mrblack | CBC15BACE96277A9115EE0C21B19C14B180B3BC947185C73201487CE7CCED200[.]7z

resource	yara_rule
static1/unpack002/DDos	family_mrblack

resource	yara_rule
static1/unpack002/Sesrver.exe	family_gh0strat

resource
unpack002/cafe.exe

resource	yara_rule
static1/unpack002/bm.exe	upx
static1/unpack002/muzzo.exe	upx
static1/unpack002/nc.exe	upx

resource
unpack002/107fjr24.exe
unpack002/109fjr24.exe
unpack002/121fjr24.exe
unpack002/127fjr24.exe
unpack002/85fjr24.exe
unpack002/Rat.exe
unpack002/SB360.exe
unpack002/Server.exe
unpack002/Servor.exe
unpack002/Sesrver.exe
unpack002/assvkl.exe
unpack002/bm.exe
unpack002/dqfjr24.exe
unpack002/knmbr.exe
unpack002/muzzo.exe
unpack002/nc.exe
unpack002/nc111.exe
unpack002/ng40a327.exe
unpack002/searver.exe
unpack002/solo.exe
unpack002/ttt.exe
unpack002/www.exe
unpack002/xiaoyao.exe
unpack002/zfbsvchost.exe

CBC15BACE96277A9115EE0C21B19C14B180B3BC947185C73201487CE7CCED200.7z

SHA256 62e3c3282c02acb07ef7a93c33ef0adc02731897a603c029ad7d727d821d09ee
MD5 af8d0ba961dac2f9f1418490f544dbef
SHA1 00ed65fa9a3e815273f5bc002c41f8db90cbd0a3
SHA512 bc9a695036b9569c6ab3d5a76fd5ce1aa3100fc1bdb9cba316cadd96f1e4491f12cd53d7a62120ea2f39f7f2a4d2eb6dd6cb0a93448fabc8b06e69aab4cf5455
SSDEEP 196608:o2JStUPIVEqZSniiVhX6hAAg9SuxMwb2/91ZEoJ01i+vJF:ozcrhii76hAAMM3l1pWl
TLSH
T16086330E8230DD7D1E9D9B7EA49F765E83337F32A36F5B57644980D572403232A8AB42
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

CBC15BACE96277A9115EE0C21B19C14B180B3BC947185C73201487CE7CCED200

SHA256 cbc15bace96277a9115ee0c21b19c14b180b3bc947185c73201487ce7cced200
MD5 6552314fdf9aa5b941a11bc0c8c2871f
SHA1 4a2ec182e522207ee3106facda220669713ec8e9
SHA512 dacd45a29fae72875b70cc3db38fe402c7365c0c4ff9e0cf3521b62c4f6d163b46a876b0cb004a4f1b2ad75a21f8ea63420d33e1dbe3570e12c6f9e4dc31ec64
SSDEEP 196608:W7WLYcOY24wCnc/TpCXw5OA2cn2NAYrSgveQhAH:W7WLYcO/LgcYXiz2NEnQq
TLSH
T182963332947726B3B38B9832EE837D296B6A5B1C009454FADCF5DB04D8D6F3870645A3
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

107fjr24.exe

IMPHASH 5c42b83be522e0c2b0b7638b2c287913
SHA256 d52054e01b1fe26ec947917ad40ad763203750b5bb83018eddf41cc1bb505704
MD5 ab6db3d9ebb1560c9081c9f7b2f0fa27
SHA1 c2327018bba4cec35be4aad1a16b98b369939808
SHA512 cc3190da2ecc61afbe9c871e3039a4e9f7c87c5531c0e778b4c4ae3339cbe44f8d367e10df302b224b69778bff90a3a387994eab44ef78311cd1171dcaab2c56
SSDEEP 3072:5zbfRvugRd+a17PqN5TfD7js5XMktHI+PO0Exn4B:hVugu0PqNVD7jsd39ExnC
TLSH
T168E3AE22B6D2C4B2C156007049A5DF715A7BAD3017B089977BF51F3E5F60BE096333AA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

11634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

TrackPopupMenuEx LoadCursorA IsMenu DeferWindowPos CloseClipboard DrawAnimatedRects ShowWindow EndPaint DrawTextA SetWindowRgn CharNextA SetCaretBlinkTime MapVirtualKeyExA DdePostAdvise ChildWindowFromPointEx SystemParametersInfoA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA EqualRect CreateWindowExA GetClassInfoA DialogBoxParamA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect

shell32

SHGetSpecialFolderLocation ShellExecuteA SHGetFileInfoA SHBrowseForFolderA SHGetPathFromIDListA SHFileOperationA

ole32

OleFlushClipboard CoInitialize CoBuildVersion CoCreateGuid OleUninitialize OleInitialize CoTaskMemFree MkParseDisplayName OleGetIconOfFile CoCreateInstance OleRegGetMiscStatus

advapi32

RegEnumKeyA RegCloseKey RegDeleteValueA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegEnumValueA RegOpenKeyExA RegDeleteKeyA

comctl32

ImageList_Destroy ImageList_Create ImageList_AddMasked

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

kernel32

GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc HeapAlloc InitializeCriticalSectionAndSpinCount LoadLibraryA RtlUnwind IsValidCodePage GetOEMCP GetACP GetCPInfo RaiseException GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter HeapFree VirtualFree HeapCreate InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue DeleteCriticalSection GetFileType SetHandleCount GetEnvironmentStringsW GetLastError WideCharToMultiByte FreeEnvironmentStringsW SetFilePointer WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA FileTimeToDosDateTime GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStdHandle VirtualAlloc CloseHandle CreateThread GetVolumePathNameW TerminateJobObject HeapSize FindAtomW SetConsoleActiveScreenBuffer FileTimeToSystemTime GetLocalTime GetCommandLineA GetStartupInfoA EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA GetModuleHandleW Sleep ExitProcess WriteFile

109fjr24.exe

IMPHASH f9edfc188aaaedd8c73043cd77708f51
SHA256 42642db8fb7d975839368992ee229b6a76fad98840122e8bd12c1d517014708f
MD5 e1245adae6e6bd15e954aefbc2e37547
SHA1 691ab418cfaf9174c04862074b720071a23e4894
SHA512 a8f8d958aef81c87c4bc854d9ab4afdcb4cf4444db0f9aa6d77449946b4e98e7d336cb4011e17293d02c21c86c859ad0916e232f5c0c055827e7791d61ed6488
SSDEEP 3072:2u0NP0w63zhJuPf5TfChs5XMAtHv+mcSw:y0x0PfVwsdvs1
TLSH
T11DE3AD21B6D2C5B2C466007009A5DFB25B3AAE31177188577BF91F3E4F60BE09A37396
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

11650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

SetActiveWindow IsCharUpperW DispatchMessageA InflateRect InsertMenuItemA IsWindowUnicode GetClassLongW DdePostAdvise DdeUnaccessData SetUserObjectInformationA EnumPropsExW DdeGetData GetClassInfoA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA DdeReconnect DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

shell32

SHGetSpecialFolderLocation ShellExecuteA SHGetFileInfoA SHBrowseForFolderA SHGetPathFromIDListA SHFileOperationA

ole32

OleUninitialize OleSetClipboard CoTaskMemFree OleSetMenuDescriptor OleRegEnumFormatEtc OleInitialize CoCreateInstance CoReleaseMarshalData

advapi32

RegEnumKeyA RegCloseKey RegDeleteValueA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegEnumValueA RegOpenKeyExA RegDeleteKeyA

comctl32

ImageList_Destroy ImageList_Create ImageList_AddMasked

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

kernel32

GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc HeapAlloc InitializeCriticalSectionAndSpinCount LoadLibraryA RtlUnwind IsValidCodePage GetOEMCP GetCPInfo RaiseException GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter HeapFree VirtualFree HeapCreate InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue DeleteCriticalSection GetFileType SetHandleCount GetEnvironmentStringsW SetFilePointer HeapSize WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA GetACP SetProcessAffinityMask GetLastError WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings VirtualAlloc CloseHandle CreateThread SetLocalTime HeapValidate CreateJobObjectA ReadConsoleInputA FindFirstChangeNotificationW GetCommandLineA GetStartupInfoA EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA

121fjr24.exe

IMPHASH 69e8d1285d93a2db865e11b0fbffb7a3
SHA256 04774a86cde968bcde830d2871d41341129a696f67a3bc99395cf08b29bb6cca
MD5 96ef5bf4508b298d0c3be338e6578482
SHA1 6c69382beb07e2a55a71e2ae8960e1e0839cad8f
SHA512 c4a7e948a35a4ca7df81784aa090c140f287c837e897c94f8b6f8946ba7c4a04f8917de1249070cb207dad07b3fe9a821231bbf05feb6c222c5a0c2dea00e404
SSDEEP 3072:EIlpOC4dNvGLUu305Tf/aBOcis5XMhtHE+tBnpOLhn:H+C4DukVSBOcisdepI
TLSH
T13FE3AE21B6D2C5B2C01A003009A4DFB19A7FAD31267589577BF51F3E4F60BE096373A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

11634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

SetClassWord CallMsgFilterA GetPriorityClipboardFormat ShowWindow EndPaint DrawTextA SetCaretPos SetMessageExtraInfo CreateAcceleratorTableW CloseDesktop LoadAcceleratorsW GetSystemMetrics SystemParametersInfoA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SetScrollPos CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect

shell32

SHGetSpecialFolderLocation ShellExecuteA SHGetFileInfoA SHBrowseForFolderA SHGetPathFromIDListA SHFileOperationA

ole32

OleUninitialize OleSetMenuDescriptor CoTaskMemFree CoRevokeClassObject OleIsCurrentClipboard OleInitialize CoCreateInstance CreateItemMoniker

advapi32

RegEnumKeyA RegCloseKey RegDeleteValueA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegEnumValueA RegOpenKeyExA RegDeleteKeyA

comctl32

ImageList_Destroy ImageList_Create ImageList_AddMasked

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

kernel32

GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc HeapAlloc InitializeCriticalSectionAndSpinCount LoadLibraryA RtlUnwind IsValidCodePage GetACP GetCPInfo RaiseException GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualFree HeapCreate InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue DeleteCriticalSection GetFileType SetFilePointer HeapSize WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA GetOEMCP HeapFree SetHandleCount GetEnvironmentStringsW GetLastError WideCharToMultiByte VirtualAlloc CloseHandle CreateThread GetCurrencyFormatW RegisterWaitForSingleObject FileTimeToSystemTime lstrcatW GetProfileSectionW GlobalGetAtomNameW FindNextVolumeMountPointW GetCommandLineA GetStartupInfoA EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW

127fjr24.exe

IMPHASH 286df28395e487b581593e4bc3404e34
SHA256 038419e02a6147a3c698ddec8d69d1a88f518a79ab16917e82955245fbd1af9b
MD5 d1f772c90546cc3c8e47c1a74764051a
SHA1 1e6a2666cdd92ec8a1e8b783f2984123f6a848dc
SHA512 167c0f8b29b622eefa4ec038fb988b460a8b811f48767e303b27f40bd8010cc6d4623e32a5a2f60990ce3d30c1fb88abc2ccac8397de009cf6d098616d5a4f2e
SSDEEP 3072:ctX/+Q9tQlvnUG0MM35TfTJs5XMFYtHl+BrogONt:fQwUDMM3VTJsdIY+ogw
TLSH
T1B9E3AD21B2C2D5B2C566007009A5DF719B7AAD30177488A73BF91F3E5F60BE0A637396
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

11634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

FillRect GetKeyNameTextA GetUserObjectInformationW InflateRect IsWindowUnicode SetWindowsHookExW CharLowerW GetProcessWindowStation CopyImage DdeClientTransaction CreateCaret GetClassLongW CreateWindowExA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA DdeInitializeW GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect DrawTextA EndPaint ShowWindow

shell32

SHGetSpecialFolderLocation ShellExecuteA SHGetFileInfoA SHBrowseForFolderA SHGetPathFromIDListA SHFileOperationA

ole32

OleUninitialize SetConvertStg CoTaskMemFree StringFromIID CoSetProxyBlanket OleInitialize CoCreateInstance CoResumeClassObjects

advapi32

RegEnumKeyA RegCloseKey RegDeleteValueA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegEnumValueA RegOpenKeyExA RegDeleteKeyA

comctl32

ImageList_Destroy ImageList_Create ImageList_AddMasked

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

kernel32

GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc InitializeCriticalSectionAndSpinCount LoadLibraryA RtlUnwind IsValidCodePage GetOEMCP GetACP RaiseException GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter HeapFree VirtualFree HeapCreate InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue DeleteCriticalSection GetFileType SetHandleCount GetEnvironmentStringsW SetFilePointer HeapSize WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA GetCPInfo HeapAlloc GetLastError WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings VirtualAlloc CloseHandle CreateThread FindFirstFileA IsDBCSLeadByte SystemTimeToFileTime ClearCommBreak SleepEx GetPrivateProfileSectionA GetCommandLineA GetStartupInfoA EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA

85fjr24.exe

IMPHASH 3a8c00303536127a452a68f30bc26eec
SHA256 34e2f9b95470a8225a9466affd102de9347416fc405c721e5715c12cb47c8d1d
MD5 cc4cd5cb397650e5c5c940c048934dc8
SHA1 8cad5d0aa2211199eedb325232c360cf35580cca
SHA512 31c28a6064489288f22393826cf09bb99720440104c02604bc79457ff422b726b52b0f2fcdc893e5e5304cde1ceeac17306fa9be45297d58c131fede90021770
SSDEEP 3072:fbBfpROI1d/dLHc5TfXms5XMRwtHa+P2oG9hyW:jROIFHcVXmsdB52jz
TLSH
T1B1E39D21B6D2C1F2C459107049A1DFB15A7EAE3017B089977BE91F3D4F60BE096373AA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

11634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetWindowLongA MessageBoxIndirectA MenuItemFromPoint ShowWindow DlgDirListComboBoxW DrawTextA FillRect GetClientRect BeginPaint wsprintfW ShowScrollBar CreateIconIndirect GetClassNameA GetClassInfoExA EndPaint FindWindowExA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA EnumDesktopsA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA

shell32

SHGetSpecialFolderLocation ShellExecuteA SHGetFileInfoA SHBrowseForFolderA SHGetPathFromIDListA SHFileOperationA

ole32

OleGetAutoConvert CoLockObjectExternal CoQueryProxyBlanket OleCreate OleUninitialize OleInitialize CoTaskMemFree CoTaskMemAlloc OleRegEnumFormatEtc CoCreateInstance OleSetClipboard

advapi32

RegEnumKeyA RegCloseKey RegDeleteValueA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegEnumValueA RegOpenKeyExA RegDeleteKeyA

comctl32

ImageList_Destroy ImageList_Create ImageList_AddMasked

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

kernel32

GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc HeapAlloc InitializeCriticalSectionAndSpinCount LoadLibraryA RtlUnwind IsValidCodePage GetOEMCP GetCPInfo RaiseException GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter HeapFree VirtualFree HeapCreate InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue DeleteCriticalSection GetFileType SetHandleCount GetEnvironmentStringsW SetFilePointer HeapSize WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA GetACP FindResourceW GetLastError WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings VirtualAlloc CloseHandle CreateThread GetCurrentDirectoryA EscapeCommFunction IsValidLanguageGroup GetProfileStringW GetVolumeNameForVolumeMountPointA SetThreadContext SetConsoleActiveScreenBuffer GetCommandLineA GetStartupInfoA EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA

DDos

SHA256 3fc2a0bee426bc54e4f3261331ec9ea9a3b5c1ad27094734bc828211f9fdf293
MD5 faa401dd97651b9b6dde523d2efa212e
SHA1 629c216585567eaf856e6cc0402a975330ebe345
SHA512 ab48201e65c45cd77e3460f52af5bbbf0467826dde1039fc6b910db136726c4c47eb311e4b2ac03de348ced8d6c0691d27bcc485399ca7e63851a11a5211687e
SSDEEP 6144:UTOzkT3puxmMmp9HovF3VBkFuPIMM2IutuXie+w7EQEtXqdTqBYWXChQyurnbOqi:2jHovzRu1ddTqDnUsIdk0KE43dcTDVPN
TLSH
T1FAF40C1A7B22DF7DF36983314BF38B20975536921BA0D585E2BCD6085E2035E192FFA4
MD5 SHA1 SHA512 SSDEEP TLSH

linux mipsbe

Detects MrBlack payload

Rat.exe

IMPHASH afa58d2685020f26c9455af485fec8c3
SHA256 3245305f1e0c6a580cfcc5e613fbe9731045b53152c093ed579b4f0336f37b6b
MD5 334449566ae89a91a04910a55ce78331
SHA1 4e3a77b0145eccdfceaf5a425c5b75acf8a8093d
SHA512 f3ba014520903b315f73ee95912b8f286a502a20968f99efb6c80df1523ddd236acc1317797f62956085e777c789d6bdcf2d4d248bffea4b7053a7eea282ce21
SSDEEP 3072:Yvi5TvI1yQqwDhjtMyAhyHAX8ajqI+3zM/e6wrVdP4en/MgAdRNSKvy6Se9dM//:Mi5UdqwDhfAhyHtEqd0cVRn0gAxdM//
TLSH
T1D814AEA9F8046CD2E40182B490F56F6DD9E9BC67987031C97F58BC4A1EB3EC45C7226B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

106496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject ExitProcess GetLastError CreateMutexA GetModuleFileNameA RtlUnwind GetModuleHandleA GetStartupInfoA GetCommandLineA GetVersion TerminateProcess GetCurrentProcess UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType CloseHandle HeapDestroy HeapCreate VirtualFree WriteFile SetFilePointer VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP SetStdHandle MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW FlushFileBuffers ExitThread OutputDebugStringA GetTickCount CreateThread Sleep LoadLibraryA GetProcAddress CreateProcessA FreeLibrary GetSystemDefaultUILanguage lstrcpyA GetVersionExA GetSystemInfo lstrlenA lstrcatA HeapAlloc GetEnvironmentVariableA HeapFree GetSystemDirectoryA

user32

GetDesktopWindow wsprintfA

advapi32

RegSetValueExA RegDeleteKeyA RegDeleteValueA RegQueryValueExA RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegCloseKey RegCreateKeyExA

shell32

ShellExecuteA

ws2_32

shutdown recv __WSAFDIsSet sendto send WSAStartup htons socket connect closesocket setsockopt WSAIoctl select gethostbyname inet_addr WSASocketA htonl

netapi32

NetLocalGroupAddMembers NetUserAdd

Name

.text

Size

36KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

uvqutsx

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rmnet

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

SB360.exe

SHA256 fd247afce88192a9ec92665f78dc85f557be4d729357bf7988da2625b39e46d0
MD5 db914865093d68e43ba373505e181bed
SHA1 362d30835a783ffc02d4873b4e9fccb2a1013aa1
SHA512 261763b65e6da76f3a8b3334bc56933548d60f8de25c70cbda41a5eeb51c33c4554ee3c3c9b2bd6d425665aae16dcb4819e4394f4beb148cdaa413911fdf6124
SSDEEP 6144:2fm+kPX1sV8KOODGFVz6ZQQxJp2AWpGHH9e:2eOVWOaFN4wU9e
TLSH
T18424024B10E9D8B2F51A0670A65AEB639A7B9CF7821F7567E3C188951DF0D98C034F0B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

0

Entry point

%!f(<nil>)

Magic Number

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Server.exe

SHA256 5be8cc124d72d465883fddc0a4284bd9d7c54fc4ad4c8a56b6cdb36014c09eb6
MD5 636f9d819e55f630488e24dc30284ff2
SHA1 037c01050b62b2eb491d34f801a89304152fe729
SHA512 ab74c6912aecbb0f2b50e9647fe3d6efd1734596153ae746e914afae3521bc5791a8decedcea5f20c4cd5729ca4dfa91a6bc5dbbcd7fa99192b1544299611c84
SSDEEP 6144:6fmekPX1oDbNjRJYdJZb5YTUL3duoWmL7zbkHQlWSNMAio/3m:6eYbNUbloUBhfbJlWuMAio/3m
TLSH
T12924010A10E0D8F3D55C39B145556B22A5FE98B7803F6677A7C48C6918F3EAAD029F0F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

0

Entry point

%!f(<nil>)

Magic Number

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Servor.exe

SHA256 c7815a92a415aca590bfec64b7358100919942587a7e1e7ea564294744136b96
MD5 b4e396953987d7db9bd1b7d863d3054c
SHA1 063a776a286abc9b53d471cec30afbd47defb7a3
SHA512 dab472268f2f6ea55adf9d81ca6b3a3cb23c9a8f50af49bb5d80604a704bb0df0bed8ea3b749eabe26c1f0a9e14cad10d0deebafa297bb06238881ff04fcead4
SSDEEP 6144:WfmOkPX1GPGnxyyV+YxfyW9AJ/mHsQ7uzgwLd:WercyEYo/J/mZCzVLd
TLSH
T1B324020734962C72F25214B06A6E3BD2EE7E9CB4432E55162794181C3CB1EC69AFDF1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

0

Entry point

%!f(<nil>)

Magic Number

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Sesrver.exe

IMPHASH 70e7da975c581c6c95939c798934d74f
SHA256 0ebf734c0f1593866d283e862290549cf62ce5dc23fc1a32a3cc1dc3e0c6141e
MD5 c29fc5fb044cdb3420b93992651ec7bf
SHA1 d7005a3a1a36eba87650e47d75ac43987b14daed
SHA512 7dca2050546a05eda4432c295e85f3dfde67bf470b845d153373e38a8ba0255463afe262cd61b5aea33c5737096745b38a59930c5b3af725ba8d83797cda9fb7
SSDEEP 1536:0D0E3RpJ+vJ7Ektoci2XfV7MhpfdXZoDd:04MJ++kto52PV7MhFdYd
TLSH
T19093390AE88340FBE8340E3291DD6BFADB7D7577375A6B6BF344C9100462058B7456EA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

60982

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

avicap32

capGetDriverDescriptionA

kernel32

WriteFile SetFilePointer GetLastError GetCurrentProcess CreateProcessA CreateThread TerminateThread Process32Next lstrcmpiA Process32First CreateToolhelp32Snapshot HeapAlloc GetProcessHeap VirtualProtect IsBadReadPtr HeapFree FreeLibrary lstrcatA GetDiskFreeSpaceExA GetDriveTypeA GlobalMemoryStatusEx GetSystemInfo SetErrorMode GetCurrentThreadId LoadLibraryA InitializeCriticalSection DeleteCriticalSection GetStartupInfoA GetModuleHandleA GetProcAddress VirtualFree EnterCriticalSection VirtualAlloc CreateEventA CloseHandle LocalSize LocalFree GetWindowsDirectoryA GetFileAttributesA CreateFileA GetFileSize ReadFile lstrlenA LocalReAlloc LocalAlloc Sleep CancelIo InterlockedExchange SetEvent lstrcpyA ResetEvent WaitForSingleObject

user32

OpenDesktopA GetThreadDesktop GetUserObjectInformationA OpenInputDesktop ExitWindowsEx EnumWindows wsprintfA CloseDesktop SetThreadDesktop

advapi32

LookupPrivilegeValueA RegOpenKeyA RegQueryValueExA RegEnumKeyExA RegEnumValueA OpenProcessToken OpenEventLogA ClearEventLogA CloseEventLog RegOpenKeyExA RegQueryValueA RegCloseKey AdjustTokenPrivileges

msvcrt

_adjust_fdiv __p__commode __p__fmode __set_app_type _mkdir _strnicmp _stricmp _controlfp ??3@YAXPAX@Z memmove __CxxFrameHandler _CxxThrowException ceil _ftol strstr ??2@YAPAXI@Z puts malloc strrchr atoi strncmp strncpy free strchr _errno exit realloc _except_handler3 strncat _beginthreadex calloc ??1type_info@@UAE@XZ __dllonexit _onexit _exit _XcptFilter _acmdln __getmainargs _initterm __setusermatherr _strcmpi

ws2_32

gethostbyname socket ntohs recv closesocket select send inet_ntoa htons getsockname bind getpeername accept listen sendto recvfrom __WSAFDIsSet gethostname WSAStartup WSACleanup WSAIoctl connect setsockopt inet_addr

assvkl.exe

IMPHASH 3b45ae40863874089bfc065f52b24706
SHA256 e1ede2abf3e94412564ff62aa01956572995a04778071dbdafe5924448e7a43a
MD5 bd149a73a8acf2189c9617ac91ce6f6f
SHA1 bfc23fe8b90ef007efa95a3692d12a3bb3272e48
SHA512 ae5b27ddc65d5aaf1b424b28b945eee42e1bd97422be7f24598fae90e2ebfb6f21322bea924d0f8f702e5284281f519e1920619cad95a9da9e6f8aefd69b61bf
SSDEEP 3072:TWY+qMAgMCcMVQa3IesowTbuV80Cg20V8BmhoJbjIMst50nnRe3x:T1iz3lnVcTogmaO782
TLSH
T1D9E38C2C72A5C0F7C8661570A4F9DB7A6A39B83107A94CD3B7684B2D5E212D0773638F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

70481

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

iphlpapi

GetNetworkParams

kernel32

GetTickCount GetLocalTime GetCurrentProcessId CloseHandle CreateThread lstrcpyA GetProcAddress OpenEventA CreateFileA FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA ResetEvent CancelIo InterlockedExchange SetEvent WaitForSingleObject CreateEventA EnterCriticalSection LeaveCriticalSection Sleep VirtualAlloc VirtualFree DeleteCriticalSection LoadLibraryA InitializeCriticalSection FreeLibrary SetStdHandle LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetLocaleInfoA GetConsoleMode GetConsoleCP SetFilePointer HeapSize IsValidCodePage GetOEMCP GetACP RtlUnwind RaiseException GetSystemTimeAsFileTime HeapAlloc GetLastError HeapReAlloc GetModuleHandleW ExitProcess ExitThread GetCurrentThreadId GetCommandLineA GetStartupInfoA HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleA HeapCreate WriteFile GetStdHandle GetModuleFileNameA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCPInfo

user32

wsprintfA CloseDesktop SetThreadDesktop

advapi32

RegQueryValueExA RegOpenKeyA RegCreateKeyExA RegSetValueExA OpenServiceA DeleteService ClearEventLogA RegOpenKeyExA RegCloseKey

ws2_32

inet_addr socket gethostbyname htons connect sendto select recv send setsockopt closesocket WSAStartup WSASocketA htonl ntohl inet_ntoa ntohs recvfrom WSAIoctl getsockname

bm.exe

SHA256 b8fe3399840229b96834203706e300ba1d5bce01b84d9f56febb1b95a5817321
MD5 140ded32fdbf6686dc9dc191ac3259c7
SHA1 8942a1f7e907f8c086d91a4e9008b4eb596d6eb6
SHA512 7efaafbb24d1be3f87758f1a50dee17a1d20e5985993c35bb64d9024b6b816328065e01af26e40fcd420b435ba141de1df696080983ab59af28454c8d28011c5
SSDEEP 6144:QdzuKJfgppKKPSfXvF8PKWkWQ6iHOek75vcB3nBksy/Qnu1DWxojWKORJom0Qrjs:QdzuBGKPcfFjTPGvc1ORou1DWxk+zx/w
TLSH
T185A423382F57269CC56583708B43CBBC6F2F9A5C18569F1F982DB4063D732B898D58B4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1124736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

cafe.exe

SHA256 6e67d3deb135464cc43679d886625fcc71dbd90d8f669e625a1bf5e6d5ccd094
MD5 9bc7781b7d0e6f75afd3175be87a7faa
SHA1 c9a2aac50085912f663758f99952012acddaf7ee
SHA512 84c84e8b8b1714011bc5c5af9d85c1a21937ee26b7e9a27532163c1b1336fa7fe109a2416158ef4aae260f7ab1d6ba482901d5a42513d9d8253e8dd0c43747b3
SSDEEP 3072:Bw+n0OvOvtYz4nqSioDXx4uE9w2qbMUeZPgrQ/O/46H4X15maZ/N:KY0OvOvtYSiod4uYzqAvZd/246avmMN
TLSH
T1F414AEF14588E85BE3ECD63BD7A1ED52D83858B0024883DF078E883B9BAB5571F31856
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

1e:d6:e7:63:84:d6:36:4c:19:92:22:bb:34:88:71:ea:0b:a5:46:0a

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 4, 2009

Minor OS version

0

Major OS version

4

Entry point

20354

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

dqfjr24.exe

IMPHASH 8c97a2728dcb9c6df1aa1a2515885c23
SHA256 2283703bbcb74562c72f19d5a33040766a68b015d1e567dabe306fb6f7f6098f
MD5 79c01b6869911c263c593c9b4dd239db
SHA1 d6a826434b6bcb720591c067923b069f3b86e817
SHA512 19bff90c2aa5428abf0f4a23d15e182c827aed2827701a1c63b24c3f4d18a1382b6b29d5c1a77bc7d793fe07a789cb87e4f063b69c1b6439404f958ddeb38511
SSDEEP 3072:Y92gk1qfEkaeGh95TfvjDuvts5XMjtHD+iCBRGD0Nup:wkWo9VvjDuFsdY3YNA
TLSH
T1B3E39D21B5C2C5F2C566107049A4DF715A7EAE31177488677BF90F3E0F60AE09A373A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

