lingjie-windows-v16[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
lingjie-windows-v16.zip
Size 15.5MB
Sample261017-g9jrbsty6m
SHA256 9e66c3ba2413cf1b647e1848c298dc622783650f3e8c9ccc27baa3dbcaa0030d
MD5 c768fef99bd382628b9541e10fa1ee73
SHA1 8d06f01c2b90c740aa54a075d5546c9c2b0b2a81
SHA512 5a1744e4a9e9f0a4a7ce80a8ae70e4069af4680fe19a74a4432ac9bb2f494770722407f57fc37da61801726866adb932374b8655f36e3cdc3af86324a6fa949e
SSDEEP 393216:LWGgXYbefLUVvb5uKlBZgeZknE7gzp9yOWYDPPftACx3Y+adyA:qBTUZAKlTgewnLWSPdr3e4A
TLSH
T103F63342DE43E1EC74492A6346DE1CAD31596F09E327CAF271128C1FDCBA29D12B2F95
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/dartjni.dll
unpack001/flutter_windows.dll
unpack001/lingjie.exe
unpack001/zs_sdk.dll

File Explorer

lingjie-windows-v16.zip

.zip 15.5MB
dartjni.dll

.dll 58KB
data\app.so

.elf 7.1MB
data\flutter_assets\AssetManifest.bin

117B
data\flutter_assets\FontManifest.json

208B
data\flutter_assets\NOTICES.Z

.gz 102KB
NOTICES.Z

1.3MB
data\flutter_assets\NativeAssetsManifest.json

45B
data\flutter_assets\fonts\MaterialIcons-Regular.otf

9KB
data\flutter_assets\packages\cupertino_icons\assets\CupertinoIcons.ttf

251KB
data\flutter_assets\shaders\ink_sparkle.frag

21KB
data\flutter_assets\shaders\stretch_effect.frag

17KB
data\icudtl.dat

844KB
flutter_windows.dll

.dll 20.3MB
lingjie.exe

.exe 168KB
native_assets.json

45B
zs_sdk.dll

.dll 8.0MB

lingjie-windows-v16.zip

SHA256 9e66c3ba2413cf1b647e1848c298dc622783650f3e8c9ccc27baa3dbcaa0030d
MD5 c768fef99bd382628b9541e10fa1ee73
SHA1 8d06f01c2b90c740aa54a075d5546c9c2b0b2a81
SHA512 5a1744e4a9e9f0a4a7ce80a8ae70e4069af4680fe19a74a4432ac9bb2f494770722407f57fc37da61801726866adb932374b8655f36e3cdc3af86324a6fa949e
SSDEEP 393216:LWGgXYbefLUVvb5uKlBZgeZknE7gzp9yOWYDPPftACx3Y+adyA:qBTUZAKlTgewnLWSPdr3e4A
TLSH
T103F63342DE43E1EC74492A6346DE1CAD31596F09E327CAF271128C1FDCBA29D12B2F95
MD5 SHA1 SHA512 SSDEEP TLSH

dartjni.dll

IMPHASH 9431ae4e1f7630c2f3a13926198bffc0
SHA256 b21fe0ad4a8fab2584f3aac11f09105ba8aa4ef8a531112cb3a70f15c43b2522
MD5 d85f4745f4a608d70f5e5e6505012e69
SHA1 f419ee04c4c3f807e578c5870e61f6e83b6e62ad
SHA512 41034ef33102a605e8920acd92f536d4e6222cc2b10f7b9c6ec54a1d3d25b460ce7b6c21952beabec3c0f56eec21a68a873fca590e295128000110bfd76785c3
SSDEEP 768:QZ+AwCWcmOu5PCBUW7dPBtjCEgZYgrQA7KxNp+yhip:e/wyBaZlQA7K3pQ
TLSH
T1F24330AA97F44469C26E80B8D423041FC2737494179297CF517D16ABAF7BBC03A3EB85
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42660

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

DartException__ctor Dart_CloseNativePort_DL Dart_CurrentIsolate_DL Dart_DeleteFinalizableHandle_DL Dart_DeletePersistentHandle_DL Dart_DeleteWeakPersistentHandle_DL Dart_EnterIsolate_DL Dart_EnterScope_DL Dart_ErrorGetException_DL Dart_ErrorGetStackTrace_DL Dart_ErrorHasException_DL Dart_ExitIsolate_DL Dart_ExitScope_DL Dart_GetCurrentThreadOwnsIsolate_DL Dart_GetError_DL Dart_GetMainPortId_DL Dart_HandleFromPersistent_DL Dart_HandleFromWeakPersistent_DL Dart_InitializeApiDL Dart_IsApiError_DL Dart_IsCompilationError_DL Dart_IsError_DL Dart_IsFatalError_DL Dart_IsNull_DL Dart_IsUnhandledExceptionError_DL Dart_NewApiError_DL Dart_NewCompilationError_DL Dart_NewFinalizableHandle_DL Dart_NewNativePort_DL Dart_NewPersistentHandle_DL Dart_NewSendPortEx_DL Dart_NewSendPort_DL Dart_NewUnhandledExceptionError_DL Dart_NewWeakPersistentHandle_DL Dart_Null_DL Dart_PostCObject_DL Dart_PostInteger_DL Dart_Post_DL Dart_PropagateError_DL Dart_SendPortGetIdEx_DL Dart_SendPortGetId_DL Dart_SetPersistentHandle_DL Dart_UpdateExternalSize_DL Dart_UpdateExternalSize_Deprecated Dart_UpdateFinalizableExternalSize_DL Dart_UpdateFinalizableExternalSize_Deprecated FindClass GetClassLoader GetCurrentIsolateId GetExceptionDetails GetGlobalEnv GetJavaVM GetJniContextPtr GetJniEnv GetMainPortId InitDartApiDL JNI_OnUnload Java_com_github_dart_1lang_jni_JniUtils_fromReferenceAddress Java_com_github_dart_1lang_jni_PortCleaner_clean Java_com_github_dart_1lang_jni_PortContinuation__1resumeWith Java_com_github_dart_1lang_jni_PortProxyBuilder__1cleanUp Java_com_github_dart_1lang_jni_PortProxyBuilder__1invoke PortContinuation__ctor SpawnJvm deleteFinalizableHandle getCaptureStackTraceOnRelease globalEnv_CallBooleanMethod globalEnv_CallByteMethod globalEnv_CallCharMethod globalEnv_CallDoubleMethod globalEnv_CallFloatMethod globalEnv_CallIntMethod globalEnv_CallLongMethod globalEnv_CallNonvirtualBooleanMethod globalEnv_CallNonvirtualByteMethod globalEnv_CallNonvirtualCharMethod globalEnv_CallNonvirtualDoubleMethod globalEnv_CallNonvirtualFloatMethod globalEnv_CallNonvirtualIntMethod globalEnv_CallNonvirtualLongMethod globalEnv_CallNonvirtualObjectMethod globalEnv_CallNonvirtualShortMethod globalEnv_CallNonvirtualVoidMethod globalEnv_CallObjectMethod globalEnv_CallShortMethod globalEnv_CallStaticBooleanMethod globalEnv_CallStaticByteMethod globalEnv_CallStaticCharMethod globalEnv_CallStaticDoubleMethod globalEnv_CallStaticFloatMethod globalEnv_CallStaticIntMethod globalEnv_CallStaticLongMethod globalEnv_CallStaticObjectMethod globalEnv_CallStaticShortMethod globalEnv_CallStaticVoidMethod globalEnv_CallVoidMethod globalEnv_NewObject newBooleanFinalizableHandle newJObjectFinalizableHandle newStackTraceFinalizableHandle resultFor setCaptureStackTraceOnRelease

flutter_windows.dll

IMPHASH ce33a3d2238374eb8f775e621f3c159d
SHA256 7b03815958c49d72385be497fbd0eb1bb2ae27d24989d6c9aee83eafbd93e9d3
MD5 4beb7f06bef02c01c0c631c17c56e86e
SHA1 8c7c07b9c880cd11d999fc30290b33ec7db3f447
SHA512 bbccbb0d17cc0358e747caaf48917447a2404d91f003c9be2d3da5d9330f7c10d842f6587abce1252daeba79b2a4eff85ac93d2a08a48f080b9f06bcc6a7e6d2
SSDEEP 196608:6sNn9G+u3IPXkZ5JZ6igxIcfwItg/X9Tdr:6sNnU1I65iZIcfwIaVdr
TLSH
T117276C03E29640EDC459E178971BAA27F670B84A0724BADF3B5C47213F66BE01B3E754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16265092

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\b\s\w\ir\cache\builder\engine\src\out\ci\host_release\flutter_windows.dll.pdb

advapi32

RegGetValueW RegOpenKeyExW RegCloseKey RegNotifyChangeKeyValue RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegSetValueExW RegCreateKeyExW RegDeleteKeyW

iphlpapi

GetAdaptersAddresses

ole32

CoInitializeSecurity CoTaskMemFree CoTaskMemAlloc CoSetProxyBlanket CoTaskMemRealloc CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

VariantClear VarUI4FromStr SafeArrayPutElement SysFreeString SafeArrayAccessData SafeArrayUnaccessData SysAllocStringLen VariantInit SysAllocString SafeArrayDestroy LoadTypeLi SafeArrayGetVartype VariantCopy VarBstrCmp SafeArrayGetDim SafeArrayCreateVector SafeArrayGetLBound LoadRegTypeLi SysStringLen SafeArrayGetUBound

psapi

EnumProcessModules GetProcessMemoryInfo

shlwapi

PathIsRelativeW

rpcrt4

UuidToStringW UuidCreateSequential RpcStringFreeW

winmm

timeBeginPeriod timeEndPeriod

ws2_32

WSASetLastError getsockopt ioctlsocket freeaddrinfo socket getaddrinfo closesocket shutdown connect setsockopt recv send WSAGetLastError WSARecv WSASend WSARecvFrom WSAIoctl GetHostNameW htons ntohs WSAAddressToStringW WSAStartup getsockname getpeername inet_pton inet_addr getnameinfo InetPtonW InetNtopW bind listen WSASendTo WSASocketW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCompositionStringW ImmNotifyIME ImmGetCompositionStringW ImmSetCandidateWindow ImmGetContext

user32

SetWindowLongW GetMonitorInfoW GetWindowInfo GetSystemMetrics PostMessageW EnumWindows SetActiveWindow IsWindowEnabled GetClassNameW MoveWindow GetClientRect SetParent SetWindowPos GetWindowRect RegisterClassExW LoadIconW IsClipboardFormatAvailable GetAncestor GetKeyState DestroyCaret ReleaseCapture CreateCaret SetCapture MonitorFromRect DefWindowProcW SetWindowLongPtrW SendMessageW MapVirtualKeyW PeekMessageW RegisterClassW LoadCursorW GetWindowLongPtrW TrackMouseEvent ScreenToClient GetCursorPos GetWindow IsWindow OpenClipboard ShowWindow GetSystemMenu SetFocus DestroyWindow SetTimer SetUserObjectInformationA CreateWindowExW SystemParametersInfoW GetClipboardData ClientToScreen GetMessageExtraInfo EmptyClipboard SetClipboardData CloseClipboard GetSysColor GetMessageW TranslateMessage MonitorFromPoint MonitorFromWindow DispatchMessageW KillTimer SetCaretPos PostQuitMessage EnumThreadWindows GetParent UnregisterClassW CreateIconIndirect ReleaseDC GetDC SetCursor EnumDisplayDevicesW EnumDisplaySettingsW EnumDisplayMonitors CharNextW NotifyWinEvent UnregisterClassA GetClassInfoW WindowFromDC GetWindowThreadProcessId EnableMenuItem GetFocus MessageBeep EnableWindow IsIconic InvalidateRect CreateWindowExA GetClassInfoExW

opengl32

wglGetProcAddress wglGetCurrentContext

bcrypt

BCryptGenRandom

api-ms-win-core-path-l1-1-0

PathAllocCanonicalize PathCchCombineEx PathCchRemoveFileSpec

ntdll

RtlUnwindEx RtlCaptureStackBackTrace VerSetConditionMask RtlAddGrowableFunctionTable RtlDeleteGrowableFunctionTable RtlUnwind

gdi32

SelectObject CreateCompatibleBitmap GetObjectW CreateCompatibleDC CreateDIBSection DeleteObject GetPixel SetPixel GetDeviceCaps PatBlt ChoosePixelFormat SetPixelFormat SwapBuffers DeleteDC DescribePixelFormat GetPixelFormat SetDIBitsToDevice

kernel32

GetCPInfo CompareStringEx FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx InitializeCriticalSectionEx EncodePointer RtlPcToFileHeader GetStringTypeW InitOnceComplete InitOnceBeginInitialize GetExitCodeThread SwitchToThread GetFileInformationByHandleEx AreFileApisANSI FindFirstFileExW GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead SetEvent InterlockedFlushSList TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetDriveTypeW PeekNamedPipe GetTempFileNameA GetTempPathA GetModuleHandleExW HeapFree HeapAlloc GetDateFormatW HeapSize GetTimeFormatW CompareStringW LCMapStringW GetModuleHandleExA LocaleNameToLCID lstrcmpiW SizeofResource LoadResource FindResourceW GetTimeZoneInformationForYear GetCurrentThreadStackLimits OpenThread WakeAllConditionVariable TryAcquireSRWLockExclusive QueryPerformanceCounter QueryPerformanceFrequency SetFileTime DeviceIoControl ReadConsoleW CopyFileExW GetFileAttributesExW CreateSymbolicLinkW GetFullPathNameW UnlockFileEx LockFileEx VirtualProtect SetFilePointerEx SetFileAttributesW MoveFileExW GetConsoleScreenBufferInfo GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CreateNamedPipeW TerminateProcess OpenProcess GetExitCodeProcess WaitForMultipleObjects DeleteProcThreadAttributeList CreateProcessW UpdateProcThreadAttribute InitializeProcThreadAttributeList SetEnvironmentVariableW GetEnvironmentVariableW ExitProcess FreeEnvironmentStringsW GetEnvironmentStringsW GetUserDefaultLocaleName SetUnhandledExceptionFilter SetErrorMode SetCurrentDirectoryW GetCurrentDirectoryW GetQueuedCompletionStatus ReadDirectoryChangesW WriteFile PostQueuedCompletionStatus GetFileType CancelIoEx CreateIoCompletionPort SetStdHandle SetConsoleMode GetConsoleMode GetStdHandle SetConsoleCP SetConsoleOutputCP GetConsoleOutputCP SetConsoleCtrlHandler GetFinalPathNameByHandleA LeaveCriticalSection EnterCriticalSection TlsSetValue TlsAlloc TlsGetValue ReleaseSRWLockShared AcquireSRWLockShared InitOnceExecuteOnce LoadLibraryExA OutputDebugStringA ReadFile GetFileSizeEx MultiByteToWideChar GetNativeSystemInfo LoadLibraryExW HeapReAlloc GetProcessHeap IsValidCodePage GetACP GetOEMCP GetCommandLineA WriteConsoleW VirtualQuery InitializeCriticalSectionAndSpinCount GetLastError FormatMessageW DecodePointer DeleteCriticalSection InterlockedPushEntrySList LoadLibraryA GetProcAddress CreateEventW RegisterWaitForSingleObject ResetEvent UnregisterWait CloseHandle OutputDebugStringW LocalFree GetCurrentProcess MoveFileW CreatePipe GetModuleHandleW GetCurrentThread SetThreadPriority SetLastError WideCharToMultiByte GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoEx GetCurrentThreadId GetCurrentProcessId CreateToolhelp32Snapshot Thread32Next Thread32First FormatMessageA GetThreadPreferredUILanguages CreateSemaphoreW WaitForSingleObject ReleaseSemaphore WaitForSingleObjectEx RaiseException IsDebuggerPresent GetCommandLineW GetTempPathW CreateDirectoryW CreateFileW DuplicateHandle GetFileInformationByHandle GetFileAttributesW RemoveDirectoryW DeleteFileW SetFilePointer SetEndOfFile FlushViewOfFile FlushFileBuffers FindFirstFileW FindNextFileW FindClose GetFinalPathNameByHandleW GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateWaitableTimerW VerifyVersionInfoW SetWaitableTimer LoadLibraryW FreeLibrary GetModuleFileNameW GetLogicalProcessorInformation Sleep FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetSystemTimeAsFileTime CreateFileA VirtualFree GetSystemInfo VirtualAlloc InitializeSRWLock InitializeConditionVariable AcquireSRWLockExclusive SleepConditionVariableSRW ReleaseSRWLockExclusive WakeConditionVariable

crypt32

CertFreeCertificateContext CertOpenStore CertEnumCertificatesInStore CertCloseStore

uiautomationcore

UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaGetReservedMixedAttributeValue UiaHostProviderFromHwnd UiaGetReservedNotSupportedValue

oleacc

LresultFromObject

propsys

VariantCompare

dxgi

CreateDXGIFactory CreateDXGIFactory1

d3d9

D3DPERF_SetMarker Direct3DCreate9 D3DPERF_EndEvent D3DPERF_GetStatus D3DPERF_BeginEvent

