2024-01-06_db582dc85f6bd65590b2f9ed513fcfaa_hacktools_xiaoba

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-06_db582dc85f6bd65590b2f9ed513fcfaa_hacktools_xiaoba
Size

4.3MB
MD5

db582dc85f6bd65590b2f9ed513fcfaa
SHA1

bf043483495ded26d83977a9db81329c2effc83d
SHA256

757a718978771f03c34ed15c58e1c14dc1490559d3b5e180874ca6e606bd5628
SHA512

885e5380dd4fd99aeb07dcc431aa46e649f1323946378040b8e23223b2dc742b626b7ded24117fda4febb7dc88472add681c1d9f2c81371de0ca0e80af1f1098
SSDEEP

49152:gXLwgcrXZCW/yKCRzE4mJQxduVlcXTvf7PXtktrqwBj:GLerXTlWzE45xdulc752v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-06_db582dc85f6bd65590b2f9ed513fcfaa_hacktools_xiaoba

Files

2024-01-06_db582dc85f6bd65590b2f9ed513fcfaa_hacktools_xiaoba
.exe windows:4 windows x86 arch:x86

b2eee75584ded5d5e4ad01a1cb952ef7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvfw32

DrawDibClose
DrawDibDraw
DrawDibOpen

avifil32

AVIFileInit
AVIStreamInfoA
AVIStreamSampleToTime
AVIStreamStart
AVIStreamLength
AVIStreamGetFrameOpen
AVIStreamOpenFromFileA
AVIStreamGetFrame
AVIStreamRelease
AVIStreamGetFrameClose
AVIFileExit

rasapi32

RasGetEntryDialParamsA
RasEnumConnectionsA
RasGetConnectStatusA
RasHangUpA
RasDialA
RasEnumEntriesA

iphlpapi

SendARP
GetAdaptersInfo

shlwapi

PathFileExistsA
SHDeleteKeyA
SHDeleteValueA
PathAppendA

mpr

WNetEnumResourceA
WNetCloseEnum
WNetAddConnection2A
WNetCancelConnection2A
WNetOpenEnumA

winmm

midiStreamRestart
midiStreamClose
midiOutReset
midiStreamStop
midiStreamPause
midiOutShortMsg
midiStreamOut
midiOutPrepareHeader
midiStreamProperty
midiStreamOpen
midiOutUnprepareHeader
waveOutOpen
waveOutGetNumDevs
waveOutClose
waveOutReset
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
timeKillEvent
waveOutRestart
waveOutGetDevCapsA
mciSendStringA
PlaySoundA
timeSetEvent

ws2_32

bind
htonl
socket
setsockopt
sendto
recvfrom
ioctlsocket
connect
gethostbyaddr
htons
WSAAsyncSelect
closesocket
send
select
recv
listen
getpeername
accept
__WSAFDIsSet
shutdown
WSAGetLastError
ntohs
getsockname
WSASetLastError
ntohl
WSACleanup
WSAStartup
inet_addr
gethostbyname
inet_ntoa
gethostname

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerLanguageNameA

kernel32

GetFileSize
Process32Next
Process32First
CreateToolhelp32Snapshot
SetFilePointer
InterlockedIncrement
OpenProcess
Module32Next
Module32First
GlobalMemoryStatus
EnumResourceNamesA
LoadLibraryExA
WriteProfileStringA
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemDefaultLangID
GetLocaleInfoA
GetVersion
FlushInstructionCache
CreateMutexA
ReleaseMutex
SuspendThread
LocalFree
FormatMessageA
FileTimeToLocalFileTime
lstrcpynA
DuplicateHandle
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetStringTypeExA
GetThreadLocale
lstrcmpiA
GetShortPathNameA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
lstrcmpA
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
TlsSetValue
LocalReAlloc
TlsGetValue
GetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
GetCurrentThread
SetThreadPriority
GlobalFlags
LocalUnlock
LocalLock
SetErrorMode
GetProcessVersion
GetCPInfo
GetOEMCP
GetPrivateProfileIntA
GetTempFileNameA
GetStartupInfoA
RtlUnwind
GetSystemTime
GetLocalTime
RaiseException
ExitThread
HeapSize
GetACP
SetStdHandle
GetFileType
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
SetEnvironmentVariableW
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
SetConsoleCtrlHandler
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
CompareStringA
CompareStringW
IsBadReadPtr
IsBadCodePtr
IsValidLocale
IsValidCodePage
EnumSystemLocalesA
GetLocaleInfoW
InterlockedDecrement
SetLastError
GetTimeZoneInformation
FileTimeToSystemTime
OpenFile
GetCurrentProcess
SetSystemPowerState
GetWindowsDirectoryA
GetSystemDirectoryA
TerminateThread
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetUserDefaultLCID
GetProfileStringA
SetCommTimeouts
SetCommMask
GetCommState
SetCommState
WriteFile
PurgeComm
WaitCommEvent
ClearCommError
WaitForMultipleObjects
GetOverlappedResult
GetCommModemStatus
CreateFileA
DeviceIoControl
SetEvent
FindResourceA
LoadResource
LockResource
SizeofResource
ReadFile
PeekNamedPipe
CreatePipe
GetExitCodeProcess
lstrlenW
RemoveDirectoryA
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
lstrlenA
WinExec
lstrcpyA
FindNextFileA
GetLogicalDriveStringsA
GetDriveTypeA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetFullPathNameA
FreeLibrary
LoadLibraryA
GetLastError
GetVersionExA
GetPrivateProfileSectionNamesA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetComputerNameA
EscapeCommFunction
CreateThread
CreateEventA
ResetEvent
Sleep
OutputDebugStringA
ExpandEnvironmentStringsA
GlobalAlloc
GlobalLock
GlobalUnlock
GetTempPathA
FindFirstFileA
FindClose
SetFileAttributesA
GetFileAttributesA
MoveFileA
DeleteFileA
CopyFileA
CreateDirectoryA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetVolumeLabelA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
GetDiskFreeSpaceA
MulDiv
SetLocalTime
GetCommandLineA
GetTickCount
CreateProcessA
WaitForSingleObject
CloseHandle
InterlockedExchange
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
WriteConsoleA
TerminateProcess

user32

IsDialogMessageA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ShowOwnedPopups
wvsprintfA
WaitMessage
LoadStringA
RemoveMenu
GetDialogBaseUnits
LoadAcceleratorsA
ReuseDDElParam
UnpackDDElParam
BringWindowToTop
EndDialog
CreateDialogIndirectParamA
DestroyWindow
EndPaint
BeginPaint
CharUpperA
GetWindowTextLengthA
GetTabbedTextExtentA
EnumChildWindows
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExA
MoveWindow
GetCursor
CheckMenuItem
GetMenuStringA
LoadMenuA
InsertMenuA
GetMenuState
GrayStringA
DrawTextA
TabbedTextOutA
WindowFromDC
IsMenu
GetMenuItemID
GetMenuItemRect
DrawMenuBar
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetSysColorBrush
GetWindowDC
GetMenuItemInfoA
GetMenuItemCount
ChangeDisplaySettingsA
EnumWindows
GetWindowTextA
FindWindowExA
GetDlgItem
SendMessageTimeoutA
FindWindowA
GetWindowThreadProcessId
mouse_event
keybd_event
GetClassNameA
GetDesktopWindow
VkKeyScanExA
GetKeyboardLayout
SetWindowTextA
OemToCharA
CharToOemA
MsgWaitForMultipleObjects
DrawStateA
FrameRect
GetNextDlgTabItem
ExitWindowsEx
GetForegroundWindow
LoadIconA
TranslateMessage
DrawFrameControl
DrawEdge
DrawFocusRect
WindowFromPoint
GetMessageA
DispatchMessageA
SetRectEmpty
RegisterClipboardFormatA
ScrollWindowEx
CreateIconFromResource
DrawIconEx
CreatePopupMenu
AppendMenuA
ModifyMenuA
CreateMenu
CreateAcceleratorTableA
GetDlgCtrlID
GetSubMenu
EnableMenuItem
GetDlgItemInt
ClientToScreen
EnumDisplaySettingsA
LoadImageA
SystemParametersInfoA
ShowWindow
IsWindowEnabled
TranslateAcceleratorA
GetKeyState
CopyAcceleratorTableA
PostQuitMessage
IsZoomed
GetClassInfoA
DefWindowProcA
GetSystemMenu
DeleteMenu
GetMenu
SetMenu
PeekMessageA
IsIconic
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetCapture
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
SetRect
InflateRect
IntersectRect
DestroyIcon
PtInRect
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor
GetDC
FillRect
InvertRect
IsRectEmpty
ScrollDC
ReleaseDC
IsChild
TrackPopupMenu
DestroyMenu
CheckRadioButton
CheckDlgButton
UnregisterClassA
SendDlgItemMessageA
MapWindowPoints
AdjustWindowRectEx
DeferWindowPos
BeginDeferWindowPos
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
CreateIconFromResourceEx
GetDlgItemTextA
EndDeferWindowPos
ScrollWindow
GetKeyboardState
GetScrollInfo
SetScrollInfo
ShowScrollBar
GetScrollPos
RegisterClassA
SetWindowPlacement
CreateWindowExA
SetForegroundWindow
GetWindowRect
EqualRect
UpdateWindow
ValidateRect
InvalidateRect
LockWindowUpdate
GetClientRect
GetFocus
GetParent
GetTopWindow
PostMessageA
IsWindow
SetParent
DestroyCursor
SendMessageA
SetWindowPos
MessageBeep
MessageBoxA
GetCursorPos
GetSystemMetrics
IsClipboardFormatAvailable
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
wsprintfA
WaitForInputIdle
GetClassLongA
GetMessageTime
GetLastActivePopup
RegisterWindowMessageA
AdjustWindowRect
GetWindowPlacement

