e:\KINGSOFT_DUBA\Build\Build_Src\kisengine_git\kisengine_git\product\win32\newuplivepop.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6c3f979fd0bcdf4535e2ce287d3ab5ea780b54f1ab6c35d48084c58ce4fcae12.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
6c3f979fd0bcdf4535e2ce287d3ab5ea780b54f1ab6c35d48084c58ce4fcae12.exe
Resource
win10v2004-20240412-en
General
-
Target
6c3f979fd0bcdf4535e2ce287d3ab5ea780b54f1ab6c35d48084c58ce4fcae12
-
Size
782KB
-
MD5
f03a2f91b7a6737fd95005963e303002
-
SHA1
e2c2ca61b600fec03742b1f28729af5549e9341b
-
SHA256
6c3f979fd0bcdf4535e2ce287d3ab5ea780b54f1ab6c35d48084c58ce4fcae12
-
SHA512
ef242d8a806cb7245e498cbf7085089ac018438dc0feec9df12d4935f4013a25ad8a2ea9a2e09dbb14777bd949f9c33927c9af63d1195a917813d94782dbe87d
-
SSDEEP
24576:yiJKVB4yaF/nkPrQJ/DnKfYvEeV4FxmNOREV5:T4B4/F/kGnKez4W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6c3f979fd0bcdf4535e2ce287d3ab5ea780b54f1ab6c35d48084c58ce4fcae12
Files
-
6c3f979fd0bcdf4535e2ce287d3ab5ea780b54f1ab6c35d48084c58ce4fcae12.exe windows:4 windows x86 arch:x86
cd51496cb8accc075a83bb24eade110f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
psapi
GetModuleInformation
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
kernel32
InterlockedCompareExchange
TerminateThread
WaitForMultipleObjects
GetTickCount
GetPrivateProfileStringW
LocalFree
HeapAlloc
HeapFree
GetProcessHeap
GetLocalTime
GetTempPathW
GetComputerNameA
GetSystemDirectoryW
GetDiskFreeSpaceExW
GetVolumeInformationW
ReleaseMutex
GetSystemInfo
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetVersionExW
GetSystemTime
InterlockedIncrement
OutputDebugStringW
GetExitCodeThread
QueryPerformanceFrequency
CreateProcessW
LoadLibraryExW
IsBadWritePtr
GetModuleHandleA
VirtualProtect
LoadLibraryA
QueryDosDeviceW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetFullPathNameW
lstrlenW
GetCurrentThreadId
OpenEventW
CreateEventW
ResetEvent
EnterCriticalSection
SetLastError
FlushInstructionCache
LeaveCriticalSection
SetEvent
WaitForSingleObject
GetCurrentProcess
InterlockedDecrement
CreateMutexW
DeleteFileW
GetWindowsDirectoryW
CloseHandle
DeleteCriticalSection
FormatMessageA
ExpandEnvironmentStringsA
SleepEx
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
LockResource
FindClose
GlobalFree
MoveFileW
GetProcAddress
GetLastError
InterlockedExchange
GetPrivateProfileIntW
RaiseException
GlobalUnlock
MultiByteToWideChar
CreateFileW
GetModuleFileNameW
ReadFile
GetFileAttributesW
SizeofResource
CopyFileW
Sleep
LoadLibraryW
WideCharToMultiByte
GlobalAlloc
OpenProcess
InitializeCriticalSection
WriteFile
GetModuleHandleW
GlobalLock
CreateDirectoryW
LoadResource
FreeLibrary
FindResourceW
FindResourceExW
lstrlenA
FreeResource
FindFirstFileW
GetFileSize
user32
GetDlgItem
PeekMessageW
SystemParametersInfoW
GetWindowLongW
InvalidateRect
UnregisterClassA
SetRect
RegisterClassExW
IsDialogMessageW
GetForegroundWindow
TranslateMessage
GetClassInfoExW
GetClientRect
IsWindowEnabled
LoadCursorW
AttachThreadInput
GetParent
GetFocus
SetForegroundWindow
KillTimer
IsChild
GetMessageW
SetActiveWindow
GetWindowRect
SetTimer
SetWindowLongW
GetSystemMetrics
GetCursorPos
WindowFromPoint
FindWindowW
PostMessageW
LoadStringW
wsprintfW
IsRectEmpty
GetMonitorInfoW
DrawFrameControl
DestroyIcon
GetDlgCtrlID
IsWindowVisible
ReleaseCapture
EqualRect
MonitorFromWindow
UnionRect
IntersectRect
OffsetRect
LoadIconW
PtInRect
BeginPaint
SetRectEmpty
SetFocus
GetDesktopWindow
SetWindowPos
GetActiveWindow
IsWindow
CreateWindowExW
SendMessageW
MapWindowPoints
EnableWindow
CallWindowProcW
DefWindowProcW
CopyRect
GetWindowThreadProcessId
GetWindow
MoveWindow
DispatchMessageW
RegisterWindowMessageW
LoadImageW
GetDC
InflateRect
DestroyWindow
PostThreadMessageW
DrawIconEx
DrawTextW
SetCapture
ScreenToClient
UpdateLayeredWindow
SetCursor
ClientToScreen
EndPaint
GetNextDlgTabItem
GetScrollPos
GetKeyState
PostQuitMessage
LoadBitmapW
ShowWindow
ReleaseDC
gdi32
LineTo
SetViewportOrgEx
GetRgnBox
SetGraphicsMode
GetViewportOrgEx
GetWindowOrgEx
SetWindowOrgEx
MoveToEx
GetClipRgn
CreateDCW
SetBkMode
GetWorldTransform
CreateRectRgnIndirect
CombineRgn
RectInRegion
OffsetRgn
CreateRoundRectRgn
SetWorldTransform
RoundRect
ExtSelectClipRgn
GetDIBits
GetTextColor
BitBlt
SetTextColor
DeleteDC
CreateDIBSection
CreateFontIndirectW
RestoreDC
GetStockObject
CreatePen
CreateRectRgn
SetStretchBltMode
GetObjectW
SaveDC
ExtTextOutW
Rectangle
CreateCompatibleBitmap
CreateCompatibleDC
SelectClipRgn
SelectObject
DeleteObject
CreateBitmap
TextOutW
GetCurrentObject
GetTextExtentPoint32W
StretchBlt
SetBkColor
advapi32
IsValidSid
GetTokenInformation
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyExW
shell32
SHGetMalloc
ShellExecuteW
Shell_NotifyIconW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SHGetPathFromIDListW
ole32
CoUninitialize
CoInitialize
CoCreateGuid
StringFromGUID2
CoCreateInstance
CreateStreamOnHGlobal
oleaut32
VariantTimeToSystemTime
VariantInit
VariantClear
SysAllocString
SystemTimeToVariantTime
SysFreeString
shlwapi
PathIsDirectoryW
PathFindFileNameW
PathRemoveFileSpecW
PathAddBackslashW
PathFileExistsW
StrToIntA
SHGetValueW
PathAppendW
SHSetValueW
StrToIntW
PathAddExtensionW
comctl32
_TrackMouseEvent
msimg32
AlphaBlend
msvcp80
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?push_back@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEX_W@Z
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
gdiplus
GdipDrawImageRectRectI
GdipPrivateAddFontFile
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipGetImageHeight
GdipLoadImageFromFile
GdipGetFontCollectionFamilyCount
GdipGraphicsClear
GdipDeleteFontFamily
GdipDrawImagePointsRectI
GdipDisposeImageAttributes
GdipAlloc
GdipSetImageAttributesColorMatrix
GdipCloneBitmapArea
GdipGetFontCollectionFamilyList
GdipFree
GdipDrawImageRectRect
GdipLoadImageFromStream
GdiplusShutdown
GdipCreatePen1
GdipSetPixelOffsetMode
GdipCreatePath
GdipSetStringFormatTrimming
GdipCreateStringFormat
GdipSetPenDashStyle
GdipSetPenStartCap
GdipSetClipPath
GdipGetFontSize
GdipDeleteStringFormat
GdipFillRectangleI
GdipBitmapLockBits
GdipDrawString
GdipTranslateWorldTransform
GdipFillRectangle
GdipCreateFontFromLogfontW
GdipResetWorldTransform
GdipRotateWorldTransform
GdipSetCompositingQuality
GdipDrawLine
GdipFillPath
GdipDrawImageRectI
GdipDisposeImage
GdipCreateImageAttributes
GdipNewPrivateFontCollection
GdipDeletePrivateFontCollection
GdipCreateHBITMAPFromBitmap
GdipCreateFromHDC
GdipSetInterpolationMode
GdipCloneImage
GdipCloneFontFamily
GdipImageRotateFlip
GdipGetImageWidth
GdiplusStartup
GdipSetStringFormatFlags
GdipDeleteBrush
GdipCreateLineBrushFromRectWithAngleI
GdipDeletePen
GdipCloneBrush
GdipAddPathRectangleI
GdipMeasureString
GdipSetStringFormatLineAlign
GdipSetTextRenderingHint
GdipSetPenMode
GdipDrawPath
GdipDeleteFont
GdipSetStringFormatAlign
GdipSetSmoothingMode
GdipClosePathFigure
GdipDrawLinesI
GdipGetFamily
GdipBitmapUnlockBits
GdipAddPathArcI
GdipCreateSolidFill
GdipDrawImageI
GdipCreateFont
GdipAddPathStringI
GdipImageGetFrameCount
GdipImageGetFrameDimensionsCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipImageSelectActiveFrame
GdipImageGetFrameDimensionsList
GdipDrawImagePointsI
GdipDrawRectangleI
GdipAddPathPieI
GdipDeletePath
GdipSetPenEndCap
msvcr80
wcscat
_lrotr
_lrotl
_wcsicmp
wcsncat
wcscpy
wcschr
wcspbrk
wcsncpy_s
iswspace
_wtoi64
_time32
_wcsupr_s
rand
srand
ceil
swscanf_s
wcsncmp
_mbsstr
sprintf
memcmp
wcsncpy
strcpy_s
_vsnwprintf
_wtol
_except_handler3
_snwprintf
strstr
fwprintf
fflush
_wfopen
_mbsicmp
sqrt
cos
_mkgmtime64
pow
__RTDynamicCast
_mbschr
floor
_mbsinc
abs
fabs
asin
sin
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
__CxxFrameHandler3
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_crt_debugger_hook
_stricmp
realloc
fwrite
__iob_func
strtoul
sscanf
strtol
isxdigit
strncpy
strrchr
_strtoi64
fgets
fopen
qsort
fputs
isdigit
_errno
memchr
getenv
strerror
__sys_nerr
_gmtime64
_stat64
_CxxThrowException
_strdup
_time64
wcscat_s
isalpha
tolower
isalnum
strchr
isspace
strncmp
atof
fseek
fprintf
fread
atoi
_vsnprintf_s
sscanf_s
fputc
memmove
fclose
_wtoi
swprintf_s
??2@YAPAXI@Z
_mbscmp
labs
_vscprintf
wcscpy_s
setlocale
wcscmp
wcscspn
wcsspn
memcpy_s
_purecall
_waccess
strcmp
??_V@YAXPAX@Z
memset
_recalloc
wcsstr
wcsrchr
_invalid_parameter_noinfo
_beginthreadex
vsprintf_s
wcslen
_wcslwr_s
vswprintf_s
strlen
malloc
calloc
free
_wtof
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_vscwprintf
memmove_s
memcpy
??3@YAXPAX@Z
ws2_32
__WSAFDIsSet
select
WSAStartup
getaddrinfo
ioctlsocket
socket
freeaddrinfo
WSASetLastError
connect
setsockopt
getpeername
getsockopt
htons
bind
ntohs
getsockname
send
recv
WSAGetLastError
closesocket
WSACleanup
Exports
Exports
??4_Init_locks@std@@QAEAAV01@ABV01@@Z
Sections
.text Size: 429KB - Virtual size: 429KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 109KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 17KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 216KB - Virtual size: 216KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE