a0abf1f2ea3865c186ec60bba865bc1246f249f8177ce4f9af5f39f451853499

Sharing

Copy URL Twitter E-mail

General

Target

a0abf1f2ea3865c186ec60bba865bc1246f249f8177ce4f9af5f39f451853499
Size

288KB
MD5

5c0d506e161bf31a593af5899d1ddcab
SHA1

c2d5cf74330fae38cc94de9a3462aa56c8ef48ab
SHA256

a0abf1f2ea3865c186ec60bba865bc1246f249f8177ce4f9af5f39f451853499
SHA512

20c8aa0e3ba7277b232de3616bb73a5172da3f41c735fe089887a1b80bbbb59c3a00731402f543e6efaf485d5857a46268b4f91d9a0afcf0e000c35961972296
SSDEEP

6144:5NcbTyyQXrCcd+k24uWwBtgzR0MBBTgUYh3WLm0nTGJiTBWPIqar7:5ev1QXeA+kECzFmUYhfJiTIPIB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a0abf1f2ea3865c186ec60bba865bc1246f249f8177ce4f9af5f39f451853499

Files

a0abf1f2ea3865c186ec60bba865bc1246f249f8177ce4f9af5f39f451853499
.exe windows:5 windows x64 arch:x64

0993f390b7bed0936cfe60760d941972

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\远控源码\C++控件版-远控源码\winos全套5.3Q-4591723\WinOsClientProject\x64\Release-exe\上线模块.pdb

Imports

kernel32

GetCurrentProcess
lstrcpyW
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
OpenProcess
GetCurrentProcessId
GetDriveTypeW
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
GetSystemInfo
GetProcAddress
LoadLibraryW
FreeLibrary
GetModuleFileNameW
GetCommandLineW
GetStartupInfoW
CreateProcessW
ExitProcess
WideCharToMultiByte
lstrcmpW
CreateFileA
DeviceIoControl
Sleep
QueryPerformanceFrequency
CreateEventW
SetEvent
ResetEvent
QueryPerformanceCounter
WaitForSingleObject
CreateEventA
FormatMessageW
SetLastError
VirtualProtect
IsBadReadPtr
LoadLibraryA
GetNativeSystemInfo
GetLocalTime
GetLocaleInfoW
GetSystemDirectoryW
SetErrorMode
SetUnhandledExceptionFilter
GetCurrentThreadId
CreateThread
CreateMutexW
CreateFileW
GetFileSize
SetFilePointer
WriteFile
ReleaseMutex
CreateWaitableTimerW
HeapDestroy
HeapCreate
LocalFree
ReadFile
GetTickCount
FlushFileBuffers
SetStdHandle
WriteConsoleW
CloseHandle
Process32NextW
Process32FirstW
InitializeCriticalSection
CreateToolhelp32Snapshot
GetConsoleWindow
GetModuleHandleW
lstrcatW
MultiByteToWideChar
lstrlenW
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RaiseException
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
HeapSize
GetStdHandle
GetConsoleMode
GetConsoleCP
GetVersion
HeapSetInformation
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
HeapReAlloc
ExitThread
EncodePointer
DecodePointer
TryEnterCriticalSection
CancelWaitableTimer
SetWaitableTimer
lstrlenA
UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingW
VirtualFree
LCMapStringW
SwitchToThread

user32

EnumDisplayMonitors
GetMonitorInfoW
GetWindowTextW
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
FindWindowA
GetWindowTextA
GetWindow
GetClassNameA
wsprintfW
SendMessageW
OpenWindowStationW
SetProcessWindowStation
IsWindow
PostThreadMessageA
GetInputState
GetLastInputInfo
GetForegroundWindow

advapi32

RegCloseKey
RegQueryInfoKeyW
GetCurrentHwProfileW
RegQueryValueExW
RegOpenKeyExW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegEnumKeyExA
RegOpenKeyExA

shell32

SHGetFolderPathW

ole32

CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

SysFreeString
SysStringLen
SysAllocString

ws2_32

WSASetLastError
WSAStringToAddressW
closesocket
send
getpeername
setsockopt
WSAIoctl
InetNtopW
htons
ntohs
WSAGetLastError
inet_ntoa
gethostbyname
gethostname
getsockname
freeaddrinfo
getaddrinfo
WSAStartup
WSAResetEvent
WSAEventSelect
WSACleanup
bind
connect
recv
WSACloseEvent
WSACreateEvent
socket
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
shutdown

shlwapi

StrChrW
PathIsDirectoryA

netapi32

NetWkstaGetInfo

dinput8

DirectInput8Create

winmm

timeGetDevCaps
timeEndPeriod
timeBeginPeriod
timeGetTime

Sections

.text
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0993f390b7bed0936cfe60760d941972

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

netapi32

dinput8

winmm

Sections

.text Size: 182KB - Virtual size: 182KB

.rdata Size: 62KB - Virtual size: 62KB

.data Size: 25KB - Virtual size: 42KB

.pdata Size: 10KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 182KB - Virtual size: 182KB

.rdata
Size: 62KB - Virtual size: 62KB

.data
Size: 25KB - Virtual size: 42KB

.pdata
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 6KB - Virtual size: 6KB