66683547f074dd82cd7a59f039eb9d94_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

66683547f074dd82cd7a59f039eb9d94_JaffaCakes118
Size

705KB
MD5

66683547f074dd82cd7a59f039eb9d94
SHA1

6cbf663b066bcbc3a421d067fe8fc062d7438e3c
SHA256

58440294752e4d6f218912d4897853b6b2a95e5ed7594a3d500c68cdf522da09
SHA512

efe6d86826e3c83ebddeb5031ff406a5e7bc496dd08fff30a8a55dd12eda2990e088b9702e0560da3d9585e56abd1dd5f28f333c64459cfe3eb10fd9a8d4c912
SSDEEP

12288:7T875anrw7GFw21lO0SmiXl5svwA4i97crSzuZSWjvzTjv9FcY+XruTpD4HHKNBL:7R2G621HLiX6wAnJc+uZSWjvzvvPcY0Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/War3改键一点通 1.2/BBXTOOLS/war3-jdwar3key/JDWar3Key.exe
unpack001/War3改键一点通 1.2/BBXTOOLS/war3-jdwar3key/KeyMask.dll
unpack001/War3改键一点通 1.2/War3改键一点通 1.2.exe

Files

66683547f074dd82cd7a59f039eb9d94_JaffaCakes118
.rar
War3改键一点通 1.2/BBXTOOLS/GameSelect.html
.html .js polyglot
War3改键一点通 1.2/BBXTOOLS/oeminfor.ini
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/HideApp.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/Jduu.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/Jduu_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/RubbishClear.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/RubbishClear_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/Weather.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/Weather_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/abouttime.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/adk.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/anjianjl.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/anjianjl_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/biansujl.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/biansujl_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/booktool.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/booktool_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/clipx.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/coretemp.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/gifpingmlx.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/gifpingmlx_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/guanji.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/guanji_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/huoxingwensrf.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/huoxingwensrf_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/jdyou.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/jdyou_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/jianpan.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/jianpan_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/jinchenggl.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/jinchenggl_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/js-wangyoujsq.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/kclock.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/lgb-keyex.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/lgb-syssu.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/naozhong.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/naozhong_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/neicunyh.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/neicunyh_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/process.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/settop.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/shubiao.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/shubiao_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/skin3.ini
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/theworld.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/theworld_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/wakeuponstandby.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/weishi.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/weishi_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/ww.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/xiaorili.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/xiaorili_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/yigenet.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/zhuomian.bmp
War3改键一点通 1.2/BBXTOOLS/skin/bbxskin/zhuomian_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/war3/guanji.bmp
War3改键一点通 1.2/BBXTOOLS/skin/war3/guanji_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/war3/jianpan.bmp
War3改键一点通 1.2/BBXTOOLS/skin/war3/jianpan_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/war3/moshouxxgjgj.bmp
War3改键一点通 1.2/BBXTOOLS/skin/war3/naozhong.bmp
War3改键一点通 1.2/BBXTOOLS/skin/war3/naozhong_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/war3/shubiao.bmp
War3改键一点通 1.2/BBXTOOLS/skin/war3/shubiao_on.bmp
War3改键一点通 1.2/BBXTOOLS/skin/war3/skin3.ini
War3改键一点通 1.2/BBXTOOLS/skin/war3/war3-jdwar3key.bmp
War3改键一点通 1.2/BBXTOOLS/skin/war3/zhuomian.bmp
War3改键一点通 1.2/BBXTOOLS/skin/war3/zhuomian_on.bmp
War3改键一点通 1.2/BBXTOOLS/war3-jdwar3key/JDWar3Key.exe
.exe windows:4 windows x86 arch:x86

7a468c70a56e0158d96e09a7f7cf04a5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord3619
ord809
ord800
ord795
ord2614
ord556
ord540
ord567
ord825
ord3663
ord3626
ord2414
ord4275
ord5875
ord2864
ord2379
ord1088
ord2122
ord1641
ord2860
ord6199
ord3874
ord3797
ord6358
ord858
ord535
ord6197
ord2859
ord6880
ord941
ord5572
ord2915
ord1200
ord926
ord2818
ord860
ord4673
ord537
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord815
ord561
ord4220
ord2584
ord3721
ord641
ord609
ord683
ord2438
ord2514
ord2621
ord4160
ord1134
ord4129
ord5683
ord5265
ord4376
ord4853
ord4998
ord4710
ord6052
ord1775
ord5280
ord4425
ord3597
ord324
ord4234
ord3631
ord2575
ord4396
ord3574
ord1146
ord1168
ord2302
ord6334
ord6241
ord1644
ord924
ord2863
ord6215
ord755
ord470
ord3226
ord6270
ord6453
ord4278
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord3402
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord3654
ord6055
ord1576

msvcrt

_setmbcp
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
__CxxFrameHandler
strstr
_mbsstr
_splitpath
atol
__dllonexit
_onexit
_exit
_controlfp
exit
_XcptFilter

kernel32

FreeLibrary
LoadLibraryA
GetModuleHandleA
GetStartupInfoA
GetWindowsDirectoryA
lstrcpyA
WinExec
lstrlenA
lstrcatA
SetCurrentDirectoryA
CreateMutexA
OpenMutexA
GetProcAddress
GetPrivateProfileIntA
WritePrivateProfileStringA
GetLocalTime

user32

PostQuitMessage
SetForegroundWindow
UnregisterHotKey
GetCursorPos
FindWindowA
GetForegroundWindow
PostMessageA
KillTimer
GetSubMenu
SetTimer
GetSysColor
SendMessageA
MessageBeep
SetCapture
IsIconic
GetSystemMetrics
DrawIcon
GetSystemMenu
AppendMenuA
LoadMenuA
RegisterHotKey
LoadIconA
EnableWindow
LoadCursorA
CopyIcon
GetWindowRect
GetParent
GetDC
ReleaseDC
InflateRect
InvalidateRect
IsWindow
SetWindowLongA
SetCursor
GetClientRect
PtInRect
ReleaseCapture
RedrawWindow

gdi32

GetTextExtentPoint32A
GetObjectA
CreateFontIndirectA
GetStockObject

advapi32

RegQueryValueA
RegCloseKey
RegOpenKeyExA

shell32

Shell_NotifyIconA
ShellExecuteA

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 204KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
War3改键一点通 1.2/BBXTOOLS/war3-jdwar3key/KeyMask.dll
.dll windows:4 windows x86 arch:x86

f8ba8daf3edfd18f2c4f3128375c69ad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx

kernel32

GetEnvironmentStringsW
RtlUnwind
GetStringTypeW
GetStringTypeA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW

Exports

Exports

??0CKeyMask@@QAE@XZ
??4CKeyMask@@QAEAAV0@ABV0@@Z
?fnKeyMask@@YAHXZ
?nKeyMask@@3HA
StartKeyMask
StopKeyMask

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mydata
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
War3改键一点通 1.2/BBXTOOLS/war3-jdwar3key/ver.ini
War3改键一点通 1.2/War3改键一点通 1.2.exe
.exe windows:4 windows x86 arch:x86

