JaffaCakes118_358c99f5f11faa788a617eae44e7d676dfbf51ba3f1cc0348f03676f7ceea8ee

Sharing

Copy URL

Twitter E-mail

Reason

error processing APK: zip: not a valid zip file

General

Target

JaffaCakes118_358c99f5f11faa788a617eae44e7d676dfbf51ba3f1cc0348f03676f7ceea8ee
Size

701.8MB
MD5

6b00ac8658b112ea80a2e5cb0e44f41d
SHA1

9c2aa45e700cb5578ada4881e36bda7ebaf39e1a
SHA256

358c99f5f11faa788a617eae44e7d676dfbf51ba3f1cc0348f03676f7ceea8ee
SHA512

2fa3db5e0107371c7a9326389ce19e51a4238a7be9a080c717136f37c7b9b491c94f66ea8c481567f96b9fc28249d9d4aeb137f50ae70fa44158da3be0d8b92f
SSDEEP

12582912:wO9mQzDbRO9pO9VO9CO9rO9IRBO92O9uO9+Z0/WADFxO9aO9VO96O9apnKO9wO9j:xbDbeW6rgSOnfmoWADAj6DSx8s

Score

6^/10

upx

Malware Config

Signatures

Requests dangerous framework permissions 2 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/captured_malware/dns.exe	upx
static1/unpack001/captured_malware/dnshelper.exe	upx
static1/unpack001/captured_malware/dnshelper.exe.1	upx

Unsigned PE 24 IoCs

Checks for missing Authenticode signature.

resource
unpack001/captured_malware/1Ptfo0FZUMT7hlK.exe
unpack001/captured_malware/5KNTQd5xFuY7hcE.exe
unpack001/captured_malware/6Dy0Bg4B9kkMsak.exe
unpack001/captured_malware/6th july.exe
unpack001/captured_malware/77KpMaGlUit8zQl.exe
unpack001/captured_malware/BuXTaVVWA5WdvtU.exe
unpack001/captured_malware/DBti7kFcOLHaK2z.exe
unpack001/captured_malware/EMU.exe
unpack001/captured_malware/EgVhr9cVP2SFBEU.exe
unpack001/captured_malware/Hlt9VTppbZE9UGs.exe
unpack001/captured_malware/KVxnEZMWrmek1i6.exe
unpack001/captured_malware/P0weOPjsmVN5OCW.exe
unpack001/captured_malware/YCUMy7OsLy2HRs6.exe
unpack001/captured_malware/benu.exe
unpack001/captured_malware/dns.exe
unpack003/out.upx
unpack004/out.upx
unpack001/captured_malware/h0AuDqUVLDrtpzq.exe
unpack001/captured_malware/hWUsDVx5V2Kte0B.exe
unpack001/captured_malware/kkpoker_setup.exe
unpack001/captured_malware/lLwIMX6OKZZo7VL.exe
unpack001/captured_malware/promise.exe
unpack001/captured_malware/pscueWLrAI893Mm.exe
unpack001/captured_malware/tukur.exe

Files

JaffaCakes118_358c99f5f11faa788a617eae44e7d676dfbf51ba3f1cc0348f03676f7ceea8ee
.zip
captured_malware/1Ptfo0FZUMT7hlK.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 815KB - Virtual size: 815KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/20210731_resign.apk
.apk android arch:arm

com.pfqjp0ubz.qke055sf1.ap76zaf

com.pfqjp0ubz.qke055sf1.ap76zaf.Rcb88bc

Activities

com.pfqjp0ubz.qke055sf1.ap76zaf.Rcb88bc

android.intent.action.MAIN
android.intent.action.VIEW

cn.jpush.android.ui.PushActivity

cn.jpush.android.ui.PushActivity

cn.jpush.android.service.JNotifyActivity

cn.jpush.android.intent.JNotifyActivity

Permissions

android.permission.RECEIVE_USER_PRESENT
android.permission.VIBRATE
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
com.pfqjp0ubz.qke055sf1.ap76zaf.permission.JPUSH_MESSAGE
com.pfqjp0ubz.qke055sf1.ap76zaf.permission.MIPUSH_RECEIVE
com.meizu.c2dm.permission.RECEIVE
com.pfqjp0ubz.qke055sf1.ap76zaf.permission.C2D_MESSAGE
com.coloros.mcs.permission.RECIEVE_MCS_MESSAGE
com.heytap.mcs.permission.RECIEVE_MCS_MESSAGE

Receivers

cn.jpush.android.service.PushReceiver

cn.jpush.android.intent.NOTIFICATION_RECEIVED_PROXY
android.intent.action.USER_PRESENT
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED

com.pfqjp0ubz.qke055sf1.ap76zaf.jpush.MyPushReceiver

cn.jpush.android.intent.REGISTRATION
cn.jpush.android.intent.MESSAGE_RECEIVED
cn.jpush.android.intent.NOTIFICATION_RECEIVED
cn.jpush.android.intent.NOTIFICATION_OPENED
cn.jpush.android.intent.CONNECTION

com.pfqjp0ubz.qke055sf1.ap76zaf.jpush.MyJPushMessageReceiver

cn.jpush.android.intent.RECEIVE_MESSAGE

Services

cn.jpush.android.service.PushService

cn.jpush.android.intent.REGISTER
cn.jpush.android.intent.REPORT
cn.jpush.android.intent.PushService
cn.jpush.android.intent.PUSH_TIME

cn.jpush.android.service.DaemonService

cn.jpush.android.intent.DaemonService

com.pfqjp0ubz.qke055sf1.ap76zaf.jpush.MyPushService

cn.jiguang.user.service.action
captured_malware/33722.apk
captured_malware/33722.apk.1
.apk android arch:arm

com.mghs.hxkeghs26

com.ch.myframe.ui.activity.start.CheckActivity

Activities

com.ch.myframe.ui.activity.start.CheckActivity

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_GPS
android.permission.ACCESS_WIFI_STATE
android.permission.READ_EXTERNAL_STORAGE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.CAMERA
android.permission.WAKE_LOCK
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.READ_PHONE_STATE
android.permission.READ_PRIVILEGED_PHONE_STATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECORD_AUDIO
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.BLUETOOTH
android.permission.CHANGE_WIFI_STATE
android.permission.CALL_PHONE

Services

com.blankj.utilcode.util.MessengerUtils$ServerService

com.mghs.hxkeghs26.messenger
captured_malware/33722.apk.2
.apk android arch:arm

com.mghs.hxkeghs26

com.ch.myframe.ui.activity.start.CheckActivity

Activities

com.ch.myframe.ui.activity.start.CheckActivity

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_GPS
android.permission.ACCESS_WIFI_STATE
android.permission.READ_EXTERNAL_STORAGE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.CAMERA
android.permission.WAKE_LOCK
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.READ_PHONE_STATE
android.permission.READ_PRIVILEGED_PHONE_STATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECORD_AUDIO
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.BLUETOOTH
android.permission.CHANGE_WIFI_STATE
android.permission.CALL_PHONE

Services

com.blankj.utilcode.util.MessengerUtils$ServerService

com.mghs.hxkeghs26.messenger
captured_malware/33722.apk.3
.apk android arch:arm

com.mghs.hxkeghs26

com.ch.myframe.ui.activity.start.CheckActivity

Activities

com.ch.myframe.ui.activity.start.CheckActivity

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_GPS
android.permission.ACCESS_WIFI_STATE
android.permission.READ_EXTERNAL_STORAGE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.CAMERA
android.permission.WAKE_LOCK
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.READ_PHONE_STATE
android.permission.READ_PRIVILEGED_PHONE_STATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECORD_AUDIO
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.BLUETOOTH
android.permission.CHANGE_WIFI_STATE
android.permission.CALL_PHONE

Services

com.blankj.utilcode.util.MessengerUtils$ServerService

com.mghs.hxkeghs26.messenger
captured_malware/5KNTQd5xFuY7hcE.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 677KB - Virtual size: 676KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
captured_malware/6Dy0Bg4B9kkMsak.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/6th july.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 777KB - Virtual size: 777KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/77KpMaGlUit8zQl.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/BuXTaVVWA5WdvtU.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/DBti7kFcOLHaK2z.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 537KB - Virtual size: 536KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
captured_malware/EMU.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/EgVhr9cVP2SFBEU.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 551KB - Virtual size: 550KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
captured_malware/Hlt9VTppbZE9UGs.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 730KB - Virtual size: 729KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
captured_malware/KVxnEZMWrmek1i6.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/P0weOPjsmVN5OCW.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 929KB - Virtual size: 928KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/YCUMy7OsLy2HRs6.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/a5068f44-8a24-4657-b285-fe457a5b9429.apk
.apk android arch:arm

w2a.W2Ajscw.vx830.com

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_SETTINGS
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.WRITE_SMS
android.permission.READ_SMS
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.RECORD_AUDIO
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.READ_PHONE_STATE
android.permission.WRITE_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
android.permission.READ_EXTERNAL_STORAGE
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/amwnsr.apk
.apk android arch:arm arch:x86

com.goujiao

com.xbzhangshi.mvp.home.SplashActivity

Activities

com.xbzhangshi.mvp.home.SplashActivity

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.ACCESS_NETWORK_STATE
android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.CAMERA
android.permission.READ_CONTACTS
android.permission.READ_PHONE_STATE
android.permission.VIBRATE
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.WAKE_LOCK
android.permission.MOUNT_UNMOUNT_FILESYSTEMS

