualAlloc
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
TlsFree
GetCurrentThread
Sleep
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
GetProcAddress
GetCurrentProcessId
CloseHandle
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
CreateThread
TlsSetValue
TlsGetValue
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
RaiseException
ExitProcess
TerminateProcess
HeapSize
TlsAlloc

user32

TranslateAcceleratorA
GetForegroundWindow
GetWindow
CopyIcon
GetWindowTextA
EnumWindows
ScreenToClient
IsIconic
GetWindowPlacement
GetKeyState
SystemParametersInfoA
GetFocus
GetActiveWindow
GetCursorPos
GetWindowThreadProcessId
CallWindowProcA
CallNextHookEx
GetWindowRect
GetClassLongW
GetClassLongA
SetWindowLongW
SetWindowLongA
DefWindowProcA
GetClientRect
ClientToScreen
GetAsyncKeyState
ReleaseCapture
MapVirtualKeyA
SetFocus
TranslateMessage
DestroyCursor
GetIconInfo
IsWindowUnicode
GetWindowLongA
GetWindowLongW
SendMessageTimeoutA
PostMessageA
SendMessageA
GetMessageTime
DrawIcon
GetDC
ReleaseDC
GetParent
IsWindow
SetCursorPos

gdi32

DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetBkColor
ExtTextOutA
DeleteDC
GetObjectA
GetDIBits

Exports

Exports

Init
User32SetWindowLongA
User32SetWindowLongW

Sections

.text
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
自动塞宝石/orc/丹1.bmp
自动塞宝石/orc/丹2.bmp
自动塞宝石/orc/丹3.bmp
自动塞宝石/orc/丹4.bmp
自动塞宝石/orc/丹5.bmp
自动塞宝石/orc/丹6.bmp
自动塞宝石/orc/主位.bmp
自动塞宝石/orc/主位1.bmp
自动塞宝石/orc/交易.bmp
自动塞宝石/orc/交易1.bmp
自动塞宝石/orc/关闭.bmp
自动塞宝石/orc/关闭1.bmp
自动塞宝石/orc/合成.bmp
自动塞宝石/orc/合成1.bmp
自动塞宝石/orc/多倍.bmp
自动塞宝石/orc/大礼包.bmp
自动塞宝石/orc/妖油.bmp
自动塞宝石/orc/宝石.bmp
自动塞宝石/orc/宝石1.bmp
自动塞宝石/orc/宝石2.bmp
自动塞宝石/orc/帽子.bmp
自动塞宝石/orc/打开铁匠.bmp
自动塞宝石/orc/提示.bmp
自动塞宝石/orc/村_1.bmp
自动塞宝石/orc/校准.bmp
自动塞宝石/orc/格1.bmp
自动塞宝石/orc/格2.bmp
自动塞宝石/orc/格3.bmp
自动塞宝石/orc/格4.bmp
自动塞宝石/orc/格5.bmp
自动塞宝石/orc/格6.bmp
自动塞宝石/orc/碧雪情天字体.txt
自动塞宝石/orc/空格.bmp
自动塞宝石/orc/空格1.bmp
自动塞宝石/orc/空格2.bmp
自动塞宝石/orc/精元.bmp
自动塞宝石/orc/背包.bmp
自动塞宝石/orc/背包1.bmp
自动塞宝石/orc/衣服.bmp
自动塞宝石/orc/通关.bmp
自动塞宝石/orc/鞋.bmp
自动塞宝石/自动塞宝石ver4.2-经验符.exe
.exe windows:4 windows x86 arch:x86

5b7a231cb3c1669f4dcc355567f106dd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

midiStreamOut
midiOutPrepareHeader
midiStreamProperty
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
waveOutPause
waveOutReset
waveOutClose
waveOutGetNumDevs
waveOutOpen
midiOutUnprepareHeader
midiStreamStop
midiOutReset
midiStreamClose
midiStreamRestart
midiStreamOpen
waveOutRestart

ws2_32

WSAAsyncSelect
closesocket
WSACleanup
inet_ntoa
ntohl
recvfrom
ioctlsocket
recv
getpeername
accept

kernel32

SetFilePointer
GetFileSize
GetCurrentProcess
TerminateProcess
SetLastError
GetTimeZoneInformation
GetVersion
CreateMutexA
ReleaseMutex
SuspendThread
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
GetLocalTime
GetSystemTime
RtlUnwind
GetStartupInfoA
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
GetFileTime
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
lstrcpynA
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedDecrement
InterlockedIncrement
LocalFree
TerminateThread
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
WriteFile
WaitForMultipleObjects
CreateFileA
SetEvent
FindResourceA
LoadResource
LockResource
ReadFile
lstrlenW
GetModuleFileNameA
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
lstrlenA
WinExec
lstrcpyA
FindNextFileA
InterlockedExchange
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetUserDefaultLCID
MultiByteToWideChar
WideCharToMultiByte
GetFullPathNameA
FreeLibrary
LoadLibraryA
GetLastError
GetVersionExA
WritePrivateProfileStringA
CreateThread
CreateEventA
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
FindFirstFileA
FindClose
GetFileAttributesA
SetCurrentDirectoryA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
MulDiv
GetCommandLineA
GetTickCount
WaitForSingleObject
CloseHandle
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
IsBadReadPtr
IsBadCodePtr
SetStdHandle

user32

GetActiveWindow
SetFocus
IsIconic
PeekMessageA
SetMenu
GetMenu
DeleteMenu
GetSystemMenu
GetSysColorBrush
LoadStringA
IsWindowEnabled
ShowWindow
SystemParametersInfoA
LoadImageA
EnumDisplaySettingsA
ClientToScreen
EnableMenuItem
GetSubMenu
GetDlgCtrlID
CreateAcceleratorTableA
CreateMenu
ModifyMenuA
AppendMenuA
CreatePopupMenu
DrawIconEx
CreateIconFromResource
CreateIconFromResourceEx
SetRectEmpty
DispatchMessageA
GetMessageA
WindowFromPoint
DrawFocusRect
GetWindow
DestroyAcceleratorTable
SetWindowRgn
DrawEdge
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetCapture
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
SetRect
InflateRect
GetMenuCheckMarkDimensions
GetMenuState
SetMenuItemBitmaps
CheckMenuItem
DefWindowProcA
SetWindowTextA
IntersectRect
DestroyIcon
PtInRect
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor
GetDC
FillRect
IsRectEmpty
ReleaseDC
IsChild
DestroyMenu
SetForegroundWindow
GetWindowRect
EqualRect
UpdateWindow
ValidateRect
InvalidateRect
GetClientRect
GetFocus
GetParent
GetTopWindow
PostMessageA
IsWindow
SetParent
DestroyCursor
SendMessageA
SetWindowPos
MessageBoxA
GetCursorPos
GetSystemMetrics
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
wsprintfA
GetClassInfoA
IsZoomed
DrawFrameControl
TranslateMessage
LoadIconA
GetDesktopWindow
GetClassNameA
GetDlgItem
GetWindowTextA
CallWindowProcA
UnregisterClassA
CreateWindowExA
RegisterHotKey
UnregisterHotKey
PostQuitMessage
CopyAcceleratorTableA
GetKeyState
MoveWindow
TranslateAcceleratorA
GetMessagePos
RegisterClipboardFormatA
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetForegroundWindow
GetLastActivePopup
GetMessageTime
RemovePropA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
GetMenuItemID
GetMenuItemCount
RegisterClassA
GetScrollPos
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA

gdi32

ExtSelectClipRgn
LineTo
MoveToEx
ExcludeClipRect
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
EndDoc
DeleteDC
StartDocA
StartPage
BitBlt
CreateCompatibleDC
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
GetTextExtentPoint32A
GetDeviceCaps
StretchBlt
CreatePalette
GetSystemPaletteEntries
CreateDIBitmap
SelectClipRgn
CreatePolygonRgn
GetClipRgn
SetStretchBltMode
CreateRectRgnIndirect
SetBkColor
CreateFontA
TranslateCharsetInfo
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
GetViewportExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetTextMetricsA
EndPage
GetObjectA
GetStockObject
CreateFontIndirectA
CreateSolidBrush
FillRgn
CreateRectRgn
CombineRgn
PatBlt
CreatePen
SelectObject
CreateBitmap
CreateDCA
CreateCompatibleBitmap
GetPolyFillMode
GetStretchBltMode
GetROP2
GetBkColor
GetBkMode
GetTextColor
CreateRoundRectRgn
CreateEllipticRgn
PathToRegion
EndPath
BeginPath
GetWindowOrgEx
GetViewportOrgEx
GetWindowExtEx
GetDIBits
RealizePalette
RoundRect
DeleteObject
SelectPalette

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegOpenKeyExA
RegSetValueExA
RegQueryValueA
RegCreateKeyExA
RegCloseKey

shell32

DragQueryFileA
ShellExecuteA
Shell_NotifyIconA
DragFinish
DragAcceptFiles

ole32

OleRun
CoCreateInstance
CLSIDFromString
OleUninitialize
OleInitialize
CLSIDFromProgID

oleaut32

UnRegisterTypeLi
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SysAllocString
VariantInit
VariantCopyInd
VariantChangeType
VariantClear

comctl32

ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_EndDrag
ord17

comdlg32

GetFileTitleA
GetSaveFileNameA
GetOpenFileNameA
ChooseColorA

Sections

.text
Size: 684KB - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 764KB - Virtual size: 760KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6401b477c5abcd084d69b0577575fd8

Headers

File Characteristics

Imports

mfc42u

msvcrt

kernel32

msvcp60

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 25KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 16B

.reloc Size: 4KB - Virtual size: 3KB

0b0c63422624d0fd8e6b4a44484d5bbe

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 138KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 20KB - Virtual size: 98KB

.reloc Size: 12KB - Virtual size: 11KB

0b0c63422624d0fd8e6b4a44484d5bbe

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 138KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 20KB - Virtual size: 98KB

.reloc Size: 12KB - Virtual size: 11KB

0b0c63422624d0fd8e6b4a44484d5bbe

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 138KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 20KB - Virtual size: 98KB

.reloc Size: 12KB - Virtual size: 11KB

5b7a231cb3c1669f4dcc355567f106dd

Headers

File Characteristics

Imports

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

comdlg32

Sections

.text
Size: 28KB - Virtual size: 25KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 16B

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 140KB - Virtual size: 138KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 20KB - Virtual size: 98KB

.reloc
Size: 12KB - Virtual size: 11KB

.text
Size: 140KB - Virtual size: 138KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 20KB - Virtual size: 98KB

.reloc
Size: 12KB - Virtual size: 11KB

.text
Size: 140KB - Virtual size: 138KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 20KB - Virtual size: 98KB

.reloc
Size: 12KB - Virtual size: 11KB

.text
Size: 684KB - Virtual size: 680KB

.rdata
Size: 764KB - Virtual size: 760KB

.data
Size: 100KB - Virtual size: 316KB

.rsrc
Size: 112KB - Virtual size: 111KB