b46f4477a3dc798b92631c215cd92de027d99d708578b7c6384fb33ade72646b

Sharing

Copy URL Twitter E-mail

General

Target
b46f4477a3dc798b92631c215cd92de027d99d708578b7c6384fb33ade72646b
Size 1.8MB
Sample261102-jf5sta1yas
SHA256 b46f4477a3dc798b92631c215cd92de027d99d708578b7c6384fb33ade72646b
MD5 73cc74eead1cb2ac8105963a8785208c
SHA1 b6a60ebe60f1641b3b6ad3fb3b011359e50bad08
SHA512 d4794dabd92259dad02ec28ff57e33d6a458e157b654d2e347c1c8de08ac022473b7c756e0ed4363617d8380498506f25f2fef93379f96fbe9ef00437e268547
SSDEEP 24576:7ngNn+RMtST97+HEqIytvhhUhxe0DRkhonOHyW2oYjpNluvDSoe2nnVyjLQ:7nKeN+HJIUhhUznOPRYjpUDSoe2VK
TLSH
T12995AF20BA97C135E7B301B1BDBDAA5D502DBD640B2640CBE3D03A1E1872EC16E7765B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b46f4477a3dc798b92631c215cd92de027d99d708578b7c6384fb33ade72646b

File Explorer

b46f4477a3dc798b92631c215cd92de027d99d708578b7c6384fb33ade72646b

.exe 1.8MB

b46f4477a3dc798b92631c215cd92de027d99d708578b7c6384fb33ade72646b

IMPHASH 31dd49190ece7958df1a818ef793828a
SHA256 b46f4477a3dc798b92631c215cd92de027d99d708578b7c6384fb33ade72646b
MD5 73cc74eead1cb2ac8105963a8785208c
SHA1 b6a60ebe60f1641b3b6ad3fb3b011359e50bad08
SHA512 d4794dabd92259dad02ec28ff57e33d6a458e157b654d2e347c1c8de08ac022473b7c756e0ed4363617d8380498506f25f2fef93379f96fbe9ef00437e268547
SSDEEP 24576:7ngNn+RMtST97+HEqIytvhhUhxe0DRkhonOHyW2oYjpNluvDSoe2nnVyjLQ:7nKeN+HJIUhhUznOPRYjpUDSoe2VK
TLSH
T12995AF20BA97C135E7B301B1BDBDAA5D502DBD640B2640CBE3D03A1E1872EC16E7765B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

806889

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Code\Package\海外模拟器\master-6.0_en_20260318165522\simulator\bin\dnmultiplayer.pdb

kernel32

IsProcessorFeaturePresent IsDebuggerPresent DecodePointer EncodePointer GetSystemTimeAsFileTime Sleep TerminateProcess TerminateThread CreateThread ReleaseSemaphore CreateSemaphoreW RemoveDirectoryW DeleteFileW UnmapViewOfFile MapViewOfFile CreateFileMappingW GetCurrentThreadId WriteFile FindNextFileW QueryPerformanceCounter SetEvent CreateMutexW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetWindowsDirectoryW K32GetModuleFileNameExW K32EnumProcessModules OpenProcess GetExitCodeProcess GetCurrentProcessId CreateEventW CreateProcessW GetStartupInfoW CreatePipe GetSystemDirectoryW GlobalMemoryStatusEx GlobalUnlock GlobalLock GetSystemInfo MulDiv FindResourceW SizeofResource LockResource LoadResource FreeResource ReadFile GetFileSize FindFirstFileW FindClose ExitProcess WaitForSingleObject LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetTickCount DeleteCriticalSection WideCharToMultiByte CloseHandle GetFileTime CreateFileW FreeLibrary GetModuleFileNameW LoadLibraryW GetLastError GetPrivateProfileStringW GetVersionExW GetProcAddress GetModuleHandleW GlobalFree GlobalAlloc GetUserDefaultUILanguage GetLocalTime MultiByteToWideChar

user32

SetCaretPos ShowCaret HideCaret CreateCaret GetCaretPos GetCaretBlinkTime GetWindowTextLengthW GetWindowTextW SetRect FillRect DrawTextW CharPrevW LoadImageW AdjustWindowRectEx GetPropW SetPropW GetMenu ShowWindow GetClassInfoExW RegisterClassExW RegisterClassW CallWindowProcW DefWindowProcW GetWindow GetParent PtInRect IsRectEmpty IntersectRect MapWindowPoints GetCursorPos InvalidateRect GetUpdateRect EndPaint BeginPaint ReleaseDC ReleaseCapture SetCapture GetFocus GetActiveWindow GetSysColor CharNextW DestroyWindow IsWindow CreateWindowExW PostMessageW DispatchMessageW TranslateMessage GetMessageW LoadCursorW OffsetRect UnionRect SetCursor wvsprintfW SetWindowLongW GetWindowLongW ScreenToClient MessageBoxW GetClientRect SetWindowRgn IsZoomed GetSystemMetrics GetMonitorInfoW MonitorFromWindow IsIconic SendMessageW SetWindowPos SetForegroundWindow BringWindowToTop SystemParametersInfoW EnumDisplayMonitors CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo GetWindowThreadProcessId GetClassNameW FindWindowExW MoveWindow EnableWindow GetWindowRect PostQuitMessage GetDesktopWindow SetWindowTextW ClientToScreen SetFocus EnumWindows GetDC SetTimer KillTimer wsprintfW MapVirtualKeyW GetKeyState IsWindowVisible

gdi32

GetTextMetricsW GetObjectW SetWindowOrgEx GetObjectA DeleteDC CreatePenIndirect CreateRectRgnIndirect CreateSolidBrush GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo AddFontResourceExW RemoveFontResourceW RoundRect SetStretchBltMode ExtSelectClipRgn SetBkColor RestoreDC StretchBlt SetTextColor CreateDIBSection MoveToEx TextOutW ExtTextOutW GdiFlush CreatePatternBrush GetDeviceCaps SelectObject SelectClipRgn SaveDC CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteObject Rectangle SetBkMode GetStockObject CombineRgn CreateRoundRectRgn

shell32

ord165 SHGetPathFromIDListW SHGetFolderPathW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteExW

ole32

CLSIDFromProgID OleLockRunning CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance CoUninitialize CoInitialize CLSIDFromString

msvcp120

?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ??0_Pad@std@@QAE@XZ ?_Release@_Pad@std@@QAEXXZ ??1_Pad@std@@QAE@XZ ?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z _Thrd_equal _Thrd_current ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_current_owns _Cnd_timedwait _Thrd_join _Do_call _Call_onceEx ?_1@placeholders@std@@3V?$_Ph@$00@2@A ?_2@placeholders@std@@3V?$_Ph@$01@2@A _Xtime_get_ticks ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Statvfs@sys@tr2@std@@YA?AUspace_info@123@PB_W@Z ?_Read_dir@sys@tr2@std@@YAPA_WAAY0BAE@_WPAXAAW4file_type@123@@Z ?_Remove_dir@sys@tr2@std@@YA_NPB_W@Z ?_Close_dir@sys@tr2@std@@YAXPAX@Z ?_Open_dir@sys@tr2@std@@YAPAXAAY0BAE@_WPB_WAAHAAW4file_type@123@@Z ?_Copy_file@sys@tr2@std@@YAHPB_W0_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?uncaught_exception@std@@YA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Orphan_all@_Container_base0@std@@QAEXXZ ?_Future_error_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z ??_7_Facet_base@std@@6B@ ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z ?tolower@?$ctype@_W@std@@QBE_W_W@Z ?is@?$ctype@_W@std@@QBE_NF_W@Z _Wcsxfrm ?_Incref@facet@locale@std@@UAEXXZ ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ??1_Locinfo@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ ??0_Locinfo@std@@QAE@PBD@Z ??0_Lockit@std@@QAE@H@Z ??1facet@locale@std@@MAE@XZ ??_7facet@locale@std@@6B@ ??0facet@locale@std@@IAE@I@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?id@?$ctype@_W@std@@2V0locale@2@A ??Bid@locale@std@@QAEIXZ ?id@?$collate@_W@std@@2V0locale@2@A _Wcscoll ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ ?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z ?_Throw_C_error@std@@YAXH@Z _Mtx_init _Mtx_lock _Mtx_unlock ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ _Cnd_wait _Cnd_broadcast _Cnd_destroy _Mtx_destroy _Cnd_register_at_thread_exit _Cnd_unregister_at_thread_exit ?_Throw_future_error@std@@YAXABVerror_code@1@@Z ?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z ?_Xinvalid_argument@std@@YAXPBD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z ?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?id@?$codecvt@DDH@std@@2V0locale@2@A ?always_noconv@codecvt_base@std@@QBE_NXZ ?_BADOFF@std@@3_JB ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??Bios_base@std@@QBE_NXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?width@ios_base@std@@QAE_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?width@ios_base@std@@QBE_JXZ ?flags@ios_base@std@@QBEHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ _Cnd_init ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?_Stat@sys@tr2@std@@YA?AW4file_type@123@PB_WAAH@Z ?_Make_dir@sys@tr2@std@@YAHPB_W@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?_Winerror_map@std@@YAPBDH@Z ?_Unlink@sys@tr2@std@@YAHPB_W@Z

msvcr120

malloc free mbstowcs_s _vsnwprintf_s memmove ??2@YAPAXI@Z ??3@YAXPAX@Z _purecall ??0exception@std@@QAE@ABV01@@Z ??_V@YAXPAX@Z wcstoul realloc swprintf_s swscanf_s iswdigit wcstol strchr ??0bad_cast@std@@QAE@ABV01@@Z ??1bad_cast@std@@UAE@XZ ??0bad_cast@std@@QAE@PBD@Z ?Alloc@Concurrency@@YAPAXI@Z ?Free@Concurrency@@YAXPAX@Z ?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z ?_GetCurrentInlineDepth@_StackGuard@details@Concurrency@@CAAAIXZ ?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z ?_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?set@event@Concurrency@@QAEXXZ ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@ABQBDH@Z ??0event@Concurrency@@QAE@XZ _controlfp_s _invoke_watson __crtSetUnhandledExceptionFilter _except_handler4_common _except1 _commode _fmode _wcmdln _initterm _initterm_e __setusermatherr _configthreadlocale _cexit _exit exit __set_app_type __wgetmainargs _amsg_exit __crtGetShowWindowMode _XcptFilter __crtTerminateProcess __crtUnhandledException _crt_debugger_hook ??1type_info@@UAE@XZ _onexit __dllonexit _calloc_crt _unlock _lock vsprintf_s _wcsnicmp _beginthreadex memchr sprintf wcscpy_s _vswprintf ??8type_info@@QBE_NABV0@@Z sscanf_s longjmp vswprintf_s srand ??0exception@std@@QAE@ABQBD@Z getchar qsort_s wcsncmp iswalnum _wtof wcstod _itow ??1event@Concurrency@@QAE@XZ isalnum isdigit _vsnwprintf _wcslwr wcsstr wcsrchr wcsncpy wcschr memset memcpy __CxxFrameHandler3 _CxxThrowException _wcsicmp _wtoi _lock_file _unlock_file fgetc ungetc memcpy_s fsetpos _fseeki64 fgetpos setvbuf fflush fputc fwrite fclose sprintf_s ?terminate@@YAXXZ _snprintf_s _snwprintf_s _errno ?__ExceptionPtrCopyException@@YAXPAXPBX1@Z ?__ExceptionPtrAssign@@YAXPAXPBX@Z ?__ExceptionPtrToBool@@YA_NPBX@Z _time64 ?__ExceptionPtrCreate@@YAXPAX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?__ExceptionPtrDestroy@@YAXPAX@Z ?__ExceptionPtrCopy@@YAXPAXPBX@Z ?_Oversubscribe@_Context@details@Concurrency@@SAX_N@Z ?_ScheduleTask@_CurrentScheduler@details@Concurrency@@SAXP6AXPAX@Z0@Z ?_NewCollection@_AsyncTaskCollection@details@Concurrency@@SAPAV123@PAV_CancellationTokenState@23@@Z rand ?wait@event@Concurrency@@QAEII@Z ??1scoped_lock@critical_section@Concurrency@@QAE@XZ ??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z ??1critical_section@Concurrency@@QAE@XZ _setjmp3 ??0critical_section@Concurrency@@QAE@XZ toupper

iphlpapi

GetAdaptersInfo

comctl32

ord17 _TrackMouseEvent

imm32

ImmSetCompositionWindow ImmSetCompositionFontW ImmReleaseContext ImmGetContext ImmGetVirtualKey

shlwapi

PathFileExistsW

msimg32

AlphaBlend

version

GetFileVersionInfoW VerQueryValueA GetFileVersionInfoSizeW

wininet

InternetOpenW InternetCloseHandle InternetConnectW InternetCrackUrlW HttpSendRequestW InternetReadFile HttpQueryInfoW HttpOpenRequestW

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

DuplicateTokenEx OpenProcessToken RegOpenKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

oleaut32

SysAllocString VariantInit VariantClear SysFreeString

gdiplus

GdipImageGetFrameDimensionsList GdipGetPropertyItemSize GdipGetPropertyItem GdipImageGetFrameCount GdipImageSelectActiveFrame GdipSetCompositingQuality GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipLoadImageFromStream GdipSetStringFormatLineAlign GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushI GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipSetInterpolationMode GdipGraphicsClear GdipDrawImage GdipDrawImageRectI GdipDeleteFontFamily GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipGetFamily GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatAlign

generic

count=2, id=199, version=41118,

count=10, id=223, productName=VS2013 build 21005, version=21005,

count=19, id=224, productName=VS2013 build 21005, version=21005,

count=1, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=37, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=221, productName=VS2013 build 21005, version=21005,

count=7, id=225, productName=VS2013 build 21005, version=21005,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=699, id=1, productName=Unmarked objects,

count=62, id=229, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,