f8c66ebd198d76c4bd803b046b509da3799c7676657927cc539989acb86b81d0

Sharing

Copy URL Twitter E-mail

General

Target

f8c66ebd198d76c4bd803b046b509da3799c7676657927cc539989acb86b81d0
Size

303KB
MD5

fd4c5a304c992bcab066f82a9c6d89ae
SHA1

39cbfcd913630f668b2bdbec4b907db71c69e1a2
SHA256

f8c66ebd198d76c4bd803b046b509da3799c7676657927cc539989acb86b81d0
SHA512

2b16d3c48c5e47e5a722a1d5fa7e72fd227fc3585799b0193bf2153c6a303236665334534ece43dc3ee8a629a7c2f8cd4d6e57e0041a5df70bfc1049f9ed861f
SSDEEP

6144:j7KwNeKc2kmaFMOzDfFh1RePAagfCDBIREwcmWOFN:PHWHDf71vagfaaRxcm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f8c66ebd198d76c4bd803b046b509da3799c7676657927cc539989acb86b81d0

Files

f8c66ebd198d76c4bd803b046b509da3799c7676657927cc539989acb86b81d0
.dll windows:5 windows x86 arch:x86

8b3ae5f04bfd69af2c004a9c470c8e91

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\工作源码\ArLog\Source\ArLog\Release\ArLog.pdb

Imports

kernel32

CreateFileA
GetModuleHandleW
GetCPInfo
GetOEMCP
FileTimeToLocalFileTime
HeapFree
HeapAlloc
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
FindFirstFileW
FindNextFileW
GetCommandLineA
RtlUnwind
ExitProcess
HeapReAlloc
RaiseException
VirtualAlloc
HeapSize
GetACP
IsValidCodePage
HeapCreate
VirtualFree
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
LCMapStringA
LCMapStringW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetStdHandle
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
InterlockedIncrement
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
InterlockedDecrement
GlobalFree
GlobalUnlock
FormatMessageA
LocalFree
lstrlenA
GetLastError
SetLastError
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpA
GlobalAlloc
GetModuleHandleA
CreateDirectoryW
SetUnhandledExceptionFilter
OutputDebugStringW
GetPrivateProfileIntW
GetModuleFileNameW
MoveFileW
DeleteFileW
FreeLibrary
GetCurrentProcess
CreateFileW
GetProcAddress
LoadLibraryA
CreateDirectoryA
GetPrivateProfileIntA
GetModuleFileNameA
MoveFileA
DeleteFileA
FindResourceA
LoadResource
LockResource
SizeofResource
GetTickCount
SuspendThread
WaitForSingleObject
GetCurrentProcessId
GetCurrentThreadId
Sleep
TerminateThread
ResumeThread
CloseHandle
SetThreadPriority
CreateThread
CreateEventA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ResetEvent
SetEvent
MultiByteToWideChar
WideCharToMultiByte
FindClose
GetLocalTime
FileTimeToSystemTime
HeapDestroy

user32

DestroyMenu
LoadCursorA
GetSysColorBrush
ShowWindow
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
GetWindowTextA
SetWindowTextA
GetSysColor
PostQuitMessage
PostMessageA
CheckMenuItem
EnableMenuItem
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetMenuState
ModifyMenuA
SendMessageA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
SetWindowsHookExA
SetCursor
UnregisterClassA
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
SetForegroundWindow

gdi32

TextOutA
DeleteDC
GetStockObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
CreateBitmap
RectVisible
PtVisible
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
GetDeviceCaps
ExtTextOutA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shlwapi

PathFileExistsW
PathFindFileNameA
PathFindExtensionA

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

DllAddLog
DllAddMsgLog
DllAddMsgLogEx
DllAddMsgLogW
DllSetLogPath
DllSetUnhandledExceptionFilterEx

Sections

.text
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8b3ae5f04bfd69af2c004a9c470c8e91

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

oleaut32

Exports

Exports

Sections

.text Size: 208KB - Virtual size: 208KB

.rdata Size: 40KB - Virtual size: 40KB

.data Size: 10KB - Virtual size: 29KB

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 30KB - Virtual size: 30KB

.text
Size: 208KB - Virtual size: 208KB

.rdata
Size: 40KB - Virtual size: 40KB

.data
Size: 10KB - Virtual size: 29KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 30KB - Virtual size: 30KB