chinesetelegramshitlol[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
chinesetelegramshitlol.rar
Size 8.2MB
Sample241218-1asdzaskd1
SHA256 f5d8f3789b735ac3a21997797feaf45101ed73315e2a31434618f4f902b9317b
MD5 58033d556161da7f1a3e06d572ff9a3d
SHA1 85747cfdef83885e211ae59281296d559e8ad993
SHA512 0d6bf7304d97e4d99f7c5c82185d76a745004ec75892bec95b4703384d50e6436be0e4ecbb135b222fea9aab76aa0566dfd1440b116a00ed16999e974942cb24
SSDEEP 196608:LH+H/GbhpNrRGbhpNrEKKQdo+rqEOpJXxDdRHAaHx20Fqk7tQFZhmEe:EGbhpNrRGbhpNrDK0oQqTpBxDdRHnx+s
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/-°¦n+¦++.exe	pyinstaller

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/-°¦n+¦++.exe
unpack001/PC远控测试-.exe
unpack001/vip文件捆绑器.exe
unpack001/菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.bat
unpack001/远程控制测试- (2).bat
unpack001/远程控制测试- (2).exe
unpack001/钱包收款地址强制更改器- (2).exe
unpack001/钱包收款地址强制更改器-.exe

File Explorer

chinesetelegramshitlol.rar

.rar 8.2MB
-°¦n+¦++.exe

.exe 1.6MB
1R.pyc

6KB
PC远控测试-.exe

.exe 2.6MB
vip文件捆绑器.exe

.exe 1.4MB
菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.bat

.exe 340KB
远程控制测试- (2).bat

.exe 1.9MB
远程控制测试- (2).exe

.exe 1.9MB
远程控制测试-.bat

.exe 1.9MB
远程控制测试-.exe

.exe 1.9MB
钱包收款地址强制更改器- (2).exe

.exe 2.2MB
钱包收款地址强制更改器-.exe

.exe 1.8MB

chinesetelegramshitlol.rar

SHA256 f5d8f3789b735ac3a21997797feaf45101ed73315e2a31434618f4f902b9317b
MD5 58033d556161da7f1a3e06d572ff9a3d
SHA1 85747cfdef83885e211ae59281296d559e8ad993
SHA512 0d6bf7304d97e4d99f7c5c82185d76a745004ec75892bec95b4703384d50e6436be0e4ecbb135b222fea9aab76aa0566dfd1440b116a00ed16999e974942cb24
SSDEEP 196608:LH+H/GbhpNrRGbhpNrEKKQdo+rqEOpJXxDdRHAaHx20Fqk7tQFZhmEe:EGbhpNrRGbhpNrDK0oQqTpBxDdRHnx+s
MD5 SHA1 SHA512 SSDEEP

-°¦n+¦++.exe

IMPHASH 456e8615ad4320c9f54e50319a19df9c
SHA256 b6cd133de42501483a7ba656c8727fe3f69961f0d9e3be7bafaf7747c68df775
MD5 fa829b4b0756226de8b2b479f91c82f2
SHA1 9073db73807de596b99bec8ff7c54da632afb399
SHA512 4cce7a3bc488e3c1108cd43305c182d56287345379123c8800055305d8bff6f6bf2b01e5f7f49d140c8d2b1f965b879de53bebca38755aa386b730d610e3d2ad
SSDEEP 49152:YrI6IISPM8EtQYJ7z0NdzF1Ech9P7Hg4F8hmslwX9:YYdPM3tQWf0jR19h9zUNg9
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

49360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers GetCurrentDirectoryW GetOEMCP GetCPInfo GetModuleHandleW MulDiv GetLastError FormatMessageW GetModuleFileNameW SetDllDirectoryW CreateSymbolicLinkW GetProcAddress CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW GetEnvironmentStringsW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle WaitForSingleObject Sleep GetCurrentProcess GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LoadLibraryExW LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile DeleteFileW IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

PC远控测试-.exe

IMPHASH f45672ec254a9fe462802f42b867d3e4
SHA256 e351be996b4035fddffa0cbf6385568263edb38da2f6997487c15ac5fef3d905
MD5 b044b1bd454046017979442448a8e390
SHA1 ded32e08fde6485cd314872f0b5ee9d8b66233d2
SHA512 2334eeec197ff2ea07edb8ec165ad0fd3494d29adebfea4131c91081adb5705a9fc0f8683941869f7aaefc114857049001ca241aed585ec8dea42b2c76b305f8
SSDEEP 49152:VB38U5zFk1NhxsDT1T47R5FPfnH/EZUlimHQB5TxTE4CYn1bfHY2o:VtV74xswQBJxtf1b
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1346900

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FindResourceExW Sleep EncodePointer DecodePointer HeapFree HeapAlloc GetCommandLineA GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx ExitProcess ExitThread CreateThread RaiseException RtlPcToFileHeader HeapQueryInformation HeapReAlloc HeapSize VirtualAlloc SetThreadStackGuarantee GetSystemInfo VirtualQuery GetSystemTimeAsFileTime SetStdHandle GetFileType UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext TerminateProcess GetConsoleCP GetConsoleMode HeapSetInformation GetVersion HeapCreate GetStdHandle IsValidCodePage FlsGetValue FlsSetValue FlsFree FlsAlloc FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount QueryPerformanceCounter GetStringTypeW LCMapStringW CompareStringW GetTimeZoneInformation WriteConsoleW GetProcessHeap CreateFileW SetEnvironmentVariableA SleepEx VerifyVersionInfoA VerSetConditionMask GetSystemDirectoryA PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA GetProfileIntA GetTickCount InitializeCriticalSectionAndSpinCount GetACP GetOEMCP GetCPInfo GetTempPathA GetTempFileNameA GetFileTime GetFileSizeEx FileTimeToLocalFileTime GetFileAttributesExA FileTimeToSystemTime VirtualProtect SetErrorMode GetFullPathNameA GetVolumeInformationA FindFirstFileA FindClose GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers lstrcmpiA FindResourceA FreeResource GlobalGetAtomNameA GlobalFindAtomA lstrcmpW GetVersionExA LoadLibraryW CopyFileA GlobalSize FormatMessageA lstrlenW TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue GlobalHandle GlobalReAlloc TlsAlloc InitializeCriticalSection EnterCriticalSection TlsGetValue LeaveCriticalSection LocalFree LocalAlloc GlobalFlags GlobalFree GlobalUnlock MulDiv GetModuleFileNameW ReleaseActCtx CreateActCtxW GetCurrentProcessId GlobalAddAtomA GetPrivateProfileStringA WritePrivateProfileStringA GetPrivateProfileIntA GetModuleHandleA WaitForSingleObject ResumeThread SetThreadPriority GlobalDeleteAtom GetCurrentThread GetCurrentThreadId MultiByteToWideChar GetUserDefaultUILanguage ConvertDefaultLocale GetSystemDefaultUILanguage GetModuleFileNameA GetLocaleInfoA WideCharToMultiByte CompareStringA ActivateActCtx LoadLibraryA GetLastError DeactivateActCtx SetLastError FindResourceW LoadResource LockResource SizeofResource GlobalLock lstrcmpA GlobalAlloc GetModuleHandleW GetProcAddress FreeLibrary GetNumberFormatA GetWindowsDirectoryA SearchPathA GetFileInformationByHandle GetDriveTypeA FindFirstFileExA GetCurrentDirectoryW SetFileTime WriteFile CreateDirectoryA LocalFileTimeToFileTime lstrcatA lstrlenA lstrcpyA GetCurrentDirectoryA SystemTimeToFileTime ReadFile CloseHandle SetFilePointer CreateFileA GetFileAttributesA DeleteFileA GetDriveTypeW

