1066b40db8171b7e80ea0d39c5acee84

Sharing

Copy URL Twitter E-mail

General

Target

1066b40db8171b7e80ea0d39c5acee84
Size

44KB
MD5

1066b40db8171b7e80ea0d39c5acee84
SHA1

84f7efbaa8cfe5a9bb367fec044955d66c0221cb
SHA256

69d9ba0b8bdac989906d1c74ecc60d1bcef7427304ac5400cdb86f387eaa0b15
SHA512

7b82db8a5ca39a81ee0fad8224d87a52102f95783a0bc51c89c347d0392a9c8e702f3492c675615e71c6cfd5fb48520a02ce07b228ad0d620f8e64d86a78db02
SSDEEP

768:pfcPNRpCRZhSi232fDoX+zqLC99Pl+l+0Z2OYtAX+E:hP24b2+O89Pl+l5mWXd

Score

1^/10

Malware Config

Signatures

Files

1066b40db8171b7e80ea0d39c5acee84
.dll windows:4 windows x86 arch:x86

baf4dc805cbc959c585ba1669e184fca

Code Sign

11:f3:af:c3:27:d0:1e:a0:4b:6d:03:1a:ce:d9:5c:a2
Certificate

Issuer

CN=Root Agency

Not Before

08/12/2009, 07:34

Not After

31/12/2039, 23:59

Subject

CN=Microsofft 模块

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
lstrcatA
InterlockedIncrement
GetCurrentThreadId
InitializeCriticalSection
HeapDestroy
LoadLibraryA
InterlockedDecrement
FlushInstructionCache
GetCurrentProcess
DebugBreak
OutputDebugStringA
lstrlenW
GetProcAddress
FreeLibrary
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
MultiByteToWideChar
lstrlenA
DisableThreadLibraryCalls
DeleteCriticalSection
Sleep

user32

wsprintfA
CharNextA
DestroyWindow
DefWindowProcA
RegisterClassExA
LoadCursorA
GetClassInfoExA
IsChild
GetFocus
ReleaseDC
GetDC
CharLowerA
CallWindowProcA
GetWindowLongA
CreateWindowExA
EndPaint
GetClientRect
BeginPaint
SetWindowLongA
wvsprintfA
PostMessageA
LoadStringA

advapi32

RegCloseKey
RegCreateKeyExA
RegSetValueExA

ole32

StringFromIID
CoGetMalloc
CoCreateInstance

oleaut32

RegisterTypeLi
LoadTypeLi
SysAllocString
LoadRegTypeLi
SysStringLen
DispCallFunc
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
VariantCopy
VariantClear
SafeArrayGetDim
SafeArrayGetElemsize
SysFreeString

gdi32

RestoreDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
CreateDCA
DeleteDC

msvcrt

memmove
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
atoi
_ismbcdigit
wcslen
_mbsicmp
_mbsstr
free
_purecall
memcmp
??2@YAPAXI@Z
memset
memcpy
__CxxFrameHandler
strlen
strcpy
fopen
strstr
strncpy
strftime
localtime
time
strchr
fclose
??3@YAXPAX@Z

Exports

Exports

AHtJthIpVrVAiXt
BAFGcoVdopgifOb
BHJeVpEXJQqFGXA
BVEnYsaTdWNoAlh
CAihndgpoQHLnDc
CregkoMhHVLgoUb
DPssJKhDF_m
DVHdZshGZYPbWDK
DePiTSMCH_n
DiNZfQOgbQLWbgs
DllCanUnloadNow
DllGetClassObject
DllSSS
DllUnregisterServer
EjKorlMGQKWmRDo
EkaEAKHgVjEjDae
FDhhkMUTbBVGfIt
FPfhNQPpKYbhIdn
FbpCtMcBbSrVUEt
FfQiEYVlPiGXAJK
FgEEjDbFWJRWanG
FmOgOajXoNDRjQb
FpGRCrFafVmTLQg
GVChWcOBQjOrIDM
GchDqXAKHRnhLAP
GhjbEUPQSDgmLWe
GsrlZiiZrllcdXZ
HBFJLLBBKIXeAdG
HOXehSZtNIBaaVE
HhBmnMGkKiJLsIB
HiQNTSeIATIKlaD
HqUefqegMgtIXEm
HrXlUKCRjWWtJkQ
IBTCkTIbULkbTPS
IFaIXThrKalHVmQ
IJSOddpWTJoLlpT
IOsPSEIeLYiYhVh
IOtTDXgQRWSOJUS
IarGXCcgdlihhpF
IhSNMKEfrMDLbrG
JoIreQcWhffNYrZ
KfCnnBUncqNYaUr
KqARUNPZXjTTTmE
LNQtPFYFf_1
LRGMnIBAVcLTqgf
LWLXRFmsj_9
LXAefNhLLAlpdfP
LZdsfCalXKprabF
LknWKEWlFPIeLmp
MbRNkHOnmYPOVGe
MjkNgBMgbkLlKCa
MjtfeEDPfSdnimM
MmNQiHdCmZnPNso
NNqIHVZEHJOPJAn
NUlQpkDrcCVOVnD
OYFNWIXjX_5
OlrMkfiOb_j
OrhXorHMnKUGrXb
OtAbHcFqApMLZNb
PGFKXFXIULJkjnt
QCBYeIXPAKLmIOC
QXILUqrHlaMkSYP
QhGDgCPVekgBRCV
QmRXRMfZBLTNBIE
RCQWBagFYLWmMaO
RChqUYKKPBZrChj
RDnNjWKSkftsDJL
RJGWahnLPbZTbFD
RXFOJcAUXWCZrcK
SANFJjNjWPgFLeM
SsfTZNRORpSJpJC
TtkhGbLmF_7
UWidLSKFtdeblWE
UcXYYCYfVJEMYIQ
UjXHkIsSOUONqth
UpqdBZCdooNJEtO
WOPdpXJnjrJRYCA
WclLNHPRUlAnUgO
WdlEDFeYrgjZYaB
WgqYrRBgBhGqNMR
XcLUcjBlrcqDopH
XrDAiEgoo_i
YqaogiGniGQPZDg
YraCLkTkFmcZlKE
ZGqnceDPhbSleCE
ZHgQTTXDaJrBFeK
ZNgXjPjRj_3
ZQnYREefApaCdmb
ZkJJDOsMhYkHtrt
aFfdNDpkOUPnQGV
aafnWcKZsOOAEEj
adtYZfFMjVXWdKB
arVUOKGOMoLZKOi
bCsmriPYQEAphBK
bMEMtTaQS_6
bdUoETKEZ_2
cWhmmgmibIqDHDq
cYTWOLEWhLCUNhg
cmOZEBNbXEeGSsZ
cnIeDQQOrOgSAaS
dIaZUCOkXbOlhef
eCsrHoKFOWLZXsL
eItlRCiRi_g
eaqefYgSgbJqcFB
elCtZokAqNYDDrt
eoAikkHssIcEJcl
fDPUSIIClKkhHre
fDYLSVRmSReseYV
fgDGJMVPa_4
fqQntGRlYSEWBNp
gAHiGnIqVLXLnAj
gIrqtJYYToqDjnn
gNhoZUKNfeceWSo
gcCOTYApJ_8
ghYQsbNHPGtAHMh
gpXNpQdCUEhIdcP
hioAYoPsQjGlUsg
hmLhfbSLSJCbMBY
iCSJkdlgiedgdtj
iQRlocjZrFSmkQt
isXKSMQGTTgjMNU
itdlereRHJbghXp
jHcHNihji_e
jIYfMBHlE_a
kImQqTPqFQanNYW
kJjHReABQsOLlrr
kiSKeQrpOXiVMWY
lZEEGZbsYBhcCVe
lrlTsFDBDNrIMVK
mKXUtRRmMGkRmfJ
mLsFtSsABeCqPAr
mfKdILFbBWlrenZ
nZaotYpleHoJsas
nfanLPPYHREJAQP
ntFJlRrYq_k
oAtdfDLVGbpCUEF
oCXXeWHYQNOVDZi
oETHpPGGTlGqfmr
oaRcLbVSSUmVafG
ofWaqeCVDLFRckJ
pQQniHGRpGHPGLp
pQVhhtpih_f
qFXUWCYbQsdShan
rVBcjMcIVNOGVaG
rZidrnJDkFIMUTr
raFneNDeqeUJFqh
rcoOtHAgeYpnDeQ
rjVADiCNf_d
srZEqOUkH_h
tBoYnfrfm_c
tKkNOhBJXDEVjJQ
tNpSLUfVo_b
tUtPssVomLUOkPG
toBPTYRcP_l

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

baf4dc805cbc959c585ba1669e184fca

Code Sign

11:f3:af:c3:27:d0:1e:a0:4b:6d:03:1a:ce:d9:5c:a2Certificate

Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

gdi32

msvcrt

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 18KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 2KB

11:f3:af:c3:27:d0:1e:a0:4b:6d:03:1a:ce:d9:5c:a2
Certificate

.text
Size: 20KB - Virtual size: 18KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 2KB