11650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

InvalidateRect DdeAbandonTransaction BeginDeferWindowPos SetWindowTextW ShowWindow EndPaint FillRect GetClientRect TabbedTextOutW DrawTextA OpenClipboard MsgWaitForMultipleObjects DdeCreateStringHandleA RealGetWindowClassW SendMessageTimeoutA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA DdeCreateStringHandleW FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow SendMessageA DefWindowProcA BeginPaint

shell32

SHGetSpecialFolderLocation ShellExecuteA SHGetFileInfoA SHBrowseForFolderA SHGetPathFromIDListA SHFileOperationA

ole32

CoReleaseServerProcess CoGetObject CoCreateInstance OleCreateFromFile OleInitialize CoTaskMemFree CoRevokeMallocSpy CreateItemMoniker OleUninitialize CoRegisterPSClsid

advapi32

RegEnumKeyA RegCloseKey RegDeleteValueA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegEnumValueA RegOpenKeyExA RegDeleteKeyA

comctl32

ImageList_Destroy ImageList_Create ImageList_AddMasked

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

kernel32

GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc HeapAlloc InitializeCriticalSectionAndSpinCount LoadLibraryA RtlUnwind IsValidCodePage GetACP GetCPInfo GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter HeapFree VirtualFree HeapCreate InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue DeleteCriticalSection GetFileType SetFilePointer HeapSize WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA GetOEMCP GetThreadPriority SetHandleCount GetEnvironmentStringsW GetLastError WideCharToMultiByte VirtualAlloc CloseHandle CreateThread SetCurrentDirectoryA GetModuleHandleW RaiseException CreateIoCompletionPort GetCurrencyFormatA MoveFileWithProgressA lstrcpyW GetCommandLineA GetStartupInfoA EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW

knmbr.exe

IMPHASH 54a1e979f2ae93e074287eeda2cedfe5
SHA256 dfc637012a04a153c7838ba5dd3903da41e64e972305b95aba8a58632494d890
MD5 0948f2d2dcbce2b419dea831ca795879
SHA1 81b61a57222ecbd41c932fbd10582ad0e4dd7f1c
SHA512 062dff0e28b6da3da2c0a0574563e32f7447439bdf362b5000d584c1b1eafbd6cb29b9768a5bcf0413e0f6843efcdcc11cc72f422a313b0d6d25a0a9a139a929
SSDEEP 768:ibXShcYoh7GW37+1EXMKt1RO5Fr5S7qYRXRDAnDlbGXfi3q:ibccYo933MKtTYFFYRXREDlbGPi
TLSH
T10C232A22AAC1C462C5C340F4743A97BB95BA2D751B4A5007FFC16E9739B86D1EA32D0F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

25328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalMemoryStatus GetModuleHandleA WaitForSingleObject GetLastError CloseHandle GetSystemDefaultUILanguage GetSystemInfo GlobalMemoryStatusEx CreateThread lstrlenA CreateProcessA lstrcpyA GetCurrentProcess SetProcessWorkingSetSize Sleep OutputDebugStringA ExitThread GetTickCount LoadLibraryA GetProcAddress lstrcatA GetProcessHeap HeapAlloc HeapFree RaiseException InterlockedExchange LocalAlloc FreeLibrary GetStartupInfoA

user32

wsprintfA

advapi32

OpenSCManagerA OpenServiceA DeleteService RegCreateKeyExA RegSetValueExA RegDeleteKeyA RegDeleteValueA RegQueryValueExA RegEnumKeyExA RegEnumValueA RegOpenKeyExA AllocateAndInitializeSid GetLengthSid InitializeAcl AddAccessAllowedAce InitializeSecurityDescriptor SetSecurityDescriptorDacl RegSetKeySecurity RegCloseKey FreeSid

msvcrt

memset strlen rand srand memcpy ??2@YAPAXI@Z strstr free malloc ??3@YAXPAX@Z sprintf exit __CxxFrameHandler _CxxThrowException __dllonexit _onexit ??1type_info@@UAE@XZ _exit _XcptFilter _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp _except_handler3 strcat strcpy strchr strncat _strnicmp

iphlpapi

GetIfTable

muzzo.exe

SHA256 95c4c2fc868d338f9b9aa3b3432f076499eb41ad308de0abe11187f790577c37
MD5 ed4ada0fbf4da07b39942baadd5dfe64
SHA1 3194017d920eb49a50958aab91101e598423bed3
SHA512 9fba4200e6dee41ef526b588363b829dfa4c66f51662c3c0c7832c8317b6a75e4ddb6b7d9a953d615162a6beab62140ab21fd49a8a70315a035ee0000dc2f24b
SSDEEP 12288:L6Wq4aaE6KwyF5L0Y2D1PqLqFIWZyUJ448x9td5RXFYtNW7hDfPocHyGiWb4KZmq:xthEVaPqLacUJw9pR2tNMhDlVZbOogvK
TLSH
T163F423DC65F55A01D17803795ECB5F91D0A090A2A7BCFA2AB22C026AFEFF444DDE1189
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

732768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

nc.exe

SHA256 7185df14a4459827b399e9115ab2784f89865b0143e9d184ac47f0adf6e19fd7
MD5 a550f3d6ae0a61ab433fc8c753e27f3f
SHA1 5e62534d09c9c4fc0823c70d6f7d1ab9840737e6
SHA512 4d205c4bd4a6a308162d2a910058deb3a32335de569403af8505908e6bda494a606444253a8e93d97d43ebfd89d21c4ac7e49337be2d3af96be5117861605df0
SSDEEP 12288:rm3PvdLs65o3sP6Nz8dDBeWBFHQ+oqK0boS:rQs65MsCNiO+z
TLSH
T1429423DCA54E9A05E9DC72FCC49E18D4DA7C97BB22FD8D06890BAC461E0C4A1316CD6E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1489296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

nc111.exe

IMPHASH 3c87388e342c634abf3efddb20827c13
SHA256 dc0cf50455c2c5344ed895e766c2681bea70fee1b8957e39dfbd265db510587b
MD5 58558421a4c90c395b6b41844a622bae
SHA1 4ff7239921c20affc7b3694b13c0a41ad8e372df
SHA512 edb6e09aa2e96937d5215d76299d71d527240c8b01f9fadbb6cb41abd05af51234e1c8ac57353426975477dae12ec049d668f2592bf4fcf51c64df27a707270b
SSDEEP 49152:m/ZzSQ3e56L+0gmKQwkt0SKUK4c3RX58lxF:K3m8KPkt0S/Dk5Wn
TLSH
T14D8533A455994D74F6CD6236C126D8CF62B0E20982F1BA083E959F3FEAE4F0405F76E4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

3937914

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ng40a327.exe

IMPHASH 146b4fc95dd0a91a86b403f3147a3d09
SHA256 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0
MD5 07373b24d644d8d5a69836738404a555
SHA1 10eadfbfafe5d3b0ee9cfcca062192be56b447a1
SHA512 9d220bed270853c1f0cde5384ece111908130f052bf7b5879c03fd129a11e1aaab5f49e5e867d141ea4bb7b72d353554a1c86a8b985bc7cf671af289a58dfae2
SSDEEP 3072:6v1XD+4Y6GZwzU5Tfxp95XM6tHbj+OkSPi7ZLhLw/JR9cReU3qT2O/dyowzg:mR+4PAVxp9dxLkStf9cTqTp/jws
TLSH
T12824E111B2D2C5B2C059007059A1DF715ABFBE3017A489977FF81B3E5F60BE09A3729A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

11634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

LoadImageA FindWindowExW IsChild MapVirtualKeyExA GetUserObjectInformationA DdeQueryStringA CheckRadioButton MoveWindow GetClipboardFormatNameW FlashWindow ShowWindow EndPaint CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA GetWindowModuleFileNameA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA

ole32

CoInitializeSecurity CoGetMalloc OleDraw CoBuildVersion OleRegEnumVerbs CreateItemMoniker OleConvertIStorageToOLESTREAM

advapi32

RegEnumKeyA RegCloseKey RegDeleteValueA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegEnumValueA RegOpenKeyExA RegDeleteKeyA

comctl32

ImageList_Destroy ImageList_Create ImageList_AddMasked

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

kernel32

GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA FlushFileBuffers GetConsoleMode HeapReAlloc HeapAlloc InitializeCriticalSectionAndSpinCount LoadLibraryA RtlUnwind IsValidCodePage GetOEMCP GetACP GetCPInfo SetFilePointer HeapSize WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA GetConsoleCP SetUnhandledExceptionFilter RaiseException GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount VirtualAlloc CloseHandle CreateThread EnumLanguageGroupLocalesA WriteFileGather LocalUnlock CreateWaitableTimerA GetPrivateProfileIntW GetThreadContext TransactNamedPipe VirtualUnlock GetCommandLineA GetStartupInfoA EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetLastError GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree HeapFree QueryPerformanceCounter

searver.exe

IMPHASH 83edf28d7664b4810ce73f7d6a74fe66
SHA256 1a4e3ff0a3ad0efac70820ad1477fd0f2b79bd15b9e57632fe49770376400057
MD5 0bb46af89ca6fab8ea0ed14d686f23ea
SHA1 7e211db8198231539fc6d5b838a891e33470ee52
SHA512 20e4bce80cb4ccfc3cd050e3d9c07324ac93cc69edad3105ddb7d1dd2ebdf4fffbce4e50bf396e755dfff309bf6549ab5984ff3a2fa99510fd9b9fd82a3ade76
SSDEEP 3072:C5YCSMOYMKzEiR8mr6Y/sDE0+mTSO20V8Z5i3fjVg8Z+c31UnROeU:CCk+mu1+rhosqRHhSvU
TLSH
T14FE38C2C73A5C1F7C8661570A4E9DB7A6A39B83107A84CD3BB684B2D5D212D0773638F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

70545

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

iphlpapi

GetNetworkParams

kernel32

ResetEvent GetProcAddress GetTickCount GetLocalTime GetCurrentProcessId CloseHandle CreateThread lstrcpyA CancelIo OpenEventA CreateFileA FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA InterlockedExchange SetEvent WaitForSingleObject CreateEventA EnterCriticalSection LeaveCriticalSection Sleep VirtualAlloc VirtualFree DeleteCriticalSection LoadLibraryA InitializeCriticalSection FreeLibrary SetStdHandle LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetLocaleInfoA GetConsoleMode GetConsoleCP SetFilePointer HeapSize IsValidCodePage GetOEMCP GetACP RtlUnwind RaiseException GetSystemTimeAsFileTime HeapAlloc GetLastError HeapReAlloc GetModuleHandleW ExitProcess ExitThread GetCurrentThreadId GetCommandLineA GetStartupInfoA HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleA HeapCreate WriteFile GetStdHandle GetModuleFileNameA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCPInfo

user32

wsprintfA CloseDesktop SetThreadDesktop

advapi32

RegQueryValueExA RegOpenKeyA RegCreateKeyExA RegSetValueExA OpenServiceA RegOpenKeyExA RegCloseKey

ws2_32

inet_addr socket gethostbyname htons connect sendto select recv send setsockopt closesocket WSAStartup WSASocketA htonl ntohl inet_ntoa ntohs recvfrom WSAIoctl getsockname

solo.exe

IMPHASH 0ea56d09395df206083d0a8da5d777a5
SHA256 fb3fee964e43cc9e6b680bf6a06641aec54686e31b46283b143204395d5a9d9f
MD5 f3bb801b1072546190a9d666ba832fd2
SHA1 6b5ff15514915fc492bf3c1b83a8c899060e2182
SHA512 43cb618bf300a31f4a4a36a0e13f4bd7fb9bcc6954d3b6dee9d34e40227608298ead41f0fd36d55413934ef16a7eb77fdfdd7a1d405e982175cd1d39e677adc8
SSDEEP 12288:ieK0qg1r+miRinJeUdupQEtvWLluuuuuxu1uouBVQ:/qQrXJkjtU
TLSH
T1CB848D22B3518035E9A60AB4C5A9C27459393E72AB2050CB53E43EFF7B7C5E7AC31257
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_AGGRESIVE_WS_TRIM IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

PDB paths

kernel32

GetSystemInfo FindNextFileA CreateIoCompletionPort GetModuleHandleA GetCurrentDirectoryA CloseHandle GetCurrentProcessId CreateThread CreateFileW FlushFileBuffers SetStdHandle VirtualQuery FreeLibrary GetStringTypeW HeapQueryInformation HeapSize HeapReAlloc OutputDebugStringW WriteConsoleW OutputDebugStringA GetConsoleMode GetConsoleCP SetFilePointer IsProcessorFeaturePresent RtlUnwind LoadLibraryW WriteFile GetFileType GetStdHandle SetHandleCount FreeEnvironmentStringsW GetModuleFileNameA GetSystemTimeAsFileTime QueryPerformanceCounter DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection LCMapStringW SetLastError GetModuleHandleW GetProcAddress TlsFree GetCurrentThreadId TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetCPInfo GetOEMCP GetACP InterlockedIncrement IsBadReadPtr HeapValidate GetModuleFileNameW EncodePointer DecodePointer IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess RaiseException GetStartupInfoW HeapSetInformation GetCommandLineA LocalFree FindClose EnumSystemCodePagesW GetLastError FindFirstFileA SetConsoleTitleA lstrlenW MultiByteToWideChar lstrcatA ReadFile HeapCreate ExitProcess CreateEventA Sleep WideCharToMultiByte GlobalAlloc InitializeCriticalSection FormatMessageA GetConsoleTitleA GetProcessHeap GetTickCount WaitForSingleObject HeapFree InterlockedDecrement GetQueuedCompletionStatus HeapAlloc lstrlenA GetFileSize CreateFileA GetEnvironmentStringsW

user32

EndDeferWindowPos DestroyIcon FindWindowA EnableWindow MoveWindow LoadImageA SetWindowTextA BeginDeferWindowPos MessageBoxW DeferWindowPos UpdateWindow InflateRect EndPaint DestroyWindow CloseClipboard GetSystemMenu RealChildWindowFromPoint GetWindowRect InsertMenuItemA PostQuitMessage FillRect DrawTextW KillTimer DrawTextA LoadStringA OpenClipboard GetClientRect GetWindowTextLengthA SendMessageA BeginPaint GetDC wsprintfA GetMenu OffsetRect GetWindowTextA MessageBoxA InvalidateRect GetWindowLongA GetClipboardData CreateWindowExA ReleaseDC GetDlgItem DefWindowProcA GetDesktopWindow GetSysColor GetMenuItemInfoA ShowWindow SetMenu GetSysColorBrush FrameRect GetKeyboardType

gdi32

GetTextExtentPoint32A LineTo SetTextColor DeleteDC CreateFontA MoveToEx CreateFontIndirectA SetBkMode DeleteObject CreateCompatibleDC Rectangle SaveDC SetDCPenColor CreateFontW GetStockObject RestoreDC CreateSolidBrush TextOutA GetDeviceCaps SelectObject

comdlg32

GetOpenFileNameA FindTextA ReplaceTextA

shell32

SHGetFolderPathW SHGetSpecialFolderLocation SHGetMalloc SHGetPathFromIDListA ExtractAssociatedIconA

ole32

CoInitialize CoCreateInstance

oleaut32

VariantClear VariantInit

wininet

FtpSetCurrentDirectoryA

ws2_32

bind listen WSASocketA WSAStartup htonl WSASend WSAGetLastError htons WSAAccept

avicap32

capCreateCaptureWindowA

comctl32

ImageList_ReplaceIcon ord8

secur32

QueryContextAttributesA

ttt.exe

SHA256 20ee80b0efc1f8748e9944859c11ad46df663708d2250a3ef707698bf39bf261
MD5 6fc59bcab666707721eb9d06c4aa109f
SHA1 8deddacdac4ac0c2d35e2b79a3922e2e72705216
SHA512 f4c04172b507757a699113e6acd15af1758960c2139949d3deb2b5e9351fb2ffa0241205a0acb5bab55a382d161d4e401d05e87ee93b1d87e9883681b4c6bc9e
SSDEEP 12288:CYpuEvNaTOoxwv1B4zSKFIl2KNPI42rlUIFC2+Rhz5qFZMirE8I495:wEqdxwdBnnHPIpUIB+zz5qjMirz95
TLSH
T15A055C32B2A14833D5732A3CDD5B57A4583ABE103E38984A6BF53D4C8F3978179352A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

