3506e1753a92644f17053e73229b0dd54f556869e96b65c491c44108390b4031 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3506e1753a92644f17053e73229b0dd54f556869e96b65c491c44108390b4031
Size

28KB
MD5

83f64866629ea5dc1ffb9ca53acf04f4
SHA1

244e60a932a06a3e716fdf05085dc8d0c2484b8b
SHA256

3506e1753a92644f17053e73229b0dd54f556869e96b65c491c44108390b4031
SHA512

3c4f1dd0c69e6cb60c7d50edf6eb880f30b05776079771d91e4003e01c57df6b47664119b9fb74a951ea56d6b93a47d11dce6e5d03b1ad718429aa7a499c6195
SSDEEP

192:5RqXPMVUfdpdpd2WQQw8ko20HQRP6q6FRi8lNghJ08BFC:jklfxQfuQR6q6FQOqhFPC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3506e1753a92644f17053e73229b0dd54f556869e96b65c491c44108390b4031

Files

3506e1753a92644f17053e73229b0dd54f556869e96b65c491c44108390b4031
.dll windows:4 windows x86 arch:x86

48fbf08abea5f67da1f190cb18161075

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetCommandLineA
GetModuleFileNameA
GetModuleHandleA
IsBadReadPtr
GetProcessHeap

msvcrt

strrchr
_ftol

user32

GetMessageA
PeekMessageA
DispatchMessageA
wsprintfA
MessageBoxA
TranslateMessage

Exports

Exports

FindPic
LeftClick
changeMap
cureAllAndUp
cureOneAndUp
getBagPet
getDefaultPet
getNowUid
getPetDv
getPetName
getSkillInfo
init
petInfoUpDate
petSetDefault
ws_send
��_��ֿ�
��_�ֿ⵽��

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 596B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 814B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