huyanbao_last_v3[.]1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
huyanbao_last_v3.1.exe
Size 6.9MB
Sample260905-rffspadn8z
SHA256 fe9ab50f0f288e7b26df6b02f2217049143ab4fe7d56d5953e3b88998e520127
MD5 9bd1b5ab09cf3057d610ea8a4997b786
SHA1 36c71659bd58a1892756806e05bb022404f30af2
SHA512 b8c63d37bd277baf015da387a3c22c77343102a60af859193ae8ff88305b617d3bbbb199aeb8b77598556b888882adbdfa312d01a1aabb246cbedcbe295bdfeb
SSDEEP 98304:S3PUzk6t0rDK2BjDyXtDGOb6bp/4gLY3KIbbLnMrhXbCM6QpWJEUKquSKI/8nO9N:SmJ2aEjDyXtDR6b1J2MluM6QpguSKpdC
TLSH
T1037623940617938BE69C3636C7570C6EB2661D79E170861A9520F9EE20FF207CEF74B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
huyanbao_last_v3.1.exe
unpack001/$PLUGINSDIR/System.dll
unpack002/HuYanBao.exe
unpack002/uninst.exe
unpack003/$PLUGINSDIR/FindProcDLL.dll
unpack003/$PLUGINSDIR/KillProcDLL.dll
unpack003/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/$PLUGINSDIR/nsis7z.dll

File Explorer

huyanbao_last_v3.1.exe

.exe 6.9MB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/app_root.7z

.7z 3.3MB
HuYanBao.exe

.exe 4.9MB
uninst.exe

.exe 223KB
$PLUGINSDIR/FindProcDLL.dll

.dll 27KB
$PLUGINSDIR/KillProcDLL.dll

.dll 36KB
$PLUGINSDIR/LangDLL.dll

.dll 5KB
$PLUGINSDIR/app_sub_resources.7z

.7z 2.6MB
chunk.blob

2.6MB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsProcess.dll

.dll 4KB
$PLUGINSDIR/nsis7z.dll

.dll 1.3MB

huyanbao_last_v3.1.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 fe9ab50f0f288e7b26df6b02f2217049143ab4fe7d56d5953e3b88998e520127
MD5 9bd1b5ab09cf3057d610ea8a4997b786
SHA1 36c71659bd58a1892756806e05bb022404f30af2
SHA512 b8c63d37bd277baf015da387a3c22c77343102a60af859193ae8ff88305b617d3bbbb199aeb8b77598556b888882adbdfa312d01a1aabb246cbedcbe295bdfeb
SSDEEP 98304:S3PUzk6t0rDK2BjDyXtDGOb6bp/4gLY3KIbbLnMrhXbCM6QpWJEUKquSKI/8nO9N:SmJ2aEjDyXtDR6b1J2MluM6QpguSKpdC
TLSH
T1037623940617938BE69C3636C7570C6EB2661D79E170861A9520F9EE20FF207CEF74B2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

HuYanBao.exe

IMPHASH 59e64a361da0c615417583f40153f929
SHA256 e6ff1a6d784500d4a10ebc65da089417116de6332175a44a64593bdd23e024ec
MD5 c5475cb4d350a8c8ade70fd32187325a
SHA1 b611a53316d24acea072bf371c9c46963c1b8391
SHA512 cc566e0c10111dbf72f4b0286ef4edcec90047e79ff5213c2a2e75eeab605d671a9de9a0e989e99d4814b3728888700a34d8940a08ebb77fd57d382bcee26632
SSDEEP 98304:YSXX8f/47cvoRasMDHqKwRsfnxlek12jajAxWuN8C+8i1qD1A/LdQZklBIpH40SQ:Y4JKBze2cKAxWuN8C+8i1qa/kSIpHfP
TLSH
T12036D02136608176C13E2132955BB36FA979AD601B3141C77598FDFE2BB12C35A3B23B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1517032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