Services
captured_malware/benu.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 853KB - Virtual size: 852KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/diqiuav.apk
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/diqiuav.apk.1
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/diqiuav.apk.10
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/diqiuav.apk.11
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/diqiuav.apk.12
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/diqiuav.apk.13
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/diqiuav.apk.14
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/diqiuav.apk.2
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/diqiuav.apk.3
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/diqiuav.apk.4
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/diqiuav.apk.5
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/diqiuav.apk.6
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/diqiuav.apk.6.1
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/diqiuav.apk.7
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/diqiuav.apk.8
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/diqiuav.apk.9
.apk android arch:arm64 arch:arm

uni.UNIA97711E

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INSTALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.FLASHLIGHT
android.permission.GET_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.vivo.notification.permission.BADGE_ICON
com.asus.msa.SupplementaryDID.ACCESS

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

Services
captured_malware/dns.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 7.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
captured_malware/dnshelper.exe
.exe windows:5 windows x86 arch:x86

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:e4:f3:47:8c:eb:8f:3b:8b:87:e0:ab:04:a7:ac:cf
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25-07-2014 00:00

Not After

23-08-2017 23:59

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:df:ce:d6:14:2d:61:f6:c3:c5:b2:79:5b:a4:d7:a9:e2:a3:8b:7f
Signer

Actual PE Digest

70:df:ce:d6:14:2d:61:f6:c3:c5:b2:79:5b:a4:d7:a9:e2:a3:8b:7f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 476KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 55KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 423KB - Virtual size: 422KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/dnshelper.exe.1
.exe windows:5 windows x86 arch:x86

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:e4:f3:47:8c:eb:8f:3b:8b:87:e0:ab:04:a7:ac:cf
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25-07-2014 00:00

Not After

23-08-2017 23:59

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:df:ce:d6:14:2d:61:f6:c3:c5:b2:79:5b:a4:d7:a9:e2:a3:8b:7f
Signer

Actual PE Digest

70:df:ce:d6:14:2d:61:f6:c3:c5:b2:79:5b:a4:d7:a9:e2:a3:8b:7f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 476KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 55KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 423KB - Virtual size: 422KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/h0AuDqUVLDrtpzq.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1018KB - Virtual size: 1018KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/hWUsDVx5V2Kte0B.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 827KB - Virtual size: 827KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/kkpoker3.9.0.apk
.apk android arch:arm arch:x86

com.dreamoeju.kkpoker

com.unity3d.player.UnityPlayerActivity

Activities

com.unity3d.player.UnityPlayerActivity

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.CHANGE_WIFI_MULTICAST_STATE
captured_malware/kkpoker_setup.exe
.exe windows:4 windows x86 arch:x86

ad9d11227a86b863e31ddf6019cc7ab5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
system
memcpy
_wfopen
fseek
fclose
wcsncpy
wcslen
wcscpy
wcscat
wcscmp
memmove
memcmp
_stricmp
sscanf
atoi
strlen
strcpy
strcat
sprintf
malloc
free
_wstat
_wcsdup
strcmp
floor
ceil
_CIpow
_isnan
_finite
fread
longjmp
_setjmp3
ftell
wcsncmp
_snwprintf
_wcsicmp
tolower
localtime
mktime
_wcsnicmp
_itow
gmtime
fabs
pow
??3@YAXPAX@Z
wcsstr
calloc
_errno
strrchr
strchr
strncpy
memchr
_lseeki64
realloc
abort
_close
_wopen
_setmode
exit
_open_osfhandle
_strdup
_snprintf
setlocale
strncmp
wctomb
_get_osfhandle
_open
toupper
wcschr
mbstowcs
frexp
modf
fopen
strerror
atof
abs
fflush
fwrite
__p__iob
fprintf
getenv
_stati64
time
_ftime
_vsnwprintf
cos
fmod
sin

kernel32

GetModuleHandleW
HeapCreate
HeapDestroy
ExitProcess
GetDiskFreeSpaceExW
GetCurrentProcess
GetLastError
GetUserDefaultLangID
GetSystemInfo
ExpandEnvironmentStringsW
FormatMessageW
LocalFree
OutputDebugStringW
LoadLibraryW
FindResourceW
FreeLibrary
LoadResource
SizeofResource
LockResource
CreateMutexW
CloseHandle
BeginUpdateResourceW
EndUpdateResourceW
GetBinaryTypeW
UpdateResourceW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateThread
HeapAlloc
HeapFree
Sleep
CreateFileW
GetFileSize
ReadFile
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableW
SetEnvironmentVariableW
DuplicateHandle
CreatePipe
GetStdHandle
CreateProcessW
GetModuleFileNameW
GetProfileStringW
SetFilePointer
WideCharToMultiByte
MultiByteToWideChar
SetEndOfFile
WriteFile
DeleteFileW
HeapReAlloc
GetVersionExW
SetLastError
CopyFileW
FindFirstFileW
FindNextFileW
FindClose
SetFileAttributesW
RemoveDirectoryW
GetDriveTypeW
GetFileAttributesW
GetTempPathW
MulDiv
GetLocalTime
TlsAlloc
TlsSetValue
TlsGetValue
GlobalFree
GlobalAlloc
HeapSize
TlsFree
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
VirtualAlloc
VirtualFree
IsValidCodePage
GetACP
GetOEMCP
GetFileType
PeekNamedPipe
GetFileInformationByHandle
GetFileAttributesA
CreateFileA
GetExitCodeProcess
GetFullPathNameW
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY

user32

IsWindowEnabled
IsWindowVisible
ExitWindowsEx
GetActiveWindow
SendMessageW
GetWindowTextLengthW
GetSysColor
SetRect
GetWindowLongW
RedrawWindow
GetDlgCtrlID
GetWindowTextW
ShowWindow
SetForegroundWindow
SetWindowLongW
UpdateLayeredWindow
DestroyIcon
EnumWindows
MessageBoxW
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
EnableWindow
SetWindowPos
DestroyWindow
SystemParametersInfoW
SetFocus
GetFocus
GetParent
GetClassNameW
SetWindowTextW
CallWindowProcW
RemovePropW
GetWindowRect
GetPropW
CreateWindowExW
SetPropW
SetScrollPos
GetDC
InflateRect
ReleaseDC
GetWindowDC
MapWindowPoints
MoveWindow
InvalidateRect
GetIconInfo
UpdateWindow
ReleaseCapture
BeginPaint
DrawStateW
EndPaint
SetCapture
ScreenToClient
GetSystemMetrics
GetSysColorBrush
DrawTextW
GetWindow
ValidateRect
ClientToScreen
GetClientRect
FillRect
DefWindowProcW
LoadCursorW
RegisterClassExW
SetClassLongW
EnumPropsExW
SetActiveWindow
LoadIconW
IsZoomed
IsIconic
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
RegisterClassW
AdjustWindowRectEx
CreateAcceleratorTableW
UnregisterClassW
DestroyAcceleratorTable
GetMenu
SetTimer
KillTimer
DefFrameProcW
EnumChildWindows
GetKeyState
IsChild
RegisterWindowMessageW
CreateIconFromResourceEx
CreateIconFromResource
CharLowerW
DrawIconEx

gdi32

StartDocW
GetMapMode
SetMapMode
GetDeviceCaps
DPtoLP
StartPage
EndPage
EndDoc
SetBkColor
CreateDCW
DeleteObject
GetStockObject
CreateFontIndirectW
ExcludeClipRect
GetObjectType
GetObjectW
SetTextColor
SelectObject
GetTextExtentPoint32W
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
SetStretchBltMode
StretchBlt
CreateSolidBrush
GdiGetBatchLimit
GdiSetBatchLimit
BitBlt
CreateDIBSection
SetBrushOrgEx
CreateBitmap
SetPixel
GetDIBits
CreateFontW
SetBkMode
SetTextAlign
TextOutW
GetTextMetricsW
GetPixel

comdlg32

PrintDlgW

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
GetUserNameW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext

comctl32

InitCommonControlsEx
ImageList_Replace
ImageList_Add
ImageList_ReplaceIcon
ImageList_Remove
ImageList_AddMasked
ImageList_Destroy
ImageList_Create

ole32

CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize
CoCreateGuid
StringFromGUID2
RevokeDragDrop

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHCreateDirectory
SHBrowseForFolderW
ExtractIconW
SHGetFileInfoW
ShellExecuteExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.code
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 576KB - Virtual size: 576KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
captured_malware/lLwIMX6OKZZo7VL.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 767KB - Virtual size: 766KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/malware.txt
captured_malware/promise.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/pscueWLrAI893Mm.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 815KB - Virtual size: 814KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/shuihust.exe
.exe windows:6 windows x86 arch:x86

93b8e6bc75e67ae4060f162e5cefcf18

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19-09-2018 00:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

17:84:31:17:85:2d:87:39:43:3c:23:9b
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

17-01-2019 07:04

Not After

16-02-2022 07:04

Subject

CN=杭州跃兔网络科技有限公司,O=杭州跃兔网络科技有限公司,L=杭州,ST=浙江,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

69:b9:68:43:2f:bd:b3:00:bf:4c:d9:3a:98:43:ce:4f:6f:ec:6d:c5
Signer

Actual PE Digest

69:b9:68:43:2f:bd:b3:00:bf:4c:d9:3a:98:43:ce:4f:6f:ec:6d:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\repos\stappup\Release Normal\GameUpdate.pdb

Imports

ws2_32

inet_addr
htons
setsockopt
ioctlsocket
connect
select
getsockopt
closesocket
send
recv
WSAGetLastError
WSAStartup
WSACleanup
gethostbyname
inet_ntoa
sendto
recvfrom
WSAAddressToStringA
ntohl
ntohs
gethostname
htonl
bind
__WSAFDIsSet
WSAStringToAddressW
WSASetLastError
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
inet_pton
getpeername
getsockname
WSAIoctl
accept
listen
getaddrinfo
getnameinfo
socket
freeaddrinfo
shutdown

kernel32

SearchPathA
GetTempFileNameA
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
CreateEventW
GetUserDefaultLCID
OutputDebugStringW
SwitchToThread
TryEnterCriticalSection
CompareStringW
LCMapStringW
GetStringTypeW
WaitForMultipleObjectsEx
OpenEventA
SetWaitableTimer
GetLogicalProcessorInformation
CreateWaitableTimerA
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetCommandLineW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetConsoleCtrlHandler
VirtualQuery
HeapQueryInformation
SetStdHandle
GetFullPathNameW
IsValidLocale
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetTimeZoneInformation
GetDriveTypeW
FindFirstFileExA
FindNextFileW
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetCurrentDirectoryW
CreateTimerQueue
SignalObjectAndWait
GetThreadPriority
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
GetVersionExW
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
SleepEx
GetSystemDirectoryA
CompareFileTime
PeekNamedPipe
FindResourceA
SizeofResource
LoadResource
LockResource
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
FormatMessageA
GetFileAttributesExW
DeleteFileW
SetConsoleMode
ReadConsoleA
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
FindFirstFileW
GetSystemTime
FormatMessageW
WideCharToMultiByte
LocalFree
CreateEventA
CloseHandle
SetEvent
MultiByteToWideChar
GetLastError
TerminateThread
ExpandEnvironmentStringsA
DeleteFileA
GetModuleFileNameA
GetCurrentProcessId
GetCommandLineA
FindResourceW
WaitForSingleObject
RemoveDirectoryA
GetTempPathA
CopyFileA
CreateFileA
OpenProcess
CreateProcessA
GetEnvironmentVariableA
SetEnvironmentVariableA
ExitProcess
MoveFileA
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
SetCurrentDirectoryA
FindFirstFileA
FindClose
CreateThread
WaitForMultipleObjects
CreateSemaphoreA
GetSystemInfo
GetCurrentProcess
DuplicateHandle
ReleaseSemaphore
GetProfileIntA
HeapAlloc
GetProcessHeap
HeapFree
WaitForSingleObjectEx
GetTickCount
UnmapViewOfFile
FindNextFileA
GetFileSizeEx
GetFileAttributesA
SetFileAttributesA
CreateDirectoryA
OutputDebugStringA
CreateToolhelp32Snapshot
Process32First
TerminateProcess
Process32Next
Module32First
Module32Next
SetThreadPriority
GetCurrentThread
WriteFile
FlushFileBuffers
GetFileSize
LockFile
UnlockFile
SetFilePointerEx
SetEndOfFile
ReadFile
GetCurrentDirectoryA
GetExitCodeThread
GetExitCodeProcess
WTSGetActiveConsoleSessionId
lstrcpynA
lstrcpynW
LoadLibraryW
GetModuleFileNameW
OpenMutexA
CreateMutexA
ReleaseMutex
SetUnhandledExceptionFilter
InitializeCriticalSection
DeleteCriticalSection
IsBadReadPtr
VirtualProtect
GetModuleHandleA
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
HeapSize
HeapReAlloc
RaiseException
DecodePointer
SetFileTime
SetFilePointer
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
GetFileAttributesExA
MoveFileExA
DeviceIoControl
GetProcessAffinityMask
SetProcessAffinityMask
GetVersionExA
GetLogicalDriveStringsA
GetDriveTypeA
GetDiskFreeSpaceExA
GetStdHandle
GetEnvironmentVariableW
GetFileType
GetModuleHandleW
SetLastError
GetWindowsDirectoryA
InitializeCriticalSectionEx
VirtualFree
VirtualAlloc
CreateFileW
ResetEvent
ResumeThread
TlsAlloc
QueueUserAPC
TlsFree
QueryPerformanceFrequency
QueryPerformanceCounter
MulDiv
GlobalSize
FreeResource
EncodePointer
GetSystemDirectoryW
LoadLibraryExW
GlobalDeleteAtom
lstrcmpW
GlobalAddAtomA
GlobalFindAtomA
GlobalGetAtomNameA
CompareStringA
LocalAlloc
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
lstrcmpA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GlobalFlags
TlsGetValue
TlsSetValue
GlobalReAlloc
GlobalHandle
LocalReAlloc
SetErrorMode
FindResourceExW
VerifyVersionInfoA
VerSetConditionMask
GetVolumeInformationA
lstrcmpiA
GetFullPathNameA
GetFileTime
FileTimeToLocalFileTime
GetCPInfo
GetOEMCP
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
lstrcpyA
GetACP
GetThreadLocale

user32

GetMessageA
MapDialogRect
SetWindowContextHelpId
PostQuitMessage
LoadBitmapW
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetTopWindow
GetClassLongA
CopyRect
MapWindowPoints
AdjustWindowRectEx
RemovePropA
ShowScrollBar
ReleaseCapture
CopyAcceleratorTableA
InvalidateRgn
IsRectEmpty
GetNextDlgGroupItem
CreatePopupMenu
GetParent
GetClientRect
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
ValidateRect
GetForegroundWindow
ShowOwnedPopups
SetMenu
GetMenu
GetCapture
GetKeyState
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
DefWindowProcA
GetMessageTime
RegisterWindowMessageA
IsDialogMessageA
GetMenuDefaultItem
DrawFocusRect
LoadImageA
DrawIconEx
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
LoadCursorW
NotifyWinEvent
SetLayeredWindowAttributes
EnumDisplayMonitors
SetClassLongA
SetWindowRgn
SetParent
DrawStateA
DrawEdge
DrawFrameControl
IsZoomed
GetDlgCtrlID
GetWindow
GetWindowTextLengthA
GetKeyNameTextA
MapVirtualKeyA
WindowFromPoint
IntersectRect
DestroyMenu
GetMenuItemInfoA
RealChildWindowFromPoint
GetSysColorBrush
TrackMouseEvent
DestroyIcon
LoadImageW
CopyImage
GetAsyncKeyState
CharUpperA
IsClipboardFormatAvailable
MessageBeep
SetRect
CharNextA
TrackPopupMenu
EnableWindow
GetWindowThreadProcessId
PostMessageA
EnumWindows
GetWindowRect
RegisterHotKey
SendMessageA
SetTimer
ReleaseDC
GetDC
MessageBoxA
BringWindowToTop
IsWindowVisible
SetFocus
DrawTextA
CheckDlgButton
ShowWindow
OffsetRect
SetRectEmpty
SendDlgItemMessageA
GetDesktopWindow
SetActiveWindow
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamA
DestroyWindow
RemoveMenu
InsertMenuA
GetMenuItemCount
GetCursorPos
ScreenToClient
GetSystemMetrics
SetWindowTextA
GetDlgItem
PostThreadMessageA
KillTimer
PeekMessageA
TranslateMessage
DispatchMessageA
IsWindow
LoadIconW
InvalidateRect
SetWindowPos
SetWindowLongA
SetCursorPos
CopyIcon
DrawIcon
GetMenuItemID
GetMenuState
GetMenuStringA
IsWindowEnabled
FillRect
GetSysColor
EndPaint
BeginPaint
GetUserObjectInformationW
GetProcessWindowStation
GetClassNameA
GetLastActivePopup
GetPropA
MoveWindow
MsgWaitForMultipleObjects
wsprintfA
UnregisterClassA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ClientToScreen
GetSubMenu
LoadMenuW
SetCursor
FrameRect
LoadCursorA
UpdateWindow
IsChild
IsIconic
SetPropA
AppendMenuA
DeleteMenu
GetSystemMenu
RegisterClipboardFormatA
UnionRect
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsA
TranslateAcceleratorA
LoadMenuA
InsertMenuItemA
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
WaitMessage
GetKeyboardLayout
IsCharLowerA
MapVirtualKeyExA
GetKeyboardState
ToAsciiEx
LoadAcceleratorsW
CreateAcceleratorTableA
DestroyAcceleratorTable
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuA
CharUpperBuffA
GetUpdateRect
DrawMenuBar
DefFrameProcA
DefMDIChildProcA
TranslateMDISysAccel
SubtractRect
CreateMenu
GetWindowRgn
DestroyCursor
SetCapture
SetForegroundWindow
MessageBoxW
GetWindowLongA
GetWindowTextA
GetWindowDC
GetMessagePos
RedrawWindow
GetFocus
InflateRect
SystemParametersInfoA
GrayStringA
DrawTextExA
TabbedTextOutA
PtInRect
EqualRect

gdi32

GetTextFaceA
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
RoundRect
OffsetRgn
EnumFontFamiliesExA
LPtoDP
CreateRoundRectRgn
Polygon
CreatePolygonRgn
Ellipse
CreateEllipticRgn
SetDIBColorTable
StretchBlt
GetTextCharsetInfo
EnumFontFamiliesA
CreateDIBitmap
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
GetRgnBox
GetTextColor
GetBkColor
GetTextMetricsA
DPtoLP
SetRectRgn
GetMapMode
CombineRgn
PatBlt
CreateRectRgnIndirect
CopyMetaFileA
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
MoveToEx
ExtCreatePen
SetTextAlign
SetTextColor
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SetBkColor
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateBitmap
SetPixel
CreateFontA
Rectangle
Polyline
CreateFontIndirectA
GetTextExtentPoint32A
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetBkMode
RealizePalette
SelectPalette
GetStockObject
GetObjectA
DeleteDC
CreateDCA
DeleteObject
SelectObject
CreateCompatibleBitmap
GetDeviceCaps
CreateSolidBrush
BitBlt
CreateCompatibleDC
CreateDIBSection

msimg32

TransparentBlt
AlphaBlend

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

CryptExportKey
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegQueryInfoKeyA
RegEnumValueA
RegDeleteValueA
OpenProcessToken
GetTokenInformation
OpenSCManagerA
EnumServicesStatusA
CloseServiceHandle
OpenThreadToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegOpenKeyExA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
RegEnumKeyExA
CryptAcquireContextW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
RegDeleteKeyA
CryptDecrypt
CryptSignHashW
CryptEnumProvidersW
RegEnumKeyA

shell32

SHGetFileInfoA
Shell_NotifyIconA
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderPathA
SHGetDataFromIDListW
SHGetDesktopFolder
SHGetSpecialFolderPathW
ShellExecuteA
SHChangeNotify
SHGetSpecialFolderLocation
DragQueryFileA
DragFinish
SHAppBarMessage

comctl32

_TrackMouseEvent
InitCommonControlsEx

shlwapi

StrFormatKBSizeA
PathStripToRootA
PathIsUNCA
PathFindFileNameA
PathFindExtensionA
UrlUnescapeA
PathAppendA
PathCompactPathA
PathFileExistsW
PathAppendW
PathRemoveFileSpecW
PathRemoveBackslashA
PathSetDlgItemPathA
UrlCanonicalizeA
PathCanonicalizeA
PathGetDriveNumberA
PathGetArgsA
PathRemoveFileSpecA
PathFileExistsA

uxtheme

GetCurrentThemeName
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetWindowTheme
GetThemeSysColor
DrawThemeText

ole32

IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
CoRegisterMessageFilter
CoRevokeClassObject
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CLSIDFromProgID
CLSIDFromString
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoInitializeEx
CoCreateInstance
CoUninitialize
CoInitialize
CreateStreamOnHGlobal

oleaut32

VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
LoadTypeLi
VariantChangeType
SysAllocStringLen
SysAllocStringByteLen
VariantClear
VariantInit
SysFreeString
VarBstrFromDate
OleCreateFontIndirect
SysAllocString

oledlg

ord8

winmm

timeGetTime
PlaySoundA

gdiplus

GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipFillRectangleI
GdipDrawString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipCreateTexture
GdipFillRectangle
GdipDeleteBrush
GdipCloneBrush
GdipCreateSolidFill
GdipDrawImageRectRect
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipSetSmoothingMode
GdiplusShutdown
GdiplusStartup
GdipReleaseDC
GdipDrawImageRect
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageHeight
GdipGetImageWidth

iphlpapi

IcmpCreateFile
IcmpCloseHandle
GetAdaptersInfo
GetAdaptersAddresses
GetIpForwardTable
IcmpSendEcho

imagehlp

MakeSureDirectoryPathExists

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

wininet

InternetCanonicalizeUrlA
InternetSetFilePointer
InternetCloseHandle
InternetReadFile
HttpQueryInfoA
InternetCrackUrlA
InternetOpenUrlA
InternetQueryDataAvailable
InternetQueryOptionA
InternetSetOptionA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetGetLastResponseInfoA
InternetSetStatusCallback
InternetWriteFile
InternetConnectA
InternetOpenA

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

wldap32

ord35
ord33
ord79
ord301
ord27
ord26
ord30
ord41
ord50
ord45
ord60
ord211
ord46
ord143
ord22
ord200
ord32

crypt32

CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore

bcrypt

BCryptGenRandom

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 287KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
captured_malware/tukur.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 815KB - Virtual size: 815KB

.rsrc Size: 21KB - Virtual size: 21KB

.reloc Size: 512B - Virtual size: 12B

com.pfqjp0ubz.qke055sf1.ap76zaf

com.pfqjp0ubz.qke055sf1.ap76zaf.Rcb88bc

Activities

com.pfqjp0ubz.qke055sf1.ap76zaf.Rcb88bc

cn.jpush.android.ui.PushActivity

cn.jpush.android.service.JNotifyActivity

Permissions

Receivers

cn.jpush.android.service.PushReceiver

com.pfqjp0ubz.qke055sf1.ap76zaf.jpush.MyPushReceiver

com.pfqjp0ubz.qke055sf1.ap76zaf.jpush.MyJPushMessageReceiver

Services

cn.jpush.android.service.PushService

cn.jpush.android.service.DaemonService

com.pfqjp0ubz.qke055sf1.ap76zaf.jpush.MyPushService

com.mghs.hxkeghs26

com.ch.myframe.ui.activity.start.CheckActivity

Activities

com.ch.myframe.ui.activity.start.CheckActivity

Permissions

Services

com.blankj.utilcode.util.MessengerUtils$ServerService

com.mghs.hxkeghs26

com.ch.myframe.ui.activity.start.CheckActivity

Activities

com.ch.myframe.ui.activity.start.CheckActivity

Permissions

Services

com.blankj.utilcode.util.MessengerUtils$ServerService

com.mghs.hxkeghs26

com.ch.myframe.ui.activity.start.CheckActivity

Activities

com.ch.myframe.ui.activity.start.CheckActivity

Permissions

Services

com.blankj.utilcode.util.MessengerUtils$ServerService

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 677KB - Virtual size: 676KB

.reloc Size: 512B - Virtual size: 12B

.rsrc Size: 18KB - Virtual size: 18KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 777KB - Virtual size: 777KB

.text
Size: 815KB - Virtual size: 815KB

.rsrc
Size: 21KB - Virtual size: 21KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 677KB - Virtual size: 676KB

.reloc
Size: 512B - Virtual size: 12B

.rsrc
Size: 18KB - Virtual size: 18KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 777KB - Virtual size: 777KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 1.1MB - Virtual size: 1.1MB

.rsrc
Size: 363KB - Virtual size: 363KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 1.3MB - Virtual size: 1.3MB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 537KB - Virtual size: 536KB

.reloc
Size: 512B - Virtual size: 12B

.rsrc
Size: 18KB - Virtual size: 18KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 551KB - Virtual size: 550KB

.reloc
Size: 512B - Virtual size: 12B

.rsrc
Size: 2KB - Virtual size: 1KB

.text
Size: 730KB - Virtual size: 729KB

.reloc
Size: 512B - Virtual size: 12B

.rsrc
Size: 363KB - Virtual size: 363KB

.text
Size: 1.0MB - Virtual size: 1.0MB