j:\data\计费客户端2010-11-03\新版电竞宾馆-无盘服务器\src\cli\wtClient_netbar\RemotePolicy\RemotePolicy\Release\RemotePolicy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f46320d5fe7f1d1b68a1038ea4c2d6d64b075fa4ac7e29c383ae4e8a1cb385f6.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
f46320d5fe7f1d1b68a1038ea4c2d6d64b075fa4ac7e29c383ae4e8a1cb385f6.exe
Resource
win10v2004-20240508-en
General
-
Target
f46320d5fe7f1d1b68a1038ea4c2d6d64b075fa4ac7e29c383ae4e8a1cb385f6
-
Size
1.2MB
-
MD5
10b5a7e20014d9dbefddd7a75e23b206
-
SHA1
8a3abf74e95d6e2a47b4830d496605b5825f9f10
-
SHA256
f46320d5fe7f1d1b68a1038ea4c2d6d64b075fa4ac7e29c383ae4e8a1cb385f6
-
SHA512
97d08f378538573c3986caa7b7ddcff4976f652c4b4f8e7c9c545e13ce7601c25c725ac730a5b7c36639da4b5ee49635bced58dfc8556fd33618de9f4fcd7f3c
-
SSDEEP
24576:Fun9o2k9xRE6hg6ZUKLPUcnMf6W6G7CN46oMUONaQ1Tcxeiy:0ehnyK9nMCW6ECNPDU2PTcx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f46320d5fe7f1d1b68a1038ea4c2d6d64b075fa4ac7e29c383ae4e8a1cb385f6
Files
-
f46320d5fe7f1d1b68a1038ea4c2d6d64b075fa4ac7e29c383ae4e8a1cb385f6.exe windows:4 windows x86 arch:x86
1ea0d82b3baffc641153de2f2c5c7913
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
netapi32
Netbios
psapi
GetModuleFileNameExA
iphlpapi
GetAdaptersInfo
mfc71
ord5491
ord1486
ord1440
ord1084
ord1123
ord745
ord557
ord1263
ord5716
ord1185
ord4541
ord3683
ord4038
ord4014
ord6278
ord3801
ord6276
ord4326
ord2063
ord2018
ord5583
ord3806
ord1010
ord5102
ord6219
ord5382
ord3832
ord1920
ord2931
ord2644
ord5226
ord3948
ord4568
ord5230
ord5213
ord5566
ord2838
ord4481
ord4261
ord3333
ord757
ord566
ord3830
ord2248
ord1025
ord2451
ord3635
ord3595
ord5227
ord4569
ord5567
ord570
ord759
ord2249
ord2131
ord5715
ord4108
ord2272
ord4085
ord5446
ord4109
ord865
ord1903
ord4580
ord6067
ord5807
ord605
ord3709
ord3719
ord3718
ord2533
ord2646
ord2540
ord2862
ord2714
ord4307
ord2835
ord2731
ord2537
ord5200
ord1599
ord1655
ord1656
ord1964
ord5175
ord1362
ord4967
ord3345
ord6277
ord3802
ord6279
ord1522
ord2172
ord2178
ord2405
ord2387
ord2385
ord2403
ord2415
ord2392
ord2408
ord354
ord2396
ord2398
ord2400
ord2394
ord2410
ord2390
ord934
ord930
ord932
ord928
ord923
ord5233
ord5235
ord5960
ord1600
ord4282
ord4722
ord3403
ord5203
ord4185
ord6275
ord5073
ord1908
ord5152
ord4244
ord1401
ord3946
ord1617
ord1620
ord5912
ord1551
ord1670
ord1671
ord2020
ord4890
ord4735
ord4212
ord5182
ord3441
ord3641
ord907
ord4035
ord2475
ord5403
ord1024
ord3997
ord911
ord762
ord6006
ord6288
ord6174
ord6180
ord3934
ord2469
ord266
ord265
ord322
ord586
ord1544
ord1490
ord1965
ord3255
ord1482
ord2933
ord299
ord6118
ord1489
ord876
ord283
ord6137
ord874
ord577
ord1485
ord5637
ord1280
ord1934
ord764
ord3210
ord3161
ord386
ord2280
ord347
ord1279
ord1966
ord1929
ord1968
ord384
ord5089
ord2903
ord5323
ord1439
ord629
ord602
ord631
ord304
ord781
ord1207
ord2271
ord2902
ord2468
ord5563
ord310
ord297
ord578
ord2322
ord784
ord1187
ord1191
ord4262
ord4486
ord2413
ord3949
ord912
ord5224
msvcr71
atoi
_except_handler3
_resetstkoflw
__CxxFrameHandler
_itoa
_setmbcp
_purecall
_mbscmp
setvbuf
_fdopen
_open_osfhandle
_iob
wcslen
wcscmp
memmove
__p___argc
__p___argv
_close
fopen
fseek
fread
fclose
strftime
??0exception@@QAE@XZ
??1exception@@UAE@XZ
ceil
_localtime64
_time64
strstr
strrchr
strcmp
tolower
strchr
printf
fabs
floor
memcpy
strcpy
pow
strncmp
_CxxThrowException
??0exception@@QAE@ABV0@@Z
malloc
free
labs
memcmp
strcat
sprintf
strlen
memset
strncpy
_lseek
_write
_read
_open
fflush
ftell
fwrite
fgets
fprintf
clearerr
_setmode
vsprintf
_vscprintf
_strdup
modf
rand
srand
time
wcsncpy
atol
__set_app_type
_atoi64
wcscat
_splitpath
_mbsstr
realloc
toupper
isspace
islower
isupper
isxdigit
ispunct
isprint
isgraph
isdigit
iscntrl
__isascii
isalpha
isalnum
calloc
__security_error_handler
??1type_info@@UAE@XZ
__dllonexit
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_controlfp
kernel32
GetACP
InterlockedExchange
GetVersionExA
DeleteCriticalSection
TerminateThread
WriteFile
SetFilePointer
SetFileTime
SetConsoleCtrlHandler
LocalFree
FormatMessageA
GlobalFree
GlobalAlloc
GetStdHandle
AllocConsole
FreeLibrary
OutputDebugStringA
CreateEventA
SetEvent
WriteProcessMemory
GetLocalTime
OpenProcess
CreateProcessA
CreatePipe
TerminateProcess
FreeConsole
GenerateConsoleCtrlEvent
AttachConsole
LoadLibraryA
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateMutexA
WaitForMultipleObjects
InitializeCriticalSection
RaiseException
lstrcpyA
GetLocaleInfoA
lstrcatA
CreateDirectoryA
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
GetProcessTimes
ReadProcessMemory
DuplicateHandle
HeapFree
GetProcessHeap
GetSystemTime
SetLastError
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
FreeResource
MoveFileA
LockResource
LoadResource
SizeofResource
FindResourceA
Process32NextW
Process32FirstW
InterlockedDecrement
FindNextFileA
SetThreadPriority
GetCurrentThread
VirtualProtect
DeviceIoControl
ExitProcess
GetCurrentProcessId
GetDriveTypeA
GetLogicalDrives
CreateThread
GetStartupInfoA
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
GetThreadLocale
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
lstrcmpiA
lstrlenA
DeleteFileA
SetFileAttributesA
GetModuleFileNameA
LeaveCriticalSection
GetCurrentProcess
GetProcAddress
GetModuleHandleA
Sleep
GetTickCount
GetLastError
WaitForSingleObject
CopyFileA
FindClose
FindFirstFileA
CloseHandle
ReadFile
GetFileSize
CreateFileA
SetLocalTime
GetSystemDirectoryA
GetFileAttributesA
EnterCriticalSection
ReadDirectoryChangesW
user32
CreateWindowExA
RegisterClassA
LoadCursorA
PostMessageA
PostThreadMessageA
GetWindowThreadProcessId
GetWindowTextA
PostQuitMessage
DispatchMessageA
DestroyWindow
SendMessageA
GetDC
ReleaseDC
TranslateMessage
keybd_event
MapVirtualKeyA
DefWindowProcA
EnableWindow
SetForegroundWindow
KillTimer
SetTimer
FindWindowA
SetWindowPos
LoadIconA
GetMessageA
FindWindowExA
IsWindowVisible
IsWindowEnabled
GetWindowTextW
GetWindowRect
GetClassNameA
GetCursorPos
SetCursorPos
mouse_event
gdi32
StretchBlt
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
DeleteObject
GetObjectA
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
ChangeServiceConfigA
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceA
RegDeleteValueA
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
RegCreateKeyA
RegSetValueExA
RegCloseKey
OpenSCManagerA
CreateServiceA
CloseServiceHandle
StartServiceCtrlDispatcherA
GetUserNameA
LookupAccountNameA
IsValidSid
GetLengthSid
CopySid
OpenProcessToken
shell32
ShellExecuteA
shlwapi
PathRemoveFileSpecA
PathFindExtensionW
StrStrIA
PathFileExistsA
StrStrIW
PathFindExtensionA
ole32
CoInitialize
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoUninitialize
oleaut32
VarUdateFromDate
VariantTimeToSystemTime
SystemTimeToVariantTime
ws2_32
closesocket
ioctlsocket
ntohl
inet_addr
getsockname
bind
htons
socket
sendto
WSASend
WSARecv
WSAGetLastError
WSAGetOverlappedResult
WSACreateEvent
WSAEventSelect
ntohs
recvfrom
select
inet_ntoa
setsockopt
htonl
WSAStartup
WSACleanup
gethostbyname
connect
send
WSAWaitForMultipleEvents
WSAResetEvent
recv
gethostname
shutdown
WSACloseEvent
msvcp71
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
gdiplus
GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipAlloc
GdipCloneImage
GdipFree
GdipDisposeImage
GdipSaveImageToFile
libeay32
ord490
ord1882
ord400
ord493
ord484
ord497
ord67
ord2081
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
setupapi
SetupDiChangeState
SetupDiSetClassInstallParamsA
SetupDiGetDeviceInstanceIdA
SetupDiClassNameFromGuidA
SetupDiEnumDeviceInfo
wininet
InternetOpenA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetSetOptionA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
Exports
Exports
OPENSSL_Applink
Sections
.text Size: 416KB - Virtual size: 414KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 784KB - Virtual size: 780KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