874d640f0aa2c54cbd1c365fa34e6daf1caf24d8b0f7cb6e4e380df9c2c21588

Sharing

Copy URL Twitter E-mail

General

Target

874d640f0aa2c54cbd1c365fa34e6daf1caf24d8b0f7cb6e4e380df9c2c21588
Size

1.1MB
MD5

dd553e50d4de121f3caa36b6c377847d
SHA1

db8da380cb218f56f5d65095719688acd971960a
SHA256

874d640f0aa2c54cbd1c365fa34e6daf1caf24d8b0f7cb6e4e380df9c2c21588
SHA512

487d2db8d610723d0f74efc9ee7b5943a96ddd5cd359ed91a6643e12194fd06b44e192316d3810f680659ec475abe931f2cf719f3c473c020de736fba196cfbe
SSDEEP

24576:rY+xTkIVy+0PVTBc/7KmA4g+Ht8T8WQ/:rBxIIkTBc/v6zY7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
874d640f0aa2c54cbd1c365fa34e6daf1caf24d8b0f7cb6e4e380df9c2c21588

Files

874d640f0aa2c54cbd1c365fa34e6daf1caf24d8b0f7cb6e4e380df9c2c21588
.exe windows:5 windows x86 arch:x86

2806ddaaaa20b107bab6743fa1376954

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\源码大全\GameServer1.93GS\ExteriorServer\Debug\ExteriorServer.pdb

Imports

kernel32

GetPrivateProfileIntA
GetLastError
CloseHandle
PostQueuedCompletionStatus
CreateIoCompletionPort
GetSystemInfo
GetQueuedCompletionStatus
GetTickCount
lstrcmpA
lstrlenA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileA
GetProcAddress
LoadLibraryA
SetUnhandledExceptionFilter
SetErrorMode
TryEnterCriticalSection
lstrcpyA
HeapFree
GetProcessHeap
HeapAlloc
CompareStringW
GetPrivateProfileStringA
SetEndOfFile
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
GetStringTypeW
HeapQueryInformation
HeapSize
HeapReAlloc
EnterCriticalSection
SetFilePointer
GetConsoleMode
GetConsoleCP
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
QueryPerformanceCounter
GetLocaleInfoW
ReadFile
GetTimeZoneInformation
SetHandleCount
FreeLibrary
VirtualQuery
CreateDirectoryA
GetLocalTime
Sleep
WaitForSingleObject
TerminateThread
DeleteCriticalSection
InitializeCriticalSection
CreateFileW
CreateThread
SetConsoleCtrlHandler
ExitProcess
OutputDebugStringW
OutputDebugStringA
WriteFile
IsValidCodePage
GetOEMCP
GetACP
IsProcessorFeaturePresent
FatalAppExitA
InitializeCriticalSectionAndSpinCount
GetCurrentThread
SetLastError
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCPInfo
LCMapStringW
LeaveCriticalSection
FlushFileBuffers
IsBadReadPtr
HeapValidate
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetStdHandle
GetFileType
WriteConsoleW
GetSystemTimeAsFileTime
LoadLibraryW
MultiByteToWideChar
WideCharToMultiByte
RaiseException
GetModuleFileNameW
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
EncodePointer
DecodePointer
SetEnvironmentVariableA

user32

DestroyWindow
ReleaseDC
FillRect
GetClientRect
GetDC
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
SendMessageA
LoadAcceleratorsA
LoadStringA
RegisterClassExA
LoadCursorA
LoadIconA
UpdateWindow
ShowWindow
GetDlgItemTextA
SetTimer
SetWindowTextA
EndDialog
DialogBoxParamA
CreateWindowExA
DefWindowProcA
PostQuitMessage
MessageBoxA
wsprintfA

gdi32

SetBkMode
SelectObject
SetTextColor
TextOutA
DeleteObject
CreateFontA
CreateSolidBrush
GetStockObject

odbc32

ord75
ord24
ord31
ord36
ord7
ord39
ord8
ord4
ord18
ord20
ord11
ord16
ord26
ord13
ord43
ord49
ord48
ord9
ord72

comctl32

ord17

ws2_32

recvfrom
WSASendTo
gethostbyname
inet_addr
ntohl
WSASend
WSAAccept
inet_ntoa
WSARecv
WSASocketA
WSAGetLastError
htonl
htons
bind
listen
closesocket
WSAStartup

Sections

.text
Size: 773KB - Virtual size: 772KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 169KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2806ddaaaa20b107bab6743fa1376954

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

odbc32

comctl32

ws2_32

Sections

.text Size: 773KB - Virtual size: 772KB

.rdata Size: 164KB - Virtual size: 163KB

.data Size: 8KB - Virtual size: 1.4MB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 169KB - Virtual size: 168KB

.text
Size: 773KB - Virtual size: 772KB

.rdata
Size: 164KB - Virtual size: 163KB

.data
Size: 8KB - Virtual size: 1.4MB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 169KB - Virtual size: 168KB