xiangrikgui[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
xiangrikgui.exe
Size 70.2MB
Sample250910-wh5baasvcw
SHA256 0455ed6abd6758907267ba9e09155bc8b1f430e2b60a33c1e1aaebf92471a32e
MD5 84bca52e2c6897aa4127d72f5bd2f166
SHA1 0f5d3d903b31390dcb3785a6f8863f8876c41a8e
SHA512 bc951ce8f5eaf9c19c9e90cb9d9cb95dc42ca6eeefc7f77971b6083268c7755426971fd7e9b581e0d069403ce8863e1f4ba0aad86fc2c803a582c677834640e6
SSDEEP 1572864:1HgCUAre2t1jRX9Y1mLbqSaRqlIS8sEsGzP63tkwerpvIqaIbzDD:1HCAre2t1jRX9Y1EbqHquvsi68rpvIqp
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/xiangrikui.exe	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
xiangrikgui.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/dllloader_v2.dll
unpack002/out.upx

File Explorer

xiangrikgui.exe

.exe 70.2MB
$PLUGINSDIR/System.dll

.dll 12KB
1.bin

2.6MB
dllloader_v2.dll

.dll 118KB
xiangrikui.exe

.exe 69.4MB
out.upx

.exe 97.0MB

xiangrikgui.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 0455ed6abd6758907267ba9e09155bc8b1f430e2b60a33c1e1aaebf92471a32e
MD5 84bca52e2c6897aa4127d72f5bd2f166
SHA1 0f5d3d903b31390dcb3785a6f8863f8876c41a8e
SHA512 bc951ce8f5eaf9c19c9e90cb9d9cb95dc42ca6eeefc7f77971b6083268c7755426971fd7e9b581e0d069403ce8863e1f4ba0aad86fc2c803a582c677834640e6
SSDEEP 1572864:1HgCUAre2t1jRX9Y1mLbqSaRqlIS8sEsGzP63tkwerpvIqaIbzDD:1HCAre2t1jRX9Y1EbqHquvsi68rpvIqp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dllloader_v2.dll

IMPHASH 91a55c2d2f924e5944a6dec40a86ef6e
SHA256 e44fbb09238220f72216405fe75ec049634ad6731575e9b464254433ab448ff2
MD5 0d10d1b0a57717aa48a1a261b90d1159
SHA1 cf6e096b90e5355222bb348e8087c5f3c1aa22ce
SHA512 c146dce4a2dc282bbac0d329f38381d6bd7b57a429f92f6ef59a25d86c24e79fbd5693675bfdda21c30a1f3eb70e41bcf292f1f3fcc27c1cfcf8982aee540e03
SSDEEP 1536:eGdL0UT0t7LKMzd1q3ae4qjj0oXSKn7SQg1gM3D1/LYgccosW5dd9dlgReNm:eGdLlkXqqto3XSc7PMJz1/sg9WNuReN
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

ReadFile GetModuleFileNameA VirtualFree GetCurrentProcess VirtualAlloc lstrlenA WaitForSingleObject GetModuleHandleExA CreateFileA LoadLibraryA CloseHandle GetProcAddress GetFileSize CreateFileW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind TerminateProcess ExitProcess GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx WriteConsoleW

xiangrikui.exe

SHA256 b1154374d1293b990af7d3ff3524d98522639e13e37a2d4f705b52695e51cf37
MD5 ec3da6610314644fa3a99a8cb86841e6
SHA1 c21ab13a0b8d0805d99276274971d028cbb8c709
SHA512 c3b20cc9a4e7baab88a2284b5aac008cd5bdb7d978251ce2d4bb66fd2125c9cce60e79ffc5d3f81749eca85fcb9edb8fe6d081c891aa60baec895940a42ff6df
SSDEEP 1572864:+39tEJ1PII152TxP1WOd1ud6M+H0vGvZwJUpPTKsn2c5k78rZ/+nu8imFWg2HQxT:o96J1AIr2t9dY6MH+q6Jms/rZWnuiFWy
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Digest

