f46320d5fe7f1d1b68a1038ea4c2d6d64b075fa4ac7e29c383ae4e8a1cb385f6

Sharing

Copy URL Twitter E-mail

General

Target

f46320d5fe7f1d1b68a1038ea4c2d6d64b075fa4ac7e29c383ae4e8a1cb385f6
Size

1.2MB
MD5

10b5a7e20014d9dbefddd7a75e23b206
SHA1

8a3abf74e95d6e2a47b4830d496605b5825f9f10
SHA256

f46320d5fe7f1d1b68a1038ea4c2d6d64b075fa4ac7e29c383ae4e8a1cb385f6
SHA512

97d08f378538573c3986caa7b7ddcff4976f652c4b4f8e7c9c545e13ce7601c25c725ac730a5b7c36639da4b5ee49635bced58dfc8556fd33618de9f4fcd7f3c
SSDEEP

24576:Fun9o2k9xRE6hg6ZUKLPUcnMf6W6G7CN46oMUONaQ1Tcxeiy:0ehnyK9nMCW6ECNPDU2PTcx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f46320d5fe7f1d1b68a1038ea4c2d6d64b075fa4ac7e29c383ae4e8a1cb385f6

Files

f46320d5fe7f1d1b68a1038ea4c2d6d64b075fa4ac7e29c383ae4e8a1cb385f6
.exe windows:4 windows x86 arch:x86

1ea0d82b3baffc641153de2f2c5c7913

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

j:\data\计费客户端2010-11-03\新版电竞宾馆-无盘服务器\src\cli\wtClient_netbar\RemotePolicy\RemotePolicy\Release\RemotePolicy.pdb

Imports

netapi32

Netbios

psapi

GetModuleFileNameExA

iphlpapi

GetAdaptersInfo

mfc71

ord5491
ord1486
ord1440
ord1084
ord1123
ord745
ord557
ord1263
ord5716
ord1185
ord4541
ord3683
ord4038
ord4014
ord6278
ord3801
ord6276
ord4326
ord2063
ord2018
ord5583
ord3806
ord1010
ord5102
ord6219
ord5382
ord3832
ord1920
ord2931
ord2644
ord5226
ord3948
ord4568
ord5230
ord5213
ord5566
ord2838
ord4481
ord4261
ord3333
ord757
ord566
ord3830
ord2248
ord1025
ord2451
ord3635
ord3595
ord5227
ord4569
ord5567
ord570
ord759
ord2249
ord2131
ord5715
ord4108
ord2272
ord4085
ord5446
ord4109
ord865
ord1903
ord4580
ord6067
ord5807
ord605
ord3709
ord3719
ord3718
ord2533
ord2646
ord2540
ord2862
ord2714
ord4307
ord2835
ord2731
ord2537
ord5200
ord1599
ord1655
ord1656
ord1964
ord5175
ord1362
ord4967
ord3345
ord6277
ord3802
ord6279
ord1522
ord2172
ord2178
ord2405
ord2387
ord2385
ord2403
ord2415
ord2392
ord2408
ord354
ord2396
ord2398
ord2400
ord2394
ord2410
ord2390
ord934
ord930
ord932
ord928
ord923
ord5233
ord5235
ord5960
ord1600
ord4282
ord4722
ord3403
ord5203
ord4185
ord6275
ord5073
ord1908
ord5152
ord4244
ord1401
ord3946
ord1617
ord1620
ord5912
ord1551
ord1670
ord1671
ord2020
ord4890
ord4735
ord4212
ord5182
ord3441
ord3641
ord907
ord4035
ord2475
ord5403
ord1024
ord3997
ord911
ord762
ord6006
ord6288
ord6174
ord6180
ord3934
ord2469
ord266
ord265
ord322
ord586
ord1544
ord1490
ord1965
ord3255
ord1482
ord2933
ord299
ord6118
ord1489
ord876
ord283
ord6137
ord874
ord577
ord1485
ord5637
ord1280
ord1934
ord764
ord3210
ord3161
ord386
ord2280
ord347
ord1279
ord1966
ord1929
ord1968
ord384
ord5089
ord2903
ord5323
ord1439
ord629
ord602
ord631
ord304
ord781
ord1207
ord2271
ord2902
ord2468
ord5563
ord310
ord297
ord578
ord2322
ord784
ord1187
ord1191
ord4262
ord4486
ord2413
ord3949
ord912
ord5224

msvcr71

atoi
_except_handler3
_resetstkoflw
__CxxFrameHandler
_itoa
_setmbcp
_purecall
_mbscmp
setvbuf
_fdopen
_open_osfhandle
_iob
wcslen
wcscmp
memmove
__p___argc
__p___argv
_close
fopen
fseek
fread
fclose
strftime
??0exception@@QAE@XZ
??1exception@@UAE@XZ
ceil
_localtime64
_time64
strstr
strrchr
strcmp
tolower
strchr
printf
fabs
floor
memcpy
strcpy
pow
strncmp
_CxxThrowException
??0exception@@QAE@ABV0@@Z
malloc
free
labs
memcmp
strcat
sprintf
strlen
memset
strncpy
_lseek
_write
_read
_open
fflush
ftell
fwrite
fgets
fprintf
clearerr
_setmode
vsprintf
_vscprintf
_strdup
modf
rand
srand
time
wcsncpy
atol
__set_app_type
_atoi64
wcscat
_splitpath
_mbsstr
realloc
toupper
isspace
islower
isupper
isxdigit
ispunct
isprint
isgraph
isdigit
iscntrl
__isascii
isalpha
isalnum
calloc
__security_error_handler
??1type_info@@UAE@XZ
__dllonexit
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_controlfp

kernel32

GetACP
InterlockedExchange
GetVersionExA
DeleteCriticalSection
TerminateThread
WriteFile
SetFilePointer
SetFileTime
SetConsoleCtrlHandler
LocalFree
FormatMessageA
GlobalFree
GlobalAlloc
GetStdHandle
AllocConsole
FreeLibrary
OutputDebugStringA
CreateEventA
SetEvent
WriteProcessMemory
GetLocalTime
OpenProcess
CreateProcessA
CreatePipe
TerminateProcess
FreeConsole
GenerateConsoleCtrlEvent
AttachConsole
LoadLibraryA
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateMutexA
WaitForMultipleObjects
InitializeCriticalSection
RaiseException
lstrcpyA
GetLocaleInfoA
lstrcatA
CreateDirectoryA
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
GetProcessTimes
ReadProcessMemory
DuplicateHandle
HeapFree
GetProcessHeap
GetSystemTime
SetLastError
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
FreeResource
MoveFileA
LockResource
LoadResource
SizeofResource
FindResourceA
Process32NextW
Process32FirstW
InterlockedDecrement
FindNextFileA
SetThreadPriority
GetCurrentThread
VirtualProtect
DeviceIoControl
ExitProcess
GetCurrentProcessId
GetDriveTypeA
GetLogicalDrives
CreateThread
GetStartupInfoA
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
GetThreadLocale
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
lstrcmpiA
lstrlenA
DeleteFileA
SetFileAttributesA
GetModuleFileNameA
LeaveCriticalSection
GetCurrentProcess
GetProcAddress
GetModuleHandleA
Sleep
GetTickCount
GetLastError
WaitForSingleObject
CopyFileA
FindClose
FindFirstFileA
CloseHandle
ReadFile
GetFileSize
CreateFileA
SetLocalTime
GetSystemDirectoryA
GetFileAttributesA
EnterCriticalSection
ReadDirectoryChangesW

user32

CreateWindowExA
RegisterClassA
LoadCursorA
PostMessageA
PostThreadMessageA
GetWindowThreadProcessId
GetWindowTextA
PostQuitMessage
DispatchMessageA
DestroyWindow
SendMessageA
GetDC
ReleaseDC
TranslateMessage
keybd_event
MapVirtualKeyA
DefWindowProcA
EnableWindow
SetForegroundWindow
KillTimer
SetTimer
FindWindowA
SetWindowPos
LoadIconA
GetMessageA
FindWindowExA
IsWindowVisible
IsWindowEnabled
GetWindowTextW
GetWindowRect
GetClassNameA
GetCursorPos
SetCursorPos
mouse_event

gdi32

StretchBlt
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
DeleteObject
GetObjectA

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
ChangeServiceConfigA
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceA
RegDeleteValueA
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
RegCreateKeyA
RegSetValueExA
RegCloseKey
OpenSCManagerA
CreateServiceA
CloseServiceHandle
StartServiceCtrlDispatcherA
GetUserNameA
LookupAccountNameA
IsValidSid
GetLengthSid
CopySid
OpenProcessToken

shell32

ShellExecuteA

shlwapi

PathRemoveFileSpecA
PathFindExtensionW
StrStrIA
PathFileExistsA
StrStrIW
PathFindExtensionA

ole32

CoInitialize
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoUninitialize

oleaut32

VarUdateFromDate
VariantTimeToSystemTime
SystemTimeToVariantTime

ws2_32

closesocket
ioctlsocket
ntohl
inet_addr
getsockname
bind
htons
socket
sendto
WSASend
WSARecv
WSAGetLastError
WSAGetOverlappedResult
WSACreateEvent
WSAEventSelect
ntohs
recvfrom
select
inet_ntoa
setsockopt
htonl
WSAStartup
WSACleanup
gethostbyname
connect
send
WSAWaitForMultipleEvents
WSAResetEvent
recv
gethostname
shutdown
WSACloseEvent

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

gdiplus

GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipAlloc
GdipCloneImage
GdipFree
GdipDisposeImage
GdipSaveImageToFile

libeay32

ord490
ord1882
ord400
ord493
ord484
ord497
ord67
ord2081

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

setupapi

SetupDiChangeState
SetupDiSetClassInstallParamsA
SetupDiGetDeviceInstanceIdA
SetupDiClassNameFromGuidA
SetupDiEnumDeviceInfo

wininet

InternetOpenA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetSetOptionA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA

Exports

Exports

OPENSSL_Applink

Sections

.text
Size: 416KB - Virtual size: 414KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 784KB - Virtual size: 780KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ea0d82b3baffc641153de2f2c5c7913

Headers

File Characteristics

PDB Paths

Imports

netapi32

psapi

iphlpapi

mfc71

msvcr71

kernel32

user32

gdi32

advapi32

shell32

shlwapi

ole32

oleaut32

ws2_32

msvcp71

gdiplus

libeay32

version

setupapi

wininet

Exports

Exports

Sections

.text Size: 416KB - Virtual size: 414KB

.rdata Size: 56KB - Virtual size: 52KB

.data Size: 12KB - Virtual size: 1.0MB

.rsrc Size: 784KB - Virtual size: 780KB

.text
Size: 416KB - Virtual size: 414KB

.rdata
Size: 56KB - Virtual size: 52KB

.data
Size: 12KB - Virtual size: 1.0MB

.rsrc
Size: 784KB - Virtual size: 780KB