11102026_0154_04102026_20262743130870[.]1E9CFF[.]vhd[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
11102026_0154_04102026_20262743130870.1E9CFF.vhd.zip
Size 3.0MB
Sample261011-cble2styb1
SHA256 9576956612a9cc8d9338e7afcad59adee4fb8d74cba6dc63281438c7c2ebdc81
MD5 8f6a09c66630fc0ea4a7171e4bb8ac22
SHA1 18826bb69877cc9d136ff493372b2f43d209a891
SHA512 246dbc58b2871df47fca42c2e3dd754ebe69b909cb884313bd15fea195bddf15b3fd01da5e0a2c5c5affb00bd9606d9e3a6d60f3b85dfb888a9901c598f1ee8d
SSDEEP 98304:0/b9gtHaO2xaK98khrNnXcdGxf+HyRcc2RbbyRbqr:0hRO275ZmSRcc29bb
TLSH
T107E5332020E43661F7CA81B149950402DD4D6168BADEE2DCCBA3F6E4F12F6DF9B5F1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack002/certpick.dll
unpack002/rimE.DLL

File Explorer

11102026_0154_04102026_20262743130870.1E9CFF.vhd.zip

.zip 3.0MB
20262743130870.1E9CFF.vhd

.vhd 16.0MB
System Volume Information/WPSettings.dat

12B
Z#2743130870.exe

.exe 1.9MB
certpick.dll

.dll 19KB
f0e9008b-eb5a-4066-b400-2f51d47f4305.bak

14KB
rimE.DLL

.dll 3.4MB

11102026_0154_04102026_20262743130870.1E9CFF.vhd.zip

SHA256 9576956612a9cc8d9338e7afcad59adee4fb8d74cba6dc63281438c7c2ebdc81
MD5 8f6a09c66630fc0ea4a7171e4bb8ac22
SHA1 18826bb69877cc9d136ff493372b2f43d209a891
SHA512 246dbc58b2871df47fca42c2e3dd754ebe69b909cb884313bd15fea195bddf15b3fd01da5e0a2c5c5affb00bd9606d9e3a6d60f3b85dfb888a9901c598f1ee8d
SSDEEP 98304:0/b9gtHaO2xaK98khrNnXcdGxf+HyRcc2RbbyRbqr:0hRO275ZmSRcc29bb
TLSH
T107E5332020E43661F7CA81B149950402DD4D6168BADEE2DCCBA3F6E4F12F6DF9B5F1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

Z#2743130870.exe

IMPHASH 9071e050024b691ff30e815dde620015
SHA256 c74f55247aa2c72001024bd977c869cb5adce6f8604a4d32329f015b73ae2a49
MD5 711cd47d4524145f9c488afecc85ebc7
SHA1 2f9e5368c039db49018ec41bbb20a3b085788b24
SHA512 8bf03abb818d6d11f210e17a7e8c8f3c941774390cf0c5e679cb18331089341d43486cdc7af1203b29eac476f2f802f789f17ec6926d17fdd099d13172a79a15
SSDEEP 24576:DitHbptR5UngkbfXXqO7jiugTdtHxVAuN9AGFwzojqnIXxXi2+QV8epwMGqtc:WtR5UngkzvyPtHxWzojqnIXtl+NeBGqq
TLSH
T105953A203942C13EEA9113718D78EAFA565DAD102F35D1CF63987A6A3B78DC31933627
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Password

infected

Digest

10:33:54:47:94:d3:a5:c7:af:79:f6:54:da:71:62:6e:db:62:86:30:a3:93:30:31:ae:9a:a8:7d:ee:32:d0:01

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91310120MA1HYANY1L,CN=卡饭（上海）信息安全有限公司,O=卡饭（上海）信息安全有限公司,POSTALCODE=201400,STREET=奉贤区金海公路6055号28幢1层,L=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Oct 12, 2021

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 3, 2014 - Dec 2, 2029

Subject

Serial Number

a6:02:b1:29:d0:4f:62:4e:59:28:95:91:74:86:02:95

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 5, 2020 - Nov 5, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