IsValidLocale WriteConsoleW GetProcessHeap GetTimeZoneInformation EnumSystemLocalesA CreateFileA GetStringTypeW IsProcessorFeaturePresent IsValidCodePage GetOEMCP GetLocaleInfoA GetConsoleMode GetConsoleCP LCMapStringW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter TerminateProcess QueryPerformanceCounter HeapCreate SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle Sleep SetUnhandledExceptionFilter SetStdHandle VirtualQuery GetSystemInfo VirtualAlloc HeapQueryInformation HeapSize ExitThread RtlUnwind RaiseException GetDateFormatA GetTimeFormatA GetSystemTimeAsFileTime GetDateFormatW GetTimeFormatW HeapAlloc HeapReAlloc HeapFree EncodePointer DecodePointer GetStartupInfoW HeapSetInformation GetCommandLineW FindResourceExW GetUserDefaultLCID VirtualProtect SearchPathW GetProfileIntW InitializeCriticalSectionAndSpinCount GetNumberFormatW GetWindowsDirectoryW GetTempFileNameW lstrcpyW lstrlenA GlobalGetAtomNameW GlobalFlags GlobalFindAtomW CompareStringW SetErrorMode TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc ReleaseActCtx CreateActCtxW GetFileTime GetFileSizeEx FileTimeToLocalFileTime FileTimeToSystemTime GetFileAttributesExW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose SetEndOfFile UnlockFile LockFile FlushFileBuffers DeleteFileW lstrcmpiW GetThreadLocale WaitForSingleObject ResumeThread SetThreadPriority GlobalAddAtomW GetCurrentProcessId GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileIntW lstrcmpA GlobalDeleteAtom GetCurrentThread GetCurrentThreadId GetUserDefaultUILanguage ConvertDefaultLocale GetSystemDefaultUILanguage GetLocaleInfoW ActivateActCtx DeactivateActCtx lstrcmpW InterlockedExchange GlobalFree CopyFileW GlobalSize FormatMessageW LocalFree SetLastError DuplicateHandle GetFileType GetCurrentProcess SystemTimeToFileTime SetFilePointer DosDateTimeToFileTime ExitProcess GetACP OpenFileMappingW CreateFileMappingW GetTempPathW GetFileAttributesW GetVersionExW WriteFile UnmapViewOfFile MapViewOfFile CreateMutexW CreateThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSection OutputDebugStringW GetSystemDefaultLangID MultiByteToWideChar GetCurrentDirectoryW GetModuleFileNameW GetModuleHandleW FreeLibrary FreeResource LockResource SizeofResource LoadResource FindResourceW CloseHandle GlobalUnlock CreateFileW ReadFile GlobalAlloc GlobalLock GetFileSize InterlockedDecrement InterlockedIncrement GetLastError lstrlenW WideCharToMultiByte GetLocalTime GetTickCount GetProcAddress MulDiv LoadLibraryW SetEnvironmentVariableA