user32

DefMDIChildProcA DrawMenuBar TranslateMDISysAccel MonitorFromPoint EnableScrollBar UpdateLayeredWindow IsMenu CreateMenu PostThreadMessageA SetMenuDefaultItem IsClipboardFormatAvailable FrameRect GetUpdateRect GetMenuDefaultItem OpenClipboard CopyImage SetClipboardData CloseClipboard EmptyClipboard LoadImageW RegisterClipboardFormatA CopyIcon CharUpperBuffA GetDoubleClickTime GetIconInfo IsCharLowerA MapVirtualKeyExA SubtractRect InvertRect HideCaret GetNextDlgGroupItem MapDialogRect DrawIcon DestroyCursor GetWindowRgn SetPropA GetPropA RemovePropA IsWindow SetFocus GetWindowTextLengthA GetForegroundWindow SetActiveWindow BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow GetWindowLongPtrA SetWindowLongPtrA GetMessageTime GetMessagePos MonitorFromWindow ScrollWindow TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar CreateWindowExA GetClassInfoExA RegisterClassA AdjustWindowRectEx EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement GetWindowPlacement CallWindowProcA GetMenu SetWindowLongA SetWindowPos MessageBeep GetClassInfoA DefWindowProcA MapWindowPoints GetClientRect SetLayeredWindowAttributes GetSystemMetrics EnumDisplayMonitors SystemParametersInfoA GetMonitorInfoA SetRectEmpty CopyRect KillTimer SetTimer InvalidateRect UpdateWindow GetMenuStringA AppendMenuA SetCursorPos DefFrameProcA RemoveMenu RealChildWindowFromPoint GetWindow GetDlgCtrlID GetWindowRect GetClassNameA PtInRect GetWindowTextA SetWindowTextA GetSysColor EndPaint BeginPaint GetWindowDC ReleaseDC GetDC GrayStringA DrawTextExA DrawTextA TabbedTextOutA FillRect UnhookWindowsHookEx InsertMenuA GetMenuItemCount DeleteMenu WaitMessage GetDesktopWindow ReleaseCapture LoadCursorA LoadCursorW GetCapture WindowFromPoint SetCapture ScreenToClient ClientToScreen GetWindowThreadProcessId GetWindowLongA GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxA ShowOwnedPopups SetCursor SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage DispatchMessageA GetActiveWindow IsWindowVisible GetKeyState PeekMessageA GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent SendMessageA ModifyMenuA GetMenuState EnableMenuItem CheckMenuItem PostQuitMessage PostMessageA wsprintfA GetSystemMenu LoadMenuW SetClassLongPtrA GetAsyncKeyState SetRect CreateAcceleratorTableA GetClassLongPtrA DestroyAcceleratorTable SetParent RedrawWindow SetWindowRgn IsZoomed IsRectEmpty UnregisterClassA GetMenuItemInfoA InflateRect UnpackDDElParam ReuseDDElParam LoadMenuA DestroyMenu LoadImageA LoadAcceleratorsA InsertMenuItemA CreatePopupMenu IntersectRect OffsetRect BringWindowToTop TranslateAcceleratorA CharUpperA DestroyIcon IsIconic ShowWindow MoveWindow IsDialogMessageA UnionRect GetKeyNameTextA CreateDialogIndirectParamA GetNextDlgTabItem EndDialog GetSubMenu LockWindowUpdate LoadAcceleratorsW GetKeyboardState GetKeyboardLayout MapVirtualKeyA ToAsciiEx CopyAcceleratorTableA DrawFocusRect DrawFrameControl DrawEdge DrawIconEx GetMenuItemID DrawStateA CheckDlgButton RegisterWindowMessageA LoadIconW LoadIconA SendDlgItemMessageA WinHelpA IsChild GetSysColorBrush GetClassLongA NotifyWinEvent

advapi32

RegCloseKey CryptImportKey RegQueryValueExA RegCreateKeyExA RegSetValueExA RegDeleteValueA RegDeleteKeyA RegEnumKeyA RegQueryValueA RegEnumValueA RegEnumKeyExA CryptReleaseContext CryptGenRandom CryptAcquireContextA RegOpenKeyExA CryptEncrypt CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptDestroyKey

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetDesktopFolder SHAppBarMessage DragQueryFileA DragFinish SHGetFileInfoA ShellExecuteA SHBrowseForFolderA

msimg32

TransparentBlt AlphaBlend

comctl32

ImageList_GetIconSize

shlwapi

PathFindExtensionA PathFindFileNameA PathStripToRootA PathIsUNCA PathRemoveFileSpecW

gdiplus

GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipBitmapUnlockBits GdipGetImageGraphicsContext GdipDrawImageI GdipBitmapLockBits GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdiplusShutdown GdiplusStartup GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree

oleacc

CreateStdAccessibleObject AccessibleObjectFromWindow LresultFromObject

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundA

gdi32

SetTextAlign MoveToEx LineTo IntersectClipRect ExcludeClipRect GetClipBox SetMapMode SetTextColor SetROP2 SetPolyFillMode SetBkMode SetBkColor RestoreDC CreateBitmap SetPixelV GetTextFaceA GetLayout SetLayout DeleteObject SelectClipRgn CreateRectRgn GetObjectA GetViewportExtEx GetWindowExtEx BitBlt GetPixel PtVisible RectVisible TextOutA ExtTextOutA Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC CreatePatternBrush CreateCompatibleDC GetStockObject SelectPalette GetObjectType GetDeviceCaps CreatePen CreateSolidBrush CreateHatchBrush CopyMetaFileA CreateDCA CreateDIBitmap CreateFontIndirectA CreateCompatibleBitmap CreateRectRgnIndirect GetTextMetricsA EnumFontFamiliesA GetTextCharsetInfo GetTextExtentPoint32A SetRectRgn CombineRgn PatBlt DPtoLP CreateDIBSection CreateRoundRectRgn CreatePolygonRgn GetBkColor GetTextColor CreateEllipticRgn Polyline Ellipse Polygon OffsetRgn GetRgnBox SetDIBColorTable RealizePalette StretchBlt SetPixel Rectangle CreatePalette GetPaletteEntries GetNearestPaletteIndex GetSystemPaletteEntries LPtoDP GetWindowOrgEx GetViewportOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries EnumFontFamiliesExA SaveDC

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

comdlg32

GetFileTitleA

ole32

CoCreateInstance CoCreateGuid CoTaskMemFree ReleaseStgMedium CoTaskMemAlloc OleDuplicateData RevokeDragDrop CoLockObjectExternal RegisterDragDrop OleGetClipboard CoUninitialize DoDragDrop CreateStreamOnHGlobal OleLockRunning IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor CoInitializeEx CoInitialize

oleaut32

VariantInit VariantTimeToSystemTime SystemTimeToVariantTime VarBstrFromDate SysAllocString VariantChangeType VariantClear SysStringLen SysFreeString SysAllocStringLen

wldap32

ord41 ord301 ord33 ord79 ord35 ord32 ord200 ord30 ord26 ord50 ord60 ord143 ord211 ord22 ord46 ord27

ws2_32

bind ntohs getsockname setsockopt WSAIoctl htons recv getsockopt WSAGetLastError __WSAFDIsSet WSASetLastError WSAStartup WSACleanup getpeername closesocket socket connect freeaddrinfo getaddrinfo sendto recvfrom accept listen ioctlsocket gethostname htonl ntohl send select

crypt32

CertFreeCertificateContext

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

583KB

Virtual Size

583KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

vip文件捆绑器.exe

IMPHASH 52633c2612ebc57be6ac804e18640cd0
SHA256 4f60677b90c4ef6a130b8df6ecacce77b8a3c10e2a38d9e76b03b169ae83f4cd
MD5 234673b74b8cf63fd7632fd016d5bf97
SHA1 b8879f89fb52c9a28adf6cb7a76fc4153a9ee498
SHA512 5994c95447a37afae559dd4846b8ca9af4e6dd6450145d3201ecc66cfd0377b61bbc47a454f6934e08fe2bc1c64b5ed8705e2006542e8029cdd5ae7551107b13
SSDEEP 24576:89BQEqTGgNnJhiK54h0IvBkEp3W8AD/Dhd+y4lqJ8QdCYDoDNKn0RbpaoG8vn+Q:83XgtJhT9IvBsvD/DX+y4onCYDoDlNao
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

406125

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer GetCurrentProcess DuplicateHandle lstrcpynA SetLastError FileTimeToLocalFileTime FileTimeToSystemTime LocalFree MultiByteToWideChar WideCharToMultiByte InterlockedDecrement CreateSemaphoreA SetStdHandle IsBadCodePtr IsBadReadPtr CompareStringW CompareStringA SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetACP HeapSize ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile ReadFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock FindFirstFileA FindClose TerminateProcess GetLocalTime GetSystemTime GetTimeZoneInformation RaiseException RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle GetFileAttributesA SetCurrentDirectoryA GetVolumeInformationA TlsAlloc LocalAlloc lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount WaitForSingleObject CloseHandle InterlockedIncrement

user32

OpenClipboard SetClipboardData EmptyClipboard GetSystemMetrics GetCursorPos MessageBoxA SetWindowPos SendMessageA DestroyCursor SetParent GetClipboardData PostMessageA GetTopWindow GetParent GetFocus GetClientRect InvalidateRect ValidateRect UpdateWindow CloseClipboard wsprintfA EqualRect GetWindowRect SetForegroundWindow IsWindow DestroyMenu IsChild ReleaseDC IsRectEmpty FillRect GetDC SetCursor LoadCursorA SetCursorPos SetActiveWindow GetSysColor SetWindowLongA GetWindowLongA RedrawWindow EnableWindow IsWindowVisible OffsetRect PtInRect DestroyIcon IntersectRect InflateRect SetRect SetScrollPos SetScrollRange GetScrollRange SetCapture TranslateMessage LoadIconA DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA GetWindowTextA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetForegroundWindow GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos UnregisterClassA AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow LoadStringA GetSysColorBrush DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture

gdi32

SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject GetObjectA PatBlt CombineRgn CreateRectRgn FillRgn CreateSolidBrush GetStockObject CreateFontIndirectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo CreateRectRgnIndirect SetBkColor CreatePen GetTextMetricsA Escape ExtTextOutA TextOutA RectVisible PtVisible GetViewportExtEx ExtSelectClipRgn

winmm

midiStreamRestart midiStreamClose midiOutReset midiStreamStop midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegCloseKey RegOpenKeyExA RegSetValueExA RegQueryValueA RegCreateKeyExA

shell32

ShellExecuteA Shell_NotifyIconA

ole32

OleUninitialize CLSIDFromString OleInitialize

oleaut32

UnRegisterTypeLi RegisterTypeLi LoadTypeLi

comctl32

ImageList_Destroy ord17

ws2_32

recv getpeername accept ioctlsocket recvfrom WSAAsyncSelect closesocket WSACleanup inet_ntoa

comdlg32

GetFileTitleA GetSaveFileNameA GetOpenFileNameA ChooseFontA ChooseColorA

菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.bat

IMPHASH 6d2e0468113e9ee683b7e555daa0c0b8
SHA256 db0c34fd60009271f420ab7adaf04d4476d7939892b217930fffcb9757be60e2
MD5 f2b6aae38b2a7d7eccd29f0293420d72
SHA1 da9209e98438a66c6453010f65e2b5c427382963
SHA512 d3c49e2d6fb731c747144e1bb301f390aeb34b1e399c841bc76287519d6ad13cb34e4a3ae24986b0f43e94c31d40e357d51d360a436b7651a4d539c8fad99951
SSDEEP 6144:uAtrKrjDnYCADp9VekbJ2tPJKA1jImwa6mcF:DmYpDFbJ2s0jIxmc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

122741

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\Rat5700\Desktop\荒蛇V4.88终级版源码\重启上线免杀小马-MFC\重启上线免杀小马-MFC\Release\MFC.pdb

kernel32

GetCommandLineA GetStartupInfoA HeapFree RtlUnwind RaiseException Sleep HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetACP IsValidCodePage InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetModuleHandleW GetCurrentProcess FlushFileBuffers SetFilePointer GetOEMCP GetCPInfo InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GlobalFlags FormatMessageA LocalFree GlobalFree InterlockedDecrement WritePrivateProfileStringA GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA InterlockedExchange lstrcmpA GlobalAlloc MulDiv GetCurrentThreadId GlobalFindAtomA GlobalDeleteAtom CompareStringA lstrcmpW GetVersionExA GlobalLock GlobalUnlock GetCurrentProcessId GetModuleHandleA GlobalGetAtomNameA GlobalAddAtomA MultiByteToWideChar lstrlenA WideCharToMultiByte GetLastError SetLastError FindResourceA LoadResource LockResource SizeofResource FreeResource GetModuleFileNameA ExitProcess CloseHandle WriteFile CreateFileA FreeLibrary IsBadReadPtr VirtualFree HeapAlloc GetProcessHeap HeapReAlloc VirtualAlloc LoadLibraryA HeapCreate GetProcAddress

user32

GetSysColorBrush SetRect SetTimer KillTimer WindowFromPoint GetDCEx LockWindowUpdate SetCapture EndDialog PostQuitMessage SetParent GetSystemMenu AppendMenuA DeleteMenu IsRectEmpty IsZoomed EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA FillRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA ModifyMenuA GetMenuState EnableMenuItem CheckMenuItem SetWindowTextA IsDialogMessageA RegisterWindowMessageA SendDlgItemMessageA IsChild SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA GetPropA GetMenuItemInfoA GetFocus GetWindowTextLengthA GetForegroundWindow DispatchMessageA BeginDeferWindowPos EndDeferWindowPos GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints TrackPopupMenu SetForegroundWindow MessageBoxA GetClassInfoExA RegisterClassA ScreenToClient DeferWindowPos PtInRect DefWindowProcA CallWindowProcA SystemParametersInfoA GetWindowPlacement GetWindowRect GetSystemMetrics GetClassNameA GetSysColor UnpackDDElParam ReuseDDElParam DestroyMenu WinHelpA SetFocus GetWindowThreadProcessId SendMessageA LoadCursorA EnableWindow LoadMenuA IsWindowEnabled EqualRect GetDlgItem GetDlgCtrlID GetKeyState LoadIconA SetCursor PeekMessageA GetCapture ReleaseCapture SetActiveWindow IsWindowVisible InvalidateRect InflateRect ShowOwnedPopups GetMessageA TranslateMessage GetCursorPos ValidateRect CreateDialogIndirectParamA RemovePropA GetNextDlgTabItem LoadAcceleratorsA UpdateWindow DefFrameProcA GetMenu DefMDIChildProcA GetMenuItemID GetSubMenu GetMenuItemCount GetParent CreateWindowExA DrawMenuBar GetActiveWindow BringWindowToTop TranslateMDISysAccel TranslateAcceleratorA IsWindow SetWindowLongA GetWindowLongA GetClientRect SetWindowPos IsIconic InsertMenuItemA CreatePopupMenu GetClassInfoA IntersectRect OffsetRect SetRectEmpty CopyRect GetLastActivePopup PostMessageA SetMenu GetDesktopWindow GetWindow ShowWindow AdjustWindowRectEx RedrawWindow GetWindowTextA

gdi32

DeleteDC CreatePatternBrush GetStockObject GetDeviceCaps CreateSolidBrush GetTextMetricsA GetTextExtentPoint32A GetCharWidthA CreateFontA StretchDIBits CreateFontIndirectA CreateRectRgnIndirect PatBlt SetRectRgn CombineRgn GetBkColor ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx TextOutA SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape CreateCompatibleBitmap RectVisible PtVisible GetPixel BitBlt CreateRectRgn SelectClipRgn DeleteObject IntersectClipRect ExcludeClipRect SetMapMode SetBkMode RestoreDC SaveDC CreateBitmap GetObjectA SetBkColor SetTextColor GetClipBox CreateCompatibleDC ExtTextOutA

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegQueryValueA RegOpenKeyA RegEnumKeyA RegDeleteKeyA RegCreateKeyExA RegQueryValueExA RegCloseKey RegSetValueExA RegOpenKeyExA

shell32

DragFinish DragQueryFileA

shlwapi

PathFindExtensionA

oleaut32

VariantClear VariantChangeType VariantInit SysAllocStringLen

远程控制测试- (2).bat

IMPHASH 88e9705447bfc1c8fd047b58cb386fee
SHA256 455d89a6e91d21bfb20ecd18f48faf8bfe67a3e3e115d737695aa1fc3883e2b4
MD5 44726e1af933ac9132a40f8c00c44e48
SHA1 b18df355daf0060c46d1eda4f7e068c1788405c2
SHA512 74e4eace0b660e1a12701533dea886218b9846fad69d5316aa835196f8713eb6ae68402b5281d27e9274aab40f1a3762bb98ddc4a5e54b24a13be8a784515c71
SSDEEP 49152:ArC7FLl2Fk6TN8pO3LEKx5iM8h5ZTvS8mQZ47Kxc1cAArVJiVjefVFLS:fLl2Fk6TaO3LEKx5i5ZTSjQZ4mxi/ark
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1090544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MulDiv GlobalAlloc ActivateActCtx DeactivateActCtx SetLastError GetProcAddress GetModuleHandleA LoadLibraryA GetTempFileNameA GlobalLock GlobalUnlock WriteFile SetFileTime GetCurrentDirectoryA GetFileAttributesA GetCurrentDirectoryW LocalFileTimeToFileTime lstrcpyA lstrlenA lstrcatA SystemTimeToFileTime ReadFile SetFilePointer GetCurrentThreadId GetSystemInfo DeleteFileA CreateFileA UnmapViewOfFile CloseHandle FindFirstFileA FindClose GetLastError FindFirstFileExA GetDriveTypeA CreateDirectoryA GetFileInformationByHandle GetTempPathA GetTickCount MultiByteToWideChar lstrlenW LocalFree FormatMessageA GlobalSize CopyFileA GlobalFree GetFileTime GetFullPathNameA GetStringTypeExA GetThreadLocale lstrcmpiA FlushFileBuffers LockFile UnlockFile SetEndOfFile GetFileSize DuplicateHandle GetCurrentProcess GetVolumeInformationA GetModuleFileNameA lstrcmpW LoadLibraryW CompareStringA FreeLibrary GetVersionExA GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA FreeResource FindResourceA ReleaseActCtx GetModuleFileNameW GetCurrentProcessId GetModuleHandleW lstrcmpA InterlockedExchange GetLocaleInfoA GetSystemDefaultUILanguage ConvertDefaultLocale GetUserDefaultUILanguage GetCurrentThread SetThreadPriority ResumeThread WaitForSingleObject GetPrivateProfileIntA WritePrivateProfileStringA GetPrivateProfileStringA GetProfileIntA LocalAlloc LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree FileTimeToSystemTime FileTimeToLocalFileTime GetFileAttributesExA GetFileSizeEx GlobalFlags GetCPInfo GetOEMCP GetACP GetWindowsDirectoryA GetNumberFormatA InitializeCriticalSectionAndSpinCount Sleep VirtualProtect SearchPathA FindResourceExW RtlUnwind EncodePointer DecodePointer ExitProcess RaiseException GetSystemTimeAsFileTime HeapFree HeapAlloc GetCommandLineA HeapSetInformation VirtualAlloc VirtualQuery HeapReAlloc ExitThread CreateThread HeapQueryInformation HeapSize SetStdHandle GetFileType TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetStdHandle IsValidCodePage LCMapStringW GetConsoleCP GetConsoleMode SetHandleCount GetStartupInfoW HeapCreate FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetStringTypeW GetTimeZoneInformation CompareStringW WriteConsoleW CreateFileW GetProcessHeap SetEnvironmentVariableA SleepEx VerifyVersionInfoA VerSetConditionMask GetSystemDirectoryA PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA InterlockedDecrement InterlockedIncrement WideCharToMultiByte FindResourceW LoadResource LockResource SizeofResource GetDriveTypeW

user32

WinHelpA LoadIconA LoadIconW RegisterWindowMessageA GetMenuItemInfoA DestroyMenu DestroyCursor LoadCursorW DefFrameProcA DefMDIChildProcA DrawMenuBar GetActiveWindow BringWindowToTop TranslateMDISysAccel RedrawWindow GetDesktopWindow IntersectRect CreatePopupMenu InsertMenuItemA GetWindowThreadProcessId DestroyIcon LoadImageA LoadMenuA ReuseDDElParam UnpackDDElParam TabbedTextOutA DrawTextA DrawTextExA GrayStringA GetWindowDC BeginPaint EndPaint PostQuitMessage ValidateRect TranslateMessage GetMessageA ShowOwnedPopups MapDialogRect SetWindowContextHelpId IsZoomed GetKeyNameTextA MapVirtualKeyA IsRectEmpty DeleteMenu GetSystemMenu SetParent WindowFromPoint EndDialog GetNextDlgTabItem CreateDialogIndirectParamA SetCursorPos GetSysColorBrush LoadAcceleratorsW RealChildWindowFromPoint DrawIcon SetWindowRgn CopyAcceleratorTableA CreateMenu PostThreadMessageA EnumDisplayMonitors SetLayeredWindowAttributes UnionRect EndDeferWindowPos InvalidateRgn GetNextDlgGroupItem MessageBeep LockWindowUpdate GetMenuDefaultItem InvertRect NotifyWinEvent GetIconInfo CopyImage DrawIconEx WaitMessage DrawEdge DrawFrameControl MonitorFromPoint UpdateLayeredWindow IsMenu SetClassLongA DestroyAcceleratorTable ToAsciiEx GetKeyboardLayout GetKeyboardState CreateAcceleratorTableA RegisterClipboardFormatA LoadImageW IsCharLowerA MapVirtualKeyExA GetCapture SetMenuDefaultItem CopyIcon GetDoubleClickTime GetUpdateRect CharUpperBuffA SubtractRect FrameRect GetWindowRgn GetMenuState GetMenuStringA AppendMenuA GetMenuItemID InsertMenuA GetMenuItemCount RemoveMenu GetSubMenu LoadMenuW ClientToScreen GetParent EnableWindow GetTopWindow GetMessageTime GetMessagePos PeekMessageA MonitorFromWindow GetMonitorInfoA MapWindowPoints ScrollWindow TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar GetFocus MessageBoxA CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA EqualRect DeferWindowPos GetScrollInfo SetScrollInfo PtInRect SetWindowPlacement GetWindowPlacement DefWindowProcA GetMenu IsIconic AdjustWindowRectEx CharUpperA GetWindowTextLengthA SetFocus SetWindowPos IsWindowEnabled ShowWindow MoveWindow GetDlgCtrlID SetWindowTextA IsDialogMessageA SendDlgItemMessageA PostMessageA CheckDlgButton GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuA EnableMenuItem wsprintfA GetSystemMetrics SystemParametersInfoA ReleaseDC GetDC InflateRect OffsetRect IsWindowVisible GetWindowRect RemovePropA SetWindowLongA GetPropA UnhookWindowsHookEx CallWindowProcA CallNextHookEx SetPropA GetClassLongA GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageA BeginDeferWindowPos CheckMenuItem DestroyWindow IsChild CharNextA SetRectEmpty EmptyClipboard SetClipboardData CloseClipboard GetKeyState OpenClipboard SetCapture SetTimer IsClipboardFormatAvailable ReleaseCapture GetCursorPos LoadCursorA SetCursor IsWindow EnableScrollBar KillTimer ScreenToClient TranslateAcceleratorA LoadAcceleratorsA GetDlgItem GetAsyncKeyState HideCaret UpdateWindow DrawFocusRect GetWindowLongA GetClassNameA SetWindowsHookExA GetSysColor GetClientRect GetWindowTextA InvalidateRect FillRect SetRect CopyRect DrawStateA SendMessageA

gdi32

CopyMetaFileA SelectClipRgn CreateRectRgn GetViewportExtEx GetWindowExtEx PtVisible RectVisible TextOutA SetTextAlign MoveToEx SetLayout IntersectClipRect ExcludeClipRect GetClipBox SetMapMode SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC GetStockObject PatBlt Rectangle GetViewportOrgEx LineTo GetLayout SetPixelV GetBoundsRect FrameRgn FillRgn PtInRegion SetPaletteEntries ExtFloodFill EnumFontFamiliesExA OffsetRgn StretchBlt SetDIBColorTable CreateRoundRectRgn Polygon Polyline CreatePolygonRgn GetSystemPaletteEntries RealizePalette GetNearestPaletteIndex GetPaletteEntries CreatePalette GetRgnBox GetTextCharsetInfo EnumFontFamiliesA CreateDIBitmap DeleteDC BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetPixel SetPixel CreatePen CreateSolidBrush GetTextExtentPoint32A CreateFontIndirectA GetObjectA GetDeviceCaps GetWindowOrgEx GetTextFaceA DPtoLP ExtTextOutA SetBkColor SetTextColor CreateBitmap CreateDCA DeleteObject GetTextColor CreateDIBSection Ellipse LPtoDP CreateEllipticRgn GetBkColor GetMapMode CombineRgn SetRectRgn CreateRectRgnIndirect GetTextMetricsA CreateHatchBrush GetObjectType SelectPalette CreatePatternBrush ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape

shell32

SHBrowseForFolderA SHAppBarMessage SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetDesktopFolder SHAddToRecentDocs DragQueryFileA DragFinish SHGetFileInfoA ShellExecuteA

msimg32

AlphaBlend TransparentBlt

comctl32

ImageList_GetIconSize

shlwapi

PathStripToRootA PathFindExtensionA PathFindFileNameA PathRemoveFileSpecW PathIsUNCA

oledlg

ord8

wldap32

ord46 ord41 ord27 ord301 ord33 ord79 ord35 ord32 ord200 ord30 ord26 ord50 ord60 ord143 ord211 ord22

ws2_32

WSACleanup WSAStartup WSASetLastError __WSAFDIsSet WSAGetLastError select recv WSAIoctl setsockopt ntohl htonl gethostname ioctlsocket listen accept recvfrom sendto getaddrinfo freeaddrinfo connect socket closesocket getpeername getsockopt htons bind ntohs getsockname send

crypt32

CertFreeCertificateContext

oleacc

AccessibleObjectFromWindow CreateStdAccessibleObject LresultFromObject

gdiplus

GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdiplusStartup GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdiplusShutdown GdipDrawImageI

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

winmm

PlaySoundA

winspool.drv

OpenPrinterA ClosePrinter DocumentPropertiesA

comdlg32

GetFileTitleA

advapi32

RegSetValueExA CryptImportKey CryptEncrypt CryptDestroyKey CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextA CryptGenRandom CryptReleaseContext RegCloseKey RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegEnumKeyA RegQueryValueA RegEnumValueA

ole32

OleGetClipboard OleUninitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject CoRegisterMessageFilter RevokeDragDrop CoLockObjectExternal RegisterDragDrop CLSIDFromString CLSIDFromProgID CoCreateGuid OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoTaskMemFree OleLockRunning CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CoInitialize OleDestroyMenuDescriptor OleCreateMenuDescriptor IsAccelerator OleTranslateAccelerator CoInitializeEx CoUninitialize CreateStreamOnHGlobal CoCreateInstance DoDragDrop OleFlushClipboard OleIsCurrentClipboard

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime SysFreeString SysAllocStringByteLen VarBstrFromDate VariantChangeType VariantInit SysAllocStringLen SysStringLen VariantCopy OleCreateFontIndirect SysAllocString VariantClear SafeArrayDestroy

远程控制测试- (2).exe

IMPHASH 88e9705447bfc1c8fd047b58cb386fee
SHA256 455d89a6e91d21bfb20ecd18f48faf8bfe67a3e3e115d737695aa1fc3883e2b4
MD5 44726e1af933ac9132a40f8c00c44e48
SHA1 b18df355daf0060c46d1eda4f7e068c1788405c2
SHA512 74e4eace0b660e1a12701533dea886218b9846fad69d5316aa835196f8713eb6ae68402b5281d27e9274aab40f1a3762bb98ddc4a5e54b24a13be8a784515c71
SSDEEP 49152:ArC7FLl2Fk6TN8pO3LEKx5iM8h5ZTvS8mQZ47Kxc1cAArVJiVjefVFLS:fLl2Fk6TaO3LEKx5i5ZTSjQZ4mxi/ark
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1090544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

shell32

SHBrowseForFolderA SHAppBarMessage SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetDesktopFolder SHAddToRecentDocs DragQueryFileA DragFinish SHGetFileInfoA ShellExecuteA

msimg32

AlphaBlend TransparentBlt

comctl32

ImageList_GetIconSize

shlwapi

PathStripToRootA PathFindExtensionA PathFindFileNameA PathRemoveFileSpecW PathIsUNCA

oledlg

ord8

wldap32

ord46 ord41 ord27 ord301 ord33 ord79 ord35 ord32 ord200 ord30 ord26 ord50 ord60 ord143 ord211 ord22

ws2_32

crypt32

CertFreeCertificateContext

oleacc

AccessibleObjectFromWindow CreateStdAccessibleObject LresultFromObject

gdiplus

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

winmm

PlaySoundA

winspool.drv

OpenPrinterA ClosePrinter DocumentPropertiesA

comdlg32

GetFileTitleA

advapi32

ole32

oleaut32

远程控制测试-.bat

IMPHASH 53f30c0e09d3aabc66df2ce13a5fc2ca
SHA256 b784b6c6eb56fb91cb881a18e5e5ce630c96b5e49b131363c4776a097bb4bdea
MD5 1abafb07254557a7e1c4045d16765c4d
SHA1 024ff7967ccc6e1237e74d23f2fab9840994a03b
SHA512 f24eabcdcfc932a9fb15042e200f8b2caf41cb2d7e718977fbaf16a14d8e1bbcf29cf7d7bdca715e0e26a88f7162b2ae8a4c2968f8036d940fd0e96d1ccf959f
SSDEEP 49152:lzvq2Kp7NXRRBChNoRhUfERKbVNK7hiwUOdj4rhEOX66VEl56r:o2Kp7NXlChNoRhRAbVNK7hiw14rKm669
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

f0:68:5f:42:2a:97:78:16:38:27:ab:3d:9a:83:51:cc:74:87:69:43:7b:76:95:71:f7:e2:04:c8:5c:3b:cc:8c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=1027739867473,CN=Kaspersky Lab JSC,OU=Kaspersky Lab,O=Kaspersky Lab JSC,L=Moscow,C=RU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025255

Chains

Dec 23, 2020

SERIALNUMBER=1027739867473,CN=Kaspersky Lab JSC,OU=Kaspersky Lab,O=Kaspersky Lab JSC,L=Moscow,C=RU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025255

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

89:23:10:47:80:6c:14:c5:0b:38:01:1d:33:78:8f:18:5e:b0:23:f3

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Kaspersky Lab JSC,O=Kaspersky Lab JSC,L=Moscow,C=RU

Chains

Dec 23, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Kaspersky Lab JSC,O=Kaspersky Lab JSC,L=Moscow,C=RU

Serial Number

01:3c:66:84:e0:f3:90:30:c0:5f:a3:6b:42:af:33:ca

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 21, 2018 - Nov 10, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=1027739867473,CN=Kaspersky Lab JSC,OU=Kaspersky Lab,O=Kaspersky Lab JSC,L=Moscow,C=RU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025255

Serial Number

0a:91:f3:b6:84:1e:24:78:6b:a2:68:d1:45:dc:a1:44

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 31, 2020 - Aug 9, 2023

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

1039312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MulDiv GlobalAlloc ActivateActCtx DeactivateActCtx SetLastError GetProcAddress GetModuleHandleA LoadLibraryA GetTempFileNameA GlobalLock GlobalUnlock WriteFile SetFileTime GetCurrentDirectoryA GetFileAttributesA GetCurrentDirectoryW LocalFileTimeToFileTime lstrcpyA lstrlenA lstrcatA SystemTimeToFileTime ReadFile SetFilePointer GetCurrentThreadId GetSystemInfo DeleteFileA CreateFileA UnmapViewOfFile CloseHandle FindFirstFileA FindClose GetLastError FindFirstFileExA GetDriveTypeA CreateDirectoryA GetFileInformationByHandle GetTempPathA GetTickCount MultiByteToWideChar lstrlenW LocalFree FormatMessageA GlobalSize CopyFileA GlobalFree GetFileTime GetFullPathNameA lstrcmpiA FlushFileBuffers LockFile UnlockFile SetEndOfFile GetFileSize DuplicateHandle GetCurrentProcess GetVolumeInformationA GetModuleFileNameA lstrcmpW LoadLibraryW CompareStringA FreeLibrary GetVersionExA GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA FreeResource FindResourceA ReleaseActCtx GetModuleFileNameW GetCurrentProcessId GetModuleHandleW lstrcmpA InterlockedExchange GetLocaleInfoA GetSystemDefaultUILanguage ConvertDefaultLocale GetUserDefaultUILanguage GetCurrentThread SetThreadPriority ResumeThread WaitForSingleObject GetPrivateProfileIntA WritePrivateProfileStringA GetPrivateProfileStringA GetProfileIntA LocalAlloc LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree FileTimeToSystemTime FileTimeToLocalFileTime GetFileAttributesExA GetFileSizeEx GlobalFlags GetCPInfo GetOEMCP GetACP GetWindowsDirectoryA GetNumberFormatA InitializeCriticalSectionAndSpinCount Sleep VirtualProtect SearchPathA FindResourceExW RtlUnwind EncodePointer DecodePointer ExitProcess RaiseException GetSystemTimeAsFileTime HeapFree HeapAlloc GetCommandLineA HeapSetInformation VirtualAlloc VirtualQuery HeapReAlloc ExitThread CreateThread HeapQueryInformation HeapSize SetStdHandle GetFileType TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetStdHandle IsValidCodePage LCMapStringW GetConsoleCP GetConsoleMode SetHandleCount GetStartupInfoW HeapCreate FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetStringTypeW GetTimeZoneInformation CompareStringW WriteConsoleW CreateFileW GetProcessHeap SetEnvironmentVariableA SleepEx VerifyVersionInfoA VerSetConditionMask GetSystemDirectoryA PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA InterlockedDecrement InterlockedIncrement WideCharToMultiByte FindResourceW LoadResource LockResource SizeofResource GetDriveTypeW

user32

GetCapture WinHelpA LoadIconA LoadIconW RegisterWindowMessageA GetMenuItemInfoA DestroyMenu DestroyCursor LoadCursorW DefFrameProcA DefMDIChildProcA DrawMenuBar GetActiveWindow BringWindowToTop TranslateMDISysAccel RedrawWindow GetDesktopWindow IntersectRect CreatePopupMenu InsertMenuItemA GetWindowThreadProcessId DestroyIcon LoadImageA LoadMenuA ReuseDDElParam UnpackDDElParam TabbedTextOutA DrawTextA DrawTextExA GrayStringA GetWindowDC BeginPaint EndPaint PostQuitMessage ValidateRect TranslateMessage GetMessageA ShowOwnedPopups IsZoomed GetKeyNameTextA MapVirtualKeyA IsRectEmpty DeleteMenu GetSystemMenu SetParent WindowFromPoint EndDialog GetNextDlgTabItem CreateDialogIndirectParamA SetCursorPos GetSysColorBrush LoadAcceleratorsW RealChildWindowFromPoint DrawIcon SetWindowRgn CopyAcceleratorTableA CreateMenu PostThreadMessageA EnumDisplayMonitors SetLayeredWindowAttributes UnionRect GetTopWindow MessageBeep GetMenuDefaultItem InvertRect NotifyWinEvent GetIconInfo CopyImage GetNextDlgGroupItem DrawIconEx WaitMessage DrawEdge DrawFrameControl MonitorFromPoint UpdateLayeredWindow IsMenu SetClassLongA DestroyAcceleratorTable ToAsciiEx GetKeyboardLayout GetKeyboardState CreateAcceleratorTableA LoadImageW IsCharLowerA MapVirtualKeyExA RegisterClipboardFormatA SetMenuDefaultItem GetClassLongA GetDoubleClickTime GetUpdateRect CharUpperBuffA SubtractRect FrameRect MapDialogRect GetWindowRgn GetMenuState GetMenuStringA AppendMenuA GetMenuItemID InsertMenuA GetMenuItemCount RemoveMenu GetSubMenu LoadMenuW ClientToScreen GetParent EnableWindow GetMessageTime GetMessagePos PeekMessageA MonitorFromWindow GetMonitorInfoA MapWindowPoints ScrollWindow TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar PostMessageA MessageBoxA GetFocus GetClassInfoExA GetClassInfoA RegisterClassA EqualRect DeferWindowPos GetScrollInfo SetScrollInfo PtInRect SetWindowPlacement GetWindowPlacement DefWindowProcA GetMenu IsIconic AdjustWindowRectEx CharUpperA GetWindowTextLengthA SetFocus SetWindowPos IsWindowEnabled ShowWindow MoveWindow GetDlgCtrlID SetWindowTextA IsDialogMessageA SendDlgItemMessageA CreateWindowExA CheckDlgButton GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuA EnableMenuItem wsprintfA GetSystemMetrics SystemParametersInfoA ReleaseDC GetDC InflateRect OffsetRect IsWindowVisible GetWindowRect RemovePropA SetWindowLongA GetPropA UnhookWindowsHookEx CallWindowProcA CallNextHookEx SetPropA GetWindowLongA GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageA BeginDeferWindowPos CopyIcon EndDeferWindowPos CheckMenuItem DestroyWindow IsChild LockWindowUpdate SetRectEmpty EmptyClipboard SetClipboardData CloseClipboard GetKeyState OpenClipboard SetCapture SetTimer IsClipboardFormatAvailable ReleaseCapture GetCursorPos LoadCursorA SetCursor IsWindow EnableScrollBar KillTimer ScreenToClient TranslateAcceleratorA LoadAcceleratorsA GetDlgItem GetAsyncKeyState HideCaret UpdateWindow DrawFocusRect GetClassNameA SetWindowsHookExA GetSysColor GetClientRect SendMessageA GetWindowTextA InvalidateRect FillRect SetRect CopyRect DrawStateA

gdi32

CopyMetaFileA SelectClipRgn CreateRectRgn GetViewportExtEx GetWindowExtEx PtVisible RectVisible TextOutA SetTextAlign MoveToEx SetLayout IntersectClipRect ExcludeClipRect GetClipBox SetMapMode SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC GetStockObject PatBlt Rectangle GetViewportOrgEx LineTo GetLayout SetPixelV GetBoundsRect FrameRgn FillRgn PtInRegion SetPaletteEntries ExtFloodFill EnumFontFamiliesExA GetRgnBox OffsetRgn StretchBlt SetDIBColorTable CreateRoundRectRgn Polygon Polyline CreatePolygonRgn GetSystemPaletteEntries RealizePalette GetNearestPaletteIndex GetPaletteEntries CreatePalette GetTextCharsetInfo EnumFontFamiliesA CreateDIBitmap DeleteDC BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetPixel SetPixel CreatePen CreateSolidBrush GetTextExtentPoint32A CreateFontIndirectA GetObjectA GetDeviceCaps GetWindowOrgEx GetTextFaceA DPtoLP ExtTextOutA SetBkColor SetTextColor CreateBitmap CreateDCA DeleteObject GetTextColor CreateDIBSection Ellipse LPtoDP CreateEllipticRgn GetBkColor CombineRgn SetRectRgn CreateRectRgnIndirect GetTextMetricsA CreateHatchBrush GetObjectType SelectPalette CreatePatternBrush ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape

shell32

SHBrowseForFolderA SHAppBarMessage SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetDesktopFolder DragQueryFileA DragFinish SHGetFileInfoA ShellExecuteA

msimg32

AlphaBlend TransparentBlt

comctl32

ImageList_GetIconSize

shlwapi

PathStripToRootA PathFindExtensionA PathFindFileNameA PathRemoveFileSpecW PathIsUNCA

wldap32

ord46 ord41 ord27 ord301 ord33 ord79 ord35 ord32 ord200 ord30 ord26 ord50 ord60 ord143 ord211 ord22

ws2_32

WSACleanup WSAStartup WSASetLastError __WSAFDIsSet WSAGetLastError select send WSAIoctl setsockopt getsockname ntohl htonl gethostname ioctlsocket listen accept recvfrom sendto getaddrinfo freeaddrinfo connect socket closesocket getpeername getsockopt htons bind ntohs recv

crypt32

CertFreeCertificateContext

oleacc

AccessibleObjectFromWindow CreateStdAccessibleObject LresultFromObject

gdiplus

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

winmm

PlaySoundA

winspool.drv

OpenPrinterA ClosePrinter DocumentPropertiesA

comdlg32

GetFileTitleA

advapi32

ole32

OleGetClipboard RevokeDragDrop CoLockObjectExternal RegisterDragDrop CoCreateGuid OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoTaskMemFree OleLockRunning CoInitialize OleDestroyMenuDescriptor OleCreateMenuDescriptor IsAccelerator OleTranslateAccelerator CoInitializeEx CoUninitialize CreateStreamOnHGlobal CoCreateInstance DoDragDrop

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime SysFreeString VariantChangeType VariantInit SysAllocStringLen SysStringLen VarBstrFromDate SysAllocString VariantClear

远程控制测试-.exe

IMPHASH 53f30c0e09d3aabc66df2ce13a5fc2ca
SHA256 b784b6c6eb56fb91cb881a18e5e5ce630c96b5e49b131363c4776a097bb4bdea
MD5 1abafb07254557a7e1c4045d16765c4d
SHA1 024ff7967ccc6e1237e74d23f2fab9840994a03b
SHA512 f24eabcdcfc932a9fb15042e200f8b2caf41cb2d7e718977fbaf16a14d8e1bbcf29cf7d7bdca715e0e26a88f7162b2ae8a4c2968f8036d940fd0e96d1ccf959f
SSDEEP 49152:lzvq2Kp7NXRRBChNoRhUfERKbVNK7hiwUOdj4rhEOX66VEl56r:o2Kp7NXlChNoRhRAbVNK7hiw14rKm669
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

f0:68:5f:42:2a:97:78:16:38:27:ab:3d:9a:83:51:cc:74:87:69:43:7b:76:95:71:f7:e2:04:c8:5c:3b:cc:8c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=1027739867473,CN=Kaspersky Lab JSC,OU=Kaspersky Lab,O=Kaspersky Lab JSC,L=Moscow,C=RU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025255

Chains

Dec 23, 2020

SERIALNUMBER=1027739867473,CN=Kaspersky Lab JSC,OU=Kaspersky Lab,O=Kaspersky Lab JSC,L=Moscow,C=RU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025255

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

89:23:10:47:80:6c:14:c5:0b:38:01:1d:33:78:8f:18:5e:b0:23:f3

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Kaspersky Lab JSC,O=Kaspersky Lab JSC,L=Moscow,C=RU

Chains

Dec 23, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Kaspersky Lab JSC,O=Kaspersky Lab JSC,L=Moscow,C=RU

Serial Number

01:3c:66:84:e0:f3:90:30:c0:5f:a3:6b:42:af:33:ca

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 21, 2018 - Nov 10, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=1027739867473,CN=Kaspersky Lab JSC,OU=Kaspersky Lab,O=Kaspersky Lab JSC,L=Moscow,C=RU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025255

Serial Number

0a:91:f3:b6:84:1e:24:78:6b:a2:68:d1:45:dc:a1:44

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 31, 2020 - Aug 9, 2023

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

1039312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MulDiv GlobalAlloc ActivateActCtx DeactivateActCtx SetLastError GetProcAddress GetModuleHandleA LoadLibraryA GetTempFileNameA GlobalLock GlobalUnlock WriteFile SetFileTime GetCurrentDirectoryA GetFileAttributesA GetCurrentDirectoryW LocalFileTimeToFileTime lstrcpyA lstrlenA lstrcatA SystemTimeToFileTime ReadFile SetFilePointer GetCurrentThreadId GetSystemInfo DeleteFileA CreateFileA UnmapViewOfFile CloseHandle FindFirstFileA FindClose GetLastError FindFirstFileExA GetDriveTypeA CreateDirectoryA GetFileInformationByHandle GetTempPathA GetTickCount MultiByteToWideChar lstrlenW LocalFree FormatMessageA GlobalSize CopyFileA GlobalFree GetFileTime GetFullPathNameA lstrcmpiA FlushFileBuffers LockFile UnlockFile SetEndOfFile GetFileSize DuplicateHandle GetCurrentProcess GetVolumeInformationA GetModuleFileNameA lstrcmpW LoadLibraryW CompareStringA FreeLibrary GetVersionExA GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA FreeResource FindResourceA ReleaseActCtx GetModuleFileNameW GetCurrentProcessId GetModuleHandleW lstrcmpA InterlockedExchange GetLocaleInfoA GetSystemDefaultUILanguage ConvertDefaultLocale GetUserDefaultUILanguage GetCurrentThread SetThreadPriority ResumeThread WaitForSingleObject GetPrivateProfileIntA WritePrivateProfileStringA GetPrivateProfileStringA GetProfileIntA LocalAlloc LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree FileTimeToSystemTime FileTimeToLocalFileTime GetFileAttributesExA GetFileSizeEx GlobalFlags GetCPInfo GetOEMCP GetACP GetWindowsDirectoryA GetNumberFormatA InitializeCriticalSectionAndSpinCount Sleep VirtualProtect SearchPathA FindResourceExW RtlUnwind EncodePointer DecodePointer ExitProcess RaiseException GetSystemTimeAsFileTime HeapFree HeapAlloc GetCommandLineA HeapSetInformation VirtualAlloc VirtualQuery HeapReAlloc ExitThread CreateThread HeapQueryInformation HeapSize SetStdHandle GetFileType TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetStdHandle IsValidCodePage LCMapStringW GetConsoleCP GetConsoleMode SetHandleCount GetStartupInfoW HeapCreate FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetStringTypeW GetTimeZoneInformation CompareStringW WriteConsoleW CreateFileW GetProcessHeap SetEnvironmentVariableA SleepEx VerifyVersionInfoA VerSetConditionMask GetSystemDirectoryA PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA InterlockedDecrement InterlockedIncrement WideCharToMultiByte FindResourceW LoadResource LockResource SizeofResource GetDriveTypeW

user32

gdi32

CopyMetaFileA SelectClipRgn CreateRectRgn GetViewportExtEx GetWindowExtEx PtVisible RectVisible TextOutA SetTextAlign MoveToEx SetLayout IntersectClipRect ExcludeClipRect GetClipBox SetMapMode SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC GetStockObject PatBlt Rectangle GetViewportOrgEx LineTo GetLayout SetPixelV GetBoundsRect FrameRgn FillRgn PtInRegion SetPaletteEntries ExtFloodFill EnumFontFamiliesExA GetRgnBox OffsetRgn StretchBlt SetDIBColorTable CreateRoundRectRgn Polygon Polyline CreatePolygonRgn GetSystemPaletteEntries RealizePalette GetNearestPaletteIndex GetPaletteEntries CreatePalette GetTextCharsetInfo EnumFontFamiliesA CreateDIBitmap DeleteDC BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetPixel SetPixel CreatePen CreateSolidBrush GetTextExtentPoint32A CreateFontIndirectA GetObjectA GetDeviceCaps GetWindowOrgEx GetTextFaceA DPtoLP ExtTextOutA SetBkColor SetTextColor CreateBitmap CreateDCA DeleteObject GetTextColor CreateDIBSection Ellipse LPtoDP CreateEllipticRgn GetBkColor CombineRgn SetRectRgn CreateRectRgnIndirect GetTextMetricsA CreateHatchBrush GetObjectType SelectPalette CreatePatternBrush ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape

shell32

SHBrowseForFolderA SHAppBarMessage SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetDesktopFolder DragQueryFileA DragFinish SHGetFileInfoA ShellExecuteA

msimg32

AlphaBlend TransparentBlt

comctl32

ImageList_GetIconSize

shlwapi

PathStripToRootA PathFindExtensionA PathFindFileNameA PathRemoveFileSpecW PathIsUNCA

wldap32

ord46 ord41 ord27 ord301 ord33 ord79 ord35 ord32 ord200 ord30 ord26 ord50 ord60 ord143 ord211 ord22

ws2_32

crypt32

CertFreeCertificateContext

oleacc

AccessibleObjectFromWindow CreateStdAccessibleObject LresultFromObject

gdiplus

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

winmm

PlaySoundA

winspool.drv

OpenPrinterA ClosePrinter DocumentPropertiesA

comdlg32

GetFileTitleA

advapi32

ole32

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime SysFreeString VariantChangeType VariantInit SysAllocStringLen SysStringLen VarBstrFromDate SysAllocString VariantClear

钱包收款地址强制更改器- (2).exe

IMPHASH 26215a450f0146afb43d09ac62d261d1
SHA256 3b98e8614b4244e0ffe0ddb86a07d8d35524ec36bc4a79ea89b556d246738ee1
MD5 4aa53cd852b2160cfe36a6623e099649
SHA1 63dadd832dc0c5d5a40a229a48bc5aa01ab59bc6
SHA512 444f967c9c73435156746a82acaba6af74f7eb458b03e17e1f9cabbe7eae9f2bc106d9c798660ad2c1ac96211072c1e93f0c8e499770ee60987f381ab2d42bf8
SSDEEP 49152:ZQSZnqs5EVcsYSijtkw9ga68mhcAP0xYHw/ZgAa0h7hYs8Id69UVgx6y:WkqKEVc7tkw9g98mHPCYHw/+Mh9Zfd6J
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1358892

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetLocaleInfoA lstrlenW ConvertDefaultLocale GetUserDefaultUILanguage GetCurrentThread GetPrivateProfileIntA WritePrivateProfileStringA GetPrivateProfileStringA GetTickCount GetFileTime GetTempFileNameA GetFullPathNameA FileTimeToSystemTime GlobalFlags LocalAlloc TlsGetValue GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc TlsFree GetProfileIntA SearchPathA GetCPInfo GetOEMCP GetACP lstrcmpiA FlushFileBuffers LockFile UnlockFile SetEndOfFile DuplicateHandle GetCurrentProcess FindClose FindFirstFileA GetVolumeInformationA GetTempPathA VirtualProtect FileTimeToLocalFileTime GetFileAttributesExA GetFileSizeEx GetWindowsDirectoryA GetNumberFormatA SetErrorMode FindResourceExW EncodePointer DecodePointer HeapAlloc VirtualAlloc GetSystemInfo VirtualQuery HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW RtlUnwind RaiseException ExitThread CreateThread lstrcmpA HeapReAlloc HeapSize HeapQueryInformation SetStdHandle GetFileType TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetStdHandle HeapCreate IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount QueryPerformanceCounter GetStringTypeW LCMapStringW CompareStringW GetTimeZoneInformation WriteConsoleW GetProcessHeap CreateFileW SetEnvironmentVariableA SleepEx VerifyVersionInfoA VerSetConditionMask GetSystemDirectoryA PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA GlobalUnlock MulDiv GetCurrentProcessId WaitForSingleObject ResumeThread SetThreadPriority GetModuleFileNameA GetFileSize GlobalLock DeleteCriticalSection InitializeCriticalSectionAndSpinCount GlobalAlloc GlobalReAlloc GlobalFree GlobalSize FindResourceA GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom GetVersionExA CompareStringA LoadLibraryW lstrcmpW FreeResource GetCurrentThreadId GetModuleFileNameW ReleaseActCtx CreateActCtxW CopyFileA FormatMessageA GetSystemTimeAsFileTime LocalFree GetFileInformationByHandle GetDriveTypeA FindFirstFileExA GetCurrentDirectoryW SetFileTime WriteFile CreateDirectoryA GetFileAttributesA LocalFileTimeToFileTime lstrcatA lstrcpyA GetCurrentDirectoryA SystemTimeToFileTime ReadFile CloseHandle SetFilePointer CreateFileA lstrlenA MultiByteToWideChar InterlockedExchange EnterCriticalSection LeaveCriticalSection Sleep ExitProcess InterlockedDecrement InterlockedIncrement DeleteFileA FindResourceW LoadResource LockResource SizeofResource WideCharToMultiByte FreeLibrary ActivateActCtx GetProcAddress GetModuleHandleA LoadLibraryA GetLastError DeactivateActCtx GetSystemDefaultUILanguage SetLastError GetDriveTypeW

user32

SetMenuItemBitmaps DrawEdge DrawFrameControl DrawFocusRect EnumDisplayMonitors SetLayeredWindowAttributes GetIconInfo TranslateAcceleratorA InsertMenuItemA LoadAcceleratorsA LoadMenuA ReuseDDElParam UnpackDDElParam CharUpperBuffA EndDialog GetNextDlgTabItem CreateDialogIndirectParamA FrameRect PostQuitMessage PostThreadMessageA WaitMessage ShowOwnedPopups InvertRect HideCaret RealChildWindowFromPoint UnregisterClassA SetCursorPos CopyIcon CopyAcceleratorTableA ToAsciiEx GetKeyboardLayout GetKeyboardState LoadAcceleratorsW CreateAcceleratorTableA SubtractRect IsClipboardFormatAvailable DefFrameProcA DefMDIChildProcA DrawMenuBar TranslateMDISysAccel GetDoubleClickTime EnumChildWindows MapDialogRect GetNextDlgGroupItem DestroyCursor DrawIcon CreateMenu IsCharLowerA MapVirtualKeyExA GetWindowRgn RemovePropA GetWindowTextLengthA GetWindowTextA GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageA GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos PeekMessageA MonitorFromWindow GetMonitorInfoA MapWindowPoints ScrollWindow TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow IsWindowVisible GetMenuItemID GetMenuItemCount GetMenuCheckMarkDimensions CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement GetWindowPlacement GetDlgCtrlID DefWindowProcA CallWindowProcA GetMenu SetWindowPos GrayStringA RegisterWindowMessageA CharUpperA SetFocus SetWindowsHookExA CallNextHookEx IsZoomed GetAsyncKeyState NotifyWinEvent GetCursorPos SetCursor MessageBeep ReleaseCapture LoadCursorA LoadCursorW WindowFromPoint SetCapture GetCapture SetWindowRgn GetSystemMenu PostMessageA EnableMenuItem CheckMenuItem DeleteMenu BeginDeferWindowPos EndDeferWindowPos EqualRect OffsetRect PtInRect UnhookWindowsHookEx MapVirtualKeyA GetKeyNameTextA CopyRect IsWindow IsWindowEnabled GetPropA SetWindowTextA IsDialogMessageA GetParent SetRectEmpty LoadMenuW GetSubMenu SendMessageA ScreenToClient GetClientRect CheckDlgButton GetSysColorBrush SetClassLongA RegisterClipboardFormatA SystemParametersInfoA GetMenuStringA GetMenuItemInfoA GetSystemMetrics ShowWindow GetDesktopWindow LockWindowUpdate GetUpdateRect MoveWindow BringWindowToTop UnionRect SetRect DestroyIcon LoadImageW LoadImageA EmptyClipboard CloseClipboard SetClipboardData ModifyMenuA InsertMenuA RemoveMenu EndPaint BeginPaint MessageBoxA GetWindowDC CopyImage OpenClipboard FillRect IsRectEmpty DrawStateA SetMenuDefaultItem DrawIconEx DestroyMenu IsMenu GetMenuDefaultItem DrawTextExA DrawTextA wsprintfA IsIconic GetKeyState KillTimer IntersectRect ReleaseDC GetDC SetTimer RedrawWindow LoadIconW GetWindowLongA SetWindowLongA GetFocus IsChild EnableWindow LoadBitmapW GetSysColor InflateRect GetWindowRect UpdateWindow InvalidateRect TabbedTextOutA GetWindowThreadProcessId MonitorFromPoint UpdateLayeredWindow EnableScrollBar DestroyAcceleratorTable SetParent GetMessageA TranslateMessage GetActiveWindow GetWindow ValidateRect ClientToScreen GetMenuState AppendMenuA CreatePopupMenu LoadIconA SendDlgItemMessageA WinHelpA GetClassLongA GetClassNameA ShowScrollBar SetPropA

gdi32

SelectClipRgn SetTextAlign MoveToEx LineTo IntersectClipRect ExcludeClipRect GetClipBox SetMapMode SetROP2 SetPolyFillMode SetBkMode SetLayout SaveDC GetTextMetricsA ExtTextOutA GetObjectA GetTextExtentPoint32A CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt CreateSolidBrush Rectangle GetStockObject DeleteObject CreateFontIndirectA DeleteDC SetDIBColorTable CreateDIBSection StretchBlt SetPixel GetPixel CombineRgn CreateRectRgn RestoreDC GetLayout CreateBitmap SelectPalette RealizePalette GetDIBits GetTextColor SetBkColor SetTextColor CreateRoundRectRgn CreatePen CreateRectRgnIndirect SetPixelV GetTextFaceA EnumFontFamiliesExA GetWindowOrgEx GetBoundsRect FrameRgn FillRgn PtInRegion GetSystemPaletteEntries GetNearestPaletteIndex LPtoDP GetViewportOrgEx SetPaletteEntries GetPaletteEntries CreatePalette ExtFloodFill GetRgnBox OffsetRgn GetTextCharsetInfo EnumFontFamiliesA CreateDIBitmap Polygon Ellipse Polyline GetBkColor CreatePolygonRgn CreateEllipticRgn GetViewportExtEx GetWindowExtEx PtVisible RectVisible TextOutA Escape SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn CreatePatternBrush GetObjectType GetDeviceCaps CreateHatchBrush SetRectRgn DPtoLP CopyMetaFileA CreateDCA PatBlt

shell32

SHBrowseForFolderA SHGetPathFromIDListA SHGetMalloc SHGetSpecialFolderLocation SHGetDesktopFolder SHGetFileInfoA SHAppBarMessage DragQueryFileA DragFinish ShellExecuteA

oleaut32

VariantClear SysStringLen SysAllocString VariantTimeToSystemTime SystemTimeToVariantTime VarBstrFromDate SysAllocStringLen VariantInit SysFreeString VariantChangeType

msimg32

TransparentBlt AlphaBlend

comctl32

ImageList_GetIconSize

shlwapi

PathFindExtensionA PathFindFileNameA PathStripToRootA PathIsUNCA PathRemoveFileSpecW

gdiplus

GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromStream GdiplusStartup GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImagePaletteSize GdipGetImagePalette GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipAlloc GdipFree GdipDisposeImage GdipGetImageGraphicsContext GdipDeleteGraphics GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI GdipCloneImage GdipDrawImageI GdiplusShutdown

wininet

InternetOpenUrlA InternetCloseHandle InternetOpenA

winmm

PlaySoundA

oleacc

LresultFromObject CreateStdAccessibleObject AccessibleObjectFromWindow

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winspool.drv

ClosePrinter OpenPrinterA DocumentPropertiesA

comdlg32

GetFileTitleA

advapi32

CryptHashData CryptImportKey CryptEncrypt CryptDestroyKey CryptGetHashParam CryptDestroyHash CryptCreateHash CryptAcquireContextA CryptGenRandom CryptReleaseContext RegCloseKey RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegSetValueExA RegDeleteValueA RegDeleteKeyA RegEnumKeyA RegQueryValueA RegEnumKeyExA RegEnumValueA

ole32

CoTaskMemAlloc CreateStreamOnHGlobal CoTaskMemFree ReleaseStgMedium RevokeDragDrop CoLockObjectExternal RegisterDragDrop OleDestroyMenuDescriptor OleCreateMenuDescriptor IsAccelerator OleTranslateAccelerator CoInitializeEx CoRevokeClassObject OleLockRunning OleGetClipboard DoDragDrop OleFlushClipboard OleIsCurrentClipboard CoFreeUnusedLibraries OleUninitialize CoCreateGuid CoInitialize CoCreateInstance CoUninitialize OleDuplicateData

wldap32

ord32 ord46 ord41 ord27 ord301 ord33 ord79 ord35 ord143 ord200 ord30 ord26 ord50 ord60 ord211 ord22

ws2_32

WSAIoctl send recv select WSAGetLastError __WSAFDIsSet WSASetLastError WSAStartup WSACleanup setsockopt getsockname ntohs gethostname bind htons getsockopt getpeername closesocket socket connect freeaddrinfo getaddrinfo sendto recvfrom accept listen ioctlsocket ntohl htonl

crypt32

CertFreeCertificateContext

钱包收款地址强制更改器-.exe

IMPHASH ce06483465fddfdf5c16c10503f572ad
SHA256 52575ef4a36b8a7c426e53dc595f7ec4680e972125a106aab51799e74dda2a45
MD5 3009b7339dc5d42d9e303b44f0ac909d
SHA1 b2dd5280172f5b3f6580fbc9ef668752d76cccf6
SHA512 9c6b58083f241ea948d6e0445d228e0f7e0edc2c5a5f907328c27555d5febdff5e0f111e89dc1ca5490e487618ca35c12f60f0b945452615bee698476f47030d
SSDEEP 49152:YYDYIdixGgyRXDBRomq2hI+Vz7SAjqElseu/V5fLBYA9ULRUh:YhIdcGFx9Romq2G+VHSAjqEaJVhV1ULq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1053810

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetLocaleInfoA lstrlenW ConvertDefaultLocale GetUserDefaultUILanguage GetCurrentThread GetPrivateProfileIntA WritePrivateProfileStringA GetPrivateProfileStringA GetTickCount GetFileTime GetTempFileNameA GetFullPathNameA FileTimeToSystemTime GlobalFlags LocalAlloc TlsGetValue GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc TlsFree GetProfileIntA SearchPathA GetCPInfo GetOEMCP GetACP lstrcmpiA FlushFileBuffers LockFile UnlockFile SetEndOfFile DuplicateHandle GetCurrentProcess FindClose FindFirstFileA GetVolumeInformationA GetTempPathA VirtualProtect FileTimeToLocalFileTime GetFileAttributesExA GetFileSizeEx GetWindowsDirectoryA GetNumberFormatA SetErrorMode FindResourceExW EncodePointer DecodePointer HeapAlloc VirtualAlloc GetSystemInfo VirtualQuery HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW RtlUnwind RaiseException ExitThread CreateThread lstrcmpA HeapReAlloc HeapSize HeapQueryInformation SetStdHandle GetFileType TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetStdHandle SetHandleCount HeapCreate IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetStringTypeW LCMapStringW CompareStringW GetTimeZoneInformation WriteConsoleW GetProcessHeap CreateFileW SetEnvironmentVariableA SleepEx VerifyVersionInfoA VerSetConditionMask GetSystemDirectoryA PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA GlobalUnlock MulDiv GetCurrentProcessId WaitForSingleObject ResumeThread SetThreadPriority GetModuleFileNameA GetFileSize GlobalLock DeleteCriticalSection InitializeCriticalSectionAndSpinCount GlobalAlloc GlobalReAlloc GlobalFree GlobalSize FindResourceA GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom GetVersionExA CompareStringA LoadLibraryW lstrcmpW FreeResource GetCurrentThreadId GetModuleFileNameW ReleaseActCtx CreateActCtxW CopyFileA FormatMessageA GetSystemTimeAsFileTime LocalFree GetFileInformationByHandle GetDriveTypeA FindFirstFileExA GetCurrentDirectoryW SetFileTime WriteFile CreateDirectoryA GetFileAttributesA LocalFileTimeToFileTime lstrcatA lstrcpyA GetCurrentDirectoryA SystemTimeToFileTime ReadFile CloseHandle SetFilePointer CreateFileA lstrlenA MultiByteToWideChar InterlockedExchange EnterCriticalSection LeaveCriticalSection Sleep ExitProcess InterlockedDecrement InterlockedIncrement DeleteFileA FindResourceW LoadResource LockResource SizeofResource WideCharToMultiByte FreeLibrary ActivateActCtx GetProcAddress GetModuleHandleA LoadLibraryA GetLastError DeactivateActCtx GetSystemDefaultUILanguage SetLastError GetDriveTypeW

user32

gdi32

shell32

SHBrowseForFolderA SHGetPathFromIDListA SHGetMalloc SHGetSpecialFolderLocation SHGetDesktopFolder SHGetFileInfoA SHAppBarMessage DragQueryFileA DragFinish ShellExecuteA

oleaut32

VariantClear SysStringLen SysAllocString VariantTimeToSystemTime SystemTimeToVariantTime VarBstrFromDate SysAllocStringLen VariantInit SysFreeString VariantChangeType

msimg32

TransparentBlt AlphaBlend

comctl32

ImageList_GetIconSize

shlwapi

PathFindExtensionA PathFindFileNameA PathStripToRootA PathIsUNCA PathRemoveFileSpecW

gdiplus

wininet

InternetOpenUrlA InternetCloseHandle InternetOpenA

winmm

PlaySoundA

oleacc

LresultFromObject CreateStdAccessibleObject AccessibleObjectFromWindow

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winspool.drv

ClosePrinter OpenPrinterA DocumentPropertiesA

comdlg32

GetFileTitleA

advapi32

ole32

wldap32

ord32 ord46 ord41 ord27 ord301 ord33 ord79 ord35 ord143 ord200 ord30 ord26 ord50 ord60 ord211 ord22

ws2_32

crypt32

CertFreeCertificateContext

Sharing

General

Malware Config

Signatures

File Explorer

chinesetelegramshitlol.rar

-°¦n+¦++.exe

user32

comctl32

kernel32

advapi32

gdi32

generic

1R.pyc

PC远控测试-.exe

kernel32

user32

advapi32

shell32

msimg32

comctl32

shlwapi

gdiplus

oleacc

imm32

winmm

gdi32

winspool.drv

comdlg32

ole32

oleaut32

wldap32

ws2_32

crypt32

generic

vip文件捆绑器.exe

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

generic

菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.bat

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

oleaut32

generic

远程控制 测试- (2).bat

kernel32

user32

gdi32

shell32

msimg32

comctl32

shlwapi

oledlg

wldap32

ws2_32

crypt32

oleacc

gdiplus

imm32

winmm

winspool.drv

comdlg32

advapi32

ole32

oleaut32

远程控制测试- (2).bat

远程控制测试- (2).exe

远程控制测试-.bat

远程控制测试-.exe