9IC�b>'���qQ������úe*� �]�-�Pl�E�US���?��B�r ��O��C������AhG1��U�&7�ku���6��6%Z� �r�(z!w8�ʮoXf^�DDdU�=��ݸ`�<��(�]�tE���T�@� �?��%����5'����^LnRQ]s�Z�T� �:aM�R����ȝ/�'E�~��YY��cm��qO3>{�j���|�g� ��5��3{��*�/)E�$�Q~OU���y����xO������w��o�l����w|�k�DD�V���߰�ޥ'c�Y�n�����1`K�� �h\�m\J�a����[�����aa��O���^�M� -$LN��!YKC�c�P�>N�iA8f���Ω�ݽ��_4�d�U�=$ȁQ��&��������2���� �������(��ZfT�/�m� �������2}��$��Z��$���L����)N&��S��RP��^]�}�>Q�/�=�S�n�"%�},��\��4����B蘓�3�f/�)� 6��ޑH��7ft�CJɃgXb�јX�uC�?��Q�/wY]��YtH.�)�u���u�W�}��ī��j.r�{�JD�g�����_9%���q&+^�/�*=e��!�5�ߘ$���u��@)��H�J�8�=j�2��i��r?wќ�Gί��~���ƲA�ҙ������%��m��b^!���[������R,�� (���V��h-���f����έWX��ؗͲ��tlq�F�2֘��ՕZ�:�Be��$|�:J���V�>1��` ��`h�Ul�KHh�]o���F��Z �xz�>�v���� �������R�Ov�I���NS 1�������_jp�u��NT�:�F<v���ux�f>q��B�X���RV�H�ZUVE�TUO ���z��N��{p�[�����]�O[��x�}��h���B��!�� ���N���y��2��㭾;��no} �z������ܦ>�/��\����^�L@���ګf��:]+�6�0K�w��k6��xx��52���'��c�hYB�T��$^�3����y���O>)��lv���>�8ۺ6:�����R�pYQ�s��\ȲG4&�5���؎�����#��S����x����l����㖉��ZK)�Ac�!��_ ��;�� W^��#H=xh�=���U�'Tߎ1g̑5�R����H9����2p-��zz�`An��|�[G�C{� h������>�vg/O�ƴ��k�M�� ���88?Ӷ>o���mg�S�-��S<��(RJ�����s�y���av[��{U�[dJ��2qZײՌ��.�\;����t�8���`.ρ��h,IeV���X�4:�M[ah�aW�����5�NyR�=����f�9h(+�U~��\�*���Gm�~p�4� ;0�u��}*�o�,X�����86�� o�0�=�4� u�q��ř-QB���6ǧ�7 ^�6����T��W�F�}�1�h�r�'����6��'�_$ Q��;R*�|0����P��o��x@ލ�_��������X�y��>�u��H�};�\���}�?��+<�=�4��Dq�U�i+6�����,[�-�Gu�v�Z}Ĵ6��\�0���#`z2W�\(/����G �4PbF-z�7�bm²b++��\ACn #)�R�v�}��R�)֓2�A�H�X��\8u�� ����0@�������qK�# �0�E����;�ڪ�`�d[:A:� ��I4e���x���0u=c"'q���%�*ԪY�4W�p9�)1K/��a���ך�$��k�9�q�g���_��D�����Q��V��k��%~iR��hF�ԑ��?$��O̻�%crx�l��e|���e�e�S&QOj����]P6����7��ô'� �`��� ź���S�1'vW��� �;���kXxǷ���j%[�QL�;b�$������e����XF���f��^�F��KJ�'��k�zj��Wc��u������?�`�h�B���ku�,����X� 7F}!'��w�� a�l�ı�:˻F�C�3��9��,mA��Kf��Ѻ:B-GC0{o��H�(|�ޯQ����y����w 3����������Sї*��i�]��i����œ㝩�ujR��}�mu�3� �Z�@|�@%�������+9�7��4�z��������q5݄��RË"�����Pa[}T��22�W�M�gl� BU���Z�j��En���\d� �U�*m{��ґGF��m$�_w�1'���AȲ��b�e���ͩw�1c�m@Ԛ��aG�^`O�+L[B���D��n�heAOr�����o� X�y~l�C8{{�� �,E��_��X�Hτ�k��z�����N�l8���I7�|��k�K&�m�/�ZD����A�d� ɋ��"��P��\1gL�aNМ��5��s4�=�?��922����������Ss����綷���-��^�H��.���x�.f>��N\����V��ׄv�d�:<�S�;���IwU���S0<�h"�u�M4����_� ����$�(��C��QOOw�*OO�����U#A�պ� #&�2dW��@�ޚS�8�&h�����+o3�G�0PP��Ov)�,����=��W���oYZ�\��Fp��0/�DT��N�$�\�0�ʜtP���i�H��I�`�$���5��/}�J��/L{�dg�����,\�24�q�(.�²(�'(��>�����L�U�Y�u^�nF�]&y�����k�{���}�D���� Zk�Nzς��I,x3n3[��jN��1���#P���J��3�Oc���Ǎ��i��o��WuB��uxPC�gr��ghP�mH�b����S�����R�T��LHS�l{N�@�w-�s��?u-#�{ec� *�k�?n���� 6{��zx���@=}�J,X�zpؖ`��e+�����Y��m�3ǚDE��C���?�jmG�����z�d�cTJ�!yg�AV `��hQ ��<��O ��9Y3�1�y��K
Overview
overview
8Static
static
3006.exe
windows7-x64
3006.exe
windows10-2004-x64
31.vbs
windows7-x64
81.vbs
windows10-2004-x64
82.bat
windows7-x64
82.bat
windows10-2004-x64
82.vbs
windows7-x64
82.vbs
windows10-2004-x64
8288IE.exe
windows7-x64
3288IE.exe
windows10-2004-x64
345.exe
windows7-x64
745.exe
windows10-2004-x64
55.exe
windows7-x64
35.exe
windows10-2004-x64
388IE.exe
windows7-x64
788IE.exe
windows10-2004-x64
788IG.exe
windows7-x64
788IG.exe
windows10-2004-x64
5feifei.exe
windows7-x64
8feifei.exe
windows10-2004-x64
8msn036.exe
windows7-x64
7msn036.exe
windows10-2004-x64
7time.exe
windows7-x64
8time.exe
windows10-2004-x64
8Static task
static1
Behavioral task
behavioral1
Sample
006.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
006.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
1.vbs
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
1.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
2.bat
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
2.bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
2.vbs
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
2.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
288IE.exe
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
288IE.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
45.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
45.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
5.exe
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
5.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