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle

FlutterDesktopEngineCreate FlutterDesktopEngineCreateViewController FlutterDesktopEngineDestroy FlutterDesktopEngineForId FlutterDesktopEngineGetGraphicsAdapter FlutterDesktopEngineGetMessenger FlutterDesktopEngineGetPluginRegistrar FlutterDesktopEngineGetTextureRegistrar FlutterDesktopEngineIsPlatformThread FlutterDesktopEnginePostPlatformThreadTask FlutterDesktopEngineProcessExternalWindowMessage FlutterDesktopEngineProcessMessages FlutterDesktopEngineRegisterPlatformViewType FlutterDesktopEngineReloadSystemFonts FlutterDesktopEngineRun FlutterDesktopEngineSetNextFrameCallback FlutterDesktopGetDpiForHWND FlutterDesktopGetDpiForMonitor FlutterDesktopMessengerAddRef FlutterDesktopMessengerIsAvailable FlutterDesktopMessengerLock FlutterDesktopMessengerRelease FlutterDesktopMessengerSend FlutterDesktopMessengerSendResponse FlutterDesktopMessengerSendWithReply FlutterDesktopMessengerSetCallback FlutterDesktopMessengerUnlock FlutterDesktopPluginRegistrarGetGraphicsAdapter FlutterDesktopPluginRegistrarGetMessenger FlutterDesktopPluginRegistrarGetView FlutterDesktopPluginRegistrarGetViewById FlutterDesktopPluginRegistrarRegisterTopLevelWindowProcDelegate FlutterDesktopPluginRegistrarSetDestructionHandler FlutterDesktopPluginRegistrarUnregisterTopLevelWindowProcDelegate FlutterDesktopRegistrarGetTextureRegistrar FlutterDesktopResyncOutputStreams FlutterDesktopTextureRegistrarMarkExternalTextureFrameAvailable FlutterDesktopTextureRegistrarRegisterExternalTexture FlutterDesktopTextureRegistrarUnregisterExternalTexture FlutterDesktopViewControllerCreate FlutterDesktopViewControllerDestroy FlutterDesktopViewControllerForceRedraw FlutterDesktopViewControllerGetEngine FlutterDesktopViewControllerGetView FlutterDesktopViewControllerGetViewId FlutterDesktopViewControllerHandleTopLevelWindowProc FlutterDesktopViewGetGraphicsAdapter FlutterDesktopViewGetHWND InternalFlutterGpu_CommandBuffer_CopyBufferToTexture InternalFlutterGpu_CommandBuffer_CopyTextureToBuffer InternalFlutterGpu_CommandBuffer_CopyTextureToTexture InternalFlutterGpu_CommandBuffer_Initialize InternalFlutterGpu_CommandBuffer_Submit InternalFlutterGpu_Context_GetDefaultColorFormat InternalFlutterGpu_Context_GetDefaultDepthStencilFormat InternalFlutterGpu_Context_GetDefaultStencilFormat InternalFlutterGpu_Context_GetMaxSamplerAnisotropy InternalFlutterGpu_Context_GetMinimumUniformByteAlignment InternalFlutterGpu_Context_GetSupportsFramebufferRenderMipmap InternalFlutterGpu_Context_GetSupportsManuallyMippedTextures InternalFlutterGpu_Context_GetSupportsOffscreenMSAA InternalFlutterGpu_Context_InitializeDefault InternalFlutterGpu_Context_SupportsTextureCompression InternalFlutterGpu_Context_SupportsTextureFormat InternalFlutterGpu_DeviceBuffer_Flush InternalFlutterGpu_DeviceBuffer_Initialize InternalFlutterGpu_DeviceBuffer_InitializeWithHostData InternalFlutterGpu_DeviceBuffer_Overwrite InternalFlutterGpu_RenderPass_Begin InternalFlutterGpu_RenderPass_BindIndexBufferDevice InternalFlutterGpu_RenderPass_BindPipeline InternalFlutterGpu_RenderPass_BindTexture InternalFlutterGpu_RenderPass_BindUniformDevice InternalFlutterGpu_RenderPass_BindVertexBufferDevice InternalFlutterGpu_RenderPass_ClearBindings InternalFlutterGpu_RenderPass_Draw InternalFlutterGpu_RenderPass_DrawIndexed InternalFlutterGpu_RenderPass_Initialize InternalFlutterGpu_RenderPass_SetColorAttachment InternalFlutterGpu_RenderPass_SetColorBlendEnable InternalFlutterGpu_RenderPass_SetColorBlendEquation InternalFlutterGpu_RenderPass_SetCullMode InternalFlutterGpu_RenderPass_SetDepthCompareOperation InternalFlutterGpu_RenderPass_SetDepthStencilAttachment InternalFlutterGpu_RenderPass_SetDepthWriteEnable InternalFlutterGpu_RenderPass_SetPolygonMode InternalFlutterGpu_RenderPass_SetPrimitiveType InternalFlutterGpu_RenderPass_SetScissor InternalFlutterGpu_RenderPass_SetStencilConfig InternalFlutterGpu_RenderPass_SetStencilReference InternalFlutterGpu_RenderPass_SetViewport InternalFlutterGpu_RenderPass_SetWindingOrder InternalFlutterGpu_RenderPipeline_Initialize InternalFlutterGpu_ShaderLibrary_GetShader InternalFlutterGpu_ShaderLibrary_InitializeWithAsset InternalFlutterGpu_ShaderLibrary_InitializeWithBytes InternalFlutterGpu_ShaderLibrary_ReinitializeWithAsset InternalFlutterGpu_ShaderLibrary_ReinitializeWithBytes InternalFlutterGpu_Shader_DebugIsDirty InternalFlutterGpu_Shader_GetUniformMemberOffset InternalFlutterGpu_Shader_GetUniformStructSize InternalFlutterGpu_Surface_AcquireNextFrame InternalFlutterGpu_Surface_DiscardFrame InternalFlutterGpu_Surface_GetBackingTextureCount InternalFlutterGpu_Surface_GetCurrentImage InternalFlutterGpu_Surface_Initialize InternalFlutterGpu_Surface_PresentFrame InternalFlutterGpu_Surface_Resize InternalFlutterGpu_Texture_AsImage InternalFlutterGpu_Texture_ImageTextureInfo InternalFlutterGpu_Texture_Initialize InternalFlutterGpu_Texture_InitializeFromImage InternalFlutterGpu_Texture_Overwrite InternalFlutterWindows_WindowManager_CreateDialogWindow InternalFlutterWindows_WindowManager_CreatePopupWindow InternalFlutterWindows_WindowManager_CreateRegularWindow InternalFlutterWindows_WindowManager_CreateTooltipWindow InternalFlutterWindows_WindowManager_GetFullscreen InternalFlutterWindows_WindowManager_GetTopLevelWindowHandle InternalFlutterWindows_WindowManager_GetWindowContentSize InternalFlutterWindows_WindowManager_Initialize InternalFlutterWindows_WindowManager_OnDestroyWindow InternalFlutterWindows_WindowManager_SetFullscreen InternalFlutterWindows_WindowManager_SetWindowConstraints InternalFlutterWindows_WindowManager_SetWindowSize InternalFlutterWindows_WindowManager_UpdatePopupPosition InternalFlutterWindows_WindowManager_UpdateTooltipPosition

Name

.text

Size

16.0MB

Virtual Size

16.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

356KB

Virtual Size

550KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

483KB

Virtual Size

482KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

lingjie.exe

IMPHASH 70d43dc8dd423824b71ee64ed485b8bd
SHA256 9a3bdf85511c10b7db90f4daccc4e3aa9f5e66c44269593b0da232b9d39e3a39
MD5 f61335782e0aeb28d1bd2cbd72dc22c4
SHA1 825a152be758b29134981fd660276c579f83c56e
SHA512 3c7d680cd7c40415dcefad80aa4469d67008574aaa96b1cbfce5d8c1c985c456d9f9fee52edc36321b5a19ab3cfff1988545c0b0f1eb1ac34a818c95ec6ed163
SSDEEP 1536:RyXdqtWO5dn6BnvE31TgZcSYjHjRBBBBoBBBBBBLGBVBtr5Fk9mbeoeqBv+H3NBn:RyXdqtxz6t8TgZcSOHj/VCMCySKNqtZ
TLSH
T137F32942DB1E8097CB1D5AF9C81E0D07CA327C5A4B90AECB57C47D960DB36F91A3A246
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23492

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmSetWindowAttribute

flutter_windows

FlutterDesktopViewControllerGetView FlutterDesktopViewGetHWND FlutterDesktopResyncOutputStreams FlutterDesktopMessengerUnlock FlutterDesktopMessengerLock FlutterDesktopMessengerIsAvailable FlutterDesktopMessengerRelease FlutterDesktopMessengerAddRef FlutterDesktopMessengerSetCallback FlutterDesktopMessengerSendResponse FlutterDesktopMessengerSendWithReply FlutterDesktopMessengerSend FlutterDesktopViewControllerHandleTopLevelWindowProc FlutterDesktopViewControllerForceRedraw FlutterDesktopViewControllerDestroy FlutterDesktopViewControllerCreate FlutterDesktopEngineSetNextFrameCallback FlutterDesktopEngineGetMessenger FlutterDesktopEngineGetPluginRegistrar FlutterDesktopEngineReloadSystemFonts FlutterDesktopEngineDestroy FlutterDesktopEngineCreate FlutterDesktopGetDpiForMonitor

kernel32

GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess InitializeSListHead UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SetUnhandledExceptionFilter LoadLibraryA GetProcAddress GetModuleHandleW FreeLibrary AllocConsole WideCharToMultiByte LocalFree GetStartupInfoW GetCommandLineW AttachConsole GetUserDefaultUILanguage IsDebuggerPresent

user32

ShowWindow MoveWindow SetWindowPos SetFocus GetClientRect DestroyWindow SetWindowLongPtrW SetParent LoadCursorW LoadIconW MonitorFromPoint GetMessageW CreateWindowExW GetWindowLongPtrW TranslateMessage DispatchMessageW DefWindowProcW RegisterClassW PostQuitMessage UnregisterClassW

shell32

CommandLineToArgvW

ole32

CoInitializeEx CoUninitialize

advapi32

RegGetValueW

msvcp140

?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?width@ios_base@std@@QEAA_J_J@Z ?_Xbad_function_call@std@@YAXXZ ?sync_with_stdio@ios_base@std@@SA_N_N@Z ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Xlength_error@std@@YAXPEBD@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy __std_exception_destroy __std_exception_copy __current_exception_context __current_exception __C_specific_handler memcmp __std_type_info_compare memmove __std_terminate memset _CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _c_exit terminate _initterm_e _crt_atexit exit _invoke_watson _register_thread_local_exe_atexit_callback _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _cexit _set_app_type _exit _seh_filter_exe

api-ms-win-crt-string-l1-1-0

wcsnlen strlen wcslen

api-ms-win-crt-stdio-l1-1-0

_dup2 __p__commode _fileno freopen_s __acrt_iob_func _set_fmode

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

zs_sdk.dll

IMPHASH 6b1fbc6bc21d42fa1d26fc188ff39681
SHA256 a097a12e3fc8e40df0a4533dcf3414136490c8c0b77ea58d6e23103f7c1328a6
MD5 68138b8de70284d99b62b4fbe56cdec9
SHA1 8cbe9b5f1c9e2701f6f52ee409fbc768330b4301
SHA512 6aaf2d7684628c007eea293a683f054fb7b78d604b76c8f3f79a8b8802537d9b834ed71da27c81e28b995ee25d5f4d7db60e3d649efa138639fc09d7dd0a6e76
SSDEEP 98304:r+yec2an3vMBA6O8Vuz7WOrKsQWgctXWlqaGPvGnOIr05R+sOwf4dvbR:iKiOrKsQWztDXGnh05Re
TLSH
T133866B43F2A691ECC15AC174535BA232FA367C8909347EBB13D09B343EA2F505B1EB59
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4847

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

combase

CoTaskMemFree CoCreateFreeThreadedMarshaler

kernel32

CreateEventA CreateEventW QueryPerformanceCounter QueryPerformanceFrequency SetEvent WaitForMultipleObjectsEx LoadLibraryExA FormatMessageW GetLastError GetProcessHeap HeapAlloc CancelIoEx ConnectNamedPipe CreateIoCompletionPort DisconnectNamedPipe GetNamedPipeInfo GetOverlappedResult GetQueuedCompletionStatusEx PostQueuedCompletionStatus ReadFile SetFileCompletionNotificationModes SetHandleInformation WriteFile AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateFileMappingA CreateFileW CreateHardLinkW CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessId GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeProcThreadAttributeList IsThreadAFiber LeaveCriticalSection LoadLibraryA LoadLibraryW LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar RaiseException ReadConsoleW ReadFileEx RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnlockFile UnmapViewOfFile UpdateProcThreadAttribute VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW

mmdevapi

ActivateAudioInterfaceAsync

ole32

CoCreateInstance CoInitializeEx CoUninitialize PropVariantClear PropVariantCopy StringFromIID

propsys

PropVariantCompareEx PropVariantToBSTR PropVariantToBoolean PropVariantToDouble PropVariantToInt16 PropVariantToInt32 PropVariantToInt64 PropVariantToUInt16 PropVariantToUInt32 PropVariantToUInt64

rpcrt4

UuidCreate

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

oleaut32

GetErrorInfo SetErrorInfo SysAllocStringLen SysFreeString SysStringLen

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtCreateNamedPipeFile NtOpenFile NtReadFile NtSetInformationFile NtWriteFile

ws2_32

WSADuplicateSocketW WSAGetLastError WSAIoctl WSAPoll WSARecv WSARecvFrom WSASend WSASendMsg WSASendTo WSASocketW accept bind closesocket connect getpeername getsockname getsockopt ioctlsocket listen recv recvfrom send sendto setsockopt shutdown GetHostNameW WSAStartup freeaddrinfo getaddrinfo select

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036

bcrypt

BCryptGenRandom

api-ms-win-crt-heap-l1-1-0

calloc free

api-ms-win-crt-math-l1-1-0

cbrt ceil ceilf cos cosf exp exp2 exp2f expf floor floorf fmaf fmodf log log10 log10f logf pow powf rintf round roundf sin sinf tanhf trunc truncf

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table _exit _initialize_onexit_table _initterm _initterm_e _register_onexit_function abort

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp wcslen

ncrypt

NCryptCreatePersistedKey NCryptFinalizeKey NCryptFreeObject NCryptOpenKey NCryptOpenStorageProvider NCryptSetProperty NCryptSignHash

user32

GetDesktopWindow GetForegroundWindow

userenv

GetUserProfileDirectoryW

Name

.text

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

190KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

lingjie-windows-v16.zip

dartjni.dll

jvm

kernel32

ole32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic

data\app.so

data\flutter_assets\AssetManifest.bin

data\flutter_assets\FontManifest.json

data\flutter_assets\NOTICES.Z

NOTICES.Z

data\flutter_assets\NativeAssetsManifest.json

data\flutter_assets\fonts\MaterialIcons-Regular.otf

data\flutter_assets\packages\cupertino_icons\assets\CupertinoIcons.ttf

data\flutter_assets\shaders\ink_sparkle.frag

data\flutter_assets\shaders\stretch_effect.frag

data\icudtl.dat

flutter_windows.dll

advapi32

iphlpapi

ole32

oleaut32

psapi

shlwapi

rpcrt4

winmm

ws2_32

imm32

user32

opengl32

bcrypt

api-ms-win-core-path-l1-1-0

ntdll

gdi32

kernel32

crypt32

uiautomationcore

oleacc

propsys

dxgi

d3d9

api-ms-win-core-synch-l1-2-0

generic

lingjie.exe

dwmapi

flutter_windows

kernel32

user32

shell32

ole32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

native_assets.json

zs_sdk.dll

api-ms-win-core-synch-l1-2-0

combase

kernel32

mmdevapi

ole32

propsys

rpcrt4