511bede8dc6de8a60bb3a57cbba67c3c

Sharing

Copy URL Twitter E-mail

General

Target

511bede8dc6de8a60bb3a57cbba67c3c
Size

455KB
MD5

511bede8dc6de8a60bb3a57cbba67c3c
SHA1

5af13614963dd4222025bca738157b8171d0c4f5
SHA256

c42d3f3c283114c4381e7521546f31c86f3f4894ade430b55626a9bf50fb05d1
SHA512

17ea3a43dfc20e171c92a31e00746a07b61e12132512f465d5dce09d5f1b90869a602bdea7a419794b3deb3a6a1a53bbd280aabf6ab286edb0e07d1530b64b80
SSDEEP

12288:hDiyGjCA5g13zaQusBuZWngiK9pq+D9uLaDO:sy2CASBluZWBK/q+DULv

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/XuanSystem.HOST主机管理系统 v1.3/Update/组件更新/XuanSystem.dll
unpack001/XuanSystem.HOST主机管理系统 v1.3/xuanmail/XuanMail.dll
unpack001/XuanSystem.HOST主机管理系统 v1.3/组件/XuanSystem.dll
unpack001/XuanSystem.HOST主机管理系统 v1.3/组件/jmail.dll
unpack001/XuanSystem.HOST主机管理系统 v1.3/组件/获取硬件特征码.exe

Files

511bede8dc6de8a60bb3a57cbba67c3c
.rar
XuanSystem.HOST主机管理系统 v1.3/Update/Update.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Update/升级说明.txt
XuanSystem.HOST主机管理系统 v1.3/Update/组件更新/XuanSystem.dll
.dll regsvr32 windows:4 windows x86 arch:x86

add4660df6fe0c082412fcb599737a24

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaVarTstGt
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaAryMove
__vbaLenBstr
__vbaAptOffset
__vbaStrVarMove
__vbaVarIdiv
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord626
__vbaResume
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
__vbaLenBstrB
__vbaLenVar
_adj_fdiv_m32
__vbaVarXor
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaForEachCollObj
ord593
__vbaExitProc
__vbaVarForInit
ord594
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
ord702
_adj_fdivr_m16i
ord304
__vbaVarIndexLoad
ord520
__vbaVargVar
__vbaBoolVarNull
__vbaRefVarAry
_CIsin
ord709
__vbaNextEachCollObj
__vbaVarCmpGt
__vbaVargVarMove
ord632
__vbaChkstk
EVENT_SINK_AddRef
ord528
__vbaGenerateBoundsError
__vbaStrCmp
__vbaVarTstEq
ord560
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaVarLateMemSt
__vbaVarOr
__vbaCastObjVar
__vbaRedimPreserve
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
ord310
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaVarMul
__vbaUI1I4
__vbaStr2Vec
__vbaExceptHandler
ord312
ord711
__vbaStrToUnicode
ord712
_adj_fprem
_adj_fdivr_m64
ord607
__vbaVarDiv
ord716
ord531
__vbaFPException
__vbaInStrVar
ord717
__vbaUbound
__vbaStrVarVal
__vbaVarCat
ord535
ord536
_CIlog
__vbaErrorOverflow
__vbaInStr
__vbaR8Str
__vbaNew2
__vbaVarLateMemCallLdRf
__vbaVarInt
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
ord573
__vbaStrCopy
__vbaVarCmpLt
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
__vbaVarTstNe
ord101
__vbaVarSetVar
ord102
__vbaI4Var
ord103
__vbaVarCmpEq
ord104
ord105
__vbaLateMemCall
__vbaVarAdd
__vbaAryLock
__vbaStrToAnsi
__vbaVarDup
ord613
__vbaFpI2
__vbaVarMod
ord616
__vbaFpI4
__vbaVarLateMemCallLd
__vbaVarCopy
__vbaVarTstGe
__vbaRecDestructAnsi
__vbaLateMemCallLd
ord617
__vbaVarSetObjAddref
_CIatan
__vbaI2ErrVar
__vbaCastObj
__vbaStrMove
__vbaAryCopy
__vbaUI1Str
__vbaForEachVar
ord619
_allmul
_CItan
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeObj
__vbaFreeStr
ord581

