73137f585639e54d66b6c130fcbe1ac1

Sharing

Copy URL Twitter E-mail

General

Target

73137f585639e54d66b6c130fcbe1ac1
Size

3.2MB
MD5

73137f585639e54d66b6c130fcbe1ac1
SHA1

dc2b04ff45ce10094f6bad2ef6072312580c6461
SHA256

c55aaf4c1af5266361233588b262fe6341d4375b44b209e5e4c5352f46c42698
SHA512

716a87cdf05c39239e9795e43751feef28a0742c9ca3816d0b52449141e1eeb87c5c171b5b396fa42f8d8de0c419a550b23a1a1da5881bc2d5bfea3aff9cd5ec
SSDEEP

49152:JBExzFqB2hDRY3Z6A8Qq8JSwGPkdUnrcGg+CElrcLaS0a60UK9K9Xn5lvTYb2a:+rncCQq8JSwGsV+lQLua60onbv0d

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/721g/bin/AoYooSifu.dll
unpack001/721g/bin/CreateHtml.exe
unpack001/721g/bin/Interop.SQLDMO.dll
unpack001/721g/bin/SQLDMO.dll
unpack001/721g/bin/SifuData.dll
unpack001/721g/sqldmo.dll

Files

73137f585639e54d66b6c130fcbe1ac1
.rar
721g/721g.gif
.gif
721g/721g17631.gif
.gif
721g/721g46860.gif
.gif
721g/721g8831.gif
.gif
721g/Ad.aspx
.asp
721g/ClubAdd.aspx
.asp
721g/ClubList.aspx
.asp
721g/Components/CommonScript.js
.js
721g/Components/Province.js
.js
721g/Components/Style.css
721g/Controls/AdBig.ascx
.asp
721g/Controls/AdSmall.ascx
.asp
721g/Controls/Channel.ascx
.asp
721g/Controls/Club.ascx
.asp
721g/Controls/Footer.ascx
.asp
721g/Controls/FreeGame.ascx
.asp
721g/Controls/Header.ascx
.asp
721g/Controls/Link.ascx
.asp
721g/Controls/Search.ascx
.asp
721g/Controls/Search1.ascx
.asp
721g/Controls/Search备份.ascx
.asp
721g/Controls/TMPxjqpdwsf2n.htm
.asp
721g/Controls/TopGame.ascx
.asp
721g/Controls/index_top.asp
.vbs
721g/Controls/复件 Search.ascx
.asp
721g/Controls/带挂机Search.ascx
.asp
721g/Default.aspx
.asp .js polyglot
721g/Default11.aspx
.asp .js polyglot
721g/ExtRefer.aspx
.asp .js polyglot
721g/G_Images/BG.gif
.gif
721g/G_Images/Index_Top.swf
721g/G_Images/Index__r1_c1.jpg
.jpg
721g/G_Images/Index__r1_c2.jpg
.jpg
721g/G_Images/Index__r2_c10.jpg
.jpg
721g/G_Images/Index__r2_c2.jpg
.jpg
721g/G_Images/Index__r2_c3.jpg
.jpg
721g/G_Images/Index__r2_c4.jpg
.jpg
721g/G_Images/Index__r2_c5.jpg
.jpg
721g/G_Images/Index__r2_c6.jpg
.jpg
721g/G_Images/Index__r2_c7.jpg
.jpg
721g/G_Images/Index__r2_c8.jpg
.jpg
721g/G_Images/Index__r2_c9.jpg
.jpg
721g/G_Images/Index__r3_c2.jpg
.jpg
721g/G_Images/Index__r4_c1.jpg
.jpg
721g/GameAdd.aspx
.asp
721g/GameAdd1.aspx
.asp
721g/Images/20060328013744.gif
.gif
721g/Images/20060328014352.gif
.gif
721g/Images/20060408223719.gif
.gif
721g/Images/20060408224157.gif
.gif
721g/Images/20060408224539.gif
.gif
721g/Images/20060505132250.gif
.gif
721g/Images/20060505163657.gif
.gif
721g/Images/20060505164433.gif
.gif
721g/Images/20060505165526.gif
.gif
721g/Images/20060520001525.gif
.gif
721g/Images/20060608151040.gif
.gif
721g/Images/20060714235929.gif
.gif
721g/Images/20060715000107.gif
.gif
721g/Images/20060715000122.gif
.gif
721g/Images/20060715000141.gif
.gif
721g/Images/20060715000149.gif
.gif
721g/Images/20060715000207.gif
.gif
721g/Images/20060715000221.gif
.gif
721g/Images/20060715000229.gif
.gif
721g/Images/20060715000257.gif
.gif
721g/Images/20060715000315.gif
.gif
721g/Images/20060715000440.gif
.gif
721g/Images/20060715000454.gif
.gif
721g/Images/20060719233253.gif
.gif
721g/Images/20060719233414.gif
.gif
721g/Images/20060720173635.gif
721g/Images/20060720173837.gif
721g/Images/20060807000228.gif
.gif
721g/Images/20060807000340.gif
