E:\工作\出站补票\程序\2021\drv_v05-邓哥给原版\ZbTest\Debug\Zbtest.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d87480198040c02694d5d49a56cfed53f4dbca8af637d7e3038305f65060200d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d87480198040c02694d5d49a56cfed53f4dbca8af637d7e3038305f65060200d.exe
Resource
win10v2004-20240226-en
General
-
Target
d87480198040c02694d5d49a56cfed53f4dbca8af637d7e3038305f65060200d
-
Size
7.1MB
-
MD5
68647df47ecb7f472e61efdfe7190671
-
SHA1
dc349a9742e8e98fc34bc0d87e5d3b46d950ed9a
-
SHA256
d87480198040c02694d5d49a56cfed53f4dbca8af637d7e3038305f65060200d
-
SHA512
94408db53138f676702380326360ea94d88f534f759642d372639630ec64c044b8a7c2bf9b54b7cac3002931ff9f4c5db3521e8fb231eadb5893436f6ed5159c
-
SSDEEP
49152:Khr6i4zQ0no0xVzNLU5DJAqopNV1xcXwzkBsRrLsRayTVUFOjYpjeemv7TwE2+DL:aYu0L+dA3nwgJyf7cE2+qHxa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d87480198040c02694d5d49a56cfed53f4dbca8af637d7e3038305f65060200d
Files
-
d87480198040c02694d5d49a56cfed53f4dbca8af637d7e3038305f65060200d.exe windows:6 windows x86 arch:x86
ce8e067808082c5abf9185e6dde47287
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DecodePointer
MultiByteToWideChar
CreateDirectoryA
GetCurrentThread
GetCurrentThreadId
GetVersionExA
GetModuleFileNameA
LoadLibraryExW
LoadResource
LockResource
LoadLibraryA
GetProcAddress
DeleteCriticalSection
LocalFileTimeToFileTime
SizeofResource
GlobalAlloc
GlobalLock
GlobalDeleteAtom
lstrcmpA
FindResourceW
WideCharToMultiByte
CompareStringA
OutputDebugStringA
SetLastError
FreeResource
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GlobalUnlock
GlobalFree
LoadLibraryW
FindResourceA
CloseHandle
SetEvent
WaitForSingleObject
CreateEventA
SuspendThread
SetThreadPriority
GetThreadPriority
ResumeThread
GetPrivateProfileIntA
SetEnvironmentVariableA
CreateFileW
LCMapStringW
GetTimeFormatW
GetDateFormatW
EnumSystemLocalesW
IsValidLocale
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetStringTypeW
HeapQueryInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
IsValidCodePage
CreateSemaphoreW
GetStartupInfoW
TerminateProcess
CreateEventW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
SetConsoleCtrlHandler
FatalAppExitA
SetStdHandle
WriteConsoleW
OutputDebugStringW
GetFileType
GetStdHandle
VirtualQuery
VirtualAlloc
ExitThread
CreateThread
AreFileApisANSI
ExitProcess
GetSystemInfo
HeapValidate
GetCommandLineA
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
IsDebuggerPresent
RtlUnwind
GetModuleHandleExW
LocalUnlock
LocalLock
SearchPathA
Sleep
GetTempPathA
VerifyVersionInfoA
VerSetConditionMask
CreateSemaphoreA
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
ReleaseSemaphore
lstrcpyA
GetTickCount
GetWindowsDirectoryA
FindResourceExW
GetUserDefaultLCID
ReplaceFileA
GetTempFileNameA
GetDiskFreeSpaceA
SetFileTime
SetFileAttributesA
FreeLibrary
GetFileTime
GetFileSizeEx
GetFileAttributesExA
GetFileAttributesA
FileTimeToLocalFileTime
GetCPInfo
GetOEMCP
PulseEvent
ResetEvent
SystemTimeToFileTime
FileTimeToSystemTime
GetStringTypeExA
GetThreadLocale
GetVolumeInformationA
MoveFileA
lstrcmpiA
GetShortPathNameA
LoadLibraryExA
GetCurrentProcess
GetHandleInformation
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetFullPathNameA
GetFileSize
FlushFileBuffers
FindFirstFileA
FindClose
CreateFileA
GetACP
VirtualProtect
GetProfileIntA
GetPrivateProfileStringA
GetAtomNameA
SetErrorMode
DeleteFileA
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GetCurrentDirectoryA
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetSystemDirectoryW
EncodePointer
CopyFileA
FormatMessageA
MulDiv
LocalFree
GlobalSize
GetCurrentProcessId
GlobalAddAtomA
WritePrivateProfileStringA
user32
TrackMouseEvent
MonitorFromPoint
UpdateLayeredWindow
LoadImageW
EmptyClipboard
SetClipboardData
CloseClipboard
EnumDisplayMonitors
SetLayeredWindowAttributes
MsgWaitForMultipleObjectsEx
GetIconInfo
DrawIconEx
RegisterClipboardFormatA
UnionRect
MapVirtualKeyA
GetKeyNameTextA
MessageBeep
IsRectEmpty
CopyAcceleratorTableA
CharNextA
ReuseDDElParam
GetMenuBarInfo
LoadImageA
TranslateAcceleratorA
LoadAcceleratorsA
CharUpperA
DestroyIcon
IntersectRect
UnpackDDElParam
GetClipboardFormatNameA
GetDialogBaseUnits
GetAsyncKeyState
InflateRect
OffsetRect
SetRect
SetRectEmpty
DestroyMenu
LoadAcceleratorsW
RealChildWindowFromPoint
SystemParametersInfoA
CopyImage
ReleaseCapture
WaitMessage
IsDialogMessageA
SetWindowTextA
ScrollWindowEx
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextA
SetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
MoveWindow
ShowWindow
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
UnhookWindowsHookEx
GetClassNameA
GetClassLongA
SetWindowLongA
PtInRect
EqualRect
AdjustWindowRectEx
GetWindowTextLengthA
RemovePropA
GetPropA
SetPropA
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
GetMenu
SetFocus
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
DefWindowProcA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
SendDlgItemMessageA
GetWindowTextA
CopyRect
GetSysColor
LoadBitmapA
CheckMenuRadioItem
InvertRect
FrameRect
FillRect
DrawFocusRect
GetSysColorBrush
GetMenuContextHelpId
SetMenuContextHelpId
ScrollDC
ExcludeUpdateRgn
GetComboBoxInfo
GetTabbedTextExtentA
DrawStateA
GrayStringA
DrawTextExA
DrawTextA
DrawIcon
SetMenuDefaultItem
GetMenuDefaultItem
SetMenuItemInfoA
GetMenuItemInfoA
InsertMenuItemA
DeleteMenu
ModifyMenuA
EnableMenuItem
CheckMenuItem
CreatePopupMenu
CreateMenu
LoadMenuIndirectA
LoadMenuW
LoadMenuA
DrawFrameControl
DrawEdge
RemoveMenu
AppendMenuA
InsertMenuA
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringA
IsMenu
SetWindowPos
GetWindowThreadProcessId
MessageBoxA
SetCursor
NotifyWinEvent
ArrangeIconicWindows
DlgDirSelectComboBoxExA
DlgDirListComboBoxA
DlgDirSelectExA
DlgDirListA
LoadIconW
LoadIconA
LoadCursorW
LoadCursorA
GetWindow
GetLastActivePopup
GetTopWindow
FindWindowExA
FindWindowA
SetParent
GetParent
ChildWindowFromPointEx
ChildWindowFromPoint
WindowFromPoint
MapWindowPoints
ScreenToClient
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
CreateCaret
GetWindowContextHelpId
SetWindowContextHelpId
GetWindowRect
GetClientRect
EnableScrollBar
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
LockWindowUpdate
RedrawWindow
ValidateRgn
InvalidateRgn
InvalidateRect
GetWindowRgn
SetWindowRgn
GetUpdateRgn
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
GetDCEx
GetDC
SetForegroundWindow
GetForegroundWindow
UpdateWindow
DragDetect
GetSystemMenu
DrawMenuBar
HiliteMenuItem
KillTimer
SetTimer
SetCapture
GetCapture
GetOpenClipboardWindow
ChangeClipboardChain
GetClipboardViewer
SetClipboardViewer
GetClipboardOwner
OpenClipboard
GetNextDlgTabItem
GetKeyboardLayout
IsCharLowerA
MapVirtualKeyExA
GetKeyboardState
ToAsciiEx
CreateAcceleratorTableA
DestroyAcceleratorTable
SetCursorPos
SetClassLongA
GetDoubleClickTime
CopyIcon
CharUpperBuffA
EnumChildWindows
IsClipboardFormatAvailable
InSendMessage
DefFrameProcA
DefMDIChildProcA
TranslateMDISysAccel
SubtractRect
DestroyCursor
GetTabbedTextExtentW
WindowFromDC
GetNextDlgGroupItem
IsZoomed
BringWindowToTop
IsIconic
IsWindowVisible
CloseWindow
OpenIcon
ShowOwnedPopups
FlashWindow
IsChild
PostThreadMessageA
SendNotifyMessageA
DrawAnimatedRects
DrawCaption
CallNextHookEx
SetWindowsHookExA
GetCursorPos
ValidateRect
GetKeyState
PeekMessageA
DispatchMessageA
TranslateMessage
GetMessageA
GetDesktopWindow
GetWindowLongA
SetActiveWindow
IsWindowEnabled
EnableWindow
GetActiveWindow
GetDlgItem
EndDialog
CreateDialogIndirectParamA
DestroyWindow
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetFocus
MapDialogRect
TabbedTextOutA
IsWindow
PostMessageA
SendMessageA
PostQuitMessage
GetSystemMetrics
UnregisterClassA
SetScrollInfo
gdi32
CreateBrushIndirect
CreateCompatibleBitmap
CreateDiscardableBitmap
CreateCompatibleDC
CreateDIBPatternBrushPt
CreateEllipticRgn
CreateEllipticRgnIndirect
CreateFontIndirectA
CreateFontA
CreateHatchBrush
CreateICA
CreatePalette
CreatePen
CreatePenIndirect
CreatePolyPolygonRgn
CreatePatternBrush
CreateRectRgn
CreateRectRgnIndirect
CreateRoundRectRgn
DrawEscape
Ellipse
EnumObjects
EqualRgn
Escape
ExtEscape
ExtCreateRegion
ExtFloodFill
FillRgn
FloodFill
FrameRgn
GetROP2
GetAspectRatioFilterEx
GetBkColor
GetBkMode
GetBitmapBits
GetBitmapDimensionEx
GetBoundsRect
GetBrushOrgEx
GetCharWidthA
GetCharWidthFloatA
GetCharABCWidthsA
GetCharABCWidthsFloatA
GetCurrentObject
GetCurrentPositionEx
GetFontData
GetGlyphOutlineA
GetGraphicsMode
GetMapMode
GetNearestColor
GetNearestPaletteIndex
GetObjectType
GetOutlineTextMetricsA
GetPaletteEntries
GetPixel
GetPolyFillMode
GetRegionData
GetRgnBox
GetStockObject
GetStretchBltMode
GetTextCharacterExtra
GetTextAlign
GetTextColor
GetTextExtentPoint32A
GetFontLanguageInfo
GetCharacterPlacementA
GetViewportExtEx
GetViewportOrgEx
GetWindowExtEx
GetWindowOrgEx
InvertRgn
MaskBlt
PlgBlt
OffsetRgn
PatBlt
Pie
PaintRgn
PolyPolygon
PtInRegion
PtVisible
RectInRegion
RectVisible
Rectangle
ResetDCA
RealizePalette
RoundRect
ResizePalette
SelectObject
SetBitmapBits
SetBoundsRect
SetPaletteEntries
SetPixel
SetPixelV
StretchBlt
SetRectRgn
UpdateColors
PlayEnhMetaFile
GdiComment
GetTextMetricsA
AngleArc
CreateBitmapIndirect
GetWorldTransform
GetColorAdjustment
CreateHalftonePalette
StartDocA
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
AbortPath
BeginPath
CloseFigure
EndPath
FillPath
FlattenPath
GetPath
PathToRegion
SetMiterLimit
StrokeAndFillPath
StrokePath
WidenPath
ExtCreatePen
GetMiterLimit
GetArcDirection
GetObjectA
TextOutA
CreatePolygonRgn
DPtoLP
LPtoDP
Polygon
Polyline
PolyBezier
SetBitmapDimensionEx
SetBrushOrgEx
GetTextFaceA
GetKerningPairsA
UnrealizeObject
DeleteDC
DeleteObject
ExcludeClipRect
GetClipBox
GetClipRgn
IntersectClipRect
LineTo
OffsetClipRgn
PlayMetaFile
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkColor
SetBkMode
SetMapperFlags
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextColor
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
MoveToEx
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
StretchDIBits
EnumFontFamiliesExA
GetSystemPaletteEntries
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
GetDIBits
CreateDIBSection
SetDIBColorTable
DeleteMetaFile
GetTextExtentPointA
GetTextExtentPoint32W
CombineRgn
Chord
BitBlt
Arc
AnimatePalette
GetDeviceCaps
CreateDCA
CopyMetaFileA
CreateBitmap
ExtTextOutA
CreateEnhMetaFileA
CloseEnhMetaFile
CreateSolidBrush
CreateMetaFileA
CloseMetaFile
PolyPolyline
msimg32
AlphaBlend
GradientFill
TransparentBlt
winspool.drv
GetJobA
DocumentPropertiesA
ClosePrinter
OpenPrinterA
advapi32
GetFileSecurityA
RegEnumKeyExA
SetFileSecurityA
RegOpenKeyExW
RegEnumValueA
RegSetValueA
RegQueryValueA
RegEnumKeyA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
shell32
SHGetMalloc
SHAddToRecentDocs
ExtractIconA
SHGetFileInfoA
DragQueryFileA
DragFinish
SHGetPathFromIDListA
ShellExecuteExA
SHAppBarMessage
SHBrowseForFolderA
DragAcceptFiles
ShellExecuteA
SHGetDesktopFolder
SHGetSpecialFolderLocation
shlwapi
PathFindFileNameA
PathRemoveExtensionA
PathRemoveFileSpecW
PathIsUNCA
PathStripToRootA
PathFindExtensionA
StrFormatKBSizeA
uxtheme
GetWindowTheme
GetThemeSysColor
GetCurrentThemeName
GetThemeColor
DrawThemeParentBackground
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
DrawThemeBackground
OpenThemeData
CloseThemeData
DrawThemeText
ole32
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
OleRun
CoRevokeClassObject
CoRegisterClassObject
PropVariantCopy
CoDisconnectObject
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
StringFromGUID2
CoGetClassObject
CoInitializeEx
SetConvertStg
CreateOleAdviseHolder
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
WriteClassStg
ReadClassStg
CreateBindCtx
CoTreatAsClass
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
CLSIDFromProgID
CLSIDFromString
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
CreateDataAdviseHolder
GetRunningObjectTable
OleRegEnumVerbs
OleRegGetMiscStatus
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleSetMenuDescriptor
OleQueryCreateFromData
OleQueryLinkFromData
OleLoad
StgIsStorageFile
StgOpenStorage
StgCreateDocfile
CoGetMalloc
GetHGlobalFromILockBytes
OleGetIconOfClass
OleLockRunning
OleIsRunning
OleSetContainedObject
OleSaveToStream
OleSave
OleCreateFromFile
OleCreateLinkToFile
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleCreate
WriteClassStm
StgIsStorageILockBytes
OleGetClipboard
DoDragDrop
CreateItemMoniker
CreateFileMoniker
GetClassFile
CreateGenericComposite
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
OleRegGetUserType
CreateStreamOnHGlobal
oleaut32
SysAllocString
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
SafeArrayGetDim
SafeArrayGetElemsize
LoadTypeLi
LoadRegTypeLi
RegisterTypeLi
SysReAllocStringLen
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCreate
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SysAllocStringByteLen
OleCreateFontIndirect
SysStringByteLen
SysFreeString
VariantChangeType
SafeArrayRedim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayCopy
SafeArrayPtrOfIndex
VariantCopy
VarDateFromStr
VarCyFromStr
VarBstrFromCy
VarBstrFromDate
VariantClear
SysAllocStringLen
VariantInit
VarDecFromStr
VarBstrFromDec
oledlg
ord9
ord7
ord6
ord5
ord4
ord3
ord8
oleacc
LresultFromObject
CreateStdAccessibleObject
AccessibleObjectFromWindow
gdiplus
GdipFree
GdipAlloc
GdipGetImageHeight
GdiplusStartup
GdipCloneImage
GdipGetImagePalette
GdipGetImagePaletteSize
GdipSetInterpolationMode
GdipDrawImageRectI
GdipGetImageWidth
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImagePixelFormat
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdiplusShutdown
GdipCreateFromHDC
imm32
ImmReleaseContext
ImmGetContext
ImmGetOpenStatus
winmm
PlaySoundA
Sections
.text Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 790KB - Virtual size: 789KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 41KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 305KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