c303848842b31a64ea429be07a11e2bfbcf71e31e86ada3b2f958429681ce165

Sharing

Copy URL Twitter E-mail

General

Target
c303848842b31a64ea429be07a11e2bfbcf71e31e86ada3b2f958429681ce165
Size 11.9MB
Sample260731-qj441stdqh
SHA256 c303848842b31a64ea429be07a11e2bfbcf71e31e86ada3b2f958429681ce165
MD5 926a7ac1834df30614200d81dd57dbff
SHA1 45e2bdfb8ace5197891682fc49e133668dcf0cc5
SHA512 6a7ca1e942d8189298236d26d27e72f630a4abf27868c3547d54aac0873fc5a9d6a7d8b3c6c938e64b795622010139d3148eccc1ef56d5c4d1d0059c39fc59f6
SSDEEP 196608:MiS87xtRiFJnZAftwhAU6qDFG2afKpYzGRP3fMC+FMPcpthlh3q/KMlxcVOgdU12:Miv7xtRMJnZwwyqDSfCVRP3UbFMcprlr
TLSH
T12FC6338DEF0A92F8CE3105738C5DE3EB97393925E0E11AE690158D97CA2E7E14B18D35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
c303848842b31a64ea429be07a11e2bfbcf71e31e86ada3b2f958429681ce165
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/deepseekcode.exe

File Explorer

c303848842b31a64ea429be07a11e2bfbcf71e31e86ada3b2f958429681ce165

.exe 11.9MB
$PLUGINSDIR/System.dll

.dll 29KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 14KB
LICENSE

11KB
deepseekcode.exe

.exe 42.1MB

c303848842b31a64ea429be07a11e2bfbcf71e31e86ada3b2f958429681ce165

IMPHASH a46ac714274c7f150eaa703de6d7fb57
SHA256 c303848842b31a64ea429be07a11e2bfbcf71e31e86ada3b2f958429681ce165
MD5 926a7ac1834df30614200d81dd57dbff
SHA1 45e2bdfb8ace5197891682fc49e133668dcf0cc5
SHA512 6a7ca1e942d8189298236d26d27e72f630a4abf27868c3547d54aac0873fc5a9d6a7d8b3c6c938e64b795622010139d3148eccc1ef56d5c4d1d0059c39fc59f6
SSDEEP 196608:MiS87xtRiFJnZAftwhAU6qDFG2afKpYzGRP3fMC+FMPcpthlh3q/KMlxcVOgdU12:Miv7xtRMJnZwwyqDSfCVRP3UbFMcprlr
TLSH
T12FC6338DEF0A92F8CE3105738C5DE3EB97393925E0E11AE690158D97CA2E7E14B18D35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19820

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcess GetDiskFreeSpaceW GetExitCodeProcess GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDirectoryW GetTempFileNameW GetTempPathW GetTickCount GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExW MoveFileExW MoveFileW MulDiv MultiByteToWideChar ReadFile RemoveDirectoryW SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFileTime Sleep WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpyA lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoTaskMemFree IIDFromString OleInitialize OleUninitialize

shell32

SHBrowseForFolderW SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW ShellExecuteExW

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetAsyncKeyState GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongW GetWindowRect InvalidateRect IsDlgButtonChecked IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetClassLongW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfA wsprintfW wvsprintfW

Name

.text

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

512B

Virtual Size

616KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/System.dll

IMPHASH b844086d4b3e59aa7b4439d88bcb40cb
SHA256 014321cd51d3ad1f8f149619d6c7e01451e967b475f2db9bfffbaf182c1b836f
MD5 9d6d0eef8bfe8e43ade97ac84f0b0dd5
SHA1 631672bfb249b47ae7eba767e309c30e60550196
SHA512 e090d07278a0e0f04ec839fc614f84feb8c7684c74b991260c252c34ba91701aade10403964be88375ba67e55771871d5fb9a70f15446a43afabf303437b50f0
SSDEEP 384:Hchls/EvE2XYBVtQQA+S4n+7g6ZxlU7RfYkvIZMIwwHnY9pyDediASIo:HmHckOVih+S/Fxq7v4HnYLoASIo
TLSH
T133D22829FF0BC8B2D1B655F049DFFB77482A790547225E6BEE168D08BC33A139A19107
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13647

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

179B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsDialogs.dll

IMPHASH c442f1649aa0670a32c622fadfcd00bd
SHA256 e524aba3715ee2b5821b2bf0498f3f8d02e6755f30d0b2b5653abe564733a391
MD5 6ae5288cd54dda370dc2456511a09e8f
SHA1 e9782c69797cf7bbd17f7f26713266588f4f0ea4
SHA512 5bdb59501ff6330f7c628f325b5a0c3b391836082042a2b77601970eb418795d0c259b756909bd6d688f06aba547d6d81114c1a06862dcafea86bf2134e64d90
SSDEEP 384:4qWL5JCYXh2OPxv9OIR6oYkvLlwgS+VX9jN:4qXG2cLR9v6gJNjN
TLSH
T1CD52B50DFB1B14FAC572D974958BFB3F8A9DA415C66B4E06EF160B0CB9922B1680E740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8876

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

363B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

516B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

deepseekcode.exe

IMPHASH d001c51257d045350eb74827f5d0cf24
SHA256 e7fa4d501b8ec05ec5aa21eb51b21802220e36a070c2585c9d57a90cc82fee40
MD5 4aeb30c17cae47fc19ac34a701a8644d
SHA1 1ad599770e1dedd7e20520004b1a1b839379e65a
SHA512 a02dcccbeebc0f7504f87e5e98befe5f53a9cfb50ec06502a0450fa564614091bb96da7b5066539f4e352c8d97a3d11b1466207b201ba0ae697f8717dd3098c7
SSDEEP 196608:7nirl4VsqdWU9s9aQrcBExvFciImAZ9sGKkaY01ig1Zof6ORzI70k:jVs5U0rcBQvKiClKr1NZof6YA
TLSH
T1FCA74A15BA5BA8ADD05AC8B083464A735F2134DB0B26B9FF40C452393F6EBF05B39719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29150032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

deepseekcode.pdb

kernel32

SetThreadPriority GetCurrentThread GlobalUnlock GetSystemTimeAsFileTime GlobalFree DuplicateHandle GlobalAlloc UnmapViewOfFile GetProcAddress GetSystemInfo WriteFile ReadFile CreatePipe GetNamedPipeInfo LoadLibraryExW FreeLibrary GetFileType GetCurrentProcess GetCurrentProcessId lstrlenW WaitForSingleObject SetFilePointerEx CreateThread PostQueuedCompletionStatus SleepEx GetLastError WriteFileEx GlobalSize SwitchToThread UnregisterWaitEx FindClose GetSystemTimePreciseAsFileTime HeapReAlloc LocaleNameToLCID SetThreadErrorMode ExitProcess FormatMessageW LocalFree LoadLibraryExA MultiByteToWideChar GetModuleFileNameW QueryPerformanceFrequency HeapAlloc CloseHandle HeapFree GetFileInformationByHandle VirtualProtect CreateFileMappingW MapViewOfFile CreateIoCompletionPort SystemTimeToFileTime RtlVirtualUnwind GetQueuedCompletionStatusEx SetFileCompletionNotificationModes RtlCaptureContext GetOverlappedResult WideCharToMultiByte CancelIoEx Sleep DeleteProcThreadAttributeList GetExitCodeProcess TerminateProcess GetProcessId InitializeProcThreadAttributeList UpdateProcThreadAttribute CreateProcessW CreateFileW SetErrorMode VirtualQuery SetThreadStackGuarantee SwitchToFiber IsThreadAFiber ConvertThreadToFiber CreateFiber DeleteFiber ConvertFiberToThread ReadFileEx GetFullPathNameW SetHandleInformation GetCurrentThreadId QueryPerformanceCounter CreateEventW RtlLookupFunctionEntry CompareStringOrdinal LoadLibraryW SetLastError SetFileTime SetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW GetStdHandle WaitForMultipleObjects CreateDirectoryW LoadLibraryA CopyFileExW MoveFileExW FindFirstFileExW WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW DeleteFileW WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer GetFileAttributesW GetModuleHandleW GetModuleHandleExW GetTempPathW GetModuleHandleA CancelIo FindNextFileW RegisterWaitForSingleObject VirtualFree RtlDeleteFunctionTable VirtualAlloc RemoveVectoredExceptionHandler FlushInstructionCache RtlAddFunctionTable GetBinaryTypeW FlushFileBuffers GetTickCount FormatMessageA GetSystemTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI RaiseException GetUserDefaultLocaleName GlobalLock GetProcessHeap SetUnhandledExceptionFilter GetEnvironmentStringsW DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeSListHead InitializeCriticalSection FreeEnvironmentStringsW ExpandEnvironmentStringsW AddVectoredExceptionHandler GetCurrentDirectoryW GetEnvironmentVariableW GetEnvironmentVariableA

advapi32

CredFree CredReadW CredWriteW CredDeleteW RegEnumValueW RegCloseKey RegQueryValueExW RegOpenKeyExW SystemFunction036

oleaut32

VariantClear GetErrorInfo SetErrorInfo SafeArrayCreateVector SysStringLen SysAllocStringLen SysFreeString SafeArrayPutElement

uiautomationcore

UiaGetReservedMixedAttributeValue UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaReturnRawElementProvider UiaGetReservedNotSupportedValue UiaLookupId UiaHostProviderFromHwnd

user32

RegisterSuspendResumeNotification EmptyClipboard CountClipboardFormats EnumClipboardFormats GetClipboardFormatNameW GetPointerType RegisterClipboardFormatW OpenClipboard ClientToScreen DefWindowProcW SendMessageW RedrawWindow UnregisterSuspendResumeNotification MessageBeep LoadImageW RegisterClassW GetDpiForWindow GetClipboardData SetClipboardData CloseClipboard GetSystemMetricsForDpi MessageBoxW GetWindowLongPtrW GetWindowRect SetWindowTextW GetForegroundWindow IsWindowVisible RemovePropW EnumDisplayMonitors GetMessageW GetKeyboardLayoutNameW SetPropW GetActiveWindow DispatchMessageW TranslateMessage PeekMessageW MapVirtualKeyW KillTimer SetTimer ToUnicode GetKeyboardState GetClientRect CreateWindowExW SetWindowLongPtrW GetWindowPlacement SystemParametersInfoW MonitorFromPoint GetCursorPos GetDoubleClickTime GetSystemMetrics GetMonitorInfoW SetCapture TrackMouseEvent ReleaseCapture IsZoomed ScreenToClient PostMessageW EnableWindow SetCursor IsWindowEnabled GetKeyState MonitorFromWindow ValidateRect SetForegroundWindow SendInput SetFocus SetActiveWindow IsIconic ShowWindowAsync SetWindowPlacement DestroyWindow SetWindowPos PostQuitMessage

combase

CoTaskMemFree CoCreateFreeThreadedMarshaler CoIncrementMTAUsage

ntdll

RtlNtStatusToDosError NtReadFile NtCreateFile NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile NtCreateNamedPipeFile RtlGetVersion NtOpenFile

ole32

CoUninitialize CoInitializeEx ReleaseStgMedium OleUninitialize RegisterDragDrop OleInitialize RevokeDragDrop CoCreateInstance PropVariantClear

gdi32

CreateSolidBrush

icuuc

u_strlen

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

bcryptprimitives

ProcessPrng

shell32

DragQueryFileW SHGetKnownFolderPath ShellExecuteW SHCreateItemFromParsingName SHOpenFolderAndSelectItems SHGetDesktopFolder

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ws2_32

getaddrinfo WSACleanup getpeername getsockname WSAGetLastError freeaddrinfo closesocket shutdown recv send accept WSASend getsockopt WSAIoctl listen WSAStartup WSASocketW ioctlsocket bind setsockopt connect

bcrypt

BCryptGenRandom

imm32

ImmReleaseContext ImmAssociateContextEx ImmGetContext ImmNotifyIME ImmSetCompositionWindow ImmSetCandidateWindow ImmGetCompositionStringW

dwmapi

DwmGetCompositionTimingInfo DwmSetWindowAttribute DwmFlush

dwrite

DWriteCreateFactory

comctl32

TaskDialogIndirect

winmm

timeBeginPeriod timeEndPeriod

dxgi

CreateDXGIFactory2

d3d11

D3D11CreateDevice

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

dcomp

DCompositionCreateDevice

userenv

GetUserProfileDirectoryW

vcruntime140

__current_exception __current_exception_context memchr memcpy __CxxFrameHandler3 memset memmove memcmp _CxxThrowException longjmp strchr strrchr __C_specific_handler

api-ms-win-crt-string-l1-1-0

strlen wcslen strncmp strspn strcmp iswctype strcspn

api-ms-win-crt-math-l1-1-0

powf fmodf __setusermatherr ceilf rintf truncf floorf roundf cosf sinf pow floor trunc rint _fdopen tan sin cos fmod atan2 log ceil acos acosf tanf fma log2 fmaf atan2f round

api-ms-win-crt-runtime-l1-1-0

_set_app_type _seh_filter_exe _initterm _initterm_e _wassert terminate _crt_atexit _get_initial_narrow_environment _register_onexit_function _initialize_narrow_environment _configure_narrow_argv __p___argc __p___argv _cexit _c_exit _endthreadex _initialize_onexit_table _register_thread_local_exe_atexit_callback exit _exit abort _beginthreadex

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode _msize malloc calloc free

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vfprintf fputs fputc fclose __acrt_iob_func __stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

28.4MB

Virtual Size

28.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11.6MB

Virtual Size

11.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

172KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1021KB

Virtual Size

1021KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

911KB

Virtual Size

911KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c303848842b31a64ea429be07a11e2bfbcf71e31e86ada3b2f958429681ce165

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/System.dll

kernel32

msvcrt

ole32

user32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

comdlg32

gdi32

kernel32

ole32

shell32

user32

generic

LICENSE

deepseekcode.exe

kernel32

advapi32

oleaut32

uiautomationcore

user32

combase

ntdll

ole32

gdi32

icuuc

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

bcryptprimitives

shell32

api-ms-win-core-synch-l1-2-0

ws2_32

bcrypt

imm32

dwmapi

dwrite

comctl32

winmm

dxgi

d3d11

api-ms-win-shcore-scaling-l1-1-1

dcomp

userenv

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic