e36ac2dcec45c56bbb440e411dc65231105af1da8e5497e0da01ec9e1a35fe44

Sharing

Copy URL

Twitter E-mail

General

Target

e36ac2dcec45c56bbb440e411dc65231105af1da8e5497e0da01ec9e1a35fe44
Size

6.7MB
MD5

a11d548173941c40b402bbe174ac4bf6
SHA1

0f55457458c1d49c67ca2364634cc3d1030b4948
SHA256

e36ac2dcec45c56bbb440e411dc65231105af1da8e5497e0da01ec9e1a35fe44
SHA512

88aa4f04a69df694dac2a9d226e1ec1cd02cfe8f7ef9dcd652ba9eadc85fbe1a45cd74618107390087f75d7dd275559f4c0cd53dab952ef8a0d5173c57a13aaa
SSDEEP

196608:ZoV29+HvV0BJby0D6Pel/q2ChFLOyomFHKnP:f9+QJ20DlcF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e36ac2dcec45c56bbb440e411dc65231105af1da8e5497e0da01ec9e1a35fe44

Files

e36ac2dcec45c56bbb440e411dc65231105af1da8e5497e0da01ec9e1a35fe44
.exe windows:6 windows x86 arch:x86

941a35729fe7cb4320e45744acf3e656

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\桌面\上-记录\MS2修改各版本\海外版\MS2\海外各版本MS2 branches\海外版-5.24\MotionStudio\bin\MotionStudio.pdb

Imports

motionstudio.interop.oscilloscope

?OpenOfflineScope@@YAPAUHWND__@@PAU1@PB_W11P6GHIPAXH@Z@Z
??0DeviceBase@@QAE@XZ
?UpdateUserType@OscilloscopeWrapper@@QAEXK@Z
?SetDriver@OscilloscopeWrapper@@QAEXPAVDriver@@@Z
?SetMutilLangDbPostfix@OscilloscopeWrapper@@QAEXPB_W@Z
?SetConnectString@OscilloscopeWrapper@@QAEXPB_W@Z
?SetApplicationDirectory@OscilloscopeWrapper@@QAEXPB_W@Z
?SetParentActive@OscilloscopeWrapper@@QAEXH@Z
?SetCursorVisible@OscilloscopeWrapper@@QAEXH@Z
?StartSample@OscilloscopeWrapper@@QAEXXZ
?StopSample@OscilloscopeWrapper@@QAEXXZ
?SetLanguage@OscilloscopeWrapper@@QAEXP6GHIPAXH@Z@Z
?SetParent@OscilloscopeWrapper@@QAEXPAUHWND__@@@Z
?Create@OscilloscopeWrapper@@QAEPAUHWND__@@PAU2@HHHHPAVDeviceBase@@@Z
?SetSize@OscilloscopeWrapper@@QAEXNN@Z
??1OscilloscopeWrapper@@QAE@XZ
??0OscilloscopeWrapper@@QAE@XZ
??0BlackboxWrapper@@QAE@XZ
?SetDataCoverModeRemark@BlackboxData@@QAEXV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?SetTriggerModeRemark@BlackboxData@@QAEXV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?SetTriggerSourceRemark@BlackboxData@@QAEXV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?SetTriggerEdgeRemark@BlackboxData@@QAEXV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?SetSize@BlackboxWrapper@@QAEXNN@Z
?Initialize@BlackboxWrapper@@QAEXXZ
?SetData@BlackboxWrapper@@QAEXAAVBlackboxData@@@Z
??1BlackboxData@@QAE@XZ
??0BlackboxData@@QAE@XZ
?SetLanguage@BlackboxWrapper@@QAEXP6GHIPAXH@Z@Z
?Create@BlackboxWrapper@@QAEPAUHWND__@@PAU2@HHHH@Z
?SetChannel@BlackboxWrapper@@QAEXAAV?$vector@VBlackboxChannel@@V?$allocator@VBlackboxChannel@@@std@@@std@@@Z
??1BlackboxWrapper@@QAE@XZ

d2d1

ord1

dwrite

DWriteCreateFactory

winusb

WinUsb_FlushPipe
WinUsb_SetPipePolicy
WinUsb_ReadPipe
WinUsb_WritePipe
WinUsb_Initialize
WinUsb_Free

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW

kernel32

FindNextFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GlobalReAlloc
lstrcpyA
VerSetConditionMask
VerifyVersionInfoW
GetCurrentThread
CompareStringA
GetPrivateProfileIntW
GetCurrentDirectoryW
GetFileAttributesExW
GetFileSizeEx
LocalFileTimeToFileTime
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalHandle
LocalReAlloc
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
VirtualProtect
SetErrorMode
GetProfileIntW
SearchPathW
GetTempPathW
FindResourceExW
GetUserDefaultLCID
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
WriteConsoleW
GetDateFormatW
EnumSystemLocalesW
IsValidLocale
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
ExitProcess
GetStdHandle
HeapQueryInformation
GetCommandLineW
GetCommandLineA
QueryPerformanceFrequency
GetFileType
SetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
VirtualQuery
VirtualAlloc
GetSystemInfo
RtlUnwind
OutputDebugStringW
FileTimeToLocalFileTime
SystemTimeToFileTime
ReplaceFileW
GetTempFileNameW
GetFileTime
GetFileAttributesW
GetDiskFreeSpaceW
GetThreadLocale
GetStringTypeExW
MoveFileW
DuplicateHandle
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetVolumeInformationW
GetShortPathNameW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
GlobalGetAtomNameW
lstrcmpA
SuspendThread
SetThreadPriority
GetCurrentProcessId
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
GetSystemDirectoryW
GetCurrentThreadId
EncodePointer
OutputDebugStringA
FormatMessageW
MulDiv
GlobalFree
GetCurrentProcess
GetModuleHandleA
GetModuleHandleW
SetLastError
LoadLibraryA
InitializeCriticalSection
lstrcatW
lstrcpyW
GetWindowsDirectoryW
lstrcmpiW
lstrlenW
GetCPInfo
GetVersionExW
GetVersion
DecodePointer
RaiseException
HeapReAlloc
HeapSize
SetThreadUILanguage
WinExec
WideCharToMultiByte
CreateProcessW
GetTickCount64
CopyFileW
ReleaseSRWLockShared
AcquireSRWLockShared
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemDefaultLangID
WaitCommEvent
GetCommModemStatus
CreateEventW
ResetEvent
SetCommMask
ResumeThread
WriteFile
GetOverlappedResult
ReadFile
PurgeComm
ClearCommError
SetupComm
BuildCommDCBW
SetCommState
GetCommState
GetModuleFileNameW
GetPrivateProfileStringW
WritePrivateProfileStringW
GlobalSize
GlobalUnlock
GlobalLock
GlobalAlloc
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
InitializeCriticalSectionEx
GetExitCodeThread
WaitForMultipleObjects
OpenMutexW
WaitForSingleObjectEx
SetEvent
CreateFileW
LocalAlloc
HeapAlloc
GetProcessHeap
HeapFree
MultiByteToWideChar
CloseHandle
CreateMutexW
Sleep
GetTickCount
CreateThread
TerminateThread
WaitForSingleObject
QueueUserAPC
SleepEx
DeleteFileW
LocalFree
FindResourceW
SetEnvironmentVariableW
FreeEnvironmentStringsW
SetFileTime
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
GetTimeFormatW
LCMapStringW
GetTimeZoneInformation
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetDriveTypeW
FindFirstFileExW
GetEnvironmentStringsW

