185855335a4f695da7129276aa8f62ff95300f182a6b83a7306ef6c97046970b

Sharing

Copy URL Twitter E-mail

General

Target
185855335a4f695da7129276aa8f62ff95300f182a6b83a7306ef6c97046970b
Size 5.1MB
Sample260808-e934vshp3t
SHA256 185855335a4f695da7129276aa8f62ff95300f182a6b83a7306ef6c97046970b
MD5 dccc49683a7dae70f2b805a0ec109e48
SHA1 449b75a43fa0ccd6b3ee32412a5f1ab217ceca8b
SHA512 ff5d9c9c62ec650805abb7d6680a2cd9cb3568f03b1301d7dce55b0bc0b9fb0a6791be2c6a1b1348a361391d3c11d8705a778c944e6aa7c85a8b99aaff888bc8
SSDEEP 98304:oVqEymWxyozx0EbtE76cTxAokP0nHA6Hv1NOjWL3I1hazz/Z3:aqnmtoVtE76Fv6vZ3
TLSH
T1CA469E307A29C135EA8100B2DE7C7EAF616DDA750B7905C3E2D81A6D09712D32F73A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
185855335a4f695da7129276aa8f62ff95300f182a6b83a7306ef6c97046970b

File Explorer

185855335a4f695da7129276aa8f62ff95300f182a6b83a7306ef6c97046970b

.exe 5.1MB

185855335a4f695da7129276aa8f62ff95300f182a6b83a7306ef6c97046970b

IMPHASH 82b38ce053810ddd3e3a701be92781b2
SHA256 185855335a4f695da7129276aa8f62ff95300f182a6b83a7306ef6c97046970b
MD5 dccc49683a7dae70f2b805a0ec109e48
SHA1 449b75a43fa0ccd6b3ee32412a5f1ab217ceca8b
SHA512 ff5d9c9c62ec650805abb7d6680a2cd9cb3568f03b1301d7dce55b0bc0b9fb0a6791be2c6a1b1348a361391d3c11d8705a778c944e6aa7c85a8b99aaff888bc8
SSDEEP 98304:oVqEymWxyozx0EbtE76cTxAokP0nHA6Hv1NOjWL3I1hazz/Z3:aqnmtoVtE76Fv6vZ3
TLSH
T1CA469E307A29C135EA8100B2DE7C7EAF616DDA750B7905C3E2D81A6D09712D32F73A5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3584288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\new_soui3\yuelun_online_4.0\Release\YLToolHelper.pdb

imm32

ImmGetContext ImmDestroyContext ImmAssociateContext ImmReleaseContext ImmCreateContext

usp10

ScriptFreeCache ScriptShape ScriptItemize

opengl32

wglGetProcAddress wglGetCurrentContext

kernel32

LoadLibraryA GetLastError WideCharToMultiByte FindFirstFileA GetVersionExW OutputDebugStringA GetConsoleWindow InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetProcessHeap GlobalAlloc GlobalUnlock GlobalLock GetFileInformationByHandle GetFileSizeEx CloseHandle MultiByteToWideChar MapViewOfFile UnmapViewOfFile TlsAlloc TlsGetValue TlsSetValue SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent WakeAllConditionVariable GetTickCount64 SleepConditionVariableSRW TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo RaiseException InitializeSListHead GetModuleHandleW GetVersionExA GetProcAddress IsBadReadPtr FlushInstructionCache HeapFree HeapAlloc HeapDestroy HeapCreate EnumResourceTypesW EnumResourceNamesW FindResourceW SizeofResource LockResource LoadResource FreeResource GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose LocalFree GetCommandLineW SetCurrentDirectoryW FreeLibrary LoadLibraryW ReadFile GetConsoleMode GetStdHandle GetPrivateProfileStringW WritePrivateProfileStringW Sleep GetExitCodeProcess GetModuleFileNameW SetLastError GetCurrentThreadId GetLocalTime GetSystemTime GetTickCount MulDiv GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA CreateFileMappingW

user32

AnimateWindow SetLayeredWindowAttributes SetWindowPos SetFocus GetMenuStringW CheckMenuItem IsMenu EnableMenuItem GetMenuItemID GetMenuItemCount PostMessageW GetActiveWindow IsRectEmpty RegisterWindowMessageW SetForegroundWindow GetCursorPos DestroyIcon ScreenToClient GetWindowRect GetMenuItemInfoW UpdateWindow BeginPaint EndPaint GetClientRect GetClassNameW MonitorFromWindow GetMonitorInfoW SendMessageW SendNotifyMessageW DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW ShowWindow UpdateLayeredWindow MoveWindow IsWindowVisible IsIconic IsZoomed GetDlgItem GetDlgCtrlID GetCapture SetCapture ReleaseCapture IsWindowEnabled GetDC LoadCursorW GetWindowDC ReleaseDC SetWindowRgn InvalidateRect SetWindowTextW GetWindowTextW CreateCaret CreateIconFromResource SystemParametersInfoW DrawIconEx InflateRect CreateIconIndirect MonitorFromRect LoadStringA LoadStringW MapVirtualKeyW CharLowerBuffW SystemParametersInfoA DrawTextW GetWindowPlacement PtInRect CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetSystemMetrics MsgWaitForMultipleObjects PostThreadMessageW PeekMessageW DispatchMessageW TranslateMessage SetCaretPos OffsetRect IntersectRect GetDesktopWindow SetActiveWindow EnableWindow DestroyCursor GetForegroundWindow CallMsgFilterW PostQuitMessage CheckMenuRadioItem GetSysColor GetMenuContextHelpId SetMenuContextHelpId SetMenuInfo GetMenuInfo TrackPopupMenu DeleteMenu AppendMenuW InsertMenuW GetSubMenu DestroyMenu CreatePopupMenu GetIconInfo CharNextW GetKeyState GetFocus WindowFromPoint GetWindow SetParent GetParent SetWindowLongW GetWindowLongW MapWindowPoints ClientToScreen LoadImageW HideCaret TrackMouseEvent MessageBoxW SetTimer KillTimer SetCursor ShowCaret IsWindow DestroyWindow LoadBitmapW

gdi32

GetClipBox GdiFlush GetTextFaceW ExtTextOutW GetTextMetricsW BitBlt CreateRectRgnIndirect DeleteObject ExcludeClipRect RectInRegion CreateCompatibleDC DeleteDC SelectObject StretchBlt GetObjectW GetDeviceCaps SetGraphicsMode CreateBitmap CreateFontIndirectW CreateSolidBrush GetStockObject Rectangle SetBkMode GetDCOrgEx CreateCompatibleBitmap SetViewportOrgEx EnumFontsW ExtCreateRegion GetCurrentObject GetViewportOrgEx CreateDCW StretchDIBits CreateDIBSection IntersectClipRect SelectClipRgn SetWorldTransform EnumFontFamiliesExW GetCharABCWidthsW GetFontData GetGlyphOutlineW GetOutlineTextMetricsW GetFontUnicodeRanges GetGlyphIndicesW GetTextExtentPointI AddFontMemResourceEx RemoveFontMemResourceEx SetTextColor SetTextAlign

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW CommandLineToArgvW ShellExecuteA SHGetFolderPathA Shell_NotifyIconW

ole32

OleLockRunning CLSIDFromProgID CLSIDFromString RegisterDragDrop CoCreateInstance OleInitialize CreateBindCtx CreateStreamOnHGlobal CoCreateGuid OleUninitialize CoTaskMemFree

msvcp140

?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ??7ios_base@std@@QBE_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?width@ios_base@std@@QAE_J_J@Z ?width@ios_base@std@@QBE_JXZ ?flags@ios_base@std@@QBEHXZ ?good@ios_base@std@@QBE_NXZ ?uncaught_exception@std@@YA_NXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?always_noconv@codecvt_base@std@@QBE_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Random_device@std@@YAIXZ _Query_perf_counter _Query_perf_frequency ?_Xout_of_range@std@@YAXPBD@Z _Thrd_detach _Xtime_get_ticks ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD4@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?_Throw_Cpp_error@std@@YAXH@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?getloc@ios_base@std@@QBE?AVlocale@2@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ ?_W_Getdays@_Locinfo@std@@QBEPBGXZ ?_W_Getmonths@_Locinfo@std@@QBEPBGXZ ?_Xbad_alloc@std@@YAXXZ _Cnd_do_broadcast_at_thread_exit ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z _Cnd_wait _Cnd_broadcast _Cnd_signal _Mtx_unlock _Mtx_lock _Thrd_hardware_concurrency _Thrd_join _Thrd_id

shlwapi

StrToIntExA StrToIntExW

gdiplus

GdipCreateBitmapFromStreamICM GdipGraphicsClear GdipDrawImageRectI GdipCreateBitmapFromFile GdipCreateBitmapFromFileICM GdipGetImageEncodersSize GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImageWidth GdipGetPropertyItem GdipDeleteGraphics GdipGetImageEncoders GdipBitmapUnlockBits GdipGetPropertyItemSize GdipGetImageGraphicsContext GdipSaveImageToFile GdipDisposeImage GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipImageSelectActiveFrame GdipImageGetFrameCount GdipGetImageHeight GdipBitmapLockBits GdipCloneImage

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

vcruntime140

__current_exception_context __current_exception memchr _except_handler4_common __std_type_info_destroy_list wcsstr wcschr strstr strchr memset memmove memcpy wcsrchr _CxxThrowException __std_exception_destroy __std_exception_copy _purecall __std_terminate __CxxFrameHandler3

api-ms-win-crt-convert-l1-1-0

wcstod _wtof atoi strtol _wtol atof atol _wtoi

api-ms-win-crt-string-l1-1-0

wcsncpy wcscpy_s toupper _wcsicmp strcspn strspn _stricmp _wcslwr wcsncmp tolower _wcsupr towlower towupper iswspace isprint isdigit _wcsdup strncpy wcstok strncmp strncat _wcsnicmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf ungetc fseek fflush __stdio_common_vswprintf __stdio_common_vswprintf_s _get_osfhandle __stdio_common_vswscanf fclose __stdio_common_vsprintf __stdio_common_vsprintf_s setvbuf fsetpos _set_fmode _fseeki64 fgetpos fputc __p__commode _filelength _fileno __acrt_iob_func __stdio_common_vfprintf _wfopen_s fopen_s ferror _ftelli64 __stdio_common_vsnprintf_s feof fopen ftell _wfopen fread rewind _get_stream_buffer_pointers fwrite fgetc fgets

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _controlfp_s _invalid_parameter_noinfo abort terminate _exit _initterm_e _initterm _get_wide_winmain_command_line _invoke_watson _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _beginthreadex _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_at_quick_exit exit _crt_atexit _errno

api-ms-win-crt-heap-l1-1-0

free calloc malloc realloc _callnewh _set_new_mode

api-ms-win-crt-time-l1-1-0

_mkgmtime64 _mktime64 strftime _localtime64 _time64 wcsftime

api-ms-win-crt-filesystem-l1-1-0

_stat64i32 _mkdir _access remove _lock_file _unlock_file

api-ms-win-crt-utility-l1-1-0

qsort bsearch qsort_s

api-ms-win-crt-math-l1-1-0

frexp ldexp _libm_sse2_tan_precise _libm_sse2_acos_precise _CIfmod copysign _dclass _libm_sse2_log_precise _except1 _libm_sse2_exp_precise __setusermatherr _libm_sse2_sin_precise _libm_sse2_cos_precise _libm_sse2_sqrt_precise modf _finite _CIatan2 _libm_sse2_pow_precise floor ceil

api-ms-win-crt-multibyte-l1-1-0

_mbscmp _mbslwr _mbsicmp _mbsinc _mbschr _mbsrchr _mbsstr _ismbcspace _mbsupr

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

185855335a4f695da7129276aa8f62ff95300f182a6b83a7306ef6c97046970b

imm32

usp10

opengl32

kernel32

user32

gdi32

shell32

ole32

msvcp140

shlwapi

gdiplus

version

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic