66f1d32dba1f7d88937599e91bcb918cb0b95cae0f738071c79e0fbc587cfff8

Sharing

Copy URL Twitter E-mail

General

Target

66f1d32dba1f7d88937599e91bcb918cb0b95cae0f738071c79e0fbc587cfff8
Size

1.3MB
MD5

8250143b71113f9bc9717df2bd480814
SHA1

bf07fd6ba5df180ac0af5b51e7b19eb65c8cb333
SHA256

66f1d32dba1f7d88937599e91bcb918cb0b95cae0f738071c79e0fbc587cfff8
SHA512

37c7f6bb9aa2941db85b40e38c1f4ba3057efc39fab727b2ed6354aa710c459e10f9e23daea56a7ba4d79eb40ba295035a3e29067bebb4852d61fb45f3593722
SSDEEP

24576:D0Wo12UUcV9LWPIuj5zYbmBnldrrBvWVCQ7cB296cefdB0ChrYxvJQ75FdAPL:D0WzUUcHLeIGpuL7cBm3kQerAvJQ75FQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SoftCnKiller.exe
unpack001/弹窗定位.exe
unpack001/锁屏广告定位.exe

Files

66f1d32dba1f7d88937599e91bcb918cb0b95cae0f738071c79e0fbc587cfff8
.zip
Data/AppdataInfo.txt
Data/GitCode更新名单.vbs
.vbs
Data/Gitee更新名单.vbs
.vbs
Data/excludepath.txt
Data/folder.txt
Data/scanpath.txt
Data/sign.txt
Data/whitepath.txt
Data/说明/关于folder说明.txt
Data/说明/关于数签sign说明.txt
SoftCnKiller.exe
.exe windows:5 windows x86 arch:x86

9f6836282f48de72eb9a5f4611d664f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Visual Studio 2015\Projects\SoftCnKiller\Release\SoftCnKiller.pdb

Imports

kernel32

ExitProcess
GetStdHandle
GetFileType
SetStdHandle
VirtualQuery
VirtualAlloc
GetSystemInfo
QueryPerformanceFrequency
GetACP
LCMapStringW
FreeLibraryAndExitThread
ExitThread
GetCommandLineW
GetCommandLineA
RtlUnwind
OutputDebugStringW
GetStringTypeW
GetDateFormatW
HeapQueryInformation
GetTimeFormatW
GetTimeZoneInformation
GetDriveTypeW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FindResourceExW
Sleep
SearchPathW
GetProfileIntW
GetTickCount
GetWindowsDirectoryW
GetFileTime
GetFileSizeEx
SetErrorMode
VirtualProtect
lstrcmpiW
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
GetTempPathW
GetTempFileNameW
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GetCurrentDirectoryW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GlobalGetAtomNameW
GlobalFindAtomW
GetSystemDirectoryW
EncodePointer
GlobalAddAtomW
ResumeThread
SetThreadPriority
CreateEventW
WaitForSingleObject
SetEvent
LoadLibraryA
VerifyVersionInfoW
lstrcpyW
VerSetConditionMask
LoadLibraryW
GetModuleHandleA
FreeResource
OutputDebugStringA
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
LoadLibraryExW
FreeLibrary
GetVersionExW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
SetLastError
CopyFileW
MulDiv
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
WideCharToMultiByte
MultiByteToWideChar
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
HeapFree
WriteFile
ReadFile
SetFilePointer
CreateFileW
GetModuleFileNameW
GetFileAttributesExW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
FindClose
FindNextFileW
FindFirstFileW
CreateDirectoryW
MoveFileW
MoveFileExW
DeleteFileW
SetProcessWorkingSetSize
CreateThread
GetProcAddress
GetFileAttributesW
CloseHandle
InterlockedDecrement
TerminateProcess
SuspendThread
OpenThread
OpenProcess
FormatMessageW
ReadProcessMemory
IsWow64Process
LocalFree
LocalAlloc
GetLastError
ExpandEnvironmentStringsW
QueryDosDeviceW
GetLogicalDriveStringsW
FindResourceW
LoadResource
LockResource
SizeofResource
GetCurrentProcess
GetModuleHandleW
GetModuleHandleExW

