2a99dec8ea9426f33e45fc298498d87b

Sharing

Copy URL Twitter E-mail

General

Target

2a99dec8ea9426f33e45fc298498d87b
Size

1.8MB
MD5

2a99dec8ea9426f33e45fc298498d87b
SHA1

df635f49fc2f0b9ec0db3ea72b0a19654e0967b5
SHA256

18a21925737956f78196c36d8829c9ee566cd88c1c73ae309cfade5fbb99d39f
SHA512

09c1f24c7f2e5d9bc2009e8b7893059074227f835bb7f2ca2fc490ac685efaf1031ba2a2ece69619852f10448276317390c2f101bbc3fa9e45e66118acd75660
SSDEEP

49152:5oJdO2YtrmVhQW2HYhP6qp9lJnfdC72kzGE/:OJc5r4hQ34hyE9TVCBKG

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/QQper/QQ宠物辅助工具v2.0（单宠物使用）/WinIo.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/QQper/QQ宠物辅助工具v2.0（单宠物使用）/WinIo.dll	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/QQper/QQ宠物辅助工具v2.0（单宠物使用）/QQ宠物辅助工具v2.0.EXE
unpack001/QQper/QQ宠物辅助工具v2.0（单宠物使用）/WinIo.dll
unpack002/out.upx
unpack001/QQper/QQ宠物辅助工具v2.0（单宠物使用）/WinIo.sys
unpack001/QQper/QQ宠物辅助工具v2.0（单宠物使用）/cfgdll.dll

Files

2a99dec8ea9426f33e45fc298498d87b
.rar
QQper/QQ宠物辅助工具v2.0（单宠物使用）/01.bmp
QQper/QQ宠物辅助工具v2.0（单宠物使用）/06.bmp
QQper/QQ宠物辅助工具v2.0（单宠物使用）/QQ宠物辅助工具v2.0.EXE
.exe windows:4 windows x86 arch:x86

9c8decf3582072f6edfc385a689f44f4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateDirectoryA
CreateFileA
DeleteFileA
ExitProcess
FreeLibrary
GetCommandLineA
GetFileTime
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetWindowsDirectoryA
LoadLibraryA
lstrcatA
lstrcmpiA
RemoveDirectoryA
SetFileTime
VirtualAlloc
VirtualFree
WriteFile

Sections

text
Size: - Virtual size: 380KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Udata
Size: 186KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pebundle
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pebundle
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pebundle
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pebundle
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pebundle
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pebundle
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pebundle
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pebundle
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pebundle
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pebundle
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
QQper/QQ宠物辅助工具v2.0（单宠物使用）/QQ宠物辅助工具帮助.doc
.doc windows office2003
QQper/QQ宠物辅助工具v2.0（单宠物使用）/WINIO.VXD
QQper/QQ宠物辅助工具v2.0（单宠物使用）/WinIo.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

GetPhysLong
GetPortVal
InitializeWinIo
InstallWinIoDriver
MapPhysToLin
RemoveWinIoDriver
SetPhysLong
SetPortVal
ShutdownWinIo
UnmapPhysicalMemory

Sections

UPX0
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
QQper/QQ宠物辅助工具v2.0（单宠物使用）/WinIo.sys
.sys windows:4 windows x86 arch:x86

172b54da983eaa27abf08d8ed525b840

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlInitUnicodeString
IoCreateDevice
MmAllocateNonCachedMemory
MmFreeNonCachedMemory
Ke386SetIoAccessMap
IoCreateSymbolicLink
IofCompleteRequest
Ke386IoSetAccessProcess
IoDeleteSymbolicLink
ZwClose
ZwMapViewOfSection
ObReferenceObjectByHandle
ZwOpenSection
ZwUnmapViewOfSection
IoDeleteDevice
IoGetCurrentProcess

hal

HalTranslateBusAddress

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 32B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 544B - Virtual size: 536B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 128B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
QQper/QQ宠物辅助工具v2.0（单宠物使用）/cfgdll.dll
.dll windows:4 windows x86 arch:x86

