7fd87c82f1b69ccb1f2c6bf4c6caee8ecb0c5b1e742c3f379468f1fe6053391d

Sharing

Copy URL Twitter E-mail

General

Target

7fd87c82f1b69ccb1f2c6bf4c6caee8ecb0c5b1e742c3f379468f1fe6053391d
Size

1.2MB
MD5

2c18a402aa8be1a090dcd0e5249756a8
SHA1

909453cbaefe5758855bb16d7d5a18a8a4745984
SHA256

7fd87c82f1b69ccb1f2c6bf4c6caee8ecb0c5b1e742c3f379468f1fe6053391d
SHA512

e3ddc089d64c1481ea4190ed966ebea3aa4f56f37813a4f07930881d994963ef129778e90e4396e8faf14b1df7568b3cc46071029c0e75084c4f4694e4a0e189
SSDEEP

24576:DifK5Bj48OzPB2EFmfQJcSyFLlxyf1OyO4I:vMNzByKFOLlGu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7fd87c82f1b69ccb1f2c6bf4c6caee8ecb0c5b1e742c3f379468f1fe6053391d

Files

7fd87c82f1b69ccb1f2c6bf4c6caee8ecb0c5b1e742c3f379468f1fe6053391d
.exe windows:5 windows x86 arch:x86

6716bafc6d1265db5b637f3e23791721

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\代码\SVN\无限项目\功能插件\服务端\插件_新\WXFPlugin\Bin\CrossMsgSrv\Release\CrossMsgSrv.pdb

Imports

kernel32

CreateIoCompletionPort
FreeLibrary
EncodePointer
DecodePointer
RaiseException
TryEnterCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
GetLastError
FormatMessageW
WideCharToMultiByte
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetExitCodeThread
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
MultiByteToWideChar
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
GetACP
GlobalLock
GlobalUnlock
GetFileSize
ReadFile
lstrlenA
LoadLibraryA
GetModuleFileNameA
GetCurrentDirectoryA
MulDiv
IsDBCSLeadByte
ExitProcess
GetCurrentProcessId
GlobalAlloc
SetFileTime
SystemTimeToFileTime
GetProcAddress
GetFileAttributesA
LocalFree
FormatMessageA
lstrcmpiA
lstrcpynA
InterlockedIncrement
InterlockedDecrement
lstrcpyA
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwind
ExitThread
GetModuleHandleExW
GetStdHandle
HeapFree
HeapAlloc
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
HeapReAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
WriteConsoleW
CreateFileW
CancelIoEx
GetVersionExA
PostQueuedCompletionStatus
GetModuleHandleA
GetCurrentThreadId
GetQueuedCompletionStatus
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
CreateDirectoryA
LoadResource
LockResource
FreeResource
FindResourceA
SizeofResource
GetLocalTime
CloseHandle
CreateFileA
SetFilePointer
WriteFile
InitializeCriticalSection
LeaveCriticalSection
LocalFileTimeToFileTime
EnterCriticalSection

user32

GetWindowLongA
SetWindowLongA
GetParent
GetWindow
LoadImageA
MonitorFromWindow
GetMonitorInfoA
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuA
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
wsprintfA
DefWindowProcA
CallWindowProcA
RegisterClassA
RegisterClassExA
RegisterClassExW
GetClassInfoExA
GetClassInfoExW
CreateWindowExW
ShowWindow
EnableWindow
GetSystemMetrics
SetPropA
GetPropA
SetWindowRgn
MessageBoxA
UpdateWindow
CharPrevA
DrawTextA
DrawTextW
FillRect
SetRect
UpdateLayeredWindow
MoveWindow
IsWindowEnabled
GetWindowRgn
IsRectEmpty
EqualRect
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
CreateAcceleratorTableA
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextA
MapVirtualKeyExA
ScreenToClient
GetCursorPos
GetWindowRect
GetClientRect
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
ReleaseCapture
GetFocus
GetActiveWindow
SetFocus
IsZoomed
IsIconic
IsWindowVisible
SetWindowPos
IsWindow
CreateWindowExA
PostMessageA
SendMessageA
DispatchMessageA
TranslateMessage
GetMessageA
PtInRect
IntersectRect
GetKeyState
LoadCursorA
OffsetRect
UnionRect
InflateRect
SetCursor
CharNextA
PostQuitMessage
KillTimer
SetTimer
DestroyWindow
GetSysColor
MapWindowPoints
SetCapture

ole32

CLSIDFromProgID
CLSIDFromString
OleInitialize
ReleaseStgMedium
CoUninitialize
CoInitialize
OleUninitialize
CreateStreamOnHGlobal
OleDuplicateData
DoDragDrop
CoCreateInstance
OleLockRunning

ws2_32

getpeername
getsockname
inet_pton
socket
connect
WSARecv
recv
listen
WSASend
accept
bind
WSAIoctl
gethostname
gethostbyname
WSAStartup
send
WSAGetLastError
setsockopt
closesocket
getsockopt
inet_ntop
htons
WSAPoll
ioctlsocket

gdi32

SaveDC
SelectObject
CloseEnhMetaFile
CreateEnhMetaFileA
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsA
GetObjectA
SetWindowOrgEx
CreateRoundRectRgn
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsA
Rectangle
GetTextExtentPoint32A
LineTo
SelectClipRgn
ExtSelectClipRgn
AddFontMemResourceEx
SetBkColor
SetBkMode
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBitmap
CreateFontIndirectA
StretchBlt
SetStretchBltMode
SetTextColor
CreateDIBSection
MoveToEx
RestoreDC
RemoveFontMemResourceEx
GetClipBox
BitBlt
CreatePen
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
TextOutA
SetBitmapBits
GetBitmapBits
GetTextExtentPointA
CreatePatternBrush
PtInRegion
CreateRectRgn
GdiFlush

shell32

DragQueryFileA

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear
SysAllocStringLen

comctl32

ord17
InitCommonControlsEx
_TrackMouseEvent

gdiplus

GdipDrawImageRectRect
GdipDrawImageI
GdipDrawLine
GdipCreateBitmapFromScan0
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipFree
GdipCreatePath
GdipDeletePath
GdipAddPathLine
ord1
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipSetPenDashStyle
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipReleaseDC
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipSetWorldTransform
GdipResetWorldTransform
GdipDrawRectangleI
GdipDrawPath
GdipFillRectangleI
GdipFillPath
GdipCreateFromHDC
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipSetStringFormatHotkeyPrefix
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipCreatePen2
GdipSetPenStartCap
GdipSetPenEndCap

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

Sections

.text
Size: 700KB - Virtual size: 700KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 282KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6716bafc6d1265db5b637f3e23791721

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ole32

ws2_32

gdi32

shell32

oleaut32

comctl32

gdiplus

imm32

Sections

.text Size: 700KB - Virtual size: 700KB

.rdata Size: 184KB - Virtual size: 183KB

.data Size: 23KB - Virtual size: 31KB

.rsrc Size: 282KB - Virtual size: 282KB

.reloc Size: 49KB - Virtual size: 48KB

.text
Size: 700KB - Virtual size: 700KB

.rdata
Size: 184KB - Virtual size: 183KB

.data
Size: 23KB - Virtual size: 31KB

.rsrc
Size: 282KB - Virtual size: 282KB

.reloc
Size: 49KB - Virtual size: 48KB