user32

CreateMenu IsMenu MonitorFromPoint TranslateMDISysAccel DrawMenuBar DefMDIChildProcW DefFrameProcW CopyImage GetIconInfo EnableScrollBar InvertRect GetMenuDefaultItem RegisterClipboardFormatW CreateDialogIndirectParamW EndDialog UnpackDDElParam ReuseDDElParam InsertMenuItemW TranslateAcceleratorW LockWindowUpdate BringWindowToTop SetCursorPos LoadAcceleratorsW GetKeyboardState GetKeyboardLayout MapVirtualKeyW ToUnicodeEx DrawFocusRect DrawFrameControl DrawEdge DrawIconEx DrawStateW GetSystemMenu SetClassLongW GetAsyncKeyState NotifyWinEvent CreatePopupMenu DestroyAcceleratorTable SetParent RedrawWindow GetMenuItemInfoW MessageBeep GetNextDlgTabItem GetNextDlgGroupItem CopyAcceleratorTableW DestroyIcon WaitMessage WindowFromPoint SetLayeredWindowAttributes EnumDisplayMonitors SetRectEmpty GetWindowDC GrayStringW DrawTextExW TabbedTextOutW DeleteMenu RealChildWindowFromPoint IsDialogMessageW CheckDlgButton RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW RemovePropW SetActiveWindow BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow GetMessageTime GetMessagePos ScrollWindow TrackPopupMenu SetMenu SetScrollRange PostThreadMessageW SetScrollPos GetScrollPos ShowScrollBar GetClassInfoW EqualRect DeferWindowPos GetScrollInfo SetScrollInfo CopyRect SetWindowPlacement GetWindowPlacement GetDlgCtrlID GetSysColorBrush UnregisterClassW UnhookWindowsHookEx CharUpperW SetWindowsHookExW CallNextHookEx GetActiveWindow PeekMessageW ValidateRect SetWindowContextHelpId MapDialogRect GetWindowThreadProcessId GetLastActivePopup IsWindowEnabled ShowOwnedPopups SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem GetMenuState GetMenuStringW AppendMenuW GetMenuItemID InsertMenuW GetMenuItemCount RemoveMenu wvsprintfW InflateRect OffsetRect GetWindowRgn keybd_event GetSubMenu TrackPopupMenuEx LoadMenuW GetLastInputInfo DestroyMenu GetClassNameA GetDesktopWindow GetShellWindow IsWindowVisible GetForegroundWindow GetClientRect IsZoomed KillTimer LoadIconW UpdateWindow DrawTextW CharPrevW SetRect UpdateLayeredWindow GetUpdateRect UnionRect GetCaretBlinkTime GetMessageW PostQuitMessage LoadImageW GetClassInfoExW wsprintfW SetPropW SetMenuDefaultItem IsClipboardFormatAvailable FrameRect OpenClipboard SetClipboardData CloseClipboard EmptyClipboard DestroyCursor DrawIcon TranslateMessage GetMenu RegisterClassExW SystemParametersInfoW CreateWindowExW AdjustWindowRectEx RegisterClassW GetSystemMetrics GetPropW CallWindowProcW GetWindow DispatchMessageW ClientToScreen HideCaret SubtractRect MapVirtualKeyExW GetKeyNameTextW IsCharLowerW GetDoubleClickTime GetScrollRange CopyIcon ScreenToClient SetTimer MoveWindow DefWindowProcW ReleaseCapture ShowWindow ReleaseDC InvalidateRect IntersectRect GetDC BeginPaint CreateAcceleratorTableW InvalidateRgn SetCapture FillRect DestroyWindow EndPaint PtInRect LoadCursorW CharNextW SetCursor GetMonitorInfoW MapWindowPoints SendMessageW GetCursorPos MonitorFromWindow GetParent IsWindow SetFocus FindWindowW GetWindowRect SetWindowTextW EnableWindow MessageBoxW SetWindowPos SetWindowLongW GetWindowTextW GetWindowLongW GetKeyState GetWindowTextLengthW GetFocus IsRectEmpty SetForegroundWindow PostMessageW IsIconic SetWindowRgn SetCaretPos CreateCaret GetCaretPos GetSysColor ShowCaret CharUpperBuffW

gdi32

CreatePatternBrush SelectPalette GetObjectType CreateHatchBrush CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetBkColor GetTextColor GetRgnBox SetRectRgn GetMapMode PatBlt DPtoLP CreatePolygonRgn CreateEllipticRgn Polyline Ellipse Polygon CreatePalette GetPaletteEntries GetNearestPaletteIndex GetSystemPaletteEntries OffsetRgn SetDIBColorTable EnumFontFamiliesExW LPtoDP GetWindowOrgEx GetViewportOrgEx FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries GetTextFaceW SetPixelV ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutW RectVisible PtVisible GetWindowExtEx GetViewportExtEx SetLayout GetLayout SetTextAlign IntersectClipRect ExcludeClipRect RealizePalette GetDeviceCaps SetROP2 SetPolyFillMode CreateBitmap CreateDCW CopyMetaFileW PtInRegion CreateRectRgn SetDeviceGammaRamp MoveToEx LineTo StretchBlt SetBkColor SelectClipRgn CreatePenIndirect CreateRectRgnIndirect CombineRgn Rectangle GetCharABCWidthsW SetStretchBltMode GetClipBox RoundRect ExtSelectClipRgn GetObjectA TextOutW SetWindowOrgEx BitBlt GetTextMetricsW DeleteDC CreateDIBSection SelectObject CreateCompatibleDC CreateCompatibleBitmap SaveDC CreatePen RestoreDC SetPixel GetPixel CreateFontIndirectW GetObjectW CreateRoundRectRgn SetTextColor SetBkMode GetStockObject CreateSolidBrush DeleteObject GetTextExtentPoint32W SetMapMode

msimg32

TransparentBlt AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegDeleteValueW RegOpenKeyExW RegCloseKey RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegEnumKeyW RegQueryValueW RegEnumValueW RegEnumKeyExW RegQueryValueExW

shell32

SHAppBarMessage ShellExecuteW SHGetFileInfoW DragFinish DragQueryFileW SHBrowseForFolderW Shell_NotifyIconW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetDesktopFolder

comctl32

_TrackMouseEvent ord17 InitCommonControlsEx ImageList_GetIconSize

shlwapi

PathFindExtensionW PathFindFileNameW PathStripToRootW PathIsUNCW PathRemoveFileSpecW

