D:\slave\workspace\paopao-client-web\bin\PPSpeedUp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9d8a027d7feb3abce90615c26af34e6490ed2242efd7d526deb921f10d35c446.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
9d8a027d7feb3abce90615c26af34e6490ed2242efd7d526deb921f10d35c446.exe
Resource
win10v2004-20240802-en
General
-
Target
9d8a027d7feb3abce90615c26af34e6490ed2242efd7d526deb921f10d35c446
-
Size
5.2MB
-
MD5
c6a49f98c75e50978edaedbc6cb6bf43
-
SHA1
4507f4ae4e85856e670355732275a9c7ebe98e1e
-
SHA256
9d8a027d7feb3abce90615c26af34e6490ed2242efd7d526deb921f10d35c446
-
SHA512
5e6cc8401601a1f071bd05738d6fedfa777e3bf61521af0306e109d1caa8e12bef3adbcca602e3e5a43926852d960b0dabe9e7965c8b673aa142809a15b29c20
-
SSDEEP
98304:d+Je/7ufdShwyundsAwYxq/BJXORb7hU59PagRLYyEHFxg:0ej/W7oPaWYySx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9d8a027d7feb3abce90615c26af34e6490ed2242efd7d526deb921f10d35c446
Files
-
9d8a027d7feb3abce90615c26af34e6490ed2242efd7d526deb921f10d35c446.exe windows:6 windows x86 arch:x86
d34d1955e908637e98eee9641e9dfbfa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
webview2loader
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
ws2_32
htonl
select
__WSAFDIsSet
closesocket
send
WSAGetLastError
accept
bind
htons
ntohs
WSASetLastError
gethostname
WSAStartup
WSACleanup
listen
recv
ioctlsocket
getsockname
setsockopt
WSAPoll
getsockopt
recvfrom
connect
WSAIoctl
socket
sendto
WSASocketW
getaddrinfo
freeaddrinfo
shutdown
WSACloseEvent
WSACreateEvent
iphlpapi
GetIpErrorString
IcmpCloseHandle
IcmpSendEcho
Icmp6SendEcho2
Icmp6CreateFile
IcmpCreateFile
GetAdaptersInfo
GetAdaptersAddresses
ppui
?SetBkImage@CControlUI@DuiLib@@QAEXPB_W@Z
?GetStyle@WindowImplBase@DuiLib@@UAEJXZ
?HandleCustomMessage@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?HandleMessage@WindowImplBase@DuiLib@@UAEJIIJ@Z
?FindControl@CPaintManagerUI@DuiLib@@QBEPAVCControlUI@2@PB_W@Z
?OnLButtonUp@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?MessageLoop@CPaintManagerUI@DuiLib@@SAHXZ
?SetResourceZip@CPaintManagerUI@DuiLib@@SAXPAXI@Z
?SetInstance@CPaintManagerUI@DuiLib@@SAXPAUHINSTANCE__@@@Z
?GetResourceDll@CPaintManagerUI@DuiLib@@SAPAUHINSTANCE__@@XZ
?CenterWindow@CWindowWnd@DuiLib@@QAEXXZ
?ShowModal@CWindowWnd@DuiLib@@QAEIXZ
?ShowWindow@CWindowWnd@DuiLib@@QAEX_N0@Z
?Create@CWindowWnd@DuiLib@@QAEPAUHWND__@@PAU3@PB_WKKHHHHPAUHMENU__@@@Z
?GetHWND@CWindowWnd@DuiLib@@QBEPAUHWND__@@XZ
??1CDuiString@DuiLib@@QAE@XZ
?OnMouseMove@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnLButtonDown@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?IsSelected@COptionUI@DuiLib@@QBE_NXZ
?SetNormalImage@CButtonUI@DuiLib@@QAEXPB_W@Z
?SetHotImage@CButtonUI@DuiLib@@QAEXPB_W@Z
??0CWindowWnd@DuiLib@@QAE@XZ
??BCWindowWnd@DuiLib@@QBEPAUHWND__@@XZ
?SetIcon@CWindowWnd@DuiLib@@QAEXI@Z
?ResizeClient@CWindowWnd@DuiLib@@QAEXHH@Z
?GetClassStyle@CWindowWnd@DuiLib@@MBEIXZ
?HandleMessage@CWindowWnd@DuiLib@@MAEJIIJ@Z
?OnFinalMessage@CWindowWnd@DuiLib@@MAEXPAUHWND__@@@Z
??0WindowImplBase@DuiLib@@QAE@XZ
??1WindowImplBase@DuiLib@@UAE@XZ
?InitWindow@WindowImplBase@DuiLib@@UAEXXZ
??8CDuiString@DuiLib@@QBE_NPB_W@Z
?Close@CWindowWnd@DuiLib@@QAEXI@Z
?SendMessageW@CWindowWnd@DuiLib@@QAEJIIJ@Z
?PostMessageW@CWindowWnd@DuiLib@@QAEJIIJ@Z
?GetSuperClassName@CWindowWnd@DuiLib@@MBEPB_WXZ
?OnFinalMessage@WindowImplBase@DuiLib@@UAEXPAUHWND__@@@Z
?GetMessageMap@WindowImplBase@DuiLib@@MBEPBUDUI_MSGMAP@2@XZ
?OnClick@WindowImplBase@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?ResponseDefaultKeyEvent@WindowImplBase@DuiLib@@MAEJI@Z
?GetClassStyle@WindowImplBase@DuiLib@@UBEIXZ
?GetResourceType@WindowImplBase@DuiLib@@UBE?AW4UILIB_RESOURCETYPE@2@XZ
?GetZIPFileName@WindowImplBase@DuiLib@@UBE?AVCDuiString@2@XZ
?GetResourceID@WindowImplBase@DuiLib@@UBEPB_WXZ
?CreateControl@WindowImplBase@DuiLib@@UAEPAVCControlUI@2@PB_W@Z
?MessageHandler@WindowImplBase@DuiLib@@UAEJIIJAA_N@Z
?OnClose@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnDestroy@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcActivate@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcCalcSize@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcPaint@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcHitTest@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnGetMinMaxInfo@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnMouseWheel@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnMouseHover@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnSize@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnChar@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnSysCommand@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnCreate@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnKeyDown@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnKillFocus@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnSetFocus@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
??0CDuiString@DuiLib@@QAE@PB_WH@Z
kernel32
SetWaitableTimer
CreateWaitableTimerExW
WriteConsoleW
GetConsoleMode
TlsFree
InitOnceComplete
TlsAlloc
InitOnceBeginInitialize
GetCurrentThread
WakeConditionVariable
PostQueuedCompletionStatus
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
ReadFile
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
GetModuleFileNameW
InitializeCriticalSectionEx
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
HeapSize
CreateToolhelp32Snapshot
FormatMessageW
GetLastError
Process32NextW
OutputDebugStringW
CreateFileA
WaitForSingleObjectEx
OpenSemaphoreW
Process32FirstW
HeapReAlloc
CloseHandle
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
SetCurrentDirectoryW
GetProcAddress
CreateMutexExW
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
lstrcmpiW
IsDebuggerPresent
LoadLibraryW
CreateProcessW
DeleteFileW
GetEnvironmentVariableA
GetFileAttributesA
GetSystemTimeAsFileTime
CreateMutexW
CreateFileW
GetFileAttributesW
OpenEventW
OpenFileMappingW
UnmapViewOfFile
QueueUserWorkItem
CreateEventW
Sleep
SetEvent
TerminateThread
lstrcatW
CreateThread
GetFileSize
CreateFileMappingW
SystemTimeToFileTime
GetTickCount
FreeLibrary
CreateDirectoryW
SizeofResource
WriteFile
LockResource
FindResourceExW
LoadResource
FindResourceW
CreateDirectoryA
FindFirstFileW
FindNextFileW
GetCurrentProcess
OutputDebugStringA
TerminateProcess
FindClose
OpenProcess
MultiByteToWideChar