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 256KB - Virtual size: 253KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
XuanSystem.HOST主机管理系统 v1.3/Update/组件更新/组件更新.bat
XuanSystem.HOST主机管理系统 v1.3/Web/Code/showcode.asp
XuanSystem.HOST主机管理系统 v1.3/Web/Code/verifycode.asp
.vbs
XuanSystem.HOST主机管理系统 v1.3/Web/DataBases/DataBases.mdb
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Administrator.asp
.html
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Check.asp
.vbs
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/CheckLogin.asp
.html .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/SetProcessing.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_AddAdmin.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_AddEmail.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_AddMember.asp
.asp .js polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_AddProduct.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_AddUser.asp
.asp
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_AddWeb.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_AdminList.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_AppPool.asp
.asp
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_AppPoolList.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_Config.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_EditAppPool.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_EditEmail.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_EditMember.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_EditProduct.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_EditUser.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_EditWeb.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_EmailList.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_MemberList.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_MemberProxy.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_ProductClass.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_ProductList.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_ReSetDisaster.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_Space.asp
.vbs
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_SysEmail.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_SysList.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_UserList.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_WebList.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/Sys_quit.asp
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/about.asp
.asp .vbs polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/Logo.jpg
.jpg .ps1 polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/admin.css
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/admin.js
.js
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/admin_XuanSoft.css
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/arrow_top.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/bg_btn.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/btm.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/btnbg.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/btnbg2.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/button.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/display.js
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/exit.ico
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/green1.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/help.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/icon_admin.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/img.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/left_bg.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/quit.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/ren.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/right_bg.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/s_email.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/spacer.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/style.css
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/submit.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/sysstop.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/toolbar_back.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/toolbar_back_up.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/toolbar_close.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/toolbar_close_up.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/toolbar_front.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/toolbar_front_up.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/toolbar_help.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/toolbar_help_up.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/toolbar_new_up.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/toolbar_refresh.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/toolbar_refresh_up.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/toolbar_search_up.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/top.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/images/top_bg.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/index.htm
.html .js polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/list_nav.asp
.vbs
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/menu.asp
.js
XuanSystem.HOST主机管理系统 v1.3/Web/XuanHost/top.asp
.html .js polyglot
XuanSystem.HOST主机管理系统 v1.3/Web/css/JCity.js
XuanSystem.HOST主机管理系统 v1.3/Web/css/bg_btn.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/css/css.css
XuanSystem.HOST主机管理系统 v1.3/Web/css/green.css
XuanSystem.HOST主机管理系统 v1.3/Web/css/green_.css
XuanSystem.HOST主机管理系统 v1.3/Web/css/inc_DateSelect.js
.js
XuanSystem.HOST主机管理系统 v1.3/Web/css/style.css
XuanSystem.HOST主机管理系统 v1.3/Web/images/2ico01.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/Later.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/XuanCss.css
XuanSystem.HOST主机管理系统 v1.3/Web/images/del_1.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/edit2.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/fl_bg.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/fl_title_01.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/g4_reg_logo.jpg
.jpg
XuanSystem.HOST主机管理系统 v1.3/Web/images/home.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/icon04.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/icon05.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/icon06.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/icon07.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/icon08.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/icon09.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/icon1.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/icon11.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/icon12.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/icon13.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/icon14.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/icon_user.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/icp.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/jindu_bg_1.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/jindu_bg_2.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/jindu_left.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/jindu_right.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/start.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/stop.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/images/table_bg.gif
.gif
XuanSystem.HOST主机管理系统 v1.3/Web/include/Connection.asp
.vbs
XuanSystem.HOST主机管理系统 v1.3/Web/include/Function.asp
.vbs
XuanSystem.HOST主机管理系统 v1.3/Web/include/Laterdiv.asp
.js
XuanSystem.HOST主机管理系统 v1.3/Web/include/config.asp
XuanSystem.HOST主机管理系统 v1.3/Web/index.asp
.asp
XuanSystem.HOST主机管理系统 v1.3/Web/index/aspnet_client/system_web/1_1_4322/SmartNav.htm
XuanSystem.HOST主机管理系统 v1.3/Web/index/aspnet_client/system_web/1_1_4322/SmartNav.js
.js
XuanSystem.HOST主机管理系统 v1.3/Web/index/aspnet_client/system_web/1_1_4322/WebUIValidation.js
.js
XuanSystem.HOST主机管理系统 v1.3/Web/index/index.htm
.html .js polyglot
XuanSystem.HOST主机管理系统 v1.3/xuanmail/DelXuanMailDll.bat
XuanSystem.HOST主机管理系统 v1.3/xuanmail/RegXuanMailDll.bat
XuanSystem.HOST主机管理系统 v1.3/xuanmail/XuanMail.dll
.dll regsvr32 windows:4 windows x86 arch:x86

