CheckValid
ExtractFromFile
ExtractReg
GetUrlParame
Behavioral task
behavioral1
Sample
蚂蚁注入工具/AntInjectTool.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
蚂蚁注入工具/AntInjectTool.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
蚂蚁注入工具/Greta.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
蚂蚁注入工具/Greta.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
蚂蚁注入工具/SkinPPWTL.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
蚂蚁注入工具/SkinPPWTL.dll
Resource
win10v2004-20231215-en
Target
117f2c6c5e8ac48f1f697a1b98b7af8e
Size
888KB
MD5
117f2c6c5e8ac48f1f697a1b98b7af8e
SHA1
4e8e921f6182ca42a887cf9d22d0d4ea24617162
SHA256
20747b3b99e06fe4977de87c656436fdd26119b4f41ccea016c730b766ff347f
SHA512
2dee6b665274a9b5fe77ba41c8c0ce172d1b2ab7ae7bd46df0fa392011e02ece01e102e918099657e1e23b07d23ac2684d39eadc815ba3c4d74f531d466a7752
SSDEEP
24576:CwVH/PH6dmy2aNWorDy2Z3AMrGDZgcDH9dRmRg38NtO/KEvS7:CwRHSmU7BArlDDH/RmROcOSEa7
resource | yara_rule |
---|---|
static1/unpack001/蚂蚁注入工具/AntInjectTool.exe | aspack_v212_v242 |
Checks for missing Authenticode signature.
resource |
---|
unpack001/蚂蚁注入工具/AntInjectTool.exe |
unpack001/蚂蚁注入工具/Greta.dll |
unpack001/蚂蚁注入工具/SkinPPWTL.dll |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
VirtualProtect
VirtualAlloc
VirtualFree
GetVersionExA
GetSystemInfo
VirtualQuery
DisableThreadLibraryCalls
ord815
ord800
ord825
ord2915
ord941
ord540
ord2818
ord354
ord823
ord858
ord4277
ord561
_adjust_fdiv
malloc
_initterm
free
??1type_info@@UAE@XZ
_onexit
__dllonexit
_isctype
_purecall
tolower
toupper
memmove
isspace
_except_handler3
_CxxThrowException
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
__CxxFrameHandler
_snprintf
??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIID@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??_7bad_alloc@std@@6B@
wctype
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADPAD0@Z
??0bad_alloc@std@@QAE@PBD@Z
??1bad_alloc@std@@UAE@XZ
??0bad_alloc@std@@QAE@ABV01@@Z
??_7logic_error@std@@6B@
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ
?_Xlen@std@@YAXXZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0logic_error@std@@QAE@ABV01@@Z
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??_7out_of_range@std@@6B@
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?what@logic_error@std@@UBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
CheckValid
ExtractFromFile
ExtractReg
GetUrlParame
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FileTimeToDosDateTime
DeleteFileA
SetFileTime
CreateDirectoryA
SystemTimeToFileTime
ResumeThread
GetModuleHandleA
GetCurrentDirectoryA
DosDateTimeToFileTime
VirtualProtectEx
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
CloseHandle
OutputDebugStringA
DebugBreak
InterlockedDecrement
InterlockedIncrement
lstrlenA
GetTempPathA
GetFileType
GetWindowsDirectoryA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetProcessHeap
HeapAlloc
HeapFree
GlobalFree
lstrcmpA
Sleep
lstrlenW
GetVersion
GetVersionExA
FindResourceExW
FindResourceExA
GetCurrentThreadId
WideCharToMultiByte
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
FindNextFileA
GetLastError
GetModuleFileNameA
GetShortPathNameA
lstrcmpiA
GetThreadLocale
GetFullPathNameA
GetVolumeInformationA
lstrcpyA
FindFirstFileA
FindClose
lstrcpynA
GetFileTime
GetFileSize
GetFileAttributesA
MoveFileA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
DuplicateHandle
MulDiv
FindResourceA
LoadResource
LockResource
SizeofResource
FreeResource
GlobalAlloc
GlobalLock
GlobalUnlock
VirtualProtect
VirtualQuery
GetCurrentProcess
LoadLibraryA
FreeLibrary
SetLastError
CreateProcessW
SuspendThread
GetThreadContext
FlushInstructionCache
SetThreadContext
CreateProcessA
GetProcAddress
VirtualAllocEx
GetFileInformationByHandle
GetLocalTime
GetCursorPos
KillTimer
RemoveMenu
UpdateWindow
InsertMenuA
GetDlgItem
GetWindowTextA
CheckMenuItem
GetForegroundWindow
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
IntersectRect
IsRectEmpty
EqualRect
GetClientRect
GetSysColor
FindWindowExA
SetPropA
GetMenu
CreateWindowExA
DestroyMenu
EnableScrollBar
GetScrollInfo
EndPaint
IsWindow
SetScrollPos
SetScrollInfo
GetWindowRect
TrackPopupMenuEx
OffsetRect
InflateRect
CopyRect
GetScrollPos
GetScrollRange
GetDlgCtrlID
MoveWindow
GetWindowDC
GetMenuItemInfoA
GetSubMenu
GetMenuItemID
SetRectEmpty
PtInRect
SetTimer
SetCursor
IsWindowEnabled
LoadCursorA
GetMenuItemCount
SetScrollRange
CharLowerA
GetSystemMetrics
DrawIconEx
CharUpperA
GetDesktopWindow
GetDC
ReleaseDC
LoadCursorFromFileA
LoadImageA
LoadStringA
CharNextA
wvsprintfA
ShowScrollBar
GetSysColorBrush
DrawFrameControl
SetWindowRgn
SetMenu
DeleteMenu
InsertMenuItemA
InsertMenuItemW
InsertMenuW
SetWindowPos
LoadStringW
DrawIcon
LoadIconA
LoadIconW
LoadImageW
LoadBitmapA
LoadBitmapW
TrackPopupMenu
DrawTextA
DrawTextW
DrawTextExA
DrawTextExW
MessageBoxIndirectA
WindowFromDC
MessageBoxA
SetMenuItemInfoA
AppendMenuA
GetMenuStringA
CreatePopupMenu
IsMenu
SendMessageTimeoutA
GetIconInfo
wsprintfA
ClientToScreen
CallWindowProcA
GetFocus
RedrawWindow
GetWindowTextLengthA
DestroyWindow
SetWindowTextA
DestroyIcon
GetMessagePos
ReleaseCapture
SetCapture
RemovePropA
FillRect
SetMenuInfo
GetMenuState
UnionRect
GetMenuItemRect
GetMenuDefaultItem
SetRect
GetCapture
WindowFromPoint
ScreenToClient
DrawFocusRect
IsWindowVisible
GetAsyncKeyState
MapWindowPoints
MonitorFromPoint
GetMonitorInfoA
EnableMenuItem
GetPropA
SetWindowLongA
GetWindow
GetClassLongA
SendMessageA
BeginPaint
GetParent
InvalidateRect
GetClassNameA
GetWindowLongA
DrawStateA
CreateIconIndirect
ModifyMenuA
PostMessageA
GetSystemMenu
SystemParametersInfoA
ShowWindow
GetMenuCheckMarkDimensions
SetBkColor
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
SetPixel
GetPixel
SetWindowOrgEx
SetViewportOrgEx
SetViewportExtEx
SetWindowExtEx
SetMapMode
GetObjectA
ExtCreateRegion
GetDIBits
CreateICA
GetClipBox
GetCurrentObject
BitBlt
SetBoundsRect
SetTextColor
SetBkMode
GetTextColor
GetBkMode
GetBkColor
PlgBlt
CreateSolidBrush
GetTextExtentPoint32A
GetTextExtentPoint32W
GetTextExtentPointA
GetTextExtentPointW
StretchBlt
SetStretchBltMode
CreateBitmap
SetPixelV
CreateDIBSection
PatBlt
SetBrushOrgEx
CreatePatternBrush
CreateBitmapIndirect
GetNearestColor
RoundRect
CreatePen
CreateFontIndirectA
RestoreDC
ExcludeClipRect
SaveDC
CombineRgn
CreateRectRgnIndirect
Rectangle
OffsetRgn
CreateRectRgn
LineTo
MoveToEx
DPtoLP
TextOutA
SelectClipRgn
GetViewportOrgEx
GetWindowOrgEx
SetTextAlign
GetCharWidthA
CreateFontA
RealizePalette
SelectPalette
CreateDIBitmap
SetDIBitsToDevice
RectVisible
StretchDIBits
GetStockObject
DeleteObject
ExtTextOutA
SelectObject
DeleteDC
ChooseColorA
ChooseColorW
GetFileTitleA
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
ShellExecuteA
CreateStreamOnHGlobal
CoCreateGuid
OleLoadPicture
ImageList_Destroy
ImageList_AddMasked
ImageList_GetImageInfo
ImageList_Copy
ImageList_Duplicate
ImageList_DrawIndirect
_TrackMouseEvent
ImageList_GetIcon
ImageList_Draw
AlphaBlend
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_CxxThrowException
strncpy
getc
fputc
fflush
ftell
fseek
fwrite
fread
realloc
fopen
fclose
div
sqrt
calloc
_mbsnbcpy
ceil
floor
malloc
free
strchr
strftime
_ismbblead
localtime
gmtime
time
mktime
sprintf
sin
cos
fabs
abs
_ftol
__RTDynamicCast
wcsncpy
toupper
_purecall
_mbschr
_mbsicmp
atof
_splitpath
_fullpath
_mbsrchr
_mbsinc
_mbsstr
memcmp
strcmp
_except_handler3
strcpy
strcat
memset
strlen
memmove
_ismbcspace
_ismbcdigit
wcslen
memcpy
atoi
_mbscmp
??2@YAPAXI@Z
??3@YAXPAX@Z
_EH_prolog
__CxxFrameHandler
_stricmp
_tzset
_adjust_fdiv
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??0CSkinIniFile@@QAE@ABV0@@Z
??0CSkinIniFile@@QAE@VCString@WTL@@@Z
??0CSkinIniFile@@QAE@XZ
??1CSkinIniFile@@UAE@XZ
??4CSkinIniFile@@QAEAAV0@ABV0@@Z
??_7CSkinIniFile@@6B@
?DeleteKey@CSkinIniFile@@QAE_NABVCString@WTL@@@Z
?DeleteValue@CSkinIniFile@@QAE_NABVCString@WTL@@0@Z
?FindKey@CSkinIniFile@@QAEHABVCString@WTL@@@Z
?FindValue@CSkinIniFile@@QAEHHABVCString@WTL@@@Z
?GetNumKeys@CSkinIniFile@@QAEHXZ
?GetNumValues@CSkinIniFile@@QAEHVCString@WTL@@@Z
?GetValue@CSkinIniFile@@QAE?AVCString@WTL@@ABV23@00@Z
?GetValue@CSkinIniFile@@QAE?AVCString@WTL@@ABV23@HAAV23@@Z
?GetValueF@CSkinIniFile@@QAENABVCString@WTL@@0@Z
?GetValueI@CSkinIniFile@@QAEHABVCString@WTL@@0H@Z
?ReadFile@CSkinIniFile@@QAE_NABVCString@WTL@@@Z
?ReadFile@CSkinIniFile@@QAE_NPAEH@Z
?ReadProfile@CSkinIniFile@@QAEXABVCString@WTL@@@Z
?Reset@CSkinIniFile@@QAEXXZ
?SetPath@CSkinIniFile@@QAEXABVCString@WTL@@@Z
?SetValue@CSkinIniFile@@QAE_NABVCString@WTL@@000_N@Z
?SetValueF@CSkinIniFile@@QAE_NABVCString@WTL@@0N_N@Z
?SetValueI@CSkinIniFile@@QAE_NABVCString@WTL@@0HH_N@Z
?WriteFile@CSkinIniFile@@QAEXXZ
?getline2@CSkinIniFile@@QAEHVCString@WTL@@AAV23@@Z
?getline@CSkinIniFile@@QAEAAV?$basic_istream@DU?$char_traits@D@std@@@std@@AAV23@AAVCString@WTL@@@Z
?skinppDrawSkinObject@@YAXPAUHDC__@@UtagRECT@@W4DRAWTYPE@@H@Z
?skinppGetBitmapRes@@YAPAUHBITMAP__@@PBD@Z
?skinppGetBitmapResRect@@YAHPBDAAH111@Z
?skinppGetBitmapSize@@YAXPAUHBITMAP__@@AAH1@Z
?skinppGetImageListFromID@@YAPAU_IMAGELIST@@H@Z
?skinppGetMainFrameMenu@@YAPAUHMENU__@@XZ
?skinppGetMultiLangMenu@@YAPAUHMENU__@@XZ
?skinppGetResFromID@@YAPAUHBITMAP__@@W4SKINOBJTYPE@@HH@Z
?skinppGetResFromID@@YAPAXPAU_ResourceInfo@@@Z
?skinppGetSkinResource@@YAPAEPBDAAH@Z
?skinppLoadLanguageStr@@YAHPBDPADH@Z
?skinppLoadSkinFromRes@@YAHPAUHINSTANCE__@@PBD1PAD@Z
?skinppLoadString@@YAHHPADH@Z
?skinppSetBackgroundDC@@YAXPAUHWND__@@PAUHDC__@@@Z
?skinppSetButtonSounds@@YAXPAUHWND__@@PBD1@Z
?skinppSetButtonTooltip@@YAXPAUHWND__@@PBD@Z
?skinppSetCustomDraw@@YAXPAUHWND__@@H@Z
?skinppSetDialogBkClipRgn@@YAXPAUHWND__@@HH@Z
?skinppSetDialogEraseBkgnd@@YAXPAUHWND__@@H@Z
?skinppSetDrawMenu@@YAXPAUHMENU__@@H@Z
?skinppSetMenuItemImage@@YAHIPAU_IMAGELIST@@H@Z
?skinppSetMenuSkinObjectID@@YAXPAUHWND__@@H@Z
?skinppSetNoDrawText@@YAXPAUHWND__@@H@Z
?skinppSetSkinOwnerMenu@@YAXH@Z
?skinppSetStaticFont@@YAHHPBDH@Z
?skinppSetStaticTextAlign@@YAHHH@Z
?skinppSetStaticTextColor@@YAHHK@Z
?skinppSetStatusBarTransparent@@YAXPAUHWND__@@H@Z
?skinppSetTabItemImageID@@YAXPAUHWND__@@HH@Z
skinppExitSkin
skinppGetDefaultSysColor
skinppGetIconFromRes
skinppGetSkinSysColor
skinppInitializeSkin
skinppLoadSkin
skinppRemoveSkin
skinppRemoveSkinHwnd
skinppSetFreeDlgID
skinppSetListBoxItemDrawInfo
skinppSetListHeaderCtrlItemID
skinppSetListHeaderSortInfo
skinppSetNoSkinHwnd
skinppSetSkinHwnd
skinppSetSkinResID
skinppSetTrackPopupMenuID
skinppSetWindowResID
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