602197

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\gitlab\builds\aCoD4X3k\0\qingyun\qingyuninput\ivan\output\KafanInputService.pdb

imm32

ImmDisableIME

rime

RimeFreeStatus RimeGetStatus rime_get_api RimeConfigNext RimeConfigBeginMap RimeConfigGetString RimeConfigGetBool RimeConfigGetInt RimeGetProperty RimeSchemaOpen RimeConfigSetBool RimeConfigEnd RimeSetOption RimeDeleteCandidate RimeFixAtFirst RimeSetProperty RimeConfigSetInt RimeClearComposition RimeCommitComposition RimeIsKeyEaten RimeProcessKey RimeDestroySession RimeCreateSession RimeFindSession RimeFinalize RimeConfigOpen RimeStartMaintenance RimeInitialize RimeSetNotificationHandler RimeSetup RimeConfigGetCString RimeConfigClose RimeConfigSetString RimeUserConfigOpen RimeGetOption

kernel32

GetProcAddress LoadLibraryExW LoadResource SizeofResource FindResourceW LoadLibraryW LocalAlloc LocalFree lstrcmpiW IsBadWritePtr VerifyVersionInfoW MultiByteToWideChar CreateToolhelp32Snapshot Thread32First Thread32Next HeapAlloc HeapFree GetProcessHeap SetEvent CreateEventA CreateEventW FormatMessageW WideCharToMultiByte WaitForSingleObjectEx CreateMutexW GetModuleFileNameA FindResourceA LockResource InitializeCriticalSectionEx Sleep QueryPerformanceCounter QueryPerformanceFrequency WaitNamedPipeW SetNamedPipeHandleState CreateFileW WriteFile FlushFileBuffers DisconnectNamedPipe ReadFile CreateNamedPipeW ConnectNamedPipe GetModuleHandleExW SleepEx ExpandEnvironmentStringsW HeapSize HeapReAlloc HeapDestroy FileTimeToSystemTime SystemTimeToFileTime GetLocalTime GetTempPathW SetErrorMode GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW GetCurrentProcess GetExitCodeProcess Process32FirstW Process32NextW GetFileAttributesW DeleteFileW FindFirstFileW SetFileAttributesW FindNextFileW FindClose RemoveDirectoryW GetFileSize CopyFileW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceInitialize InitOnceExecuteOnce InitOnceBeginInitialize InitOnceComplete InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetTickCount64 GetModuleHandleA GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetTickCount TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread GetStringTypeW GetStartupInfoW ResetEvent TerminateProcess UnhandledExceptionFilter LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer WriteConsoleW OutputDebugStringW IsDebuggerPresent FreeLibrary UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualQuery GetVersionExW CreateProcessW ResumeThread SuspendThread OpenThread GetCurrentThreadId GetCurrentProcessId WaitForSingleObject LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetLastError SetUnhandledExceptionFilter CloseHandle CreateDirectoryW GetCommandLineW VerSetConditionMask DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException DecodePointer ReleaseSemaphore WaitForMultipleObjectsEx OpenEventA SetWaitableTimer GetSystemInfo GetLogicalProcessorInformation CreateWaitableTimerA RtlUnwind InterlockedFlushSList GetConsoleMode ReadConsoleW GetConsoleCP ExitProcess GetStdHandle CreateThread ExitThread FreeLibraryAndExitThread GetCurrentThread GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleCtrlHandler SetStdHandle SetFilePointerEx HeapQueryInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA SetEnvironmentVariableW GetTimeZoneInformation GetFileSizeEx GetModuleHandleW OpenProcess

user32

WindowFromPoint MoveWindow UpdateLayeredWindow ReleaseDC SystemParametersInfoW IsRectEmpty GetKeyState SendInput GetSystemMetrics UnregisterClassW DefWindowProcW DestroyWindow CharNextW wsprintfW SetWindowTextW PostQuitMessage MonitorFromWindow GetWindowThreadProcessId CloseDesktop OpenDesktopW AllowSetForegroundWindow WaitForInputIdle LoadStringW LoadCursorW GetDC IsWindow PostMessageW DispatchMessageW TranslateMessage GetMessageW SetWindowPos ScreenToClient GetMonitorInfoW EnableWindow ShowWindow GetDlgItem CallWindowProcW CreateWindowExW GetWindowLongW SetWindowLongW GetWindowRect GetClassInfoExW RegisterClassExW PeekMessageW

gdi32

GetObjectW CreateCompatibleDC SelectObject DeleteDC TextOutW

advapi32

BuildExplicitAccessWithNameW GetNamedSecurityInfoW ConvertSidToStringSidW CreateProcessAsUserW SetTokenInformation ConvertStringSidToSidW DuplicateTokenEx GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation OpenProcessToken RegSetKeySecurity AddAccessAllowedAce InitializeAcl GetLengthSid RegRestoreKeyW RegSaveKeyW RegEnumValueW RegQueryValueExW RegOpenKeyW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW ConvertStringSecurityDescriptorToSecurityDescriptorW SetEntriesInAclW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey GetUserNameW SetSecurityDescriptorSacl SetSecurityDescriptorDacl InitializeSecurityDescriptor GetSecurityDescriptorSacl FreeSid AllocateAndInitializeSid LookupAccountSidW GetAclInformation GetSecurityDescriptorDacl AdjustTokenPrivileges LookupPrivilegeValueW AccessCheck SetNamedSecurityInfoW IsValidSid GetSidIdentifierAuthority GetAce GetSidLengthRequired InitializeSid AddAce GetFileSecurityW DuplicateToken MapGenericMask