369c5423d50c36075a954f6dfade94b1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ResetEvent
GetProcAddress
GetModuleHandleA
PulseEvent
CreateEventA
WaitForSingleObject
RtlUnwind
OpenEventA
SetEvent
CloseHandle
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetFileAttributesA
GetFileType
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
VirtualAlloc
HeapReAlloc
SetStdHandle
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
FlushFileBuffers
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

UnhookWindowsHookEx
SetWindowsHookExA
GetKeyState
GetCursorPos
SendMessageA
PostMessageA
keybd_event

gdi32

GetPixel
DeleteDC
CreateDCA

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

code
Size: 4KB - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
QQper/QQ宠物辅助工具v2.0（单宠物使用）/mymacro.ini
QQper/QQ宠物辅助工具v2.0（单宠物使用）/stdlib.vbs
.vbs

Sharing

General

Malware Config

Signatures

Files

9c8decf3582072f6edfc385a689f44f4

Headers

File Characteristics

Imports

kernel32

Sections

text Size: - Virtual size: 380KB

Udata Size: 186KB - Virtual size: 188KB

.rsrc Size: 4KB - Virtual size: 8KB

pebundle Size: 1024B - Virtual size: 4KB

pebundle Size: 8KB - Virtual size: 8KB

pebundle Size: 16KB - Virtual size: 20KB

pebundle Size: 8KB - Virtual size: 8KB

pebundle Size: 2KB - Virtual size: 4KB

pebundle Size: 8KB - Virtual size: 8KB

pebundle Size: 1024B - Virtual size: 4KB

pebundle Size: 8KB - Virtual size: 8KB

pebundle Size: 16KB - Virtual size: 16KB

pebundle Size: 8KB - Virtual size: 8KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 40KB

UPX1 Size: 14KB - Virtual size: 16KB

.rsrc Size: 1KB - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 20KB - Virtual size: 17KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 936B

.reloc Size: 4KB - Virtual size: 3KB

172b54da983eaa27abf08d8ed525b840

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 1KB - Virtual size: 1KB

.data Size: 32B - Virtual size: 4B

INIT Size: 544B - Virtual size: 536B

.reloc Size: 128B - Virtual size: 108B

369c5423d50c36075a954f6dfade94b1

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Sections

.text Size: 20KB - Virtual size: 18KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 9KB

code Size: 4KB - Virtual size: 320B

.reloc Size: 4KB - Virtual size: 3KB

text
Size: - Virtual size: 380KB

Udata
Size: 186KB - Virtual size: 188KB

.rsrc
Size: 4KB - Virtual size: 8KB

pebundle
Size: 1024B - Virtual size: 4KB

pebundle
Size: 8KB - Virtual size: 8KB

pebundle
Size: 16KB - Virtual size: 20KB

pebundle
Size: 8KB - Virtual size: 8KB

pebundle
Size: 2KB - Virtual size: 4KB

pebundle
Size: 8KB - Virtual size: 8KB

pebundle
Size: 1024B - Virtual size: 4KB

pebundle
Size: 8KB - Virtual size: 8KB

pebundle
Size: 16KB - Virtual size: 16KB

pebundle
Size: 8KB - Virtual size: 8KB

UPX0
Size: - Virtual size: 40KB

UPX1
Size: 14KB - Virtual size: 16KB

.rsrc
Size: 1KB - Virtual size: 4KB

.text
Size: 20KB - Virtual size: 17KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 936B

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 1KB - Virtual size: 1KB

.data
Size: 32B - Virtual size: 4B

INIT
Size: 544B - Virtual size: 536B

.reloc
Size: 128B - Virtual size: 108B

.text
Size: 20KB - Virtual size: 18KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 9KB

code
Size: 4KB - Virtual size: 320B

.reloc
Size: 4KB - Virtual size: 3KB