8a:6a:64:e7:cc:a8:f8:3e:56:c6:20:20:8f:cd:06:8b:85:8b:4a:a3:27:c0:50:73:bd:3d:1e:90:6e:c7:04:9d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91310110787862412B,CN=上海贝锐信息科技股份有限公司,O=上海贝锐信息科技股份有限公司,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 7, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

8b:0b:b4:af:5d:27:98:e5:ba:65:27:c9:e0:2f:f6:b9:2c:f4:8f:48

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jul 7, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

04:a5:a1:33:e7:fe:db:53:c8:f1:66:87:cf:bc:4e:db

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 4, 2023 - Apr 4, 2026

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

04:a5:a1:33:e7:fe:db:53:c8:f1:66:87:cf:bc:4e:db

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 4, 2023 - Apr 4, 2026

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

111522256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

generic

count=34, id=241, version=40116,

count=247, id=243, version=40116,

count=74, id=242, version=40116,

count=1, id=135, version=30729,

count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=17, id=199, version=41118,

count=33, id=259, version=24123,

count=3, id=261, version=23013,

count=1, id=259, version=23013,

count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=134, id=261, version=24123,

count=44, id=260, version=24123,

count=40, id=261, version=24245,

count=39, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=147, productName=Unmarked objects (old),

count=2, id=257, version=26213,

count=61, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1237, id=1, productName=Unmarked objects,

count=937, id=260, version=24245,

count=503, id=265, version=24215,

count=2189, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=299, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

out.upx

SHA256 8f77d3a6ea2a62153ad7dd3fa892f38c7e5f1fc16539c5fc283e25790f7f7c43
MD5 d5c3eb865ef3d7739e184b92792366e7
SHA1 47875d60ca574ef16fa118dd01e98cd3a729d788
SHA512 501b5ce23290c7bf242830ea6e796950c57fd2840cbb035c628eb900e857b16564515d4a257ba4d185a283cd581e7f9ef0f00c7158b72fb6e90a4d86748c3605
SSDEEP 1572864:1av5Cn3pMnsF9quYFk6mG37PMQKYofTt83jAU87KbEgDWu//J:gvm3OwzcJtDseE8Agx
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16198388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AG_FreeSurfaces AG_LoadGIF AG_LoadGIF_RW AG_isGIF IMG_Init IMG_Linked_Version IMG_Load IMG_LoadBMP_RW IMG_LoadCUR_RW IMG_LoadGIF_RW IMG_LoadICO_RW IMG_LoadJPG_RW IMG_LoadLBM_RW IMG_LoadPCX_RW IMG_LoadPNG_RW IMG_LoadPNM_RW IMG_LoadSVG_RW IMG_LoadTGA_RW IMG_LoadTIF_RW IMG_LoadTexture IMG_LoadTextureTyped_RW IMG_LoadTexture_RW IMG_LoadTyped_RW IMG_LoadXCF_RW IMG_LoadXPM_RW IMG_LoadXV_RW IMG_Load_RW IMG_Quit IMG_ReadXPMFromArray IMG_SaveJPG IMG_SaveJPG_RW IMG_SavePNG IMG_SavePNG_RW IMG_isBMP IMG_isCUR IMG_isGIF IMG_isICO IMG_isJPG IMG_isLBM IMG_isPCX IMG_isPNG IMG_isPNM IMG_isSVG IMG_isTIF IMG_isXCF IMG_isXPM IMG_isXV SDL_AddEventWatch SDL_AddHintCallback SDL_AddTimer SDL_AllocFormat SDL_AllocPalette SDL_AllocRW SDL_AtomicAdd SDL_AtomicCAS SDL_AtomicCASPtr SDL_AtomicGet SDL_AtomicGetPtr SDL_AtomicLock SDL_AtomicSet SDL_AtomicSetPtr SDL_AtomicTryLock SDL_AtomicUnlock SDL_AudioInit SDL_AudioQuit SDL_AudioStreamAvailable SDL_AudioStreamClear SDL_AudioStreamFlush SDL_AudioStreamGet SDL_AudioStreamPut SDL_BuildAudioCVT SDL_CalculateGammaRamp SDL_CaptureMouse SDL_ClearError SDL_ClearHints SDL_ClearQueuedAudio SDL_CloseAudio SDL_CloseAudioDevice SDL_ComposeCustomBlendMode SDL_CondBroadcast SDL_CondSignal SDL_CondWait SDL_CondWaitTimeout SDL_ConvertAudio SDL_ConvertPixels SDL_ConvertSurface SDL_ConvertSurfaceFormat SDL_CreateColorCursor SDL_CreateCond SDL_CreateCursor SDL_CreateMutex SDL_CreateRGBSurface SDL_CreateRGBSurfaceFrom SDL_CreateRGBSurfaceWithFormat SDL_CreateRGBSurfaceWithFormatFrom SDL_CreateRenderer SDL_CreateSemaphore SDL_CreateShapedWindow SDL_CreateSoftwareRenderer SDL_CreateSystemCursor SDL_CreateTexture SDL_CreateTextureFromSurface SDL_CreateThread SDL_CreateWindow SDL_CreateWindowAndRenderer SDL_CreateWindowFrom SDL_DXGIGetOutputInfo SDL_DYNAPI_entry SDL_DelEventWatch SDL_DelHintCallback SDL_Delay SDL_DequeueAudio SDL_DestroyCond SDL_DestroyMutex SDL_DestroyRenderer SDL_DestroySemaphore SDL_DestroyTexture SDL_DestroyWindow SDL_DetachThread SDL_Direct3D9GetAdapterIndex SDL_DisableScreenSaver SDL_DuplicateSurface SDL_EnableScreenSaver SDL_EnclosePoints SDL_Error SDL_EventState SDL_FillRect SDL_FillRects SDL_FilterEvents SDL_FlushEvent SDL_FlushEvents SDL_FreeAudioStream SDL_FreeCursor SDL_FreeFormat SDL_FreePalette SDL_FreeRW SDL_FreeSurface SDL_FreeWAV SDL_GL_BindTexture SDL_GL_CreateContext SDL_GL_DeleteContext SDL_GL_ExtensionSupported SDL_GL_GetAttribute SDL_GL_GetCurrentContext SDL_GL_GetCurrentWindow SDL_GL_GetDrawableSize SDL_GL_GetProcAddress SDL_GL_GetSwapInterval SDL_GL_LoadLibrary SDL_GL_MakeCurrent SDL_GL_ResetAttributes SDL_GL_SetAttribute SDL_GL_SetSwapInterval SDL_GL_SwapWindow SDL_GL_UnbindTexture SDL_GL_UnloadLibrary SDL_GameControllerAddMapping SDL_GameControllerAddMappingsFromRW SDL_GameControllerClose SDL_GameControllerEventState SDL_GameControllerFromInstanceID SDL_GameControllerGetAttached SDL_GameControllerGetAxis SDL_GameControllerGetAxisFromString SDL_GameControllerGetBindForAxis SDL_GameControllerGetBindForButton SDL_GameControllerGetButton SDL_GameControllerGetButtonFromString SDL_GameControllerGetJoystick SDL_GameControllerGetProduct SDL_GameControllerGetProductVersion SDL_GameControllerGetStringForAxis SDL_GameControllerGetStringForButton SDL_GameControllerGetVendor SDL_GameControllerMapping SDL_GameControllerMappingForGUID SDL_GameControllerMappingForIndex SDL_GameControllerName SDL_GameControllerNameForIndex SDL_GameControllerNumMappings SDL_GameControllerOpen SDL_GameControllerUpdate SDL_GetAssertionHandler SDL_GetAssertionReport SDL_GetAudioDeviceName SDL_GetAudioDeviceStatus SDL_GetAudioDriver SDL_GetAudioStatus SDL_GetBasePath SDL_GetCPUCacheLineSize SDL_GetCPUCount SDL_GetClipRect SDL_GetClipboardText SDL_GetClosestDisplayMode SDL_GetColorKey SDL_GetCurrentAudioDriver SDL_GetCurrentDisplayMode SDL_GetCurrentVideoDriver SDL_GetCursor SDL_GetDefaultAssertionHandler SDL_GetDefaultCursor SDL_GetDesktopDisplayMode SDL_GetDisplayBounds SDL_GetDisplayDPI SDL_GetDisplayMode SDL_GetDisplayName SDL_GetDisplayUsableBounds SDL_GetError SDL_GetEventFilter SDL_GetGlobalMouseState SDL_GetGrabbedWindow SDL_GetHint SDL_GetHintBoolean SDL_GetKeyFromName SDL_GetKeyFromScancode SDL_GetKeyName SDL_GetKeyboardFocus SDL_GetKeyboardState SDL_GetMemoryFunctions SDL_GetModState SDL_GetMouseFocus SDL_GetMouseState SDL_GetNumAllocations SDL_GetNumAudioDevices SDL_GetNumAudioDrivers SDL_GetNumDisplayModes SDL_GetNumRenderDrivers SDL_GetNumTouchDevices SDL_GetNumTouchFingers SDL_GetNumVideoDisplays SDL_GetNumVideoDrivers SDL_GetPerformanceCounter SDL_GetPerformanceFrequency SDL_GetPixelFormatName SDL_GetPlatform SDL_GetPowerInfo SDL_GetPrefPath SDL_GetQueuedAudioSize SDL_GetRGB SDL_GetRGBA SDL_GetRelativeMouseMode SDL_GetRelativeMouseState SDL_GetRenderDrawBlendMode SDL_GetRenderDrawColor SDL_GetRenderDriverInfo SDL_GetRenderTarget SDL_GetRenderer SDL_GetRendererInfo SDL_GetRendererOutputSize SDL_GetRevision SDL_GetRevisionNumber SDL_GetScancodeFromKey SDL_GetScancodeFromName SDL_GetScancodeName SDL_GetShapedWindowMode SDL_GetSurfaceAlphaMod SDL_GetSurfaceBlendMode SDL_GetSurfaceColorMod SDL_GetSystemRAM SDL_GetTextureAlphaMod SDL_GetTextureBlendMode SDL_GetTextureColorMod SDL_GetThreadID SDL_GetThreadName SDL_GetTicks SDL_GetTouchDevice SDL_GetTouchFinger SDL_GetVersion SDL_GetVideoDriver SDL_GetWindowBordersSize SDL_GetWindowBrightness SDL_GetWindowData SDL_GetWindowDisplayIndex SDL_GetWindowDisplayMode SDL_GetWindowFlags SDL_GetWindowFromID SDL_GetWindowGammaRamp SDL_GetWindowGrab SDL_GetWindowID SDL_GetWindowMaximumSize SDL_GetWindowMinimumSize SDL_GetWindowOpacity SDL_GetWindowPixelFormat SDL_GetWindowPosition SDL_GetWindowSize SDL_GetWindowSurface SDL_GetWindowTitle SDL_GetWindowVisible SDL_GetWindowWMInfo SDL_GetYUVConversionMode SDL_GetYUVConversionModeForResolution SDL_HapticClose SDL_HapticDestroyEffect SDL_HapticEffectSupported SDL_HapticGetEffectStatus SDL_HapticIndex SDL_HapticName SDL_HapticNewEffect SDL_HapticNumAxes SDL_HapticNumEffects SDL_HapticNumEffectsPlaying SDL_HapticOpen SDL_HapticOpenFromJoystick SDL_HapticOpenFromMouse SDL_HapticOpened SDL_HapticPause SDL_HapticQuery SDL_HapticRumbleInit SDL_HapticRumblePlay SDL_HapticRumbleStop SDL_HapticRumbleSupported SDL_HapticRunEffect SDL_HapticSetAutocenter SDL_HapticSetGain SDL_HapticStopAll SDL_HapticStopEffect SDL_HapticUnpause SDL_HapticUpdateEffect SDL_Has3DNow SDL_HasAVX SDL_HasAVX2 SDL_HasAltiVec SDL_HasClipboardText SDL_HasEvent SDL_HasEvents SDL_HasIntersection SDL_HasMMX SDL_HasNEON SDL_HasRDTSC SDL_HasSSE SDL_HasSSE2 SDL_HasSSE3 SDL_HasSSE41 SDL_HasSSE42 SDL_HasScreenKeyboardSupport SDL_HideWindow SDL_Init SDL_InitSubSystem SDL_IntersectRect SDL_IntersectRectAndLine SDL_IsGameController SDL_IsScreenKeyboardShown SDL_IsScreenSaverEnabled SDL_IsShapedWindow SDL_IsTextInputActive SDL_IsUserKeyboardAccess SDL_JoystickClose SDL_JoystickCurrentPowerLevel SDL_JoystickEventState SDL_JoystickFromInstanceID SDL_JoystickGetAttached SDL_JoystickGetAxis SDL_JoystickGetAxisInitialState SDL_JoystickGetBall SDL_JoystickGetButton SDL_JoystickGetDeviceGUID SDL_JoystickGetDeviceInstanceID SDL_JoystickGetDeviceProduct SDL_JoystickGetDeviceProductVersion SDL_JoystickGetDeviceType SDL_JoystickGetDeviceVendor SDL_JoystickGetGUID SDL_JoystickGetGUIDFromString SDL_JoystickGetGUIDString SDL_JoystickGetHat SDL_JoystickGetProduct SDL_JoystickGetProductVersion SDL_JoystickGetType SDL_JoystickGetVendor SDL_JoystickInstanceID SDL_JoystickIsHaptic SDL_JoystickName SDL_JoystickNameForIndex SDL_JoystickNumAxes SDL_JoystickNumBalls SDL_JoystickNumButtons SDL_JoystickNumHats SDL_JoystickOpen SDL_JoystickUpdate SDL_LoadBMP_RW SDL_LoadDollarTemplates SDL_LoadFile_RW SDL_LoadFunction SDL_LoadObject SDL_LoadWAV_RW SDL_LockAudio SDL_LockAudioDevice SDL_LockJoysticks SDL_LockMutex SDL_LockSurface SDL_LockTexture SDL_Log SDL_LogCritical SDL_LogDebug SDL_LogError SDL_LogGetOutputFunction SDL_LogGetPriority SDL_LogInfo SDL_LogMessage SDL_LogMessageV SDL_LogResetPriorities SDL_LogSetAllPriority SDL_LogSetOutputFunction SDL_LogSetPriority SDL_LogVerbose SDL_LogWarn SDL_LowerBlit SDL_LowerBlitScaled SDL_MapRGB SDL_MapRGBA SDL_MasksToPixelFormatEnum SDL_MaximizeWindow SDL_MemoryBarrierAcquireFunction SDL_MemoryBarrierReleaseFunction SDL_MinimizeWindow SDL_MixAudio SDL_MixAudioFormat SDL_MouseIsHaptic SDL_NewAudioStream SDL_NumHaptics SDL_NumJoysticks SDL_OpenAudio SDL_OpenAudioDevice SDL_PauseAudio SDL_PauseAudioDevice SDL_PeepEvents SDL_PixelFormatEnumToMasks SDL_PollEvent SDL_PumpEvents SDL_PushEvent SDL_QueryTexture SDL_QueueAudio SDL_Quit SDL_QuitSubSystem SDL_RWFromConstMem SDL_RWFromFP SDL_RWFromFile SDL_RWFromMem SDL_RaiseWindow SDL_ReadBE16 SDL_ReadBE32 SDL_ReadBE64 SDL_ReadLE16 SDL_ReadLE32 SDL_ReadLE64 SDL_ReadU8 SDL_RecordGesture SDL_RegisterApp SDL_RegisterEvents SDL_RemoveTimer SDL_RenderClear SDL_RenderCopy SDL_RenderCopyEx SDL_RenderDrawLine SDL_RenderDrawLines SDL_RenderDrawPoint SDL_RenderDrawPoints SDL_RenderDrawRect SDL_RenderDrawRects SDL_RenderFillRect SDL_RenderFillRects SDL_RenderGetClipRect SDL_RenderGetD3D9Device SDL_RenderGetIntegerScale SDL_RenderGetLogicalSize SDL_RenderGetMetalCommandEncoder SDL_RenderGetMetalLayer SDL_RenderGetScale SDL_RenderGetViewport SDL_RenderIsClipEnabled SDL_RenderPresent SDL_RenderReadPixels SDL_RenderSetClipRect SDL_RenderSetIntegerScale SDL_RenderSetLogicalSize SDL_RenderSetScale SDL_RenderSetViewport SDL_RenderTargetSupported SDL_ReportAssertion SDL_ResetAssertionReport SDL_RestoreWindow SDL_SaveAllDollarTemplates SDL_SaveBMP_RW SDL_SaveDollarTemplate SDL_SemPost SDL_SemTryWait SDL_SemValue SDL_SemWait SDL_SemWaitTimeout SDL_SetAssertionHandler SDL_SetClipRect SDL_SetClipboardText SDL_SetColorKey SDL_SetCursor SDL_SetError SDL_SetEventFilter SDL_SetHint SDL_SetHintWithPriority SDL_SetKeyBoardFocus SDL_SetMainReady SDL_SetMemoryFunctions SDL_SetModState SDL_SetPaletteColors SDL_SetPixelFormatPalette SDL_SetRelativeMouseMode SDL_SetRenderDrawBlendMode SDL_SetRenderDrawColor SDL_SetRenderTarget SDL_SetSurfaceAlphaMod SDL_SetSurfaceBlendMode SDL_SetSurfaceColorMod SDL_SetSurfacePalette SDL_SetSurfaceRLE SDL_SetTextInputRect SDL_SetTextureAlphaMod SDL_SetTextureBlendMode SDL_SetTextureColorMod SDL_SetThreadPriority SDL_SetWindowBordered SDL_SetWindowBrightness SDL_SetWindowData SDL_SetWindowDisplayMode SDL_SetWindowFullscreen SDL_SetWindowGammaRamp SDL_SetWindowGrab SDL_SetWindowHitTest SDL_SetWindowIcon SDL_SetWindowInputFocus SDL_SetWindowMaximumSize SDL_SetWindowMinimumSize SDL_SetWindowModalFor SDL_SetWindowOpacity SDL_SetWindowPosition SDL_SetWindowResizable SDL_SetWindowShape SDL_SetWindowSize SDL_SetWindowTitle SDL_SetWindowsMessageHook SDL_SetYUVConversionMode SDL_ShowCursor SDL_ShowMessageBox SDL_ShowSimpleMessageBox SDL_ShowWindow SDL_SoftStretch SDL_StartIme SDL_StartTextInput SDL_StopIme SDL_StopTextInput SDL_TLSCreate SDL_TLSGet SDL_TLSSet SDL_ThreadID SDL_TryLockMutex SDL_UnionRect SDL_UnloadObject SDL_UnlockAudio SDL_UnlockAudioDevice SDL_UnlockJoysticks SDL_UnlockMutex SDL_UnlockSurface SDL_UnlockTexture SDL_UnregisterApp SDL_UpdateTexture SDL_UpdateWindowSurface SDL_UpdateWindowSurfaceRects SDL_UpdateYUVTexture SDL_UpperBlit SDL_UpperBlitScaled SDL_VideoInit SDL_VideoQuit SDL_Vulkan_CreateSurface SDL_Vulkan_GetDrawableSize SDL_Vulkan_GetInstanceExtensions SDL_Vulkan_GetVkGetInstanceProcAddr SDL_Vulkan_LoadLibrary SDL_Vulkan_UnloadLibrary SDL_WaitEvent SDL_WaitEventTimeout SDL_WaitThread SDL_WarpMouseGlobal SDL_WarpMouseInWindow SDL_WasInit SDL_WriteBE16 SDL_WriteBE32 SDL_WriteBE64 SDL_WriteLE16 SDL_WriteLE32 SDL_WriteLE64 SDL_WriteU8 SDL_abs SDL_acos SDL_acosf SDL_asin SDL_asinf SDL_atan SDL_atan2 SDL_atan2f SDL_atanf SDL_atof SDL_atoi SDL_calloc SDL_ceil SDL_ceilf SDL_copysign SDL_copysignf SDL_cos SDL_cosf SDL_fabs SDL_fabsf SDL_floor SDL_floorf SDL_fmod SDL_fmodf SDL_free SDL_getenv SDL_iconv SDL_iconv_close SDL_iconv_open SDL_iconv_string SDL_isdigit SDL_isspace SDL_itoa SDL_lltoa SDL_log SDL_log10 SDL_log10f SDL_logf SDL_ltoa SDL_malloc SDL_memcmp SDL_memcpy SDL_memmove SDL_memset SDL_pow SDL_powf SDL_qsort SDL_realloc SDL_scalbn SDL_scalbnf SDL_setenv SDL_sin SDL_sinf SDL_snprintf SDL_sqrt SDL_sqrtf SDL_sscanf SDL_strcasecmp SDL_strchr SDL_strcmp SDL_strdup SDL_strlcat SDL_strlcpy SDL_strlen SDL_strlwr SDL_strncasecmp SDL_strncmp SDL_strrchr SDL_strrev SDL_strstr SDL_strtod SDL_strtol SDL_strtoll SDL_strtoul SDL_strtoull SDL_strupr SDL_tan SDL_tanf SDL_tolower SDL_toupper SDL_uitoa SDL_ulltoa SDL_ultoa SDL_utf8strlcpy SDL_utf8strlen SDL_vsnprintf SDL_vsscanf SDL_wcscmp SDL_wcslcat SDL_wcslcpy SDL_wcslen TTF_ByteSwappedUNICODE TTF_CloseFont TTF_FontAscent TTF_FontDescent TTF_FontFaceFamilyName TTF_FontFaceIsFixedWidth TTF_FontFaceStyleName TTF_FontFaces TTF_FontHeight TTF_FontLineSkip TTF_GetFontHinting TTF_GetFontKerning TTF_GetFontKerningSize TTF_GetFontKerningSizeGlyphs TTF_GetFontOutline TTF_GetFontStyle TTF_GlyphIsProvided TTF_GlyphMetrics TTF_Init TTF_Linked_Version TTF_OpenFont TTF_OpenFontIndex TTF_OpenFontIndexRW TTF_OpenFontRW TTF_Quit TTF_RenderGlyph_Blended TTF_RenderGlyph_Shaded TTF_RenderGlyph_Solid TTF_RenderText_Blended TTF_RenderText_Blended_Wrapped TTF_RenderText_Shaded TTF_RenderText_Solid TTF_RenderUNICODE_Blended TTF_RenderUNICODE_Blended_Wrapped TTF_RenderUNICODE_Shaded TTF_RenderUNICODE_Solid TTF_RenderUTF8_Blended TTF_RenderUTF8_Blended_Wrapped TTF_RenderUTF8_Shaded TTF_RenderUTF8_Solid TTF_SetFontHinting TTF_SetFontKerning TTF_SetFontOutline TTF_SetFontStyle TTF_SizeText TTF_SizeUNICODE TTF_SizeUTF8 TTF_WasInit

Name

.text

Size

27.7MB

Virtual Size

27.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

614KB

Virtual Size

8.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1003KB

Virtual Size

1003KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.sunlogi

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.custom

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

345B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

58.1MB

Virtual Size

58.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

232KB

Virtual Size

231KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=34, id=241, version=40116,

count=247, id=243, version=40116,

count=74, id=242, version=40116,

count=1, id=135, version=30729,

count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=17, id=199, version=41118,

count=33, id=259, version=24123,

count=3, id=261, version=23013,

count=1, id=259, version=23013,

count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=134, id=261, version=24123,

count=44, id=260, version=24123,

count=40, id=261, version=24245,

count=39, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=147, productName=Unmarked objects (old),

count=2, id=257, version=26213,

count=61, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1237, id=1, productName=Unmarked objects,

count=937, id=260, version=24245,

count=503, id=265, version=24215,

count=2189, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=299, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Sharing

General

Malware Config

Signatures

File Explorer

xiangrikgui.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

1.bin

dllloader_v2.dll

kernel32

generic

xiangrikui.exe

generic

out.upx

generic