64bb88946a8d8faf6f85dd1973903a82

Sharing

Copy URL

Twitter E-mail

General

Target

64bb88946a8d8faf6f85dd1973903a82
Size

4.9MB
MD5

64bb88946a8d8faf6f85dd1973903a82
SHA1

6aca8d041d802a85e7cc794c2122d83d2f31fc3a
SHA256

9e4330c26a27910b5713211ae3bf5a93c20e00bedb60c0f63e773cebd48ec9c6
SHA512

4c17520f5010ca54c80ce2fd79ce5c5d4b0442f5b8094b9c0a789eadffdafd47f04194f58427220cc92e4021658e634d3a64e30dcab803b57c5c2b9df0620b13
SSDEEP

98304:35de/PDbA9Rlc2LJtjUoPI7lRAEWbqNoy6iaAGv2pbUQkR5K648SUOVPNlxwxdHn:35dQo9Rlcytj1IR6WZAepbUQkR5xxIVS

Score

3^/10

pdf link

Malware Config

Signatures

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
unpack001/免费版/Interop.ADOX.dll
unpack001/免费版/Interop.NiniComLib.dll
unpack001/免费版/MySql.Data.dll
unpack001/免费版/NiniDataBrowser.exe
unpack001/免费版/NiniDown.exe
unpack001/免费版/NiniPoster.exe
unpack001/免费版/NiniUpdate.exe
unpack001/免费版/NiniUrlEncoder.exe
unpack001/免费版/NiniWeb.dll
unpack001/免费版/UpdateRules.exe
unpack001/免费版/ninicom.dll

Files

64bb88946a8d8faf6f85dd1973903a82
.rar
免费版/Config/Config.xml
.xml
免费版/Config/ConfigPoster.xml
.xml
免费版/Config/Default.dic
免费版/Config/Register.xml
.xml
免费版/Config/ReplaceWords.dic
免费版/Config/SpiderGroup.xml
.xml
免费版/Config/UpDbGroup.xml
.xml
免费版/Config/Variable.xml
.xml
免费版/Interop.ADOX.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
免费版/Interop.NiniComLib.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
免费版/MySql.Data.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
免费版/Native.NiniWeb.manifest
免费版/NiniDataBrowser.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.textxc
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 86B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
免费版/NiniDown.exe
.exe windows:4 windows x86 arch:x86

4ff1290a6cc967cbdb694dd6c213dbae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryW
GetModuleHandleW
GetCurrentProcess
CreateFileMappingW
GetLastError
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
CloseHandle
CreateFileW
VirtualAlloc
GetModuleHandleA
GetProcAddress

user32

MessageBoxW

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xcpad
Size: - Virtual size: 1.1MB

.idata
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
免费版/NiniPoster.exe
.exe windows:4 windows x86 arch:x86

4ff1290a6cc967cbdb694dd6c213dbae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryW
GetModuleHandleW
GetCurrentProcess
CreateFileMappingW
GetLastError
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
CloseHandle
CreateFileW
VirtualAlloc
GetModuleHandleA
GetProcAddress

user32

MessageBoxW

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xcpad
Size: - Virtual size: 784KB

.idata
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
免费版/NiniReg.bat
免费版/NiniUnreg.bat
免费版/NiniUpdate.exe
.exe windows:4 windows x86 arch:x86

4ff1290a6cc967cbdb694dd6c213dbae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryW
GetModuleHandleW
GetCurrentProcess
CreateFileMappingW
GetLastError
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
CloseHandle
CreateFileW
VirtualAlloc
GetModuleHandleA
GetProcAddress

user32

MessageBoxW

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xcpad
Size: - Virtual size: 400KB

.idata
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
免费版/NiniUrlEncoder.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.textxc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 86B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
免费版/NiniWeb.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.textxc
Size: 620KB - Virtual size: 617KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.datax
Size: 4KB - Virtual size: 6B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 86B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
免费版/TaskData/天气预报.xml
.xml
免费版/TaskData/新浪科技.xml
.xml
免费版/TaskPoster/Discuz7.0在线发布.xml
.xml
免费版/TaskPoster/phpwind7.3在线发布.xml
.xml
免费版/TaskPoster/动网论坛测试.xml
.xml
免费版/TaskPoster/帝国CMS在线发布新闻.xml
.xml
免费版/TaskSpider/POST导航分页.xml
.xml
免费版/TaskSpider/post导航分页表格.xml
.xml
免费版/TaskSpider/中国天气.xml
.xml
免费版/TaskSpider/今日新闻示带分页示例.xml
.xml
免费版/TaskSpider/健康搜狐.xml
.xml
免费版/TaskSpider/凤凰网络台海新闻.xml
.xml
免费版/TaskSpider/函数型分页合并.xml
.xml
免费版/TaskSpider/图片icon下载.xml
.xml
免费版/TaskSpider/图片含小图示例.xml
.xml
免费版/TaskSpider/图片含小图跨表保存.xml
.xml
免费版/TaskSpider/天气预报.xml
.xml
免费版/TaskSpider/小说极品家丁合并.xml
.xml
免费版/TaskSpider/扬州新闻.xml
.xml
免费版/TaskSpider/搜狐文化.xml
.xml
免费版/TaskSpider/文章采集POST（分页）.xml
.xml
免费版/TaskSpider/新华网英文.xml
.xml
免费版/TaskSpider/新华英文.xml
.xml
免费版/TaskSpider/新浪国内.xml
.xml
免费版/TaskSpider/新浪国际.xml
.xml
免费版/TaskSpider/新浪女性.xml
.xml
免费版/TaskSpider/新浪娱乐.xml
.xml
免费版/TaskSpider/新浪科技.xml
.xml
免费版/TaskSpider/新浪财经.xml
.xml
免费版/TaskSpider/绝对小孩.xml
.xml
免费版/TaskSpider/绝对小孩2漫画.xml
.xml
免费版/TaskSpider/网易体育新闻.xml
.xml
免费版/TaskSpider/论坛带回复.xml
.xml
免费版/TaskSpider/财经资讯金融时报.xml
.xml
免费版/TaskSpider/软件下载.xml
.xml
免费版/TaskSpider/软件下载测试.xml
.xml
免费版/TaskSpider/金融时报.xml
.xml
免费版/TaskSpider/阿里巴巴公司.xml
.xml
免费版/TaskSpider/飞采软件.xml
.xml
免费版/UpdateRules.exe
.exe windows:4 windows x86 arch:x86

4ff1290a6cc967cbdb694dd6c213dbae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryW
GetModuleHandleW
GetCurrentProcess
CreateFileMappingW
GetLastError
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
CloseHandle
CreateFileW
VirtualAlloc
GetModuleHandleA
GetProcAddress

user32

MessageBoxW

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xcpad
Size: - Virtual size: 264KB

.idata
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
免费版/help.pdf
.pdf
- http://www.ninidown.com
- http://www.ninidown.com/download/ninidown_free.zip
- http://download.microsoft.com/download/5/6/7/567758a3-759e-473e-bf8f-52154438565a/dotnetfx.exe
- http://www.newhua.com/soft/38669.htm
- http://www.ninidown.com/show.asp?page=2
- http://126.com
- http://mjVM.net
免费版/htm/main.htm
.html
免费版/htm/tableft.gif
.gif
免费版/htm/tabright.gif
.gif
免费版/ninicom.dll
.dll regsvr32 windows:4 windows x86 arch:x86

135893531afd7373c67e7dfbf27af619

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetCrackUrlW

urlmon

CreateURLMonikerEx
CreateAsyncBindCtx
RegisterBindStatusCallback
CoInternetGetSession

kernel32

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrcmpiW
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
SetThreadLocale
GetThreadLocale
CloseHandle
RaiseException
ReadFile
GetFileSize
GlobalUnlock
GlobalLock
lstrlenA
WriteFile
SetFilePointer
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
lstrlenW
LCMapStringA
LCMapStringW
CreateFileW
GetCPInfo
GetStringTypeW
GetStringTypeA
IsValidCodePage
GetOEMCP
SetHandleCount
Sleep
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsDebuggerPresent
SetUnhandledExceptionFilter
GetStartupInfoA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleFileNameA
GetStdHandle
ExitProcess
VirtualFree
HeapCreate
HeapDestroy
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
HeapFree
HeapAlloc
RtlUnwind
HeapReAlloc
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleA
GetSystemInfo
VirtualQuery
GetCurrentThreadId
GetCommandLineA
GetProcessHeap
GetFileType

user32

RegisterWindowMessageW
SetWindowsHookExW
GetDesktopWindow
MessageBoxW
UnhookWindowsHookEx
CallNextHookEx
SendMessageTimeoutW
IsWindow
LoadStringW
CharNextW
UnregisterClassA

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW

ole32

ProgIDFromCLSID
CoCreateInstance
StringFromGUID2
CoGetClassObject
OleUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
OleInitialize

oleaut32

SafeArrayGetLBound
SafeArrayGetUBound
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
VarBstrCat
SafeArrayAccessData
SafeArrayUnaccessData
LoadRegTypeLi
SetErrorInfo
VariantClear
VariantInit
VarBstrCmp
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen
CreateErrorInfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 104KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
免费版/使用说明（重要，必读）.txt
免费版/协议.txt
免费版/新云软件.url
.url
免费版/更新.txt
免费版/飞采使用教程.pdf
.pdf
- http://download.microsoft.com/download/5/6/7/567758a3-759e-473e-bf8f-5215443856
- http://sports.163.com/
- http://tech.sina.com.cn/t/
- http://ent.qq.com/a/
- http://news.sohu.com/
- http://tech.sina.com.cn/mobile/n/2009-05-14/07293090845.shtml
- http://zx.cjn.cn/whgw/sczn/200901/t852841.htm
- http://zx.cjn.cn/whgw/sczn/200901/t852841_3.htm
- http://market.szhome.com/Sell_Search2.aspx?mode=5&content=0
- http://download.microsoft.com/download/5/6/7/567758a3-759e-473e-bf8f-52154438565a/dotnetfx.exe
- http://sports.163.com/4zt{|@
- http://sports.163.com/09/0514/09/5991EOS200051CA1.html
- http://tech.sina.com.cn/t/2009-05-14/08433091289.shtml
- http://ent.qq.com/a/20090514/000156.htm
- http://news.sohu.com/20090514/n263947453.shtml
- http://tech.sina.com.cn/mobile/n/2009-05-14/07293090845.shtml:?G
- http://zx.cjn.cn/whgw/sczn/200901/t852841.htm:?G$%4
- http://zx.cjn.cn/whgw/sczn/200901/t852841_3.htm4@AU1VW,-.6st
- http://market.szhome.com/Sell_Search2.aspx?mode=5&content=04
- Show all

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 24KB - Virtual size: 20KB

.rsrc Size: 4KB - Virtual size: 808B

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 28KB - Virtual size: 24KB

.rsrc Size: 4KB - Virtual size: 840B

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 276KB - Virtual size: 275KB

.rsrc Size: 4KB - Virtual size: 896B

.reloc Size: 4KB - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.textxc Size: 68KB - Virtual size: 66KB

.idata Size: 4KB - Virtual size: 86B

.reloc Size: 4KB - Virtual size: 12B

.rsrc Size: 24KB - Virtual size: 23KB

4ff1290a6cc967cbdb694dd6c213dbae

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 3KB - Virtual size: 2KB

.data Size: - Virtual size: 544B

.xcpad Size: - Virtual size: 1.1MB

.idata Size: 1024B - Virtual size: 516B

.reloc Size: 512B - Virtual size: 136B

.rsrc Size: 23KB - Virtual size: 23KB

4ff1290a6cc967cbdb694dd6c213dbae

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 3KB - Virtual size: 2KB

.data Size: - Virtual size: 544B

.xcpad Size: - Virtual size: 784KB

.idata Size: 1024B - Virtual size: 516B

.reloc Size: 512B - Virtual size: 136B

.rsrc Size: 110KB - Virtual size: 109KB

4ff1290a6cc967cbdb694dd6c213dbae

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 3KB - Virtual size: 2KB

.text
Size: 24KB - Virtual size: 20KB

.rsrc
Size: 4KB - Virtual size: 808B

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 28KB - Virtual size: 24KB

.rsrc
Size: 4KB - Virtual size: 840B

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 276KB - Virtual size: 275KB

.rsrc
Size: 4KB - Virtual size: 896B

.reloc
Size: 4KB - Virtual size: 12B

.textxc
Size: 68KB - Virtual size: 66KB

.idata
Size: 4KB - Virtual size: 86B

.reloc
Size: 4KB - Virtual size: 12B

.rsrc
Size: 24KB - Virtual size: 23KB

.text
Size: 3KB - Virtual size: 2KB

.data
Size: - Virtual size: 544B

.xcpad
Size: - Virtual size: 1.1MB

.idata
Size: 1024B - Virtual size: 516B

.reloc
Size: 512B - Virtual size: 136B

.rsrc
Size: 23KB - Virtual size: 23KB

.text
Size: 3KB - Virtual size: 2KB

.data
Size: - Virtual size: 544B

.xcpad
Size: - Virtual size: 784KB

.idata
Size: 1024B - Virtual size: 516B

.reloc
Size: 512B - Virtual size: 136B

.rsrc
Size: 110KB - Virtual size: 109KB

.text
Size: 3KB - Virtual size: 2KB

.data
Size: - Virtual size: 544B

.xcpad
Size: - Virtual size: 400KB

.idata
Size: 1024B - Virtual size: 516B

.reloc
Size: 512B - Virtual size: 136B

.rsrc
Size: 23KB - Virtual size: 23KB

.textxc
Size: 48KB - Virtual size: 47KB

.idata
Size: 4KB - Virtual size: 86B

.reloc
Size: 4KB - Virtual size: 12B

.rsrc
Size: 24KB - Virtual size: 23KB

.textxc
Size: 620KB - Virtual size: 617KB

.datax
Size: 4KB - Virtual size: 6B

.idata
Size: 4KB - Virtual size: 86B

.reloc
Size: 4KB - Virtual size: 12B

.rsrc
Size: 4KB - Virtual size: 832B

.text
Size: 3KB - Virtual size: 2KB

.data
Size: - Virtual size: 544B

.xcpad
Size: - Virtual size: 264KB

.idata
Size: 1024B - Virtual size: 516B

.reloc
Size: 512B - Virtual size: 136B

.rsrc
Size: 23KB - Virtual size: 23KB

.text
Size: 104KB - Virtual size: 102KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 16KB - Virtual size: 14KB

.reloc
Size: 16KB - Virtual size: 13KB