user32

EnumDisplayMonitors
SetClassLongW
UnionRect
LockWindowUpdate
GetUpdateRect
NotifyWinEvent
GetSystemMenu
CharNextW
MapDialogRect
SetWindowContextHelpId
CharUpperW
CopyImage
GetNextDlgGroupItem
SetParent
IsZoomed
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
ReuseDDElParam
UnpackDDElParam
IntersectRect
InsertMenuItemW
DestroyMenu
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
GetMessageW
GetWindowThreadProcessId
EndDialog
CreateDialogIndirectParamW
MapVirtualKeyW
GetKeyNameTextW
SetWindowRgn
DrawIcon
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
IsDialogMessageW
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
SendDlgItemMessageA
GetMonitorInfoW
MonitorFromWindow
WinHelpW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongW
EqualRect
DestroyAcceleratorTable
MapWindowPoints
AdjustWindowRectEx
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
GetScrollRange
SetScrollRange
GetScrollPos
ScrollWindow
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetDlgItem
IsIconic
EndDeferWindowPos
CopyAcceleratorTableW
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
GetClassInfoExW
RegisterClassW
GetMessageTime
PeekMessageW
RegisterWindowMessageW
GetMenuStringW
GetWindowDC
InvalidateRgn
CharUpperBuffW
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableW
SubtractRect
EnumChildWindows
MapVirtualKeyExW
GetComboBoxInfo
HideCaret
InvertRect
IsCharLowerW
SetMenuDefaultItem
ShowScrollBar
EndPaint
BeginPaint
IsWindowEnabled
SetWindowTextW
SetWindowPos
GetWindow
ShowWindow
GetWindowTextW
GetDoubleClickTime
MonitorFromPoint
EnableScrollBar
PostQuitMessage
PostThreadMessageW
WaitMessage
ShowOwnedPopups
UpdateLayeredWindow
SetCursorPos
GetMenuDefaultItem
RealChildWindowFromPoint
GetWindowRgn
SetTimer
KillTimer
EnableWindow
SendMessageW
MessageBoxExW
PostMessageW
GetWindowRect
InvalidateRect
GetParent
FindWindowExW
CopyRect
GetClientRect
RegisterDeviceNotificationW
UnregisterDeviceNotification
ScreenToClient
SetScrollPos
ReleaseCapture
ClientToScreen
SetCapture
SetWindowLongW
GetWindowLongW
SetLayeredWindowAttributes
GetDC
GetFocus
OpenClipboard
EmptyClipboard
CloseClipboard
SetClipboardData
GetClipboardData
RegisterClipboardFormatW
wsprintfW
IsWindow
OffsetRect
IsWindowVisible
LoadBitmapW
LoadIconW
MessageBoxW
GetCursorPos
PtInRect
LoadMenuW
GetSubMenu
GetDlgCtrlID
ReleaseDC
GetSystemMetrics
SetRectEmpty
GetIconInfo
InflateRect
GetSysColor
IsRectEmpty
LoadImageW
RedrawWindow
UpdateWindow
CreatePopupMenu
CreateMenu
AppendMenuW
GetKeyState
UnregisterClassW
DrawTextW
CreateCaret
ShowCaret
EnableMenuItem
FillRect
DrawEdge
SetRect
GetMenuItemInfoW
SystemParametersInfoW
DrawIconEx
DestroyIcon
GetDesktopWindow
GetMenuItemCount
DeferWindowPos
InsertMenuW
ModifyMenuW
GetMenuState
GetMenuItemID
GetSysColorBrush
RemoveMenu
DeleteMenu
TabbedTextOutW
DrawTextExW
GrayStringW
DestroyCursor
IsMenu
GetNextDlgTabItem
SetCursor
WindowFromPoint
GetActiveWindow
FrameRect
DrawFocusRect
IsClipboardFormatAvailable
DestroyWindow
GetScrollInfo
SetScrollInfo
MoveWindow
DrawFrameControl
CreateWindowExW
SetFocus
CallWindowProcW
GetAsyncKeyState
RegisterClassExW
DispatchMessageW
TranslateMessage
ValidateRect
DefWindowProcW
GetClassInfoW
TrackMouseEvent
CopyIcon
LoadCursorW
GetMessagePos
MessageBeep
CreateIconIndirect
DrawStateW

gdi32

GetNearestPaletteIndex
GetWindowOrgEx
GetPaletteEntries
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
SetPixelV
ExtFloodFill
GetRgnBox
SetTextAlign
GetBkColor
EnumFontFamiliesExW
OffsetRgn
RealizePalette
GetTextCharsetInfo
EnumFontFamiliesW
Polyline
Polygon
CreatePolygonRgn
SetRectRgn
GetMapMode
CreateRoundRectRgn
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportExtEx
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
RestoreDC
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetObjectType
GetClipBox
ExcludeClipRect
LPtoDP
DPtoLP
CreateEllipticRgn
CreateDCW
CopyMetaFileW
GetSystemPaletteEntries
CreateDIBitmap
SelectClipRgn
GetTextColor
CreateRectRgnIndirect
CreateFontW
GetTextMetricsW
GetTextExtentPoint32W
DeleteObject
GetObjectW
CreateFontIndirectW
CreateCompatibleDC
DeleteDC
SelectObject
SetDIBColorTable
CreateDIBSection
StretchBlt
GetDIBColorTable
ExtTextOutW
MoveToEx
GetStockObject
LineTo
GetDeviceCaps
CreatePalette
BitBlt
CreateCompatibleBitmap
CreateSolidBrush
CreatePen
GetBkMode
Ellipse
GetPixel
SetPixel
PatBlt
CreateHatchBrush
Rectangle
PtVisible
RectVisible
TextOutW
Escape
CreateBitmap
SetBkColor
SetTextColor
RoundRect
GetViewportOrgEx
SetViewportOrgEx
CreateRectRgn
SetDCBrushColor
ExtCreatePen
CreatePatternBrush
SetBkMode
GetDIBits
SetDIBits
SelectPalette
ExtSelectClipRgn
GetTextFaceW
GetTextExtentExPointW
CombineRgn
SaveDC

