89d0329a0ca2ab1b944afcc443c2676e79337e7265082b1b0b0f8ee4213c6b61

Sharing

Copy URL Twitter E-mail

General

Target

89d0329a0ca2ab1b944afcc443c2676e79337e7265082b1b0b0f8ee4213c6b61
Size

1.1MB
MD5

9184406f84a6eda4a9f5d53dc092fa88
SHA1

a1c027eef73e5031dc4de801dcdf687cec058783
SHA256

89d0329a0ca2ab1b944afcc443c2676e79337e7265082b1b0b0f8ee4213c6b61
SHA512

d1aedcb30b698c77947a4053bd0c56bfbc6c79ad7b0f5a3bbea53b997149276b44c641088a6adcc1321e8ab723f24fdb89be9784fbb0c5769fcb5789a999d737
SSDEEP

24576:nqJBg9wAmid6/H6vplIzoGIhgXIygRNsOIhrsZHxd9ty3:nqJB7Amid6/4+7IWXkNB2rsZHxdH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89d0329a0ca2ab1b944afcc443c2676e79337e7265082b1b0b0f8ee4213c6b61

Files

89d0329a0ca2ab1b944afcc443c2676e79337e7265082b1b0b0f8ee4213c6b61
.exe windows:4 windows x86 arch:x86

862890a604298668f855f92417a03dfc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetCloseHandle
FtpGetFileA
InternetSetStatusCallback
FtpSetCurrentDirectoryA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile

dsound

ord1

code

INITCODE
ENCODO
DECODO
OridginalImage

routine

ON_PLAY
PLAY_STOP
WAVE_FORMAT
MWOM_CLOSE
MWOM_DON
MWIM_CLOSE
MWIM_DATA
MWIM_OPEN
RECORD_STOP
Clear_Voice
Nakinasi_Onoff
PICTURE_KURE
Lobby_room
Ranking_Point
Disconnect_Server
Login_send
Personal_send
Mjwork_Infomation
ON_RECORD
SendEdit_HandleName
Infomation_HITORI
Infomation_Server
EditTime_IsOver
Lobby_score
Lobby_client
Push_OK
Init_client
pGameOver
MajongOption_DlgOk
Chat_Send
Ryoukin_send
pMJ_TIMER
mMJ_TIMER
pCURSOL
pZENHAN
pKOUHAN
Gamedata_Prepare
only_host
Infomatuin_Main
mReceive
fReceive_FromMain
pReceive_FromMain
ReceiveTimer_FromMain
GIVE_CG
GIVE_SCORE
JONG_DB
LOGUIN_MODE
ORIGIN_TOUROKU
mjwork_routine
REPLAY_JONG
Close_Main
Kansen_Infomation
_FORM

comctl32

InitCommonControlsEx
ImageList_Draw

wsock32

WSACleanup

kernel32

GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
SetUnhandledExceptionFilter
GetCPInfo
SetHandleCount
GetFileType
QueryPerformanceCounter
GetOEMCP
IsBadWritePtr
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
InitializeCriticalSection
RaiseException
DeleteCriticalSection
LCMapStringA
lstrlenA
LocalFree
LocalAlloc
LockResource
SizeofResource
LoadResource
FindResourceA
GetCurrentDirectoryA
SetCurrentDirectoryA
DeleteFileA
GetCurrentProcessId
WriteFile
CloseHandle
ReadFile
GlobalAlloc
CreateFileA
IsDBCSLeadByte
EnterCriticalSection
LeaveCriticalSection
GlobalUnlock
GlobalLock
MultiByteToWideChar
lstrlenW
GetModuleFileNameA
MulDiv
lstrcmpA
WideCharToMultiByte
GetLastError
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
HeapAlloc
GetProcessHeap
FlushInstructionCache
GetCurrentProcess
HeapFree
ExitThread
GetFileAttributesA
GetWindowsDirectoryA
GetTickCount
Sleep
CreateThread
CreateMutexA
GetModuleHandleA
FreeLibrary
LoadLibraryExA
lstrcmpiA
lstrcpynA
ExitProcess
GetProcAddress
TerminateProcess
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
GetStartupInfoA
GetCommandLineA
HeapSize
HeapDestroy
RtlUnwind
HeapCreate
VirtualFree
GetSystemTimeAsFileTime
IsBadReadPtr
IsBadCodePtr
LCMapStringW
GetStringTypeA
GetStringTypeW
SetFilePointer
SetStdHandle
FlushFileBuffers
LoadLibraryA
SetEndOfFile
OutputDebugStringA
MapViewOfFile
GetFileSize
CreateFileMappingA
CreateFileW
UnmapViewOfFile
IsProcessorFeaturePresent
GetTempFileNameA
GetTempPathA
CompareStringA
FreeResource
DeleteFileW
MoveFileA
MoveFileW
GetTempFileNameW
GlobalMemoryStatus
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetLocaleInfoW
GlobalFree

user32

GetMessageA
PeekMessageA
SetForegroundWindow
ScreenToClient
GetCursorPos
CheckDlgButton
GetClassNameA
RedrawWindow
IsWindow
IsChild
GetFocus
GetWindow
DestroyAcceleratorTable
GetWindowTextLengthA
GetWindowTextA
DefWindowProcA
RegisterWindowMessageA
GetClassInfoExA
LoadCursorA
RegisterClassExA
GetWindowLongA
EnableMenuItem
CountClipboardFormats
IsWindowEnabled
SetTimer
IsWindowVisible
LoadIconA
MoveWindow
EndDialog
SetWindowTextA
TranslateMessage
SetWindowLongA
CallWindowProcA
KillTimer
PostMessageA
GetSysColor
GetClientRect
DrawFocusRect
DrawTextExA
wsprintfA
GetWindowRect
SystemParametersInfoA
SetWindowPos
GetSystemMetrics
CreateDialogParamA
GetDC
ReleaseDC
BeginPaint
EndPaint
DispatchMessageA
GetActiveWindow
GetForegroundWindow
DialogBoxParamA
EnableWindow
SetRect
SendMessageA
SendDlgItemMessageA
GetDlgItemTextA
MessageBoxA
InvalidateRect
UpdateWindow
FillRect
CreateWindowExA
GetDlgItem
SetDlgItemTextA
ShowWindow
LoadImageA
WinHelpA
PostQuitMessage
FindWindowExA
GetMenu
MessageBeep
InvalidateRgn
SetCapture
ReleaseCapture
CreateAcceleratorTableA
GetDesktopWindow
CharNextA
SetFocus
GetParent
UnregisterClassA
DestroyWindow

gdi32

ExtTextOutA
SetMapMode
CreateFontIndirectW
GetFontLanguageInfo
MoveToEx
GetCharacterPlacementW
GetCharacterPlacementA
GetObjectW
SelectPalette
CreateCompatibleDC
GetTextMetricsW
GetTextMetricsA
CreateFontIndirectA
RestoreDC
SetTextColor
SetBkMode
SaveDC
TextOutA
SetTextAlign
GetStockObject
GetClipBox
SetBkColor
GetObjectA
GetDeviceCaps
SetDIBitsToDevice
CreateDIBSection
CreateBitmap
PatBlt
ExtTextOutW
RealizePalette
CreateCompatibleBitmap
SelectObject
SetDIBits
DeleteDC
CreatePalette
StretchDIBits
CreateFontA
GetPixel
CreateSolidBrush
BitBlt
GetGlyphOutlineA
DeleteObject

advapi32

RegCloseKey
RegDeleteKeyA
RegQueryValueExA
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegOpenKeyA
RegDeleteValueA

shell32

ShellExecuteA
DragQueryFileA
DragAcceptFiles

ole32

OleUninitialize
CreateStreamOnHGlobal
OleInitialize
CoTaskMemRealloc
CoTaskMemFree
OleLockRunning
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CLSIDFromString
CoGetClassObject
CLSIDFromProgID

oleaut32

LoadRegTypeLi
VarUI4FromStr
OleCreateFontIndirect
SysStringByteLen
VariantClear
VariantInit
LoadTypeLi
SysAllocStringLen
SysAllocString
SysStringLen
SysFreeString

shlwapi

SHGetValueA

d3d9

Direct3DCreate9

winmm

mmioClose
mmioSeek
mmioOpenA
mmioDescend
mmioRead
mmioAscend
timeBeginPeriod
timeEndPeriod
timeGetTime

Sections

.text
Size: 916KB - Virtual size: 912KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 588KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

862890a604298668f855f92417a03dfc

Headers

File Characteristics

Imports

wininet

dsound

code

routine

comctl32

wsock32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

d3d9

winmm

Sections

.text Size: 916KB - Virtual size: 912KB

.rdata Size: 140KB - Virtual size: 137KB

.data Size: 52KB - Virtual size: 588KB

.rsrc Size: 44KB - Virtual size: 42KB

.text
Size: 916KB - Virtual size: 912KB

.rdata
Size: 140KB - Virtual size: 137KB

.data
Size: 52KB - Virtual size: 588KB

.rsrc
Size: 44KB - Virtual size: 42KB