user32

KillTimer
SetTimer
RealChildWindowFromPoint
DeleteMenu
CopyImage
WindowFromPoint
ReleaseCapture
SetCapture
WaitMessage
InflateRect
GetMenuItemInfoW
DestroyMenu
FillRect
ClientToScreen
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
OffsetRect
SendDlgItemMessageA
IsDialogMessageW
CheckDlgButton
MoveWindow
ShowWindow
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
UnhookWindowsHookEx
GetWindow
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
EqualRect
ScreenToClient
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
InvalidateRect
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
UpdateWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
LockWindowUpdate
SetClassLongW
DestroyIcon
MapDialogRect
LoadImageW
EnableWindow
LoadIconW
SendMessageW
TranslateAcceleratorW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
BringWindowToTop
SetWindowPos
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
RegisterClassW
CallWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
SetCursor
ShowOwnedPopups
CallNextHookEx
SetWindowsHookExW
ValidateRect
GetKeyState
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
DrawEdge
DrawFrameControl
DrawStateW
SetWindowRgn
DrawFocusRect
IsRectEmpty
DrawIconEx
ToUnicodeEx
GetKeyboardLayout
CharUpperW
GetAsyncKeyState
GetKeyboardState
LoadAcceleratorsW
CreateAcceleratorTableW
DestroyAcceleratorTable
SetMenuItemBitmaps
EnableMenuItem
CopyAcceleratorTableW
TrackMouseEvent
IsZoomed
GetSystemMenu
MessageBeep
IntersectRect
NotifyWinEvent
SetCursorPos
SetRect
SetScrollRange
SetParent
GetClientRect
SetWindowTextW
IsIconic
GetSystemMetrics
DrawIcon
LoadMenuW
GetSubMenu
GetNextDlgGroupItem
GetCursorPos
MessageBoxW
GetDlgItem
PostMessageW
UnregisterClassW
GetMenuStringW
GetMenuState
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
IsWindowEnabled
GetWindowLongW
GetParent
GetWindowThreadProcessId
GetLastActivePopup
PostQuitMessage
IsWindow
DestroyWindow
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
GetActiveWindow
SetActiveWindow
GetDesktopWindow
DefWindowProcW
GetClassInfoW
SetLayeredWindowAttributes
MapWindowPoints
GetSysColor
GetSysColorBrush
SetRectEmpty
CopyRect
LoadCursorW
SystemParametersInfoW
GetMonitorInfoW
EnumDisplayMonitors
GetKeyNameTextW
MapVirtualKeyW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetDC
ReleaseDC
GetWindowRect
GetFocus
CheckMenuItem
GetWindowPlacement
CreatePopupMenu
GetMenuDefaultItem
MonitorFromPoint
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
UnionRect
EnableScrollBar
GetDoubleClickTime
GetIconInfo
CopyIcon
SetMenuDefaultItem
ModifyMenuW
IsCharLowerW
MapVirtualKeyExW
RegisterClipboardFormatW
CharUpperBuffW
UpdateLayeredWindow
FrameRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
IsClipboardFormatAvailable
GetUpdateRect
SubtractRect
PostThreadMessageW
CreateMenu
GetWindowRgn
DestroyCursor
GetComboBoxInfo
InvertRect
HideCaret
GetDlgCtrlID

gdi32

PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetTextExtentPoint32W
CombineRgn
CreateEllipticRgn
Ellipse
GetBkColor
GetTextColor
Polygon
Polyline
CreateRoundRectRgn
CreateDIBSection
SetRectRgn
DPtoLP
RealizePalette
SetPixel
StretchBlt
SetDIBColorTable
Rectangle
GetRgnBox
OffsetRgn
RoundRect
CreatePalette
GetPaletteEntries
EnumFontFamiliesExW
GetNearestPaletteIndex
GetSystemPaletteEntries
LPtoDP
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetWindowOrgEx
GetViewportOrgEx
SetPixelV
GetTextFaceW
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateRectRgn
CreateHatchBrush
SetTextColor
SetBkColor
CreateBitmap
PatBlt
GetObjectW
GetTextMetricsW
GetTextCharsetInfo
GetStockObject
EnumFontFamiliesW
DeleteObject
CreateSolidBrush
CreateRectRgnIndirect
CreatePatternBrush
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetDeviceCaps
CreateDCW
CopyMetaFileW
CreatePolygonRgn
DeleteDC

msimg32

AlphaBlend
TransparentBlt

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

EnumServicesStatusW
OpenServiceW
CloseServiceHandle
QueryServiceConfigW
RegOpenKeyExW
RegQueryValueExW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegEnumValueW
RegEnumKeyExW
OpenSCManagerW
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
DeleteService
ControlService
UnlockServiceDatabase
ChangeServiceConfigW
LockServiceDatabase
QueryServiceStatus
RegCloseKey

shell32

SHGetSpecialFolderPathW
SHFileOperationW
SHGetFileInfoW
DragQueryFileW
DragFinish
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHBrowseForFolderW
ShellExecuteW
SHAppBarMessage
SHGetDesktopFolder

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsW
SHDeleteValueW
SHDeleteKeyW
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathRemoveFileSpecW

uxtheme

GetThemeSysColor
DrawThemeParentBackground
DrawThemeText
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetWindowTheme
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
IsAppThemed

ole32

RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
DoDragDrop
CreateStreamOnHGlobal
CoDisconnectObject
CoCreateGuid
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoInitializeEx
IsAccelerator

oleaut32

VariantClear
VariantInit
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocString
SysStringLen
VariantCopy
VarBstrFromDate
LoadTypeLi
SysFreeString
VariantChangeType
SysAllocStringLen

gdiplus

GdipCreateFromHDC
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdiplusShutdown
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipDeleteGraphics
GdipSetInterpolationMode
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat

psapi

GetProcessImageFileNameW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CryptMsgGetParam
CertFindCertificateInStore
CryptQueryObject
CertGetNameStringW

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

winmm

PlaySoundW

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 342KB - Virtual size: 342KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 213KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
使用前更新流氓软件黑名单.bat
弹窗定位.exe
.exe windows:5 windows x86 arch:x86

8a4fa5c2b82549e031510e42fb40992f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Visual Studio 2015\Projects\adwView\Release\adwView.pdb

Imports

mfc140u

ord9135
ord6490
ord3145
ord4219
ord9126
ord2215
ord2304
ord6842
ord3260
ord3366
ord8070
ord4239
ord9138
ord6117
ord265
ord266
ord5884
ord14320
ord3009
ord285
ord280
ord1525
ord5921
ord4664
ord14405
ord7493
ord540
ord3182
ord4884
ord3869
ord1171
ord4477
ord14507
ord6589
ord5850
ord13656
ord8062
ord4225
ord9132
ord5984
ord4886
ord5422
ord14137
ord5427
ord3833
ord6549
ord6225
ord501
ord1143
ord4093
ord6316
ord11038
ord12131
ord6218
ord13752
ord2760
ord9210
ord12172
ord9040
ord11015
ord11396
ord10472
ord458
ord3403
ord3404
ord3164
ord6531
ord6129
ord6220
ord13756
ord3305
ord3302
ord10255
ord8210
ord2761
ord14785
ord10285
ord10287
ord10286
ord10284
ord10288
ord5652
ord11725
ord11726
ord9139
ord12089
ord3838
ord11936
ord14588
ord8965
ord12220
ord6978
ord11002
ord9256
ord3266
ord13878
ord12262
ord12258
ord1722
ord1744
ord1770
ord4236
ord1777
ord4936
ord5003
ord4948
ord4966
ord4960
ord4954
ord5013
ord4997
ord4942
ord5019
ord4974
ord4912
ord4927
ord4988
ord4502
ord5790
ord9693
ord4494
ord3055
ord14590
ord7923
ord14596
ord6877
ord11717
ord14234
ord8817
ord13703
ord5935
ord2682
ord12124
ord3941
ord3371
ord3372
ord3265
ord12168
ord1002
ord3697
ord1391
ord890
ord2246
ord4815
ord8360
ord14410
ord14416
ord8712
ord12884
ord2990
ord1523
ord286
ord296
ord5117
ord5110
ord1663
ord1454
ord1180
ord8470
ord7653
ord1472
ord8386
ord12247
ord10433
ord12928
ord12865
ord4589
ord8324
ord5357
ord10379
ord3257
ord2486
ord12542
ord12541
ord14589
ord7922
ord14595
ord9398
ord4152
ord4090
ord12947
ord7941
ord2034
ord11983
ord11982
ord14466
ord12531
ord8000
ord14667
ord6348
ord14669
ord6350
ord14668
ord6349
ord995
ord6860
ord3852
ord5918
ord12239
ord8217
ord12251
ord12219
ord1133
ord1066
ord1446
ord1756
ord1111
ord4092
ord5249
ord5549
ord5760
ord6834
ord9350
ord5525
ord5763
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord10250
ord9209
ord1045
ord8756
ord1513
ord2409

kernel32

ExpandEnvironmentStringsW
GetFileAttributesW
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
OutputDebugStringA
SetLastError
GetModuleHandleA
EnterCriticalSection
GetLongPathNameW
SetEvent
lstrcmpiW
SetProcessWorkingSetSize
VirtualAllocEx
IsWow64Process
QueryDosDeviceW
ResetEvent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcessId
GetCurrentThreadId
OutputDebugStringW
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetLogicalDriveStringsW
SuspendThread
ReadProcessMemory
GetSystemTimeAsFileTime
GetLastError
OpenThread
TerminateProcess
OpenProcess
LocalFree
LocalAlloc
GetModuleFileNameW
LoadLibraryW
CloseHandle
GetCurrentProcess
GetProcAddress
LeaveCriticalSection
FreeLibrary

user32

ReleaseDC
GetWindowDC
ReleaseCapture
SetCapture
IsWindow
PostMessageW
GetAncestor
GetTitleBarInfo
DestroyIcon
GetLastActivePopup
GetWindowThreadProcessId
GetClassNameW
WindowFromPoint
FindWindowExW
GetWindowRect
GetClassLongW
GetWindowLongW
IsWindowVisible
ShowWindow
LoadIconW
GetClientRect
GetWindowTextW
SetWindowTextW
DrawIcon
GetSystemMetrics
EnableWindow
IsIconic
SetWindowPos
SendMessageW
SetCursor
FindWindowW
ClientToScreen
ChildWindowFromPoint
LoadCursorW
UnregisterClassW
EnumWindows

gdi32

DeleteObject
GetStockObject
SelectObject
Rectangle
CreatePen
SetROP2

advapi32

RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW

shell32

ShellExecuteExW
SHGetFileInfoW
Shell_NotifyIconW
ShellExecuteW
DragQueryFileW

comctl32

ImageList_ReplaceIcon

shlwapi

PathFileExistsW
SHDeleteKeyW

ole32

CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysFreeString

psapi

GetProcessImageFileNameW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

crypt32

CertFindCertificateInStore
CryptMsgGetParam
CertGetNameStringW
CryptQueryObject

vcruntime140

__vcrt_InitializeCriticalSectionEx
memmove
__std_type_info_destroy_list
_except_handler4_common
__std_terminate
__CxxFrameHandler3
memset

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-heap-l1-1-0

free
_recalloc
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv
exit
_get_wide_winmain_command_line
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_exit
_initterm
_set_app_type
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
terminate
_controlfp_s
_invalid_parameter_noinfo
_errno
_seh_filter_exe
_initialize_wide_environment
_initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 277KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
微信赞赏.png
.png
文件关联修复/Win10/bat.reg
文件关联修复/Win10/cmd.reg
文件关联修复/Win10/com.reg
文件关联修复/Win10/exe.reg
文件关联修复/Win10/ini.reg
文件关联修复/Win10/lnk.reg
文件关联修复/Win10/log.reg
文件关联修复/Win10/pif.reg
文件关联修复/Win10/txt.reg
文件关联修复/Win10/vbs.reg
文件关联修复/Win10/全部导入.bat
文件关联修复/Win7/bat.reg
文件关联修复/Win7/cmd.reg
文件关联修复/Win7/com.reg
文件关联修复/Win7/exe.reg
文件关联修复/Win7/ini.reg
文件关联修复/Win7/lnk.reg
文件关联修复/Win7/log.reg
文件关联修复/Win7/pif.reg
文件关联修复/Win7/txt.reg
文件关联修复/Win7/vbs.reg
文件关联修复/Win7/全部导入.bat
文件关联修复/Win8.1/bat.reg
文件关联修复/Win8.1/cmd.reg
文件关联修复/Win8.1/com.reg
文件关联修复/Win8.1/exe.reg
文件关联修复/Win8.1/ini.reg
文件关联修复/Win8.1/lnk.reg
文件关联修复/Win8.1/log.reg
文件关联修复/Win8.1/pif.reg
文件关联修复/Win8.1/txt.reg
文件关联修复/Win8.1/vbs.reg
文件关联修复/Win8.1/全部导入.bat
文件关联修复/WinXP/bat.reg
文件关联修复/WinXP/cmd.reg
文件关联修复/WinXP/com.reg
文件关联修复/WinXP/exe.reg
文件关联修复/WinXP/ini.reg
文件关联修复/WinXP/lnk.reg
文件关联修复/WinXP/log.reg
文件关联修复/WinXP/pif.reg
文件关联修复/WinXP/txt.reg
文件关联修复/WinXP/vbs.reg
文件关联修复/WinXP/全部导入.bat
文件关联修复/目录打不开时_压缩包里双击这个文件导入.reg
锁屏广告定位.exe
.exe windows:4 windows x86 arch:x86

943bda6613477b81c1db225488878342

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
OpenProcess

user32

GetMessageA
WindowFromPoint
GetWindowRect
GetWindowThreadProcessId
GetCursorPos
RegisterHotKey

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

psapi

GetProcessImageFileNameA

msvcrt

__p__fmode
__p__commode
_controlfp
_except_handler3
__set_app_type
_adjust_fdiv
__setusermatherr
printf
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm

Sections

.text
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 380B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9f6836282f48de72eb9a5f4611d664f5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

psapi

version

crypt32

oleacc

imm32

winmm

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 342KB - Virtual size: 342KB

.data Size: 21KB - Virtual size: 45KB

.gfids Size: 105KB - Virtual size: 104KB

.giats Size: 512B - Virtual size: 16B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 213KB - Virtual size: 213KB

.reloc Size: 123KB - Virtual size: 123KB

8a4fa5c2b82549e031510e42fb40992f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc140u

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

psapi

version

crypt32

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 39KB - Virtual size: 38KB

.data Size: 1024B - Virtual size: 2KB

.gfids Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 277KB - Virtual size: 276KB

.reloc Size: 7KB - Virtual size: 7KB

943bda6613477b81c1db225488878342

Headers

File Characteristics

Imports

kernel32

user32

advapi32

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 342KB - Virtual size: 342KB

.data
Size: 21KB - Virtual size: 45KB

.gfids
Size: 105KB - Virtual size: 104KB

.giats
Size: 512B - Virtual size: 16B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 213KB - Virtual size: 213KB

.reloc
Size: 123KB - Virtual size: 123KB

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 39KB - Virtual size: 38KB

.data
Size: 1024B - Virtual size: 2KB

.gfids
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 277KB - Virtual size: 276KB

.reloc
Size: 7KB - Virtual size: 7KB

.text
Size: 1024B - Virtual size: 844B

.rdata
Size: 1024B - Virtual size: 888B

.data
Size: 512B - Virtual size: 380B