d4a2b870dff5eabfca77c0fd01432703855b4a5cba2661143cb5c271b7f048c3

Sharing

Copy URL Twitter E-mail

General

Target

d4a2b870dff5eabfca77c0fd01432703855b4a5cba2661143cb5c271b7f048c3
Size

2.1MB
MD5

b0a3c5416ebd2ef3c0b0a10a47d55f64
SHA1

4b5e0be350d66c6b08f658ee12b053c75f4ee3c5
SHA256

d4a2b870dff5eabfca77c0fd01432703855b4a5cba2661143cb5c271b7f048c3
SHA512

18d783ce566fce20e277d930786be5b230e3120bfef8bd6239ad63d97b010c351988d0539974fef6e9b952b989c92a7521138f7dfa47bcf894ebd30fba73de40
SSDEEP

49152:CKtqj0B2eG3o84lWwv/STx0Gl6rnHD5ru:E0lD8/wnIinHD5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4a2b870dff5eabfca77c0fd01432703855b4a5cba2661143cb5c271b7f048c3

Files

d4a2b870dff5eabfca77c0fd01432703855b4a5cba2661143cb5c271b7f048c3
.dll windows:5 windows x64 arch:x64

62a776b6f29d51710fca7c287d24ad3c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\yili\Desktop\在线文档\1109\targets\win32\msc_lua\x64\Release\msc_x64.pdb

Imports

netapi32

Netbios

ws2_32

inet_ntoa
gethostbyname
ioctlsocket
connect
WSAStartup
recvfrom
htons
setsockopt
WSACleanup
recv
socket
__WSAFDIsSet
closesocket
send
getsockopt
WSAGetLastError
WSASetLastError
select

kernel32

SetEnvironmentVariableA
CreateFileW
GetProcessHeap
SetEndOfFile
GetDriveTypeW
GetStringTypeW
HeapSize
WriteConsoleW
SetStdHandle
GetExitCodeProcess
CreatePipe
GetFileAttributesA
LCMapStringW
RaiseException
CompareStringW
GetTimeZoneInformation
GetCurrentDirectoryW
CreateFileA
CreateDirectoryA
CopyFileA
DeleteFileA
WaitForSingleObject
SetEvent
CreateEventA
CreateMutexA
GetCurrentThreadId
ReleaseMutex
CloseHandle
CreateThread
GetTickCount
GetLocalTime
GetCurrentProcessId
GetModuleHandleExA
VirtualFree
GetProcAddress
LoadLibraryA
GetSystemInfo
GetModuleHandleA
FreeLibrary
FormatMessageA
GetLastError
LoadLibraryExA
WideCharToMultiByte
MultiByteToWideChar
FindClose
GetCurrentProcess
FlushInstructionCache
SetLastError
VirtualAlloc
VirtualProtect
GetSystemTime
QueryPerformanceCounter
Sleep
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
ExitProcess
DecodePointer
HeapReAlloc
FlsSetValue
GetCommandLineA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
GetSystemTimeAsFileTime
RtlUnwindEx
ReadFile
CreateProcessA
DuplicateHandle
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetConsoleCP
GetConsoleMode
LoadLibraryW
FlsGetValue
FlsFree
FlsAlloc
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
FlushFileBuffers
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe

advapi32

CryptGenRandom
CryptAcquireContextA
CryptReleaseContext

Exports

Exports

MSPDownload
MSPDownloadData
MSPGetParam
MSPLogin
MSPLogout
MSPNlpSchCancel
MSPNlpSearch
MSPRegisterNotify
MSPSearch
MSPSetParam
MSPUploadData
QHCRDataWrite
QHCRGetResult
QHCRSessionBegin
QHCRSessionEnd
QISEAudioWrite
QISEGetParam
QISEGetResult
QISEResultInfo
QISESessionBegin
QISESessionEnd
QISESetParam
QISETextPut
QISRAudioWrite
QISRBuildGrammar
QISRGetBinaryResult
QISRGetParam
QISRGetResult
QISRRegisterNotify
QISRSessionBegin
QISRSessionEnd
QISRSetParam
QISRUpdateLexicon
QISVAudioWrite
QISVGetParam
QISVGetResult
QISVQueDelModel
QISVQueDelModelRelease
QISVSessionBegin
QISVSessionEnd
QISVSetParam
QMFVDataWrite
QMFVGetParam
QMFVGetResult
QMFVRegisterNotify
QMFVSessionBegin
QMFVSessionEnd
QMFVSetParam
QTTSAudioGet
QTTSAudioInfo
QTTSGetParam
QTTSRegisterNotify
QTTSSessionBegin
QTTSSessionEnd
QTTSSetParam
QTTSTextPut

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 660KB - Virtual size: 659KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 239KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

62a776b6f29d51710fca7c287d24ad3c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

netapi32

ws2_32

kernel32

advapi32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 660KB - Virtual size: 659KB

.data Size: 239KB - Virtual size: 261KB

.pdata Size: 51KB - Virtual size: 51KB

text Size: 7KB - Virtual size: 7KB

data Size: 25KB - Virtual size: 24KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 660KB - Virtual size: 659KB

.data
Size: 239KB - Virtual size: 261KB

.pdata
Size: 51KB - Virtual size: 51KB

text
Size: 7KB - Virtual size: 7KB

data
Size: 25KB - Virtual size: 24KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 19KB - Virtual size: 18KB