msimg32

AlphaBlend
TransparentBlt

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

SetFileSecurityW
RegEnumValueW
RegCloseKey
RegGetValueW
RegQueryValueExW
RegQueryValueW
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
RegEnumKeyW
RegDeleteKeyW
GetFileSecurityW
RegSetValueW
RegOpenKeyExW

shell32

SHGetMalloc
SHAppBarMessage
SHGetFileInfoW
SHBrowseForFolderW
DragQueryFileW
ShellExecuteExW
SHGetSpecialFolderPathW
DragAcceptFiles
ShellExecuteW
SHGetPathFromIDListW
SHGetDesktopFolder
ExtractIconW
SHAddToRecentDocs
SHGetSpecialFolderLocation
DragFinish

comctl32

ImageList_AddMasked
ImageList_SetBkColor
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_Draw
ImageList_GetImageCount
ImageList_GetIcon
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_Destroy
ImageList_Create

shlwapi

PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW
PathRemoveExtensionW
StrCmpW
PathFindExtensionW
StrCpyW
PathFindFileNameW
PathFileExistsW
StrFormatKBSizeW

uxtheme

GetThemeColor
CloseThemeData
OpenThemeData
IsAppThemed
DrawThemeText
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
GetWindowTheme
GetThemeSysColor
DrawThemeParentBackground
GetCurrentThemeName
DrawThemeBackground

ole32

OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CoCreateGuid
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
CoGetClassObject
StgCreateDocfileOnILockBytes
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
OleLockRunning
CoRevokeClassObject
CoRegisterMessageFilter
CoInitializeEx
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
CLSIDFromProgID
CLSIDFromString
OleRun
CoCreateInstance
CoUninitialize
CoInitialize
OleGetClipboard
CoLockObjectExternal
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
StgOpenStorageOnILockBytes
IsAccelerator
RegisterDragDrop
RevokeDragDrop
CoDisconnectObject

oleaut32

OleCreateFontIndirect
LoadTypeLi
VarBstrFromDate
VarBstrFromCy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
SysAllocStringLen
SysStringLen
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SysAllocString
VariantInit
VariantCopy
GetErrorInfo
VariantClear

oledlg

OleUIBusyW

gdiplus

GdiplusShutdown
GdipCreateBitmapFromStream
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipCreateBitmapFromFile
GdipGetImagePixelFormat
GdipGetImageHeight
GdipBitmapLockBits
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette
GdipDrawImageI
GdipFree
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits

odbc32

ord2
ord3
ord5
ord9
ord72
ord4
ord176
ord138
ord141
ord145
ord139
ord119
ord117
ord111
ord110
ord108
ord68
ord59
ord20
ord49
ord48
ord18
ord44
ord43
ord16
ord15
ord14
ord13
ord12
ord1

crypt32

CryptUnprotectData
CryptProtectData

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

bcrypt

BCryptDestroyKey
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptEncrypt
BCryptDecrypt
BCryptGetProperty
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 698KB - Virtual size: 698KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 277KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

941a35729fe7cb4320e45744acf3e656

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

motionstudio.interop.oscilloscope

d2d1

dwrite

winusb

setupapi

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

odbc32

crypt32

version

bcrypt

oleacc

imm32

winmm

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 698KB - Virtual size: 698KB

.data Size: 40KB - Virtual size: 59KB

.rsrc Size: 2.3MB - Virtual size: 2.3MB

.reloc Size: 277KB - Virtual size: 276KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 698KB - Virtual size: 698KB

.data
Size: 40KB - Virtual size: 59KB

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

.reloc
Size: 277KB - Virtual size: 276KB