GetLogicalDriveStringsA
ReadProcessMemory
WideCharToMultiByte
CreateProcessA
lstrcmpW
LoadLibraryA
GetTempPathW
GetCommandLineW
FreeResource
LocalFree
lstrcmpiA
K32GetModuleFileNameExW
SwitchToThread
SetEndOfFile
SetFilePointer
SetFileTime
GetStdHandle
GetFileInformationByHandle
GetCurrentDirectoryW
SetFileAttributesW
GetModuleHandleA
VirtualAlloc
VirtualFree
SystemTimeToTzSpecificLocalTime
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetStdHandle
SetFileCompletionNotificationModes
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlushFileBuffers
GetConsoleOutputCP
ReadConsoleW
SetFilePointerEx
PeekNamedPipe
GetFileType
GetDriveTypeW
ExitProcess
FreeLibraryAndExitThread
ExitThread
GetFileAttributesExW
LoadLibraryExW
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
TlsGetValue
TlsSetValue
SleepConditionVariableSRW
ReleaseSRWLockExclusive
WakeAllConditionVariable
FileTimeToSystemTime
GetTimeZoneInformation
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
QueryPerformanceFrequency
CreateMutexA
GetEnvironmentVariableW
SetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileInformationByHandleEx
SetHandleInformation
QueryPerformanceCounter
CreateIoCompletionPort
MapViewOfFile
SetThreadStackGuarantee
GetSystemInfo
EnterCriticalSection
LeaveCriticalSection
CreateEventA
GetSystemDirectoryA
CompareStringEx
GetLocaleInfoEx
LCMapStringEx
MoveFileExA
SleepEx
VerifyVersionInfoW
GetFileSizeEx
InitializeSRWLock
TryEnterCriticalSection
EncodePointer
GetCPInfoExW
GetNativeSystemInfo
GetExitCodeThread
SleepConditionVariableCS
InitializeConditionVariable
GetStringTypeW
user32
SendMessageW
wsprintfW
FindWindowW
IsWindowVisible
SetForegroundWindow
SetProcessDPIAware
SetWindowLongW
EnumWindows
GetWindowTextA
IsWindow
ShowWindow
GetClassNameA
SetWindowPos
PostMessageW
GetWindowThreadProcessId
GetWindowLongW
LoadIconW
GetSystemMetrics
GetWindowRect
UpdateWindow
PostQuitMessage
MessageBoxW
GetParent
RegisterHotKey
UnregisterHotKey
GetCursorPos
PtInRect
KillTimer
SetTimer
AppendMenuW
TrackPopupMenu
CreatePopupMenu
CharUpperW
advapi32
RegCreateKeyExW
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
SystemFunction036
RegCreateKeyW
RegCreateKeyA
RegDeleteKeyA
RegFlushKey
RegSetValueExA
RegOpenKeyW
CryptDestroyHash
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
shell32
ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteExW
Shell_NotifyIconW
ShellExecuteA
ole32
CoCreateGuid
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
oleaut32
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
memipc
uninit_ipc
write_ipc
init_ipc
crypt32
CertFreeCertificateChain
CertOpenStore
CertEnumCertificatesInStore
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CertDuplicateCertificateContext
CryptDecodeObjectEx
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CryptStringToBinaryA
PFXImportCertStore
bcrypt
BCryptGenRandom
ntdll
RtlNtStatusToDosError
NtReadFile
NtCancelIoFileEx
NtDeviceIoControlFile
NtCreateFile
NtWriteFile
RtlCaptureContext
VerSetConditionMask
RtlUnwind
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 816KB - Virtual size: 816KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