e7f89c9d55e15e872337370b97f2fd1b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaAptOffset
__vbaFreeVarList
_adj_fdiv_m64
_adj_fprem1
ord518
__vbaStrCat
__vbaVarCmpNe
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord304
ord520
__vbaBoolVarNull
_CIsin
__vbaVarCmpGt
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaVarTstEq
__vbaObjVar
__vbaVarOr
__vbaCastObjVar
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
ord310
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
ord312
__vbaPrintFile
_adj_fprem
_adj_fdivr_m64
ord716
__vbaFPException
__vbaStrVarVal
__vbaVarCat
_CIlog
__vbaFileOpen
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
__vbaFreeStrList
__vbaVarCmpLt
_adj_fdivr_m32
_adj_fdiv_r
ord101
__vbaVarSetVar
ord102
ord103
__vbaVarCmpEq
ord104
ord105
__vbaLateMemCall
__vbaVarCopy
__vbaVarLateMemCallLd
__vbaVarTstGe
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaCastObj
__vbaI2ErrVar
_allmul
_CItan
ord546
_CIexp
__vbaFreeStr
__vbaFreeObj

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
XuanSystem.HOST主机管理系统 v1.3/xuanmail/XuanSystem_mailexe.asp
.vbs
XuanSystem.HOST主机管理系统 v1.3/下载说明.htm
.html .js polyglot
XuanSystem.HOST主机管理系统 v1.3/安装说明.txt
XuanSystem.HOST主机管理系统 v1.3/组件/ServUDaemon.ini
XuanSystem.HOST主机管理系统 v1.3/组件/XuanSystem.dll
.dll regsvr32 windows:4 windows x86 arch:x86

add4660df6fe0c082412fcb599737a24

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaVarTstGt
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaAryMove
__vbaLenBstr
__vbaAptOffset
__vbaStrVarMove
__vbaVarIdiv
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord626
__vbaResume
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
__vbaLenBstrB
__vbaLenVar
_adj_fdiv_m32
__vbaVarXor
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaForEachCollObj
ord593
__vbaExitProc
__vbaVarForInit
ord594
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
ord702
_adj_fdivr_m16i
ord304
__vbaVarIndexLoad
ord520
__vbaVargVar
__vbaBoolVarNull
__vbaRefVarAry
_CIsin
ord709
__vbaNextEachCollObj
__vbaVarCmpGt
__vbaVargVarMove
ord632
__vbaChkstk
EVENT_SINK_AddRef
ord528
__vbaGenerateBoundsError
__vbaStrCmp
__vbaVarTstEq
ord560
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaVarLateMemSt
__vbaVarOr
__vbaCastObjVar
__vbaRedimPreserve
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
ord310
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaVarMul
__vbaUI1I4
__vbaStr2Vec
__vbaExceptHandler
ord312
ord711
__vbaStrToUnicode
ord712
_adj_fprem
_adj_fdivr_m64
ord607
__vbaVarDiv
ord716
ord531
__vbaFPException
__vbaInStrVar
ord717
__vbaUbound
__vbaStrVarVal
__vbaVarCat
ord535
ord536
_CIlog
__vbaErrorOverflow
__vbaInStr
__vbaR8Str
__vbaNew2
__vbaVarLateMemCallLdRf
__vbaVarInt
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
ord573
__vbaStrCopy
__vbaVarCmpLt
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
__vbaVarTstNe
ord101
__vbaVarSetVar
ord102
__vbaI4Var
ord103
__vbaVarCmpEq
ord104
ord105
__vbaLateMemCall
__vbaVarAdd
__vbaAryLock
__vbaStrToAnsi
__vbaVarDup
ord613
__vbaFpI2
__vbaVarMod
ord616
__vbaFpI4
__vbaVarLateMemCallLd
__vbaVarCopy
__vbaVarTstGe
__vbaRecDestructAnsi
__vbaLateMemCallLd
ord617
__vbaVarSetObjAddref
_CIatan
__vbaI2ErrVar
__vbaCastObj
__vbaStrMove
__vbaAryCopy
__vbaUI1Str
__vbaForEachVar
ord619
_allmul
_CItan
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeObj
__vbaFreeStr
ord581

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 256KB - Virtual size: 253KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
XuanSystem.HOST主机管理系统 v1.3/组件/jmail.dll
.dll regsvr32 windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

CODE
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 162B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
XuanSystem.HOST主机管理系统 v1.3/组件/注册组件.bat
XuanSystem.HOST主机管理系统 v1.3/组件/注销删除组件.bat
XuanSystem.HOST主机管理系统 v1.3/组件/组件更新.bat
XuanSystem.HOST主机管理系统 v1.3/组件/获取硬件特征码.exe
.exe windows:4 windows x86 arch:x86

ceb3cf20991abb7e11d3a4fc3721e5a6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaVarIdiv
__vbaFreeVarList
_adj_fdiv_m64
ord516
_adj_fprem1
ord518
__vbaRecAnsiToUni
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaLenBstrB
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaVarXor
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaVarForInit
__vbaObjSet
ord595
_adj_fdiv_m16i
_adj_fdivr_m16i
ord520
__vbaBoolVarNull
__vbaRefVarAry
_CIsin
__vbaVarCmpGt
__vbaVargVarMove
ord632
__vbaChkstk
EVENT_SINK_AddRef
ord528
__vbaGenerateBoundsError
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
__vbaVarOr
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaUI1I2
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaStr2Vec
__vbaVarMul
__vbaStrUI1
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaVarDiv
__vbaFPException
ord717
__vbaUbound
__vbaStrVarVal
__vbaVarCat
_CIlog
__vbaErrorOverflow
__vbaInStr
__vbaR8Str
__vbaVarInt
_adj_fdiv_m32i
_adj_fdivr_m32i
ord573
__vbaStrCopy
__vbaVarCmpLt
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaI4Var
__vbaAryLock
__vbaVarAdd
__vbaStrToAnsi
__vbaVarDup
__vbaVarMod
__vbaVarTstGe
ord616
__vbaVarCopy
ord617
__vbaRecDestructAnsi
_CIatan
__vbaAryCopy
__vbaUI1Str
__vbaStrMove
ord619
_allmul
_CItan
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj

Sections

.text
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

add4660df6fe0c082412fcb599737a24

Headers

File Characteristics

Imports

msvbvm60

Exports

Exports

Sections

.text Size: 256KB - Virtual size: 253KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 16KB - Virtual size: 13KB

.reloc Size: 24KB - Virtual size: 22KB

e7f89c9d55e15e872337370b97f2fd1b

Headers

File Characteristics

Imports

msvbvm60

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 30KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 8KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 3KB

add4660df6fe0c082412fcb599737a24

Headers

File Characteristics

Imports

msvbvm60

Exports

Exports

Sections

.text Size: 256KB - Virtual size: 253KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 16KB - Virtual size: 13KB

.reloc Size: 24KB - Virtual size: 22KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 228KB - Virtual size: 228KB

DATA Size: 3KB - Virtual size: 2KB

BSS Size: - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 162B

.reloc Size: 16KB - Virtual size: 15KB

.rsrc Size: 57KB - Virtual size: 57KB

ceb3cf20991abb7e11d3a4fc3721e5a6

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 64KB - Virtual size: 62KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 12KB - Virtual size: 10KB

.text
Size: 256KB - Virtual size: 253KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 16KB - Virtual size: 13KB

.reloc
Size: 24KB - Virtual size: 22KB

.text
Size: 32KB - Virtual size: 30KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 256KB - Virtual size: 253KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 16KB - Virtual size: 13KB

.reloc
Size: 24KB - Virtual size: 22KB

CODE
Size: 228KB - Virtual size: 228KB

DATA
Size: 3KB - Virtual size: 2KB

BSS
Size: - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 162B

.reloc
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 57KB - Virtual size: 57KB

.text
Size: 64KB - Virtual size: 62KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 12KB - Virtual size: 10KB