88IE.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
88IE.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
88IG.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
88IG.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
feifei.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
feifei.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
msn036.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
msn036.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
time.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
time.exe
Resource
win10v2004-20231215-en
General
-
Target
7884f34de0cc756bd5dea6cad11b0fae
-
Size
507KB
-
MD5
7884f34de0cc756bd5dea6cad11b0fae
-
SHA1
5e8c3c5508fdba1b4c7f2be9e3390caecdd2985c
-
SHA256
6c0e97b564eb352cc7acbb6bc1f0306241076f2254b38a8a080955a2892324fc
-
SHA512
7ba7ea3d33e9d8d1f3d05956f41fc8ed04e7b46e8709476587278a214e993dd4735fc5eb8bc1a7ac85db98ff760ce72303b3db322da3f23ac6fe0c6837d6ec04
-
SSDEEP
12288:shBgEUER+yqPZuReyD9hBz5LLHEjOarfhnF6YAoNtTB:scEUERShoeoJLLHF8XAo3TB
Malware Config
Signatures
-
Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/006.exe unpack001/288IE.exe unpack001/45.exe unpack001/5.exe unpack001/88IE.exe unpack001/88IG.exe unpack001/feifei.exe unpack001/msn036.exe unpack001/time.exe -
NSIS installer 3 IoCs
resource yara_rule static1/unpack001/288IE.exe nsis_installer_2 static1/unpack001/5.exe nsis_installer_2 static1/unpack001/88IE.exe nsis_installer_2
Files
-
7884f34de0cc756bd5dea6cad11b0fae.rar
-
006.exe.exe windows:6 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
LoadLi Size: 4KB - Virtual size: 1830.1MB
Size: 200KB - Virtual size: 4B
���� Size: - Virtual size:
-
1.vbs.vbs
-
2.bat
-
2.vbs.vbs
-
288IE.exe.exe windows:4 windows x86 arch:x86
7fa974366048f9c551ef45714595665e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 40KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
45.exe.exe windows:4 windows x86 arch:x86
a93acd5bf33ccab48587917cab882ace
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemDirectoryA
FreeLibrary
WinExec
GetModuleFileNameA
Sleep
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetStartupInfoA
user32
DispatchMessageA
CreateWindowExA
ShowWindow
PostMessageA
DefWindowProcA
GetMessageA
RegisterClassExA
TranslateMessage
msvcrt
strncpy
_controlfp
_except_handler3
__set_app_type
sprintf
rand
__CxxFrameHandler
??3@YAXPAX@Z
strchr
__p__fmode
fwrite
fclose
fopen
srand
time
atol
??2@YAPAXI@Z
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
Sections
.text Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 556B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
5.exe.exe windows:4 windows x86 arch:x86
7fa974366048f9c551ef45714595665e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 40KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
88IE.exe.exe windows:4 windows x86 arch:x86
7fa974366048f9c551ef45714595665e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 260KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
88IG.exe.exe windows:4 windows x86 arch:x86
73ba3482e344c923d4cc9579ad4b1e9b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemDirectoryA
FreeLibrary
GetModuleFileNameA
GetProcAddress
LoadLibraryA
WinExec
Sleep
GetModuleHandleA
GetStartupInfoA
user32
CreateWindowExA
PostMessageA
DefWindowProcA
GetMessageA
TranslateMessage
DispatchMessageA
ShowWindow
RegisterClassExA
msvcrt
atol
_controlfp
_except_handler3
__set_app_type
sprintf
??3@YAXPAX@Z
rand
__CxxFrameHandler
srand
__p__fmode
strncpy
fclose
fwrite
fopen
strchr
??2@YAPAXI@Z
time
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
Sections
.text Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 556B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
feifei.exe.exe windows:4 windows x86 arch:x86
ccc0e829fe1206cd39d147ca374725d4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
SetFileSecurityA
SetFileSecurityW
kernel32
CloseHandle
CompareStringA
CreateDirectoryA
CreateDirectoryW
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW
DosDateTimeToFileTime
ExitProcess
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FindResourceA
FreeLibrary
GetCPInfo
GetCommandLineA
GetCurrentDirectoryA
GetCurrentProcess
GetDateFormatA
GetFileAttributesA
GetFileAttributesW
GetFileType
GetFullPathNameA
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetNumberFormatA
GetProcAddress
GetProcessHeap
GetStdHandle
GetSystemTime
GetTempPathA
GetTickCount
GetTimeFormatA
GetVersionExA
GlobalAlloc
HeapAlloc
HeapFree
HeapReAlloc
IsDBCSLeadByte
LoadLibraryA
LocalFileTimeToFileTime
MoveFileA
MoveFileExA
MultiByteToWideChar
ReadFile
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
Sleep
SystemTimeToFileTime
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcmpiA
lstrlenA
comctl32
ord17
comdlg32
CommDlgExtendedError
GetOpenFileNameA
GetSaveFileNameA
gdi32
DeleteObject
shell32
SHBrowseForFolderA
SHChangeNotify
SHFileOperationA
SHGetFileInfoA
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
user32
CharToOemA
CharToOemBuffA
CharUpperA
CopyRect
CreateWindowExA
DefWindowProcA
DestroyIcon
DestroyWindow
DialogBoxParamA
DispatchMessageA
EnableWindow
EndDialog
FindWindowExA
GetClassNameA
GetClientRect
GetDlgItem
GetDlgItemTextA
GetMessageA
GetParent
GetSysColor
GetSystemMetrics
GetWindow
GetWindowLongA
GetWindowRect
GetWindowTextA
IsWindow
IsWindowVisible
LoadBitmapA
LoadCursorA
LoadIconA
LoadStringA
MapWindowPoints
MessageBoxA
OemToCharA
OemToCharBuffA
PeekMessageA
PostMessageA
RegisterClassExA
SendDlgItemMessageA
SendMessageA
SetDlgItemTextA
SetFocus
SetMenu
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
TranslateMessage
UpdateWindow
WaitForInputIdle
wsprintfA
wvsprintfA
ole32
CLSIDFromString
CoCreateInstance
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
Sections
.text Size: 78KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
msn036.exe.exe windows:4 windows x86 arch:x86
42134c4fb1b2d3cf6b447e018a5de700
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
SetFileTime
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
lstrcmpA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
MulDiv
FindNextFileA
FindFirstFileA
DeleteFileA
ExitProcess
user32
ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
SystemParametersInfoA
RegisterClassA
EndDialog
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
CreateDialogParamA
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
LoadImageA
GetDC
EnableWindow
InvalidateRect
CreateWindowExA
GetWindowLongA
DrawFocusRect
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
TrackPopupMenu
wsprintfA
SendMessageA
CallWindowProcA
MapWindowPoints
GetWindowRect
ScreenToClient
PtInRect
LoadCursorA
SetCursor
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SetWindowLongA
gdi32
SetBkColor
GetDeviceCaps
GetCurrentObject
GetObjectA
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegEnumKeyA
RegEnumValueA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegQueryValueExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 290KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 264KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
time.exe.exe windows:4 windows x86 arch:x86
7f4e72916dd448ec452c94258bb1813d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strcmp
memset
sprintf
strlen
rand
memcpy
_strnicmp
printf
strrchr
strcat
strstr
strcpy
kernel32
CreateThread
GetStartupInfoA
LoadLibraryA
lstrcmpiA
FreeLibrary
VirtualAllocEx
GetModuleHandleA
GetProcAddress
CreateRemoteThread
LocalAlloc
GetVolumeInformationA
CopyFileA
WinExec
GetLocalTime
MultiByteToWideChar
WriteProcessMemory
Process32Next
GetCurrentProcessId
Process32First
CreateToolhelp32Snapshot
ResumeThread
CreateProcessA
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
Sleep
CloseHandle
WriteFile
CreateFileA
GetLastError
OpenProcess
WritePrivateProfileStringA
HeapFree
HeapAlloc
GetProcessHeap
WideCharToMultiByte
TerminateThread
WaitForSingleObject
lstrlenA
DuplicateHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
QueryServiceConfigA
ChangeServiceConfigA
CreateServiceA
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
SetServiceStatus
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
shell32
SHGetSpecialFolderPathA
ShellExecuteA
netapi32
NetScheduleJobAdd
ntdll
NtQueryInformationFile
NtQuerySystemInformation
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