817e43a6fbfc7a028f2b89097cae2a6e8b214981c48b6ad9f95b32ccda29f072

Sharing

Copy URL Twitter E-mail

General

Target

817e43a6fbfc7a028f2b89097cae2a6e8b214981c48b6ad9f95b32ccda29f072
Size

3.5MB
MD5

48a67bb70950f77bdc5af98176694cbe
SHA1

ca2e81fd5906ccd14549f7b713f6d2bc3cc1f720
SHA256

817e43a6fbfc7a028f2b89097cae2a6e8b214981c48b6ad9f95b32ccda29f072
SHA512

47d79cdb6f8d6fca28df257880cf8be21e5e994a3a3693230ffb0b7fd68219661a3201665c8948cc9be58412acf30e8323e442f879730e59a114a69f38426aef
SSDEEP

49152:wkfognomrN7CS6n2wGOEkW46q4US1GrHygUMuaV+6/jGEyryxyIn507DbryV4wcB:wynTcdn2wpE5q1SeHygAaA6R4wLRrlU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
817e43a6fbfc7a028f2b89097cae2a6e8b214981c48b6ad9f95b32ccda29f072

Files

817e43a6fbfc7a028f2b89097cae2a6e8b214981c48b6ad9f95b32ccda29f072
.exe windows:6 windows x86 arch:x86

7a74465d2f798d0923fbb808b5de9a25

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Terry\G-spy KB(巨鵬)\GK600(MAD DOG)\code\bin\Config.pdb

Imports

kernel32

GetFileType
SetStdHandle
QueryPerformanceFrequency
HeapQueryInformation
GetCommandLineW
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
FreeEnvironmentStringsW
ExitProcess
VirtualQuery
VirtualAlloc
GetSystemInfo
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetStdHandle
GetDateFormatW
GetTimeFormatW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetDriveTypeW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetEnvironmentVariableW
GetStringTypeW
SetConsoleCtrlHandler
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
GetUserDefaultLCID
ReplaceFileW
GetTempFileNameW
GetDiskFreeSpaceW
GetEnvironmentStringsW
GetProfileIntW
SearchPathW
GetTempPathW
GetWindowsDirectoryW
FindResourceExW
VerifyVersionInfoW
VerSetConditionMask
LocalUnlock
LocalLock
GetCurrentDirectoryW
SetErrorMode
SetFileTime
LocalFileTimeToFileTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GlobalFlags
LocalReAlloc
LocalAlloc
GlobalHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
SystemTimeToFileTime
GetAtomNameW
GlobalGetAtomNameW
SuspendThread
SetThreadPriority
CompareStringA
GetCurrentThread
GetVersionExW
GetThreadLocale
GetStringTypeExW
MoveFileW
lstrcmpiW
GetCurrentProcess
DuplicateHandle
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetVolumeInformationW
GetShortPathNameW
GetFullPathNameW
FlushFileBuffers
lstrcmpA
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryA
LoadLibraryExW
GetModuleHandleA
FreeLibrary
GetSystemDirectoryW
GetCurrentThreadId
EncodePointer
OutputDebugStringA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
GetCurrentProcessId
SetLastError
MulDiv
LocalFree
GlobalSize
GetLocalTime
CopyFileW
SetCurrentDirectoryW
ReleaseMutex
CreateMutexW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
HeapFree
OutputDebugStringW
lstrcpyW
FindNextFileW
RemoveDirectoryW
SetFileAttributesW
CreateDirectoryW
FindClose
CreateProcessW
WideCharToMultiByte
FormatMessageW
lstrlenW
GetModuleHandleW
ExpandEnvironmentStringsW
DeleteFileW
GetProcAddress
LoadLibraryW
GetModuleFileNameW
GetPrivateProfileIntW
GetPrivateProfileStructW
WritePrivateProfileStructW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetFileSize
GlobalFree
GlobalReAlloc
SetEvent
ResetEvent
FreeResource
GlobalUnlock
GlobalLock
GlobalAlloc
ResumeThread
SizeofResource
FindFirstFileW
WriteFile
CreateThread
TerminateThread
CreateFileW
Sleep
CloseHandle
GetOverlappedResult
WaitForSingleObject
ReadFile
CreateEventW
GetTickCount
GetSystemDefaultLangID
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
GetLastError
EnterCriticalSection
LeaveCriticalSection
FindResourceW
LoadResource
LockResource
GetModuleHandleExW
WriteConsoleW

user32

TranslateMessage
MapDialogRect
SetWindowContextHelpId
PostQuitMessage
CharUpperW
GetDesktopWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetMonitorInfoW
MonitorFromWindow
WinHelpW
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetTopWindow
GetClassNameW
EqualRect
MapWindowPoints
AdjustWindowRectEx
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
GetScrollPos
ScrollWindow
ValidateRect
SetActiveWindow
TrackPopupMenuEx
SetMenu
GetMenu
GetKeyState
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
IsMenu
GetClassInfoExW
GetClassInfoW
RegisterClassW
DefWindowProcW
GetMessageTime
GetMessagePos
PeekMessageW
DispatchMessageW
LoadMenuW
IsDialogMessageW
ShowOwnedPopups
SetWindowTextW
ScrollWindowEx
GetDlgCtrlID
SendDlgItemMessageW
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextW
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
GetDlgItem
MoveWindow
MessageBoxW
IsWindowEnabled
EndPaint
BeginPaint
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
UnionRect
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSystemMenu
GetMenuState
GetMenuStringW
DrawIcon
IsIconic
UnregisterClassW
MonitorFromPoint
LoadImageW
RegisterClipboardFormatW
OffsetRect
SendMessageW
EnableWindow
InvalidateRect
GetClientRect
SetParent
GetScrollInfo
GetWindow
ShowWindow
RedrawWindow
ToUnicodeEx
MapVirtualKeyExW
GetWindowThreadProcessId
GetKeyboardLayout
GetForegroundWindow
SetWindowLongW
SetFocus
CreateWindowExW
CallWindowProcW
DestroyWindow
SetCursor
DrawStateW
IntersectRect
GetSysColorBrush
LoadCursorW
RealChildWindowFromPoint
GetMenuItemInfoW
SystemParametersInfoW
CopyImage
SendDlgItemMessageA
GetAsyncKeyState
GetDialogBaseUnits
DeleteMenu
CharNextW
CopyAcceleratorTableW
InvalidateRgn
GetWindowTextW
DrawFrameControl
GetNextDlgGroupItem
MessageBeep
DestroyIcon
IsClipboardFormatAvailable
GetTabbedTextExtentW
SetLayeredWindowAttributes
EnumDisplayMonitors
GetWindowTextLengthW
InflateRect
ReleaseDC
GetWindowLongW
GetActiveWindow
GetParent
GetCapture
TrackMouseEvent
SetCapture
ClientToScreen
WindowFromPoint
ReleaseCapture
GetDC
GetClassLongW
SetClassLongW
PostMessageW
UnpackDDElParam
SetWindowRgn
LoadBitmapW
SetScrollRange
SetRect
CopyRect
SetWindowPos
GetWindowRect
PtInRect
GetSystemMetrics
SetScrollPos
RegisterWindowMessageW
SetRectEmpty
FillRect
IsRectEmpty
ScreenToClient
UpdateWindow
RegisterDeviceNotificationW
GetMessageW
PostThreadMessageW
LoadIconW
FindWindowW
DrawEdge
DrawFocusRect
DrawIconEx
GetKeyboardState
GetLastActivePopup
SetForegroundWindow
CreatePopupMenu
AppendMenuW
SetMenuDefaultItem
GetCursorPos
TrackPopupMenu
DestroyMenu
SetTimer
KillTimer
GetFocus
GetSysColor
IsWindow
IsZoomed
NotifyWinEvent
GetMenuDefaultItem
UpdateLayeredWindow
GetSubMenu
EnableScrollBar
MapVirtualKeyW
LoadAcceleratorsW
CreateAcceleratorTableW
DestroyAcceleratorTable
SetCursorPos
BringWindowToTop
LockWindowUpdate
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
CharUpperBuffW
ModifyMenuW
TranslateAcceleratorW
InsertMenuItemW
GetMenuBarInfo
GetDCEx
GetWindowRgn
EnumChildWindows
GetComboBoxInfo
DestroyCursor
WindowFromDC
CreateMenu
InSendMessage
MonitorFromRect
SendNotifyMessageW
SubtractRect
GetUpdateRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
IsCharLowerW
GetDoubleClickTime
GetKeyNameTextW
InvertRect
HideCaret
GetIconInfo
WaitMessage
FrameRect
CopyIcon
ReuseDDElParam
RemoveMenu

gdi32

CombineRgn
StretchBlt
GetStockObject
SelectPalette
RealizePalette
GetPixel
CreateFontIndirectW
CreatePatternBrush
CopyMetaFileW
CreateDCW
GetDeviceCaps
CreateBitmap
CreateDIBPatternBrushPt
CreateHatchBrush
CreatePen
CreateRectRgn
Escape
ExcludeClipRect
GetClipBox
GetClipRgn
GetCurrentPositionEx
GetObjectType
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
OffsetClipRgn
PlayMetaFile
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
SetMapperFlags
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextColor
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
StartDocW
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
ExtCreatePen
MoveToEx
TextOutW
ExtTextOutW
ExtCreateRegion
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateRectRgnIndirect
GetMapMode
PatBlt
SetRectRgn
DPtoLP
GetBkColor
GetRgnBox
GetCharWidthW
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
CreateRoundRectRgn
EnumFontFamiliesExW
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
GetCurrentObject
SetPixel
OffsetRgn
Rectangle
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
LPtoDP
RoundRect
ExtFloodFill
SetPaletteEntries
StretchDIBits
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetWindowOrgEx
GetViewportOrgEx
CloseMetaFile
CreateMetaFileW
DeleteMetaFile
SetPixelV
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextFaceW
SetBitmapBits
GetBitmapBits
GetTextMetricsW
CreateSolidBrush
GetTextColor
CreateCompatibleBitmap
BitBlt
CreateDIBSection
GetObjectW
CreateCompatibleDC
SetDIBColorTable
SelectObject
DeleteDC
DeleteObject
CreateFontW
PolyBezierTo
GetDIBits
GetTextExtentPoint32W