shell32

ord165 SHGetFolderPathW ShellExecuteW

ole32

CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoUninitialize CoCreateGuid

oleaut32

SysFreeString VarUI4FromStr

shlwapi

PathFileExistsW PathRemoveFileSpecW PathAppendW PathAddBackslashW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

certpick.dll

IMPHASH 3745cbdf0e278e4ce3f4608d897ff02e
SHA256 e07c0ba8aca6c24ce4a4c467173325dbbfa978cb5c0a43a87ce4636b202c416e
MD5 edae75fd9467698023d931f9805faca2
SHA1 03f5bf9c22b9baeda5477043c2bfa5f2cbb6f773
SHA512 cb6c295e6dc27f59002749f577e75de6dc92338b4b5b0b3ef5f33a4506c8890fc295e24b1b22c854979addf8c3673f6b02e0462cf458d3fa810e2eaf9a831bb5
SSDEEP 384:CBb1/v4ESqu42iOCEc+ICGhjYvdf+mdw+pbhramoWsXWi:CH4ESqu42i4c+DfBnmx
TLSH
T184922A40A59499F6EBEE19F8256E773E0A7EE6200F9045D7434342CE3E219C2EB36356
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

14704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

certpick.pdb

msvcrt

_initterm _amsg_exit __dllonexit memcpy _lock _unlock _except_handler4_common _onexit _XcptFilter _callnewh malloc memcpy_s free memset

user32

RegisterClipboardFormatW

kernel32

GetSystemTime SystemTimeToFileTime LocalFree SetLastError RaiseException MultiByteToWideChar GlobalUnlock GetCurrentProcess CloseHandle Sleep QueryPerformanceCounter GetLastError GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GlobalLock LocalAlloc GetTickCount TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter

advapi32

CryptReleaseContext LookupAccountSidW EqualSid AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken

ole32

ReleaseStgMedium CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitialize

oleaut32

SafeArrayUnaccessData SafeArrayAccessData VariantInit SysAllocString SysStringLen VarBstrCat SysAllocStringLen SysFreeString VariantClear

crypt32

CertGetNameStringW CertFindCertificateInStore CertGetEnhancedKeyUsage CryptDecodeObject CertGetCertificateContextProperty CryptAcquireCertificatePrivateKey CertCloseStore CertEnumCertificatesInStore CertOpenStore CertFreeCertificateContext CertFindExtension

cryptui

CryptUIDlgViewContext CryptUIDlgSelectCertificateW

ncrypt

NCryptIsKeyHandle NCryptFreeObject

wtsapi32

WTSEnumerateProcessesW WTSFreeMemory

rimE.DLL

IMPHASH e6b81662ebc0527eb39e4d54d12656a8
SHA256 4c939547cdfa87e7d732c55ade2cf98e9eedd7559d18a65c150c2f6e3685aa58
MD5 960846b9ea93b14bde8cdcfcb492140b
SHA1 941f455e95eca78ec56fc09815dc8db919e18a5f
SHA512 14a6fd284794961dd93443d473677aad1db4c9a080806c962cda5dec8165fbf74633a8ed736a80e5eaca001215097c3f3b7016a70f12ae7072355ed649a77f56
SSDEEP 98304:CWCPEp3NBOMoNxY9J4SwEi8qmlNOZxOs3gz5da2aUydgHG:O5QCv8qmlNOPtgzzcG
TLSH
T1A3F5E12379D4807AC26F02704E6F776D72FDA5704D3545AB36C86E2C6DB08A2763C6A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

1254044

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\vmware-vdiskmanager\Release\vmware-vdiskmanager.pdb

kernel32

SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage SetFilePointerEx GetConsoleMode GetConsoleCP GetTimeZoneInformation GetFileType SetStdHandle QueryPerformanceFrequency VirtualQuery GetSystemInfo HeapQueryInformation GetCommandLineA FreeLibraryAndExitThread ExitThread InterlockedFlushSList RtlUnwind GetCPInfo GetStringTypeW LCMapStringW OutputDebugStringW WriteConsoleW GetACP InitializeSListHead VirtualAlloc HeapAlloc HeapFree DeleteCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection HeapCreate HeapDestroy CreateEventA CloseHandle WaitForSingleObject Sleep SetEvent FormatMessageW GetLastError GetCurrentThreadId SwitchToThread SetLastError CreateEventW CancelIo ResetEvent WideCharToMultiByte lstrlenW CreateWaitableTimerW SetWaitableTimer LoadLibraryW GetProcAddress TryEnterCriticalSection lstrcpyW lstrcatW WriteProcessMemory MultiByteToWideChar InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException DecodePointer GetProcessHeap CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileAttributesW CreateDirectoryW GetCurrentProcess SizeofResource LockResource LoadResource FindResourceW LocalFree LocalAlloc CreateFileW GetTickCount OpenProcess DeviceIoControl ExitProcess GetLocalTime SystemTimeToFileTime CreateMutexW GetModuleFileNameW CreateThread DeleteFileW GetTempPathW SetFileAttributesW CreateThreadpoolTimer SetThreadpoolTimer GetModuleHandleExW GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile WriteFile GetWindowsDirectoryW GetModuleHandleW CreateProcessW GetSystemDirectoryW CopyFileW GetStdHandle ResumeThread lstrlenA OpenMutexW GetCommandLineW GlobalAlloc GlobalSize GlobalLock GlobalUnlock GlobalFree MulDiv SetThreadPriority SuspendThread GetCurrentThread GetVersionExW FreeLibrary LoadLibraryExW GlobalDeleteAtom lstrcmpA lstrcmpW SetErrorMode OutputDebugStringA GetModuleHandleA InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalReAlloc GetCurrentProcessId GlobalGetAtomNameW FileTimeToSystemTime EncodePointer FreeResource LoadLibraryA GlobalAddAtomW GlobalFindAtomW GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW GetCurrentDirectoryW CompareStringW GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalFlags FindClose FindFirstFileW FlushFileBuffers GetFullPathNameW GetVolumeInformationW LockFile ReadFile SetEndOfFile SetFilePointer UnlockFile DuplicateHandle lstrcmpiW VirtualProtect FileTimeToLocalFileTime GetFileAttributesExW GetFileSizeEx GetFileTime SystemTimeToTzSpecificLocalTime FindResourceExW VerSetConditionMask VerifyVersionInfoW GetTempFileNameW GetProfileIntW SearchPathW WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime VirtualFree

user32

IsRectEmpty DrawFocusRect WindowFromPoint ReleaseCapture SetCapture GetNextDlgGroupItem LoadImageW TrackMouseEvent IntersectRect MapDialogRect GetAsyncKeyState GetNextDlgTabItem EndDialog CreateDialogIndirectParamW OffsetRect SetRectEmpty SendDlgItemMessageA InflateRect GetMenuItemInfoW DestroyMenu CharUpperW DestroyIcon FillRect GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW InvalidateRect KillTimer SetTimer RealChildWindowFromPoint GetDesktopWindow ClientToScreen DeleteMenu SetCursor ShowOwnedPopups SystemParametersInfoW CopyImage IsDialogMessageW SetWindowTextW CheckDlgButton MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo LoadIconW GetWindow GetTopWindow GetClassNameW GetClassLongW SetWindowLongW PtInRect EqualRect DrawIconEx MapWindowPoints ScreenToClient AdjustWindowRectEx GetWindowRect GetClientRect RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow RedrawWindow IsZoomed BeginPaint SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow TrackPopupMenu SetMenu GetMenu GetSystemMenu BringWindowToTop SetCursorPos PeekMessageW TranslateMessage DispatchMessageW MsgWaitForMultipleObjects UnregisterClassW GetCapture SetFocus GetDlgCtrlID GetDlgItem IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement SetWindowPos DestroyWindow IsChild IsMenu IsWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos RegisterWindowMessageW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetFocus GetWindowTextLengthW GetWindowTextW LoadCursorW GetIconInfo MessageBeep EnableScrollBar HideCaret InvertRect NotifyWinEvent CreatePopupMenu GetMenuDefaultItem MapVirtualKeyW GetKeyNameTextW LoadMenuW SetLayeredWindowAttributes EnumDisplayMonitors SetClassLongW SetWindowRgn SetParent OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW DrawEdge CopyRect DrawFrameControl DestroyAcceleratorTable MessageBoxW CharUpperBuffW GetMenuStringW GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu GetMessageW SendMessageW IsWindowVisible GetActiveWindow GetKeyState ValidateRect GetCursorPos SetWindowsHookExW CallNextHookEx PostMessageW PostQuitMessage UnhookWindowsHookEx EnableWindow IsWindowEnabled GetWindowLongW GetParent GetWindowThreadProcessId GetLastActivePopup GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush CopyIcon FrameRect DrawIcon UnionRect UpdateLayeredWindow MonitorFromPoint LoadAcceleratorsW TranslateAcceleratorW InsertMenuItemW UnpackDDElParam ReuseDDElParam GetComboBoxInfo PostThreadMessageW WaitMessage GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyCursor GetWindowRgn CreateMenu SubtractRect TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar GetUpdateRect IsClipboardFormatAvailable RegisterClipboardFormatW ModifyMenuW GetDoubleClickTime SetMenuDefaultItem LockWindowUpdate SetRect CopyAcceleratorTableW EndPaint

gdi32

GetTextFaceW GetViewportOrgEx GetWindowOrgEx SetPixelV SetPaletteEntries ExtFloodFill PtInRegion GetBoundsRect FrameRgn FillRgn RoundRect OffsetRgn GetRgnBox Rectangle LPtoDP CreateRoundRectRgn Polyline Polygon CreatePolygonRgn GetTextColor Ellipse CreateEllipticRgn SetDIBColorTable CreateDIBSection StretchBlt SetPixel GetTextCharsetInfo EnumFontFamiliesW CreateDIBitmap CreateCompatibleBitmap GetBkColor RealizePalette GetSystemPaletteEntries GetPaletteEntries GetNearestPaletteIndex CreatePalette EnumFontFamiliesExW GetTextMetricsW DPtoLP SetRectRgn PatBlt CreateRectRgnIndirect CombineRgn GetTextExtentPoint32W CreateFontIndirectW ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW MoveToEx SetTextAlign SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetStockObject GetPixel GetObjectType GetClipBox ExcludeClipRect Escape DeleteDC CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateCompatibleDC BitBlt DeleteObject GetObjectW SetTextColor SetBkColor CreateBitmap GetDeviceCaps CreateDCW CopyMetaFileW

msimg32

TransparentBlt AlphaBlend

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

SystemFunction036 RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegDeleteTreeW RegCreateKeyExW DeleteService ControlService QueryServiceStatusEx StartServiceW OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW CheckTokenMembership FreeSid EqualSid AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation OpenProcessToken RegCreateKeyW RegQueryValueExW RegCloseKey RegSetValueExW RegDeleteValueW RegOpenKeyExW

shell32

ShellExecuteExW SHGetFileInfoW ShellExecuteW SHGetPathFromIDListW SHGetSpecialFolderLocation SHAppBarMessage SHBrowseForFolderW SHGetFolderPathW DragFinish DragQueryFileW SHGetDesktopFolder

shlwapi

PathFindExtensionW PathFindFileNameW PathIsUNCW PathStripToRootW PathRemoveFileSpecW PathFileExistsW StrFormatKBSizeW

uxtheme

DrawThemeText GetThemePartSize GetThemeSysColor IsThemeBackgroundPartiallyTransparent IsAppThemed DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName GetWindowTheme

ole32

CreateStreamOnHGlobal CoInitializeEx IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor DoDragDrop OleGetClipboard CoLockObjectExternal RegisterDragDrop RevokeDragDrop OleLockRunning CoCreateInstance CoDisconnectObject CoCreateGuid ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CoUninitialize CoGetObject CoInitialize

oleaut32

SysStringLen SystemTimeToVariantTime VariantTimeToSystemTime SysAllocStringLen VariantClear VariantCopy VariantChangeType VarBstrFromDate VariantInit SysAllocString LoadTypeLi SysFreeString

ws2_32

WSASetLastError shutdown WSACloseEvent WSAResetEvent WSAEnumNetworkEvents WSAWaitForMultipleEvents WSAEventSelect WSACreateEvent WSAGetLastError send recv select WSAIoctl connect htons gethostbyname socket closesocket setsockopt WSACleanup WSAStartup

winmm

PlaySoundW timeGetTime

ntdll

RtlInitUnicodeString

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

gdiplus

GdipGetImagePalette GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown

imm32

ImmGetContext ImmGetOpenStatus ImmReleaseContext

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

338KB

Virtual Size

338KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.卡饭�

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

11102026_0154_04102026_20262743130870.1E9CFF.vhd.zip

20262743130870.1E9CFF.vhd

System Volume Information/WPSettings.dat

Z#2743130870.exe

imm32

rime

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

generic

certpick.dll

msvcrt

user32

kernel32

advapi32

ole32

oleaut32

crypt32

cryptui

ncrypt

wtsapi32

generic

f0e9008b-eb5a-4066-b400-2f51d47f4305.bak

rimE.DLL

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

ws2_32

winmm

ntdll

oleacc

gdiplus

imm32

generic