b4f7a277d62fd8b62fa4ab73ed0b41cf29df294cc97e50f671efbccb945b53c1

Sharing

Copy URL Twitter E-mail

General

Target

b4f7a277d62fd8b62fa4ab73ed0b41cf29df294cc97e50f671efbccb945b53c1
Size

1.8MB
MD5

209d23db1108a08375faf0fa24be5f08
SHA1

4462f97f6652d314e9e120cf63e52e7980b8a68c
SHA256

b4f7a277d62fd8b62fa4ab73ed0b41cf29df294cc97e50f671efbccb945b53c1
SHA512

ecc09d842483c876859263a631810a00f155c23edd6082563b727d2d843e8f13b37c481ecfb972ec743c3fc7e7d9e90527909427becf7b6e7ac8616efd78b466
SSDEEP

24576:vAFC0DV7EQHRsxxvopbrLDQCIn5xwTFHtN8owyyKoa4P:vEBDVoRxirLpIHwZHtN8obJk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4f7a277d62fd8b62fa4ab73ed0b41cf29df294cc97e50f671efbccb945b53c1

Files

b4f7a277d62fd8b62fa4ab73ed0b41cf29df294cc97e50f671efbccb945b53c1
.exe windows:5 windows x86 arch:x86

eda65548e0b110b45936c70f49f0c69f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\gjjj20200621\小财子六炫\六炫三四五星内置公式newy\Release\d3demo.pdb

Imports

kernel32

GetSystemTimeAsFileTime
HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStartupInfoA
RaiseException
HeapReAlloc
ExitProcess
ExitThread
CreateThread
HeapSize
SetStdHandle
GetFileType
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
GetACP
IsValidCodePage
GetStdHandle
HeapFree
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
GetDriveTypeA
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
RtlUnwind
GetProcessHeap
GetTickCount
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
InterlockedIncrement
GetModuleHandleW
GetFileSizeEx
SetErrorMode
LocalAlloc
DeleteCriticalSection
InitializeCriticalSection
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
WritePrivateProfileStringA
FreeResource
GlobalAddAtomA
CreateEventA
SuspendThread
SetEvent
WaitForSingleObject
ResumeThread
SetThreadPriority
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
CompareStringA
InterlockedExchange
FreeLibrary
GetModuleFileNameW
lstrcmpA
FormatMessageA
LocalFree
MulDiv
FileTimeToLocalFileTime
FindNextFileA
GetCurrentProcessId
GetModuleFileNameA
GetFullPathNameA
GetVolumeInformationA
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
SetSystemTime
SetLastError
GetSystemTime
GlobalFree
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
GlobalMemoryStatus
CreateFileA
GetFileTime
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
CloseHandle
GetFileAttributesA
GetCurrentProcess
CopyFileA
MultiByteToWideChar
GetLastError
GlobalAlloc
GlobalLock
GlobalUnlock
GetCommandLineA
GetModuleHandleA
Sleep
InterlockedDecrement
SetCurrentDirectoryA
GetCurrentDirectoryA
GetVersionExA
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceA
lstrlenA
CreateDirectoryA
RemoveDirectoryA
lstrcmpiA
CreateProcessA
DeleteFileA
FreeEnvironmentStringsA
FindFirstFileA

user32

GetNextDlgGroupItem
InvalidateRgn
IsRectEmpty
CopyAcceleratorTableA
CharNextA
ReleaseCapture
SetCapture
LoadCursorA
GetSysColorBrush
DestroyMenu
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
SetDlgItemInt
GetDlgItemInt
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
TrackPopupMenu
SetMenu
GetScrollRange
GetScrollPos
SetForegroundWindow
UpdateWindow
CreateWindowExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
CopyRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetWindow
SetWindowContextHelpId
MapDialogRect
SetWindowPos
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetDlgItem
SendMessageA
GetSystemMetrics
SetCursorPos
GetNextDlgTabItem
EndDialog
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
PeekMessageA
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
EnableMenuItem
PostThreadMessageA
RegisterClipboardFormatA
CheckMenuItem
PostMessageA
MessageBeep
GetClassInfoExA
GetCursorPos
DrawIcon
AppendMenuA
GetSystemMenu
IsIconic
GetWindowRect
GetClientRect
InvalidateRect
SetTimer
KillTimer
GetDesktopWindow
EnableWindow
LoadIconA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetWindowTextA
DrawEdge
GetClipboardData
GetSubMenu
LoadMenuA
ClientToScreen
SetRect
GetKeyState
PtInRect
GetDC
ReleaseDC
GetParent
CharUpperA
MessageBoxA
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetWindowThreadProcessId
GetMenuItemCount
GetMenuItemID
PostQuitMessage
UnhookWindowsHookEx
GetMenuState
UnregisterClassA

gdi32

CreateRectRgnIndirect
GetMapMode
GetStockObject
GetBkColor
GetTextColor
GetRgnBox
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
CreateFontIndirectA
GetWindowExtEx
GetViewportExtEx
GetClipBox
SetMapMode
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateBitmap
GetDeviceCaps
GetCurrentObject
GetTextExtentPoint32A
BitBlt
SelectObject
CreateCompatibleDC
CreateDIBSection
DeleteObject
GetObjectA
CreateSolidBrush
PtVisible

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegCloseKey
RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
RegOpenKeyExA
RegEnumValueA

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetMalloc

comctl32

ord17

shlwapi

PathFindExtensionW
PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW
UrlUnescapeA
PathFindFileNameA
PathFindExtensionA

oledlg

ord8

ole32

CoRegisterMessageFilter
CoInitialize
CLSIDFromProgID
CLSIDFromString
OleRun
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoInitializeEx
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard

oleaut32

SysAllocStringByteLen
SysStringByteLen
VariantClear
SysStringLen
SysAllocStringLen
VariantChangeType
VariantInit
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocString
GetErrorInfo
SysFreeString

psapi

GetProcessMemoryInfo

gdiplus

GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipAlloc
GdipCloneImage
GdipFree
GdipDisposeImage
GdipSaveImageToFile
GdiplusShutdown

ws2_32

select
closesocket
recv
send
connect
htons
WSACleanup
WSAStartup
ntohl
htonl
socket
gethostbyname
inet_addr

wininet

InternetCanonicalizeUrlA
InternetQueryOptionA
InternetOpenUrlA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
InternetQueryDataAvailable
InternetCrackUrlA

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eda65548e0b110b45936c70f49f0c69f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

psapi

gdiplus

ws2_32

wininet

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 179KB - Virtual size: 179KB

.data Size: 16KB - Virtual size: 31KB

.rsrc Size: 121KB - Virtual size: 121KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 179KB - Virtual size: 179KB

.data
Size: 16KB - Virtual size: 31KB

.rsrc
Size: 121KB - Virtual size: 121KB