dedfe337fb7a36b97390635771a60781

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord5678
ord5736
ord5579
ord5571
ord6061
ord5864
ord3596
ord640
ord6194
ord1640
ord323
ord2405
ord5785
ord2864
ord2096
ord2408
ord5860
ord6154
ord2530
ord4056
ord5471
ord4121
ord2389
ord5234
ord6369
ord5279
ord2444
ord807
ord2920
ord2012
ord2120
ord554
ord4163
ord1644
ord1146
ord5572
ord2919
ord939
ord940
ord941
ord5787
ord4133
ord4297
ord1621
ord2764
ord4202
ord5856
ord536
ord2452
ord2753
ord1195
ord472
ord5440
ord6383
ord5450
ord6394
ord3610
ord656
ord4275
ord6215
ord3874
ord809
ord556
ord4284
ord5053
ord4774
ord5981
ord6270
ord2642
ord283
ord4278
ord613
ord6880
ord289
ord2122
ord6358
ord1088
ord6197
ord6378
ord6199
ord2860
ord2089
ord4853
ord5953
ord6597
ord6650
ord6591
ord6807
ord6857
ord6823
ord6855
ord6832
ord6859
ord6867
ord6847
ord6814
ord6839
ord6846
ord6858
ord6816
ord6815
ord6812
ord6845
ord6856
ord6835
ord4589
ord4588
ord4899
ord4370
ord4892
ord6817
ord5076
ord4340
ord4347
ord4720
ord4889
ord4531
ord4545
ord4543
ord4526
ord4529
ord4524
ord4963
ord4960
ord4108
ord6054
ord5281
ord3748
ord1725
ord5260
ord6614
ord6691
ord4432
ord6478
ord6514
ord6800
ord6808
ord641
ord5710
ord6877
ord3721
ord795
ord6241
ord6453
ord922
ord3089
ord3097
ord3499
ord2515
ord355
ord2358
ord3742
ord818
ord5794
ord2558
ord6442
ord2915
ord755
ord470
ord1570
ord1197
ord5148
ord6128
ord3752
ord4694
ord4299
ord6157
ord6663
ord6153
ord5645
ord5583
ord6385
ord1979
ord2393
ord665
ord5186
ord354
ord3790
ord6283
ord6282
ord3811
ord551
ord2784
ord3797
ord2086
ord5655
ord6068
ord6000
ord2117
ord3698
ord765
ord6195
ord4287
ord1768
ord668
ord1980
ord3181
ord4058
ord2781
ord2770
ord356
ord2585
ord4365
ord5085
ord1709
ord1714
ord4404
ord5258
ord3722
ord796
ord529
ord4265
ord2078
ord2116
ord4454
ord5039
ord4475
ord5063
ord2546
ord1176
ord291
ord1105
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2621
ord1247
ord1134
ord6930
ord6928
ord2817
ord3870
ord690
ord5207
ord389
ord6170
ord2243
ord2370
ord5808
ord1075
ord5204
ord3229
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord692
ord6805
ord6380
ord2135
ord1949
ord1988
ord1997
ord6407
ord798
ord5194
ord533
ord1228
ord5789
ord5873
ord6172
ord6021
ord6189
ord4330
ord4200
ord6379
ord6605
ord1153
ord1232
ord609
ord3574
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord3402
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord6186
ord5756
ord6192
ord5759
ord2971
ord3619
ord2614
ord5788
ord2567
ord5683
ord4277
ord2763
ord4129
ord3693
ord3571
ord2859
ord5606
ord2863
ord4083
ord6142
ord823
ord2438
ord3654
ord2584
ord4220
ord1862
ord500
ord3701
ord772
ord1574
ord1099
ord686
ord384
ord537
ord2379
ord4476
ord5875
ord3663
ord1641
ord2414
ord3626
ord3573
ord1175
ord3226
ord4224
ord2818
ord3092
ord1168
ord926
ord1199
ord535
ord4710
ord4376
ord6334
ord1200
ord4234
ord2302
ord2301
ord825
ord324
ord567
ord540
ord860
ord924
ord858
ord800
ord6648
ord4160
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4396
ord1776
ord4078
ord6055
ord2575
ord3597
ord4425
ord5280
ord4407
ord1775
ord6052
ord2514
ord4998
ord6662
ord5265
ord1576

msvcrt

atol
atoi
_mbsnbcpy
_mbscmp
memmove
_getpid
realloc
fclose
fwrite
fopen
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
_CxxThrowException
sscanf
_access
_setmbcp
_ftol
wcslen
wcscpy
malloc
free
__CxxFrameHandler
sprintf
strstr
_mbsstr
_beginthreadex
strncpy
_except_handler3
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
exit
_splitpath
rand
srand
time
strncmp
__dllonexit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_onexit

kernel32

GetModuleHandleA
GetProcAddress
OutputDebugStringA
GetLocalTime
ReleaseMutex
OpenMutexA
CreateMutexA
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
GetSystemDirectoryA
TerminateThread
SizeofResource
SetFileAttributesA
EnterCriticalSection
LeaveCriticalSection
CopyFileA
CreateProcessA
GetCommandLineA
DeleteCriticalSection
GetTempPathA
InitializeCriticalSection
SetCurrentDirectoryA
HeapCreate
CreateFileA
ReadFile
WriteFile
HeapDestroy
CreateToolhelp32Snapshot
Process32First
Process32Next
UnmapViewOfFile
DeleteFileA
lstrcatA
WinExec
lstrcpyA
GetWindowsDirectoryA
LoadLibraryA
FreeLibrary
GetProcessHeap
HeapAlloc
HeapFree
CreateThread
WaitForSingleObject
GetExitCodeThread
GetLastError
CreateEventA
CloseHandle
Sleep
GetPrivateProfileStringA
IsDBCSLeadByteEx
lstrcmpiA
FindResourceA
LoadResource
LockResource
GetCPInfo
lstrlenW
lstrlenA
GetVersion
GetVersionExA
GetPrivateProfileIntA
MultiByteToWideChar
WritePrivateProfileStringA
SetUnhandledExceptionFilter
GetCurrentThreadId
IsBadReadPtr
GetModuleFileNameA
Module32Next
Module32First
GetStartupInfoA

user32

SendMessageA
UnregisterHotKey
FillRect
GetClientRect
EnableWindow
GetMenuItemInfoA
SetRect
DrawEdge
CopyRect
GetSysColor
SystemParametersInfoA
DestroyIcon
DrawIconEx
ReleaseDC
DrawTextA
GetDC
GetDesktopWindow
GetSystemMetrics
AppendMenuA
InsertMenuA
GetMenuItemCount
ModifyMenuA
PostQuitMessage
MessageBoxA
DestroyWindow
DefWindowProcA
GetMenuItemID
CreatePopupMenu
CreateMenu
GetMenuStringA
GetSysColorBrush
LoadBitmapA
TabbedTextOutA
GrayStringA
GetSubMenu
DestroyCursor
GetWindowLongA
IsMenu
GetNextDlgTabItem
GetParent
SetCursor
InvalidateRect
GetActiveWindow
WindowFromPoint
ClientToScreen
PostMessageA
FindWindowA
UpdateWindow
EnableMenuItem
RegisterHotKey
GetSystemMenu
EnumWindows
GetWindowThreadProcessId
GetMenu
LoadMenuA
IsIconic
IsWindowVisible
SetForegroundWindow
IsZoomed
GetWindowDC
CopyIcon
SetWindowLongA
wsprintfA
IsWindow
LoadIconA
ShowScrollBar
GetCapture
SetCapture
GetMessageA
DispatchMessageA
GetCursorPos
SetTimer
ReleaseCapture
KillTimer
RedrawWindow
LoadCursorA
PtInRect
LoadImageA
DrawStateA
DrawIcon
FrameRect
InflateRect
GetWindowRect
DrawFocusRect
OffsetRect
GetMenuState

gdi32

PatBlt
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
Rectangle
GetObjectA
SetTextColor
SetBkColor
CreateBitmap
StretchBlt
CreateFontA
SetViewportOrgEx
GetViewportOrgEx
GetPixel
SetPixel
CreateDIBSection
SelectObject
BitBlt
DeleteObject
DeleteDC
Ellipse
GetTextExtentPoint32A
GetTextExtentPoint32W
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectA
CreatePen
GetBkMode
GetStockObject
CreateSolidBrush
GetDeviceCaps

advapi32

RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegQueryValueA
RegDeleteValueA
RegSetValueExA
RegOpenKeyA
RegCloseKey

shell32

SHGetFileInfoA
DragFinish
DragQueryFileA
SHGetSpecialFolderPathA
ShellExecuteA
Shell_NotifyIconA
SHFileOperationA
ShellExecuteExA

comctl32

ImageList_GetImageCount
ImageList_GetIcon
ImageList_AddMasked
ImageList_ReplaceIcon
ImageList_Draw
_TrackMouseEvent

ole32

CoCreateInstance
CoUninitialize
CoInitialize

wsock32

inet_addr
ntohs
ntohl
htonl
htons
gethostbyname
ioctlsocket
shutdown
closesocket
setsockopt
WSAGetLastError

msvcp60

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1ios_base@std@@UAE@XZ
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??_8?$basic_ifstream@DU?$char_traits@D@std@@@std@@7B@
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
??_7?$basic_ifstream@DU?$char_traits@D@std@@@std@@6B@
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@D@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ

dbghelp

MakeSureDirectoryPathExists

ws2_32

WSAConnect
WSASend
WSAEnumNetworkEvents
WSARecv
WSAEventSelect
WSASocketA
WSAWaitForMultipleEvents

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 316KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
War3改键一点通 1.2/bbx.ini
War3改键一点通 1.2/新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

7a468c70a56e0158d96e09a7f7cf04a5

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

Sections

.text Size: 20KB - Virtual size: 16KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 204KB - Virtual size: 203KB

f8ba8daf3edfd18f2c4f3128375c69ad

Headers

File Characteristics

Imports

user32

kernel32

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 10KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 2KB

mydata Size: 4KB - Virtual size: 8B

.reloc Size: 4KB - Virtual size: 1KB

dedfe337fb7a36b97390635771a60781

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

wsock32

msvcp60

dbghelp

ws2_32

version

Sections

.text Size: 316KB - Virtual size: 312KB

.rdata Size: 68KB - Virtual size: 65KB

.data Size: 8KB - Virtual size: 9KB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.text
Size: 20KB - Virtual size: 16KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 204KB - Virtual size: 203KB

.text
Size: 12KB - Virtual size: 10KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 2KB

mydata
Size: 4KB - Virtual size: 8B

.reloc
Size: 4KB - Virtual size: 1KB

.text
Size: 316KB - Virtual size: 312KB

.rdata
Size: 68KB - Virtual size: 65KB

.data
Size: 8KB - Virtual size: 9KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB