5926c1542cfdb9b512cb658a0b9ae38a21cf686f61df0f8bb17e9df416d440da

Sharing

Copy URL Twitter E-mail

General

Target
5926c1542cfdb9b512cb658a0b9ae38a21cf686f61df0f8bb17e9df416d440da
Size 3.7MB
Sample260808-e9wpsahp2z
SHA256 5926c1542cfdb9b512cb658a0b9ae38a21cf686f61df0f8bb17e9df416d440da
MD5 713621df2a4de89b92475f5fb953ce2d
SHA1 d052fa71c02af531759deb93543840c37beaa0d7
SHA512 ca3562acbabc96675768689d1a6676e0b628c635f094904eb41b717372f121b87d60d538a237c580d46df169345e7712899f3497e1c1224885f3027763353f40
SSDEEP 98304:Af2Poh2dssoUa2yiflSWyWu22UH2GNRfs1/Z3h:Eh2dssoUa2jfwWyf22XZ3
TLSH
T14606AE223AB5C032D72303718D3CB65E91FDB9710FB442C7769C0A1E5EB05D2AA7A667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5926c1542cfdb9b512cb658a0b9ae38a21cf686f61df0f8bb17e9df416d440da

File Explorer

5926c1542cfdb9b512cb658a0b9ae38a21cf686f61df0f8bb17e9df416d440da

.exe 3.7MB

5926c1542cfdb9b512cb658a0b9ae38a21cf686f61df0f8bb17e9df416d440da

IMPHASH 8943c2fab1dfe2fef5258a243246192e
SHA256 5926c1542cfdb9b512cb658a0b9ae38a21cf686f61df0f8bb17e9df416d440da
MD5 713621df2a4de89b92475f5fb953ce2d
SHA1 d052fa71c02af531759deb93543840c37beaa0d7
SHA512 ca3562acbabc96675768689d1a6676e0b628c635f094904eb41b717372f121b87d60d538a237c580d46df169345e7712899f3497e1c1224885f3027763353f40
SSDEEP 98304:Af2Poh2dssoUa2yiflSWyWu22UH2GNRfs1/Z3h:Eh2dssoUa2jfwWyf22XZ3
TLSH
T14606AE223AB5C032D72303718D3CB65E91FDB9710FB442C7769C0A1E5EB05D2AA7A667
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1094665

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\new_soui3\yuelun_online_4.0\Release\YLToolHelper.pdb

jsoncpp

??4Value@Json@@QAEAAV01@ABV01@@Z ?newStreamWriter@StreamWriterBuilder@Json@@UBEPAVStreamWriter@2@XZ ??0CharReaderBuilder@Json@@QAE@XZ ??1CharReaderBuilder@Json@@UAE@XZ ?parseFromStream@Json@@YA_NABVFactory@CharReader@1@AAV?$basic_istream@DU?$char_traits@D@std@@@std@@PAVValue@1@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@5@@Z ?newCharReader@CharReaderBuilder@Json@@UBEPAVCharReader@2@XZ ?get@Value@Json@@QBE?AV12@PBDABV12@@Z ?isBool@Value@Json@@QBE_NXZ ?asInt@Value@Json@@QBEHXZ ?isInt@Value@Json@@QBE_NXZ ?isString@Value@Json@@QBE_NXZ ?asCString@Value@Json@@QBEPBDXZ ?isEqual@ValueIteratorBase@Json@@IBE_NABV12@@Z ?increment@ValueIteratorBase@Json@@IAEXXZ ?deref@ValueIteratorBase@Json@@IBEABVValue@2@XZ ?begin@Value@Json@@QBE?AVValueConstIterator@2@XZ ?end@Value@Json@@QBE?AVValueConstIterator@2@XZ ??0Value@Json@@QAE@W4ValueType@1@@Z ?append@Value@Json@@QAEAAV12@ABV12@@Z ??0Value@Json@@QAE@H@Z ??0Value@Json@@QAE@_J@Z ?asUInt64@Value@Json@@QBE_KXZ ??AValue@Json@@QBEABV01@H@Z ?empty@Value@Json@@QBE_NXZ ?asString@Value@Json@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ??AValue@Json@@QBEABV01@PBD@Z ?isArray@Value@Json@@QBE_NXZ ??0Value@Json@@QAE@ABV01@@Z ?isMember@Value@Json@@QBE_NPBD@Z ?isObject@Value@Json@@QBE_NXZ ??0Reader@Json@@QAE@XZ ?parse@Reader@Json@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVValue@2@_N@Z ?writeString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVFactory@StreamWriter@1@ABVValue@1@@Z ??AStreamWriterBuilder@Json@@QAEAAVValue@1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??1StreamWriterBuilder@Json@@UAE@XZ ??0StreamWriterBuilder@Json@@QAE@XZ ??0Value@Json@@QAE@PBD@Z ??0Value@Json@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??AValue@Json@@QAEAAV01@PBD@Z ??4Value@Json@@QAEAAV01@$$QAV01@@Z ??1Value@Json@@QAE@XZ ?asBool@Value@Json@@QBE_NXZ

ylproxy

?GetInstance@YueLunApiClient@@SAPAV1@XZ ?YLTwitchCurlRequest@YueLunApiClient@@QAE?AUHttpResponse@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0V34@10ABUSessionData@@H_N@Z

kernel32

GetModuleFileNameW GetProcessId WaitForSingleObject GetExitCodeProcess WaitForMultipleObjects CloseHandle ExitProcess GetFileAttributesW CreateProcessW GetLastError Sleep GetCurrentProcessId OpenProcess CreateEventW CreateThread SetEvent FreeLibrary GetProcAddress LoadLibraryW WritePrivateProfileStringW GetPrivateProfileStringW GetStdHandle GetConsoleMode ReadFile SetCurrentDirectoryW GetCommandLineW LocalFree MultiByteToWideChar WideCharToMultiByte FindClose FindFirstFileW FindNextFileW GetFullPathNameW FreeResource GetCurrentThreadId LockResource SizeofResource FindResourceW EnumResourceTypesW EnumResourceNamesW HeapCreate HeapDestroy HeapAlloc HeapFree InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetCurrentProcess FlushInstructionCache IsBadReadPtr OutputDebugStringA GetVersionExW GetVersionExA GetModuleHandleW GetModuleHandleA LoadLibraryA GetLocalTime GlobalAlloc GetSystemTime GetTickCount GlobalUnlock SetLastError lstrlenA TlsSetValue TlsGetValue TlsAlloc UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSizeEx GetFileInformationByHandle InitializeSListHead GetSystemTimeAsFileTime MulDiv LoadResource QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter GlobalLock UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount

user32

WaitMessage PostThreadMessageW DispatchMessageW TranslateMessage GetDesktopWindow SetActiveWindow EnableWindow GetForegroundWindow CallMsgFilterW PeekMessageW CheckMenuRadioItem GetSysColor GetMenuContextHelpId SetMenuContextHelpId GetMenuItemInfoW SetMenuInfo GetMenuInfo TrackPopupMenu DeleteMenu AppendMenuW InsertMenuW GetMenuItemCount GetSubMenu MapVirtualKeyA CharLowerBuffW SetCaretPos SystemParametersInfoA DrawTextW GetWindowPlacement CheckMenuItem DestroyMenu CreatePopupMenu IsMenu GetIconInfo CharNextW GetKeyState WindowFromPoint GetWindow SetParent GetParent SetWindowLongW GetWindowLongW MapWindowPoints ClientToScreen ShowCaret HideCaret CreateCaret GetWindowTextW SetWindowTextW InvalidateRect SetWindowRgn GetWindowDC IsWindowEnabled ReleaseCapture SetCapture GetCapture CallNextHookEx GetDlgItem IsZoomed IsIconic IsWindowVisible MoveWindow UpdateLayeredWindow ShowWindow CreateWindowExW RegisterClassExW UnregisterClassW CallWindowProcW DefWindowProcW SendNotifyMessageW SendMessageW GetMonitorInfoW MonitorFromWindow GetClassNameW GetClientRect EndPaint BeginPaint UpdateWindow SetFocus SetWindowPos SetLayeredWindowAttributes AnimateWindow TrackMouseEvent LoadImageW CreateIconFromResource LoadBitmapW DestroyCursor LoadCursorW DestroyWindow EnableMenuItem IsWindow PostQuitMessage PtInRect EqualRect UnionRect IntersectRect InflateRect SetCursor KillTimer SetTimer LoadStringA LoadStringW MessageBoxW GetSystemMetrics GetWindowRect MonitorFromRect GetDC ReleaseDC ScreenToClient EnumWindows GetWindowThreadProcessId DestroyIcon GetCursorPos SetForegroundWindow RegisterWindowMessageW IsRectEmpty CopyRect GetActiveWindow PostMessageW OffsetRect DrawIconEx SetWindowsHookExW UnhookWindowsHookEx GetDlgCtrlID SetRect SystemParametersInfoW GetFocus

gdi32

GetClipBox BitBlt ExcludeClipRect RectInRegion DeleteObject GdiFlush GetTextFaceW ExtTextOutW GetTextMetricsW SetTextAlign SetTextColor RemoveFontMemResourceEx AddFontMemResourceEx GetTextExtentPointI GetGlyphIndicesW GetFontUnicodeRanges GetOutlineTextMetricsW GetGlyphOutlineW GetFontData GetCharABCWidthsW EnumFontFamiliesExW EnumFontsW CreateBitmap CreateCompatibleDC DeleteDC SelectObject SetGraphicsMode CreateFontIndirectW CreateSolidBrush GetStockObject Rectangle SetBkMode GetObjectW GetViewportOrgEx GetCurrentObject CreateDIBSection SetWorldTransform SelectClipRgn IntersectClipRect ExtCreateRegion GetDCOrgEx StretchBlt CreateCompatibleBitmap SetViewportOrgEx GetDeviceCaps

shell32

Shell_NotifyIconW SHGetFolderPathA ShellExecuteW CommandLineToArgvW ShellExecuteA

ole32

CoCreateInstance CLSIDFromProgID CoCreateGuid CLSIDFromString CreateBindCtx RegisterDragDrop OleUninitialize OleInitialize CreateStreamOnHGlobal OleLockRunning

msvcp140

?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD4@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?getloc@ios_base@std@@QBE?AVlocale@2@XZ ??Bid@locale@std@@QAEIXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ ?_Getdays@_Locinfo@std@@QBEPBDXZ ?_Getmonths@_Locinfo@std@@QBEPBDXZ ?_W_Getdays@_Locinfo@std@@QBEPBGXZ ?_W_Getmonths@_Locinfo@std@@QBEPBGXZ ?_Xbad_alloc@std@@YAXXZ _Mbrtowc _Cnd_do_broadcast_at_thread_exit ?_Xbad_function_call@std@@YAXXZ _Cnd_wait _Cnd_broadcast _Cnd_signal _Cnd_destroy_in_situ _Cnd_init_in_situ _Mtx_unlock _Mtx_lock _Mtx_destroy_in_situ _Mtx_init_in_situ _Thrd_hardware_concurrency ?_Throw_C_error@std@@YAXH@Z _Thrd_join _Thrd_id ?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPBD@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z _Xtime_get_ticks _Thrd_detach ?_Xout_of_range@std@@YAXPBD@Z _Query_perf_frequency _Query_perf_counter _Thrd_sleep ?_Random_device@std@@YAIXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipCloneImage GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipAlloc GdipImageSelectActiveFrame GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdipDrawImageRectI GdipDeleteGraphics GdipDrawImageI GdipBitmapLockBits GdipBitmapUnlockBits GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipGetPropertyItemSize GdipGetPropertyItem GdiplusStartup GdipDisposeImage GdipFree GdiplusShutdown GdipSaveImageToFile GdipGraphicsClear GdipGetImageEncoders GdipGetImageEncodersSize GdipGetImageGraphicsContext

ws2_32

socket htons bind closesocket WSACleanup htonl WSAStartup

crypt32

CryptBinaryToStringA CryptStringToBinaryA

shlwapi

StrToIntExW

imm32

ImmReleaseContext ImmAssociateContext ImmGetContext ImmDestroyContext ImmCreateContext

vcruntime140

memset wcsstr wcschr memmove memcpy memcmp __std_exception_copy __current_exception _purecall __std_terminate __CxxFrameHandler3 _except_handler4_common longjmp _setjmp3 wcsrchr _CxxThrowException __std_type_info_destroy_list strchr strstr memchr __std_exception_destroy __current_exception_context

api-ms-win-crt-convert-l1-1-0

atof wcstod _wtoi _wtof atoi strtol _itow

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _controlfp_s _beginthreadex _execute_onexit_table _crt_atexit abort _register_thread_local_exe_atexit_callback _c_exit _crt_at_quick_exit _exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv terminate _set_app_type _cexit _invalid_parameter_noinfo _errno _seh_filter_exe _invalid_parameter_noinfo_noreturn exit _seh_filter_dll

api-ms-win-crt-stdio-l1-1-0

fgetc __stdio_common_vswprintf_s fputc __stdio_common_vswscanf _wfopen_s fopen_s ferror _ftelli64 __stdio_common_vsnprintf_s ungetc fopen setvbuf __stdio_common_vsprintf_s _set_fmode __p__commode __stdio_common_vswprintf fclose _wfopen _fileno _filelength __stdio_common_vsprintf _get_stream_buffer_pointers fread fwrite fgetpos _fseeki64 __stdio_common_vsscanf _get_osfhandle rewind __stdio_common_vfprintf fgets __acrt_iob_func ftell fseek feof fsetpos fflush

api-ms-win-crt-heap-l1-1-0

free calloc malloc realloc _set_new_mode

api-ms-win-crt-string-l1-1-0

strcmp strncmp strcspn isdigit strspn wcstok _wcsnicmp wcscpy_s _wcsicmp iswspace towupper wcscpy strcpy isprint wcsncmp towlower wcscmp wcslen _wcslwr wcsncpy strlen tolower toupper _wcsupr _wcsdup

api-ms-win-crt-time-l1-1-0

_gmtime64 _mkgmtime64 wcsftime _localtime64_s _time64 _mktime64 _localtime64 strftime

api-ms-win-crt-filesystem-l1-1-0

_mkdir _stat64i32 remove _unlock_file _lock_file _access

api-ms-win-crt-multibyte-l1-1-0

_mbsstr _ismbcspace _mbsupr _mbsrchr _mbslwr _mbsinc _mbsicmp _mbscmp _mbschr

api-ms-win-crt-math-l1-1-0

fabs pow modf _finite frexp floor ceil cos sin tan atan2 acos __setusermatherr ldexp copysign fmod log sqrt exp _except1

api-ms-win-crt-utility-l1-1-0

_lrotl div qsort bsearch abs qsort_s labs

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

usp10

ScriptItemize ScriptFreeCache ScriptShape

opengl32

wglGetProcAddress wglGetCurrentContext

generic

count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=261, version=27412,

count=1, id=253, version=28518,

count=14, id=260, version=30034,

count=11, id=259, version=30034,

count=1, id=263, version=27412,

count=22, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=356, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=30, id=261, version=30034,

count=4, id=257, version=30034,

count=9, id=260, version=27412,

count=26, id=257, version=27412,

count=2, id=257, productName=VS2015 [14.0] build 23026, version=23026,

count=3, id=257, version=35217,

count=628, id=1, productName=Unmarked objects,

count=109, id=261, productName=VS2015 [14.0] build 23026, version=23026,

count=27, id=265, version=30159,

count=1, id=255, version=30159,

count=1, id=151,

count=1, id=258, version=30159,