ole32

CoTaskMemAlloc CoTaskMemFree OleGetClipboard ReleaseStgMedium OleDuplicateData CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoInitializeEx OleUninitialize CoFreeUnusedLibraries OleInitialize OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator OleIsCurrentClipboard OleFlushClipboard DoDragDrop CoRevokeClassObject CoRegisterMessageFilter CoCreateGuid CoInitialize CoUninitialize CreateStreamOnHGlobal CLSIDFromString RevokeDragDrop CLSIDFromProgID OleLockRunning CoCreateInstance CoLockObjectExternal RegisterDragDrop

oleaut32

SysAllocStringLen VariantChangeType VariantCopy VariantInit SafeArrayDestroy SystemTimeToVariantTime SysStringLen VarBstrFromDate OleCreateFontIndirect VariantClear SysFreeString SysAllocString VariantTimeToSystemTime

oledlg

OleUIBusyW

winmm

PlaySoundW mciSendCommandW timeGetDevCaps timeBeginPeriod timeKillEvent timeEndPeriod timeSetEvent timeGetTime

gdiplus

GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipDrawImageI GdipSetInterpolationMode GdipCreateBitmapFromHBITMAP GdipCreateFontFromDC GdipDeleteStringFormat GdipSetStringFormatTrimming GdipFillRectangleI GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipDrawString GdipCreateSolidFill GdipGetImagePixelFormat GdipDeleteFont GdipSetTextRenderingHint GdipSetStringFormatLineAlign GdipMeasureString GdipCreateFontFromLogfontA GdipDeleteBrush GdipSetStringFormatFlags GdiplusStartup GdiplusShutdown GdipImageGetFrameCount GdipGetImageWidth GdipCloneImage GdipImageGetFrameDimensionsCount GdipCreateFromHDC GdipGetPropertyItemSize GdipDisposeImage GdipAlloc GdipGetPropertyItem GdipImageSelectActiveFrame GdipImageGetFrameDimensionsList GdipDrawImageRectI GdipGetImageHeight GdipFree GdipLoadImageFromStream GdipSetStringFormatAlign GdipDeleteGraphics

imm32

ImmGetContext ImmSetCompositionWindow ImmGetOpenStatus ImmReleaseContext

wininet

InternetCloseHandle InternetReadFile InternetOpenUrlW InternetOpenW

d3d9

Direct3DCreate9

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

uninst.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 db8386c08d52daef58593beb22fa2de248c7e092f92e8ac4dfb5ef34fc199bcc
MD5 baf32e36bd8529e5863cafb2f16fcc99
SHA1 80a37e8debc816b32a79df61a7f0299869ca8263
SHA512 58df391f37cd718a0d1052eb53ee52b5a8c512cd4046568a3ef7ca3d85ed484898a21f5c32e8fd97677b4a6bf133662aff6a6ba432667ee1ff5b2e621cdb54ce
SSDEEP 3072:H5BuYAVrgUCPnSqMSD+t+MHuR58lOCkqbjO:H50gUCVv+AVWlOCkqO
TLSH
T1632427C166B78F67E5BC16731462467E0E65AC331931862B6240FACFA8736138C3B776
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/FindProcDLL.dll

IMPHASH e26d7460d0c04056b9226a899477ba4d
SHA256 6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9
MD5 6f73b00aef6c49eac62128ef3eca677e
SHA1 1b6aff67d570e5ee61af2376247590eb49b728a1
SHA512 678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938
SSDEEP 384:DZoRF0XXUuJReQg0Tw67ADWBTgmldIogUD3GLgFmyaX/fVYcWJQCDmrinogRdBl:DZaF0HtTwuz9yu3KgwRX1nWJ1q+noI
TLSH
T12DC26C107C9042B7D28E5671A1E50F075B3F6E512AE65883CF256ADA2D612F0FA3F31B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6100

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/KillProcDLL.dll

IMPHASH d806a080e21508dd768fa70be247d2ae
SHA256 de1177a4bd1c56c3555f366d40b37d7dd9cb25e16c4973d0a4d22bf9a8af7aed
MD5 1cc87d2b5a79b18f133b4f944e2f2f74
SHA1 98e0ddb727c76e06be1668434d754e5b80a0c154
SHA512 d8fee1c09fef9af4e1f38baaffa3a6d059713b14ecad900815c086cc22855644fcdeacd6bba31ea6e6925831e650f7b0d34e6dea4c57a978fb4f5bf0cd6d72a9
SSDEEP 384:JLmJwO50x66T9JOpOUT38YZvml7xoKdyuwlx8xSiorppugBwUdJopS:JW50hJwwUTsXdPwxvtpDtdJo
TLSH
T1DFF26C507C8144F7C28E4235A5A9AB179FBF692036E55983CF269EDA1C311F0E93B307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6841

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/LangDLL.dll

IMPHASH e981c0ab92cb1f191bb5e23392e14796
SHA256 47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6
MD5 a1cd3f159ef78d9ace162f067b544fd9
SHA1 72671fdf4bfeeb99b392685bf01081b4a0b3ae66
SHA512 ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362
SSDEEP 48:apTVWFeApYx2lxaKe3yfeEIWCGWNpBWLGGrx3pMt4z8mtJ7HofYZVSLa:RFG0xaKkyfjIWTW7BYrhSbmtJ7/V
TLSH
T1D8B18331F3C08CF5C692453A28D337D6AA56BA141748445FCBA726AB2910DEBEF3D781
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH 439074d1c01f7b16781bdf060930814a
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis7z.dll

IMPHASH f2f3e95cbf8fb9e86846ee5e8656853e
SHA256 2d24132e09a2bd434cadd3e4b0f9fa6f5eb8630a3d8b2bd6de6ce88d96e9707b
MD5 bd67fe303f31bf19947a55d11d7bcfa8
SHA1 3a604c448f5a04ba00d1572b0801b1803d34c5e3
SHA512 65183447b7596b239b14fe2da57cb93e0c2ada3bcabebd9addf351d13f31dc6b6cd41184b6672095456a06482567e58d03a04eaeeb687ef0e73ed7ae9130e13d
SSDEEP 24576:8fiWl61crAGr8RH+tzB+GRK/vjA/Gt/Vw4e5:qJjr8R0B+EQvjA/Gta5
TLSH
T14D558E51EDB280FAC14F9770D53D673BAA3253178E1C4D6FDA689EE85C31660F20A12E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1090437

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CompareFileTime CompareStringW CreateDirectoryW CreateEventW CreateFileA CreateFileW CreateSemaphoreW CreateThread DecodePointer DeleteCriticalSection DeleteFileW DeviceIoControl DosDateTimeToFileTime EncodePointer EnterCriticalSection ExitProcess ExitThread FileTimeToDosDateTime FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindCloseChangeNotification FindFirstChangeNotificationW FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceW GetDriveTypeW GetEnvironmentStringsW GetExitCodeThread GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetLastError GetLogicalDriveStringsW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetTickCount GetVersionExW GetVolumeInformationW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalMemoryStatus HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileW MultiByteToWideChar OpenEventW OpenFileMappingW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW ResetEvent SetConsoleCtrlHandler SetConsoleMode SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileApisToANSI SetFileApisToOEM SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetLastError SetProcessAffinityMask SetStdHandle SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcpyW lstrcpynW lstrlenW

comdlg32

GetOpenFileNameW

advapi32

AdjustTokenPrivileges GetFileSecurityW GetUserNameW LookupAccountNameW LookupPrivilegeValueW LsaAddAccountRights LsaClose LsaOpenPolicy OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW SetFileSecurityW

user32

CharPrevExA CharUpperW FindWindowExW FindWindowW GetDlgItem GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId LoadStringW SendMessageW SetWindowTextW wsprintfW

shell32

DragFinish DragQueryFileW SHBrowseForFolderW SHGetMalloc SHGetPathFromIDListW

ole32

CoInitialize CoUninitialize

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantClear VariantCopy

ntdll

NtAllocateVirtualMemory NtAlpcConnectPort NtAlpcCreatePort NtAlpcSetInformation NtClose NtDuplicateObject NtGetNextProcess NtQueryInformationFile NtQueryInformationProcess NtQueryInformationWorkerFactory NtQueryObject NtReadFile NtSetInformationWorkerFactory NtWriteVirtualMemory RtlAllocateHeap RtlFreeHeap RtlRunDecodeUnicodeString RtlUnwind

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

148KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

huyanbao_last_v3.1.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/app_root.7z

HuYanBao.exe

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

winmm

gdiplus

imm32

wininet

d3d9

oleacc

generic

uninst.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/FindProcDLL.dll

kernel32

generic

$PLUGINSDIR/KillProcDLL.dll

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/app_sub_resources.7z

chunk.blob

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsProcess.dll

kernel32

user32

generic

$PLUGINSDIR/nsis7z.dll

kernel32

comdlg32