msimg32

TransparentBlt
AlphaBlend

winspool.drv

DocumentPropertiesW
ClosePrinter
GetJobW
OpenPrinterW

advapi32

RegSetValueExW
RegQueryValueExW
SetFileSecurityW
GetFileSecurityW
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueW
RegCloseKey

shell32

ShellExecuteW
SHGetFolderPathW
SHGetFileInfoW
SHAddToRecentDocs
ExtractIconW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteExW
SHBrowseForFolderW
SHGetMalloc
DragFinish
DragQueryFileW
SHAppBarMessage
Shell_NotifyIconW

comctl32

_TrackMouseEvent

shlwapi

PathFindExtensionW
PathIsUNCW
PathRemoveExtensionW
PathRemoveFileSpecW
StrFormatKBSizeW
PathFindFileNameW
PathStripToRootW

uxtheme

GetThemePartSize
GetWindowTheme
DrawThemeBackground
IsAppThemed
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
GetThemeSysColor
GetThemeColor
GetCurrentThemeName
IsThemeBackgroundPartiallyTransparent

ole32

IsAccelerator
OleRegGetMiscStatus
OleRegEnumVerbs
OleGetClipboard
CoLockObjectExternal
OleTranslateAccelerator
RegisterDragDrop
RevokeDragDrop
WriteClassStm
GetHGlobalFromILockBytes
CreateGenericComposite
CreateItemMoniker
CoTaskMemAlloc
OleCreateMenuDescriptor
CreateFileMoniker
StgIsStorageFile
StgOpenStorage
StgCreateDocfile
OleLockRunning
OleSetMenuDescriptor
PropVariantCopy
CoRegisterMessageFilter
CoRevokeClassObject
CoRegisterClassObject
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
OleCreate
OleCreateFromData
OleRun
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
StringFromGUID2
CoInitialize
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
CoCreateInstance
CoInitializeEx
CoUninitialize
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
CreateBindCtx
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemFree
StringFromCLSID
CreateStreamOnHGlobal
OleCreateLinkFromData
OleCreateStaticFromData
OleCreateLinkToFile
OleCreateFromFile
OleLoad
OleSave
OleSaveToStream
OleSetContainedObject
OleGetIconOfClass
CreateDataAdviseHolder
CreateOleAdviseHolder
GetRunningObjectTable
OleIsRunning
CoGetMalloc
OleQueryLinkFromData
OleQueryCreateFromData
OleDestroyMenuDescriptor

oleaut32

SysStringByteLen
SysFreeString
OleLoadPicture
VariantTimeToSystemTime
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCreate
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayRedim
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SysAllocString
SysAllocStringByteLen
SysReAllocStringLen
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayCopy
SafeArrayPtrOfIndex
VariantCopy
VarDateFromStr
VarCyFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromDec
VarDecFromStr
LoadTypeLi
LoadRegTypeLi
RegisterTypeLi
OleCreateFontIndirect
SysAllocStringLen
VariantInit
VariantClear
SafeArrayAccessData
VariantChangeType
SysStringLen
SafeArrayUnlock
SystemTimeToVariantTime

oledlg

OleUIBusyW

gdiplus

GdipSetInterpolationMode
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameDimensionsList
GdipCreateBitmapFromStream
GdipLoadImageFromStreamICM
GdipTranslateWorldTransform
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromHBITMAP
GdipCreateLineBrushFromRect
GdipImageGetFrameDimensionsCount
GdipCreateBitmapFromStreamICM
GdiplusShutdown
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipFree
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdiplusStartup
GdipCreateFromHDC
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipDrawImageRectI
GdipReleaseDC
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipCreateRegionRect
GdipDeleteRegion
GdipFillRegion
GdipCreatePen1
GdipDeletePen
GdipDrawRectangle
GdipImageGetFrameCount

setupapi

SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW

hid

HidD_GetHidGuid
HidD_GetPreparsedData
HidP_GetCaps
HidP_GetButtonCaps
HidP_GetValueCaps
HidD_FreePreparsedData
HidD_GetAttributes
HidD_GetProductString
HidD_GetManufacturerString
HidD_SetFeature
HidD_SetOutputReport
HidD_GetFeature

winmm

PlaySoundW

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 614KB - Virtual size: 613KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a74465d2f798d0923fbb808b5de9a25

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

setupapi

hid

winmm

oleacc

imm32

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 614KB - Virtual size: 613KB

.data Size: 33KB - Virtual size: 54KB

.rsrc Size: 166KB - Virtual size: 166KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 614KB - Virtual size: 613KB

.data
Size: 33KB - Virtual size: 54KB

.rsrc
Size: 166KB - Virtual size: 166KB