.gif
721g/Images/20060808202717.gif
.gif
721g/Images/721G_001.gif
.gif
721g/Images/721gAD.gif
.gif
721g/Images/721gx.gif
.gif
721g/Images/721y.gif
.gif
721g/Images/Admin_001.gif
.gif
721g/Images/Admin_002.gif
.gif
721g/Images/Admin_003.gif
.gif
721g/Images/Admin_004.gif
.gif
721g/Images/AoYoo.Com_064.gif
.gif
721g/Images/AoYoo.Com_067.gif
.gif
721g/Images/ICON_New.gif
.gif
721g/Images/ICON_New1.gif
.gif
721g/Images/ICON_New2.gif
.gif
721g/Images/ICON_New3.gif
.gif
721g/Images/ICON_New4.gif
.gif
721g/Images/Index_001.gif
.gif
721g/Images/Index_001.jpg
.jpg
721g/Images/Index_002.gif
.gif
721g/Images/Index_002.jpg
.jpg
721g/Images/Index_003.gif
.gif
721g/Images/Index_004.gif
.gif
721g/Images/Index_005.gif
.gif
721g/Images/Index_006.gif
.gif
721g/Images/Index_007a.gif
.gif
721g/Images/Index_007b.gif
.gif
721g/Images/Index_008.gif
.gif
721g/Images/Index_009.gif
.gif
721g/Images/Index_010.gif
.gif
721g/Images/Index_011.gif
.gif
721g/Images/Index_012.gif
.gif
721g/Images/Index_013.gif
.gif
721g/Images/Index_014.gif
.gif
721g/Images/Space.gif
.gif
721g/Images/biao4-1.gif
.gif
721g/Images/bu01.gif
.gif
721g/Images/gongshanglogo.gif
.gif
721g/Images/guaji.gif
.gif
721g/Images/jianshelogo.jpg
.jpg
721g/Images/nongyelogo.gif
.gif
721g/Images/poll_icon.gif
.gif
721g/Images/qqsico.gif
.gif
721g/Images/star.gif
.gif
721g/Images/复件 ICON_New.gif
.gif
721g/Link.aspx
.asp
721g/Manage/Default.aspx
.asp
721g/Manage/Login.aspx
.asp
721g/Manage/Manage_AdBig.aspx
.asp
721g/Manage/Manage_AdSmall.aspx
.asp
721g/Manage/Manage_Channel.aspx
.asp
721g/Manage/Manage_ClubAdd.aspx
.asp
721g/Manage/Manage_ClubEdit.aspx
.asp
721g/Manage/Manage_ClubList.aspx
.asp
721g/Manage/Manage_CreateHtml.aspx
.asp
721g/Manage/Manage_Data.aspx
.asp
721g/Manage/Manage_DataTrans.aspx
.asp
721g/Manage/Manage_DeleteDb.aspx
.asp
721g/Manage/Manage_DownloadDb.aspx
.asp
721g/Manage/Manage_FrameFooter.aspx
.asp
721g/Manage/Manage_FrameHeader.aspx
.asp
721g/Manage/Manage_FrameLeft.aspx
.asp .js polyglot
721g/Manage/Manage_FrameMain.aspx
.asp
721g/Manage/Manage_GameAdd.aspx
.asp
721g/Manage/Manage_GameEdit.aspx
.asp
721g/Manage/Manage_GameList.aspx
.asp
721g/Manage/Manage_GameSetting.aspx
.asp
721g/Manage/Manage_GameType.aspx
.asp
721g/Manage/Manage_HomePageSetting.aspx
.asp
721g/Manage/Manage_Link.aspx
.asp
721g/Manage/Manage_RestoreDb.aspx
.asp
721g/Manage/Manage_Template.aspx
.asp
721g/Manage/Manage_Top.aspx
.asp .vbs polyglot
721g/Manage/Manage_User.aspx
.asp
721g/Manage/Manage_ValidateImg.aspx
.asp
721g/Manage/Manage_WebsiteSetting.aspx
.asp
721g/Redirect.aspx
.asp
721g/Search.aspx
.asp
721g/Setup/遨游私服发布数据库.sql
721g/Show.aspx
.asp
721g/Web.config
721g/aspnet_client/system_web/1_1_4322/SmartNav.htm
721g/aspnet_client/system_web/1_1_4322/SmartNav.js
.js
721g/aspnet_client/system_web/1_1_4322/WebUIValidation.js
.js
721g/bin/AoYooSifu.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 208KB - Virtual size: 206KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
721g/bin/CreateHtml.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
721g/bin/Interop.SQLDMO.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 912KB - Virtual size: 911KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
721g/bin/SQLDMO.dll
.dll regsvr32 windows:4 windows x86 arch:x86

cef8e3068cafa659382ca9c1032cbb86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

sqlunirl

_CreateFile@28
_ttof
_GetModuleFileName@12
_GetUnicodeRedirectionLayer@0
_FormatMessage@28
_GetVersionEx@4
_SendMessage@16
_GetProcAddress_@8
_LoadLibrary@4
_GetComputerName@8

sqlresld

SQLUIUnloadResourceDLL
SQLUIRegisterResourceDLLCallback
SQLUILoadResourceDLL
?SQLUIUpdateRegistryFromResource@@YAJHPAUHINSTANCE__@@IKPAPBG1@Z

kernel32

GetUserDefaultLCID
DeleteCriticalSection
LeaveCriticalSection
TlsAlloc
TlsFree
EnterCriticalSection
TlsSetValue
TlsGetValue
IsDBCSLeadByte
GetFileSize
InitializeCriticalSection
HeapCreate
CloseHandle
FileTimeToSystemTime
LocalFree
GlobalLock
GlobalAlloc
InterlockedIncrement
InterlockedDecrement
SetThreadPriority
GetThreadPriority
GetCurrentThread
MapViewOfFile
UnmapViewOfFile
GetSystemDefaultLCID
HeapDestroy
GetLastError
GetTickCount
Sleep
WideCharToMultiByte
WriteFile
MultiByteToWideChar
GlobalFree
FreeLibrary
GlobalUnlock
LocalFlags
LocalUnlock
LocalReAlloc
LocalAlloc
LocalLock
HeapFree
GetProcessHeap
HeapAlloc
GlobalFlags
lstrlenW
SetFilePointer
SystemTimeToFileTime
GetComputerNameW
GetVersionExA
GetCommandLineA
GetComputerNameA
GetCurrentProcess
GetModuleFileNameW
GetModuleFileNameA
FormatMessageW
FormatMessageA
InterlockedExchange
GetCurrentThreadId
GetVersionExW
LoadLibraryW
GetProcAddress
ReleaseMutex
WaitForSingleObject
CreateMutexA
GlobalReAlloc
GetCommandLineW
HeapCompact
HeapReAlloc

user32

LoadStringW
IsWindow
LoadStringA

advapi32

RegDeleteValueA
RegQueryValueExA
RegEnumKeyExW
RegDeleteKeyA
RegDeleteKeyW
RegSetValueExA
RegSetValueExW
RegCreateKeyExA
RegCreateKeyExW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegEnumValueA
RegEnumValueW
RegEnumKeyExA
OpenThreadToken
OpenProcessToken
RegConnectRegistryA
GetTokenInformation
RegCloseKey
LookupAccountSidW
GetUserNameW
RegConnectRegistryW
GetUserNameA

msvcrt

_wsplitpath
_ultow
_wmakepath
div
??1type_info@@UAE@XZ
_i64tow
_wtoi64
_wcsdup
realloc
?terminate@@YAXXZ
_initterm
_adjust_fdiv
abs
strcat
strcpy
_heapmin
_wcsicmp
iswspace
_wtoi
wcsncmp
wcstok
tolower
wcsncat
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_CxxThrowException
memmove
_wcsupr
_wcsnicmp
_ftol
memset
wcscmp
wcsstr
__dllonexit
_onexit
_except_handler3
wcsncpy
wcsrchr
iswdigit
swprintf
_purecall
_ltow
_wtol
strlen
memcmp
memcpy
malloc
free
wcscat
wcslen
wcscpy
__CxxFrameHandler
sprintf
_mbsnbicmp
_mbsnbcpy
wcschr
_vsnwprintf

ole32

CoGetMalloc
OleUninitialize
OleInitialize
StringFromCLSID
StringFromIID
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CLSIDFromProgID
IIDFromString

oleaut32

SysAllocStringLen
SetErrorInfo
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayRedim
VariantInit
SafeArrayPutElement
SafeArrayDestroy
GetErrorInfo
CreateErrorInfo
SafeArrayAccessData
SafeArrayUnaccessData
SysFreeString
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SafeArrayGetLBound
SafeArrayGetDim
DispInvoke
DispGetIDsOfNames
LoadRegTypeLi
SysAllocString
SafeArrayCreate
VariantChangeType

sqlsvc

SHRecMemFree
SHRecMemLock
SHRecMemDelete
SHRecMemInsert
SHRecMemBSInsert
SHRecMemBSLocate
SHRecMemInit
SHRecMemAdd
SHRecMemPreAllocAndZeroInit
SHRecMemIncrementRecordCount
SHMemInit
SHMemCleanUp
SHMemFreeFromHeap
SHMemAllocFromHeap
SHMemBurstIntoHeap
SHMemReAllocFromHeap
SHMemReset
SHMemDeFragment
SHMemDBsDump
SHMemSetBurstMode
QSQLGetQueryFailCode
QSQLRows
QSQLReleaseMem
QSQLLogonEx
SQLSvcExit
SQLSvcInit
QSQLConvertToSystemTime
QSQLBcp_collation
QSQLBcp_sendrow
QSQLBcp_done
QSQLBcp_colptr
QSQLBcp_collen
QSQLBcp_bind
QSQLColumnData
QSQLColumnDataA
QSQLColumnDataEx
QSQLResults
QSQLColumns
QSQLNextRow
QSQLColumnLength
QSQLColumnType
QSQLDatabase
QSQLMoreResultsAsync
QSQLExecDirectAsync
SQLSCMControl
SQLSCMGetServiceState
QSQLEnumerateOneServer
QSQLSetProperty
QSQLCancel
QSQLSetPostingFunction
QSQLPurgeExec
QSQLRegisterSpewCallback
QSQLIsConnDead
QSQLGetSpewCallback
QSQLGetSpewWnd
QSQLLogoff
QSQLRegisterSpewWnd
QSQLGetPrefix
QSQLSetPrefix
QSQLBcp_readfmt
QSQLBcp_columns
QSQLBcp_colfmt
QSQLSetConnProp
QSQLUseDB
QSQLBcp_init
QSQLBcp_exec
QSQLBcp_controlHint
QSQLBcp_control
QSQLEnumerateServers
QSQLColumnName
QSQLColumnMetadata
QSQLExecDirectForwardOnly
QSQLBcp_batch
QSQLExecDirect
QSQLConvert

odbc32

ord136
ord31
ord24
ord75
ord145

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 448KB - Virtual size: 444KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 240KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 536KB - Virtual size: 535KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
721g/bin/SifuData.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1024B - Virtual size: 916B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
721g/dl.aspx
.asp .js polyglot
721g/dlq.swf
721g/gjxiaoguo/0.gif
.gif
721g/gjxiaoguo/1.gif
.gif
721g/gjxiaoguo/2.gif
.gif
721g/gjxiaoguo/3.gif
.gif
721g/gjxiaoguo/721g-mir.gif
.gif
721g/gjxiaoguo/721gliuliang.gif
.gif
721g/gjxiaoguo/721gliuliang.jpg
.jpg
721g/gjxiaoguo/paiming.jpg
.jpg
721g/info.txt
721g/kjym.aspx
.asp .js polyglot
721g/logo_1.gif
.gif
721g/post/image/new.gif
.gif
721g/qgofwh.gif
.gif
721g/sfgj.aspx
.asp .js polyglot
721g/sfsetup.aspx
.asp
721g/sqldmo.dll
.dll regsvr32 windows:4 windows x86 arch:x86

cef8e3068cafa659382ca9c1032cbb86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

sqlunirl

_CreateFile@28
_ttof
_GetModuleFileName@12
_GetUnicodeRedirectionLayer@0
_FormatMessage@28
_GetVersionEx@4
_SendMessage@16
_GetProcAddress_@8
_LoadLibrary@4
_GetComputerName@8

sqlresld

SQLUIUnloadResourceDLL
SQLUIRegisterResourceDLLCallback
SQLUILoadResourceDLL
?SQLUIUpdateRegistryFromResource@@YAJHPAUHINSTANCE__@@IKPAPBG1@Z

kernel32

GetUserDefaultLCID
DeleteCriticalSection
LeaveCriticalSection
TlsAlloc
TlsFree
EnterCriticalSection
TlsSetValue
TlsGetValue
IsDBCSLeadByte
GetFileSize
InitializeCriticalSection
HeapCreate
CloseHandle
FileTimeToSystemTime
LocalFree
GlobalLock
GlobalAlloc
InterlockedIncrement
InterlockedDecrement
SetThreadPriority
GetThreadPriority
GetCurrentThread
MapViewOfFile
UnmapViewOfFile
GetSystemDefaultLCID
HeapDestroy
GetLastError
GetTickCount
Sleep
WideCharToMultiByte
WriteFile
MultiByteToWideChar
GlobalFree
FreeLibrary
GlobalUnlock
LocalFlags
LocalUnlock
LocalReAlloc
LocalAlloc
LocalLock
HeapFree
GetProcessHeap
HeapAlloc
GlobalFlags
lstrlenW
SetFilePointer
SystemTimeToFileTime
GetComputerNameW
GetVersionExA
GetCommandLineA
GetComputerNameA
GetCurrentProcess
GetModuleFileNameW
GetModuleFileNameA
FormatMessageW
FormatMessageA
InterlockedExchange
GetCurrentThreadId
GetVersionExW
LoadLibraryW
GetProcAddress
ReleaseMutex
WaitForSingleObject
CreateMutexA
GlobalReAlloc
GetCommandLineW
HeapCompact
HeapReAlloc

user32

LoadStringW
IsWindow
LoadStringA

advapi32

RegDeleteValueA
RegQueryValueExA
RegEnumKeyExW
RegDeleteKeyA
RegDeleteKeyW
RegSetValueExA
RegSetValueExW
RegCreateKeyExA
RegCreateKeyExW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegEnumValueA
RegEnumValueW
RegEnumKeyExA
OpenThreadToken
OpenProcessToken
RegConnectRegistryA
GetTokenInformation
RegCloseKey
LookupAccountSidW
GetUserNameW
RegConnectRegistryW
GetUserNameA

msvcrt

_wsplitpath
_ultow
_wmakepath
div
??1type_info@@UAE@XZ
_i64tow
_wtoi64
_wcsdup
realloc
?terminate@@YAXXZ
_initterm
_adjust_fdiv
abs
strcat
strcpy
_heapmin
_wcsicmp
iswspace
_wtoi
wcsncmp
wcstok
tolower
wcsncat
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_CxxThrowException
memmove
_wcsupr
_wcsnicmp
_ftol
memset
wcscmp
wcsstr
__dllonexit
_onexit
_except_handler3
wcsncpy
wcsrchr
iswdigit
swprintf
_purecall
_ltow
_wtol
strlen
memcmp
memcpy
malloc
free
wcscat
wcslen
wcscpy
__CxxFrameHandler
sprintf
_mbsnbicmp
_mbsnbcpy
wcschr
_vsnwprintf

ole32

CoGetMalloc
OleUninitialize
OleInitialize
StringFromCLSID
StringFromIID
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CLSIDFromProgID
IIDFromString

oleaut32

SysAllocStringLen
SetErrorInfo
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayRedim
VariantInit
SafeArrayPutElement
SafeArrayDestroy
GetErrorInfo
CreateErrorInfo
SafeArrayAccessData
SafeArrayUnaccessData
SysFreeString
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SafeArrayGetLBound
SafeArrayGetDim
DispInvoke
DispGetIDsOfNames
LoadRegTypeLi
SysAllocString
SafeArrayCreate
VariantChangeType