gdi32

PatBlt
CreatePen
GetObjectA
SelectObject
CreatePatternBrush
CreateBitmap
CreateHatchBrush
CreateBrushIndirect
CreateDCA
CreateCompatibleBitmap
GetPolyFillMode
GetStretchBltMode
GetROP2
GetBkColor
GetBkMode
GetTextColor
CreateRoundRectRgn
CreateEllipticRgn
PathToRegion
EndPath
BeginPath
GetWindowOrgEx
GetViewportOrgEx
GetWindowExtEx
GetDIBits
RealizePalette
SelectPalette
StretchBlt
CreatePalette
DPtoLP
GetCurrentObject
RoundRect
CombineRgn
CreateRectRgn
TextOutA
FillRgn
SetTextColor
StretchDIBits
SetDIBitsToDevice
GetBitmapBits
GetGlyphOutlineA
GetTextExtentExPointA
CreateFontA
GetGlyphOutlineW
GetTextExtentExPointW
EnumFontFamiliesExA
AddFontResourceA
RemoveFontResourceA
GdiFlush
SetDIBColorTable
GetPaletteEntries
CreateSolidBrush
GetClipBox
PtVisible
RectVisible
GetStockObject
Escape
SetWindowOrgEx
SaveDC
RestoreDC
CreatePenIndirect
SetPolyFillMode
SetROP2
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
MoveToEx
LineTo
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetCurrentPositionEx
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
PolyBezierTo
SelectClipPath
ExtSelectClipRgn
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
GetViewportExtEx
ExtCreatePen
CreateDIBPatternBrushPt
GetDCOrgEx
GetTextMetricsA
GetMapMode
SetRectRgn
GetCharWidthA
CopyMetaFileA
AbortDoc
SetAbortProc
SelectClipRgn
DeleteObject
CreateDIBitmap
GetSystemPaletteEntries
CreateFontIndirectA
EndPage
EndDoc
SetBkColor
CreateRectRgnIndirect
CreateDIBSection
SetPixel
ExtCreateRegion
SetStretchBltMode
GetClipRgn
Pie
Chord
DeleteDC
Arc
StartDocA
StartPage
BitBlt
Polygon
GetPixel
CreateCompatibleDC
SetPixelV
ExtTextOutA
Ellipse
Rectangle
GetTextExtentPoint32A
CreateHalftonePalette
LPtoDP
SetBkMode
GetDeviceCaps
CreatePolygonRgn

msimg32

TransparentBlt
GradientFill
AlphaBlend

winspool.drv

SetPrinterA
SetFormA
DeleteFormA
GetFormA
EnumFormsA
OpenPrinterA
DocumentPropertiesA
ClosePrinter
EnumPrintersA
AddFormA
GetPrinterA

comdlg32

GetFileTitleA
GetSaveFileNameA
FindTextA
ReplaceTextA
ChooseColorA
ChooseFontA
CommDlgExtendedError
GetOpenFileNameA
PrintDlgA
PageSetupDlgA

advapi32

GetUserNameA
AllocateAndInitializeSid
InitializeAcl
AddAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
GetLengthSid
CopySid
RegSetKeySecurity
RegQueryInfoKeyA
RegOpenKeyA
RegEnumKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegGetKeySecurity
RegCreateKeyExA
RegSetValueA
SetFileSecurityA
GetFileSecurityA

shell32

SHEmptyRecycleBinA
SHChangeNotify
SHAppBarMessage
SHFileOperationA
DragFinish
DragQueryFileA
SHGetSpecialFolderPathA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetFileInfoA
DragAcceptFiles
ShellExecuteA
Shell_NotifyIconA

ole32

OleRun
OleUninitialize
CLSIDFromString
CoCreateGuid
CLSIDFromProgID
CoCreateInstance
CoTaskMemAlloc
CreateBindCtx
CoTaskMemFree
SetConvertStg
WriteFmtUserTypeStg
WriteClassStg
CreateStreamOnHGlobal
OleDuplicateData
OleRegGetUserType
ReadFmtUserTypeStg
ReadClassStg
StringFromCLSID
CoTreatAsClass
CoDisconnectObject
OleInitialize
ReleaseStgMedium

oleaut32

VariantInit
SysAllocString
SafeArrayDestroy
SafeArrayCreate
SafeArrayPutElement
CreateErrorInfo
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
LHashValOfNameSys
GetActiveObject
OleCreatePictureIndirect
OleCreateFontIndirect
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantCopyInd
SafeArrayLock
SafeArrayUnlock
SafeArrayGetElemsize
SafeArrayRedim
SysStringByteLen
VarCyFromStr
VarBstrFromCy
VarDateFromStr
VarBstrFromDate
SafeArrayCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayPtrOfIndex
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SysAllocStringLen
SysReAllocStringLen
SafeArrayGetElement
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
GetErrorInfo
SetErrorInfo
VariantChangeType
VariantClear
VariantCopy
SafeArrayCreateVector

comctl32

ImageList_SetBkColor
ImageList_GetImageCount
ImageList_GetImageInfo
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_Create
ImageList_Destroy
ord14
ord13
ord17
ImageList_AddMasked
ImageList_Draw
ImageList_Duplicate
ImageList_DrawIndirect
ImageList_LoadImageA
_TrackMouseEvent
ImageList_Write
ImageList_Read
ImageList_Merge

wininet

InternetGetLastResponseInfoA
GopherFindFirstFileA
HttpSendRequestExA
HttpEndRequestA
HttpAddRequestHeadersA
InternetErrorDlg
GopherOpenFileA
GopherGetAttributeA
GopherCreateLocatorA
FtpOpenFileA
InternetQueryDataAvailable
InternetWriteFile
InternetSetFilePointer
InternetGetCookieA
InternetSetCookieA
InternetSetStatusCallback
InternetSetOptionExA
InternetQueryOptionA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetGetConnectedState
InternetOpenUrlA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
DeleteUrlCacheEntry
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
FtpFindFirstFileA
InternetFindNextFileA
FtpGetFileA
FtpPutFileA
FtpGetCurrentDirectoryA
FtpSetCurrentDirectoryA
FtpRemoveDirectoryA
FtpCreateDirectoryA
FtpRenameFileA
FtpDeleteFileA
InternetConnectA
InternetSetOptionA
InternetCloseHandle
InternetOpenA

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 188KB - Virtual size: 672KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 152KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b2eee75584ded5d5e4ad01a1cb952ef7

Headers

File Characteristics

Imports

msvfw32

avifil32

rasapi32

iphlpapi

shlwapi

mpr

winmm

ws2_32

version

kernel32

user32

gdi32

msimg32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

wininet

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 188KB - Virtual size: 672KB

.idata Size: 28KB - Virtual size: 25KB

.rsrc Size: 44KB - Virtual size: 42KB

.reloc Size: 152KB - Virtual size: 149KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 188KB - Virtual size: 672KB

.idata
Size: 28KB - Virtual size: 25KB

.rsrc
Size: 44KB - Virtual size: 42KB

.reloc
Size: 152KB - Virtual size: 149KB