682080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

662KB

Virtual Size

662KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

www.exe

SHA256 d51e69fe4e3aa3f57f329f17b0b28b0aea1656999ce338aee27845170073b794
MD5 ff5c5493c17f08e9637102a8bd996a80
SHA1 3b1750dc36c95499718e00b2a5e855470aec7536
SHA512 b35ff389a996dbc8aeb4ef7f85b4e5e85424e849411b7680ddc28955014e09bdac0386f22ce3f5f1135baa2242b416b4f2101b94bf8ecb9865db57af8d623a81
SSDEEP 12288:RYpuEvNaTOoxwv1B4zSKFIl2KNPI42rlUIFC2+Rhz5qFZMir/8RcZf:LEqdxwdBnnHPIpUIB+zz5qjMirOg
TLSH
T1BA156C32B2E14833D5732A38DD5B57A4583ABE103E38984A6BF53D4C8F3978179352A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

682080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

662KB

Virtual Size

662KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

xiaoyao.exe

IMPHASH a80f25421c209c64896a3556baf5c1e9
SHA256 fe57d397b15be3874c1eeed60cb25e752eea0785ebed3b47f26953e0fe7e8814
MD5 9a5e9427ca0a77ccd5b44510ca9c1121
SHA1 cdfec2e591daff4552fe8c9e89b12f78fa721348
SHA512 0d7af6aafdb07659747b53c073e5e48e69f9dedee7afb24825c6d42708a0b238602af813b9721b96a4d41b99438e099bb6259cee80cd78998762cc9504d32f40
SSDEEP 49152:CoSogBnlG4M1i7t2raVTZaqdwk0c05HGiL1tm8MyWFMPkrHzHH:J+nlG4M/raVYqdwkLcHH5/e+MfHH
TLSH
T157E5C003E541A8B6D54406310DBB173A7A7AA7652E20CB43B79CFDB57F32121AA673CC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1114930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

rasapi32

RasHangUpA RasGetConnectStatusA

winmm

midiStreamRestart midiStreamClose midiOutReset midiStreamStop midiStreamOut midiOutPrepareHeader midiStreamProperty waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause waveOutReset waveOutClose waveOutGetNumDevs midiStreamOpen midiOutUnprepareHeader waveOutOpen

ws2_32

WSAAsyncSelect closesocket send select WSACleanup WSAStartup gethostbyname inet_ntoa inet_addr htons bind socket accept getpeername listen recv ioctlsocket recvfrom htonl

kernel32

GetSystemDirectoryA MultiByteToWideChar GetVersion IsDBCSLeadByte lstrcmpA lstrcmpiA lstrcpynA UnmapViewOfFile MapViewOfFile CreateFileMappingA FlushViewOfFile TerminateThread WideCharToMultiByte FileTimeToLocalFileTime GetFileType DuplicateHandle SystemTimeToFileTime GetLocalTime DosDateTimeToFileTime SetFileTime GetWindowsDirectoryA TerminateProcess GetCurrentProcess GetFileSize SetFilePointer SetLastError GetTimeZoneInformation FileTimeToSystemTime CreateSemaphoreA IsBadCodePtr IsBadReadPtr CompareStringW CompareStringA GetCurrentProcessId GetStringTypeW GetStringTypeA SetUnhandledExceptionFilter IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter SetStdHandle GetACP HeapSize RaiseException GetSystemTime RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom GetThreadLocale SetEndOfFile UnlockFile LockFile FlushFileBuffers FormatMessageA LocalFree InterlockedDecrement InterlockedIncrement ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile ReadFile GetLastError WaitForMultipleObjects CreateFileA CloseHandle WaitForSingleObject CreateProcessA GetTickCount GetCommandLineA MulDiv GetProcAddress GetModuleHandleA GetVolumeInformationA SetCurrentDirectoryA GetCurrentDirectoryA CreateDirectoryA CopyFileA DeleteFileA MoveFileA DeviceIoControl SetEvent FindResourceA LoadResource LockResource GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA lstrlenA lstrlenW GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA InterlockedExchange

user32

OpenClipboard wsprintfA WaitForInputIdle UnregisterHotKey RegisterHotKey CloseClipboard GetClipboardData CreateWindowExA DestroyMenu SetClipboardData EmptyClipboard GetSystemMetrics GetCursorPos MessageBoxA MessageBeep SetWindowPos CallWindowProcA GetForegroundWindow CharUpperA GetWindowTextA GetDlgItem GetClassNameA GetDesktopWindow SetWindowTextA SystemParametersInfoA TranslateMessage LoadIconA DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem SendMessageA DestroyCursor SetParent IsWindow PostThreadMessageA GetNextDlgGroupItem GetSysColorBrush LoadStringA MapDialogRect SetWindowContextHelpId CharNextA GetMenuCheckMarkDimensions GetMenuState SetMenuItemBitmaps CheckMenuItem MoveWindow IsDialogMessageA ScrollWindowEx SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx GetScrollPos RegisterClassA GetMenuItemCount GetMenuItemID SetWindowsHookExA CallNextHookEx ClientToScreen EnumDisplaySettingsA LoadImageA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetSystemMenu DeleteMenu GetClassInfoA DefWindowProcA GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos InflateRect SetRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild TrackPopupMenu UnregisterClassA SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA GetWindowTextLengthA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA

gdi32

GetViewportExtEx ExtSelectClipRgn LineTo MoveToEx SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject CreatePen PatBlt FillRgn CreateRectRgn CombineRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextMetricsA GetMapMode CreateRectRgnIndirect SetBkColor CreateFontA TranslateCharsetInfo CreateDIBitmap SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegQueryValueA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey RegCreateKeyExA

shell32

ShellExecuteA DragQueryFileA DragFinish DragAcceptFiles SHGetSpecialFolderPathA Shell_NotifyIconA

ole32

StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoFreeUnusedLibraries CoRegisterMessageFilter CoRevokeClassObject OleFlushClipboard StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromProgID OleRun CoCreateInstance CLSIDFromString OleUninitialize OleInitialize CoTaskMemFree CoTaskMemAlloc OleIsCurrentClipboard

oleaut32

SafeArrayAccessData SafeArrayGetElement VariantCopyInd VariantInit SysAllocString SafeArrayDestroy SafeArrayCreate SafeArrayPutElement RegisterTypeLi LHashValOfNameSys LoadTypeLi SafeArrayGetElemsize SysAllocStringByteLen SafeArrayUnaccessData SysAllocStringLen SafeArrayGetDim SafeArrayGetLBound SafeArrayGetUBound VariantChangeType VariantClear SysStringLen VariantTimeToSystemTime OleCreatePictureIndirect OleCreateFontIndirect UnRegisterTypeLi SysFreeString VariantCopy

comctl32

ord17 ImageList_EndDrag ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_Destroy ImageList_Create ImageList_BeginDrag ImageList_Add

oledlg

ord8

wininet

InternetCanonicalizeUrlA InternetCrackUrlA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetReadFile InternetConnectA InternetSetOptionA InternetCloseHandle InternetOpenA

comdlg32

ChooseColorA GetFileTitleA GetSaveFileNameA GetOpenFileNameA

zfbsvchost.exe

IMPHASH 18e1383b6f17ae0f74441d2f38bcc4b9
SHA256 eaa33db14242703f1f09e9854dbc4c2423e9b457f26892e6c802d54ec39a289f
MD5 f7294a6913ac7fe9e27c8100699e17f8
SHA1 95c80fca8d90db66cba9c442ab853f7b6987ff90
SHA512 483f66d54a32cccd5cc7c26f5f05b2aa235a0da625649f6e2ef31a90c34557c65d01aa26434937b872db80d4a1f3519de24a417d33968028f3e9ac0e3d512d2f
SSDEEP 24576:/wM3R5oFLD4jcq76q0EbdpJE542Ho6sXkVaWXcxmtkFn4K1:/m+cdEbpE5XGXkVaW4mtM
TLSH
T1B0559E12E553C0B1C249153115BA573BADB9BB260B21C9C3F7D8DDBC5D321E2AE3A21E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

613533

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

iphlpapi

GetAdaptersInfo

winmm

midiStreamOut midiOutPrepareHeader midiStreamProperty waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause waveOutReset waveOutClose waveOutGetNumDevs waveOutOpen midiStreamStop midiOutReset midiStreamClose midiStreamRestart midiStreamOpen midiOutUnprepareHeader

ws2_32

WSAAsyncSelect closesocket WSACleanup WSAStartup inet_ntoa ioctlsocket recvfrom accept inet_addr recv gethostbyname getpeername

kernel32

GetSystemDirectoryA MultiByteToWideChar SetLastError GetTimeZoneInformation GetVersion SetSystemPowerState WideCharToMultiByte HeapSize RaiseException GetWindowsDirectoryA GetSystemTime RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA GetThreadLocale SetEndOfFile UnlockFile LockFile FlushFileBuffers DuplicateHandle lstrcpynA FileTimeToLocalFileTime FileTimeToSystemTime FormatMessageA LocalFree InterlockedDecrement InterlockedIncrement TerminateProcess GetCurrentProcess GetFileSize SetFilePointer CreateToolhelp32Snapshot Process32First Process32Next GetTempFileNameA CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile ReadFile GetLastError WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource lstrlenW GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree InterlockedExchange HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetVersionExA WritePrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose GetFileAttributesA DeleteFileA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle GetACP UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr SetStdHandle GetLocalTime

user32

PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient SetMenu GetMenu DeleteMenu GetSystemMenu DefWindowProcA GetClassInfoA IsZoomed PostQuitMessage CopyAcceleratorTableA GetKeyState TranslateAcceleratorA IsWindowEnabled ShowWindow SystemParametersInfoA LoadImageA EnumDisplaySettingsA ClientToScreen EnableMenuItem GetSubMenu GetDlgCtrlID CreateAcceleratorTableA CreateMenu ModifyMenuA ChildWindowFromPointEx AppendMenuA LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PostThreadMessageA GetNextDlgGroupItem GetSysColorBrush PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBeep MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle CreatePopupMenu DrawIconEx CreateIconFromResource CreateIconFromResourceEx RegisterClipboardFormatA SetRectEmpty DispatchMessageA WindowFromPoint DrawFocusRect DrawEdge DrawFrameControl TranslateMessage LoadIconA GetDesktopWindow GetClassNameA UnregisterClassA GetDlgItem FindWindowExA GetWindowTextA GetForegroundWindow ExitWindowsEx CopyRect GetMessageA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions CharNextA SetWindowContextHelpId MapDialogRect LoadStringA

gdi32

GetTextMetricsA Escape ExtTextOutA TextOutA RectVisible PtVisible GetViewportExtEx ExtSelectClipRgn EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject GetMapMode GetTextExtentPoint32A GetDeviceCaps GetClipRgn SetStretchBltMode CreateRectRgnIndirect SetBkColor LineTo MoveToEx ExcludeClipRect GetClipBox ScaleWindowExtEx SetWindowExtEx GetObjectA GetStockObject CreateFontIndirectA CreateSolidBrush FillRgn CreateRectRgn CombineRgn PatBlt CreatePen SelectObject CreateBitmap CreateDCA CreateCompatibleBitmap GetPolyFillMode GetStretchBltMode GetROP2 GetBkColor GetBkMode GetTextColor CreateRoundRectRgn CreateEllipticRgn PathToRegion EndPath BeginPath GetWindowOrgEx GetViewportOrgEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetTextColor SetROP2 GetWindowExtEx GetDIBits RealizePalette SelectPalette StretchBlt CreatePalette GetSystemPaletteEntries CreateDIBitmap DeleteObject SelectClipRgn RoundRect SetPolyFillMode SetBkMode RestoreDC SaveDC CreatePolygonRgn

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

RegQueryValueExA RegOpenKeyExA RegSetValueExA RegCreateKeyA RegQueryValueA LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyExA RegCloseKey OpenProcessToken

shell32

ShellExecuteA Shell_NotifyIconA SHGetSpecialFolderPathA

ole32

StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoFreeUnusedLibraries CoRegisterMessageFilter CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard StgOpenStorageOnILockBytes CoTaskMemFree CoTaskMemAlloc CLSIDFromProgID OleRun CoCreateInstance CLSIDFromString OleUninitialize OleInitialize CoGetClassObject

oleaut32

VariantChangeType VariantClear SysFreeString SafeArrayGetUBound VariantTimeToSystemTime SysStringLen SysAllocStringLen SysAllocStringByteLen SafeArrayGetElemsize SafeArrayGetLBound SafeArrayGetDim SafeArrayUnaccessData SafeArrayAccessData UnRegisterTypeLi OleCreateFontIndirect LoadTypeLi LHashValOfNameSys RegisterTypeLi SafeArrayPutElement SafeArrayCreate SafeArrayDestroy SysAllocString VariantInit VariantCopyInd SafeArrayGetElement VariantCopy

comctl32

ord17 ImageList_Destroy

oledlg

ord8

comdlg32

ChooseColorA GetOpenFileNameA GetFileTitleA GetSaveFileNameA

Sharing

General

Malware Config

Signatures

File Explorer

CBC15BACE96277A9115EE0C21B19C14B180B3BC947185C73201487CE7CCED200.7z

CBC15BACE96277A9115EE0C21B19C14B180B3BC947185C73201487CE7CCED200

107fjr24.exe

user32

shell32

ole32

advapi32

comctl32

version

kernel32

generic

109fjr24.exe

user32

shell32

ole32

advapi32

comctl32

version

kernel32

generic

121fjr24.exe

user32

shell32

ole32

advapi32

comctl32

version

kernel32

generic

127fjr24.exe

user32

shell32

ole32

advapi32

comctl32

version

kernel32

generic

85fjr24.exe

user32

shell32

ole32

advapi32

comctl32

version

kernel32

generic

DDos

Rat.exe

kernel32

user32

advapi32

shell32

ws2_32

netapi32

generic

SB360.exe

generic

Server.exe

generic

Servor.exe

generic

Sesrver.exe

avicap32

kernel32

user32

advapi32

msvcrt

ws2_32

generic

assvkl.exe

iphlpapi

kernel32

user32

advapi32