sqlsvc

SHRecMemFree
SHRecMemLock
SHRecMemDelete
SHRecMemInsert
SHRecMemBSInsert
SHRecMemBSLocate
SHRecMemInit
SHRecMemAdd
SHRecMemPreAllocAndZeroInit
SHRecMemIncrementRecordCount
SHMemInit
SHMemCleanUp
SHMemFreeFromHeap
SHMemAllocFromHeap
SHMemBurstIntoHeap
SHMemReAllocFromHeap
SHMemReset
SHMemDeFragment
SHMemDBsDump
SHMemSetBurstMode
QSQLGetQueryFailCode
QSQLRows
QSQLReleaseMem
QSQLLogonEx
SQLSvcExit
SQLSvcInit
QSQLConvertToSystemTime
QSQLBcp_collation
QSQLBcp_sendrow
QSQLBcp_done
QSQLBcp_colptr
QSQLBcp_collen
QSQLBcp_bind
QSQLColumnData
QSQLColumnDataA
QSQLColumnDataEx
QSQLResults
QSQLColumns
QSQLNextRow
QSQLColumnLength
QSQLColumnType
QSQLDatabase
QSQLMoreResultsAsync
QSQLExecDirectAsync
SQLSCMControl
SQLSCMGetServiceState
QSQLEnumerateOneServer
QSQLSetProperty
QSQLCancel
QSQLSetPostingFunction
QSQLPurgeExec
QSQLRegisterSpewCallback
QSQLIsConnDead
QSQLGetSpewCallback
QSQLGetSpewWnd
QSQLLogoff
QSQLRegisterSpewWnd
QSQLGetPrefix
QSQLSetPrefix
QSQLBcp_readfmt
QSQLBcp_columns
QSQLBcp_colfmt
QSQLSetConnProp
QSQLUseDB
QSQLBcp_init
QSQLBcp_exec
QSQLBcp_controlHint
QSQLBcp_control
QSQLEnumerateServers
QSQLColumnName
QSQLColumnMetadata
QSQLExecDirectForwardOnly
QSQLBcp_batch
QSQLExecDirect
QSQLConvert

odbc32

ord136
ord31
ord24
ord75
ord145

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 448KB - Virtual size: 444KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 240KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 536KB - Virtual size: 535KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
721g/wgdown.aspx
.asp .js polyglot
721g/wzxs.aspx
.asp .js polyglot
721g/xybb.aspx
.asp .js polyglot
721g/yule.aspx
.asp .js polyglot
721g/上Show.aspx
.asp
721g/下载说明.htm
.html .js polyglot
721g/中Show.aspx
.asp
721g/免费私服--无推荐星级/FreeGame.ascx
.asp
721g/免费私服--显示所有列/FreeGame.ascx
.asp
721g/初次使用必读！！.txt
721g/固顶私服--无所在地区/TopGame.ascx
.asp
721g/固顶私服--无所在地区/复件 TopGame.ascx
.asp
721g/固顶私服--无所在地区无私服类型/TopGame.ascx
.asp
721g/固顶私服--无所在地区无私服类型无推荐星级/TopGame.ascx
.asp
721g/固顶私服--显示所有列/TopGame.ascx
.asp
721g/复件 Show.aspx
.asp
721g/杞国网络.txt
721g/程序说明.txt
721g/说明.txt
721g/遨游私服发布系统V3.02升级说明.txt
721g/非常世纪资源网.url
.url

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 208KB - Virtual size: 206KB

.rsrc Size: 4KB - Virtual size: 872B

.reloc Size: 4KB - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 20KB - Virtual size: 19KB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 912KB - Virtual size: 911KB

.rsrc Size: 4KB - Virtual size: 816B

.reloc Size: 4KB - Virtual size: 12B

cef8e3068cafa659382ca9c1032cbb86

Headers

File Characteristics

Imports

sqlunirl

sqlresld

kernel32

user32

advapi32

msvcrt

ole32

oleaut32

sqlsvc

odbc32

Exports

Exports

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 448KB - Virtual size: 444KB

.data Size: 240KB - Virtual size: 241KB

.rsrc Size: 536KB - Virtual size: 535KB

.reloc Size: 180KB - Virtual size: 178KB

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 1024B - Virtual size: 916B

.rsrc Size: 1024B - Virtual size: 824B

.reloc Size: 512B - Virtual size: 12B

cef8e3068cafa659382ca9c1032cbb86

Headers

File Characteristics

Imports

sqlunirl

sqlresld

kernel32

user32

advapi32

msvcrt

ole32

oleaut32

sqlsvc

.text
Size: 208KB - Virtual size: 206KB

.rsrc
Size: 4KB - Virtual size: 872B

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 20KB - Virtual size: 19KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 912KB - Virtual size: 911KB

.rsrc
Size: 4KB - Virtual size: 816B

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 448KB - Virtual size: 444KB

.data
Size: 240KB - Virtual size: 241KB

.rsrc
Size: 536KB - Virtual size: 535KB

.reloc
Size: 180KB - Virtual size: 178KB

.text
Size: 1024B - Virtual size: 916B

.rsrc
Size: 1024B - Virtual size: 824B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 448KB - Virtual size: 444KB

.data
Size: 240KB - Virtual size: 241KB

.rsrc
Size: 536KB - Virtual size: 535KB

.reloc
Size: 180KB - Virtual size: 178KB