ecd6ff7f8e749d9a0463292f5a2bb859
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2017-Dec-01 14:11:35 |
| Detected languages |
Chinese - PRC
|
| FileVersion | 1.0.0.0 |
| FileDescription | 易语言程序 |
| ProductName | 易语言程序 |
| ProductVersion | 1.0.0.0 |
| LegalCopyright | 作者版权所有 请尊重并使用正版 |
| Comments | 本程序使用易语言编写(http://www.eyuyan.com) |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ Microsoft Visual C++ v6.0 Microsoft Visual C++ v5.0/v6.0 (MFC) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to MD5
Uses constants related to SHA256 Uses constants related to AES |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 54/65 (Scanned on 2018-01-19 15:10:56) |
MicroWorld-eScan:
Adware.GenericKD.12644470
CAT-QuickHeal: Trojan.BitMiner ALYac: Adware.GenericKD.12644470 Cylance: Unsafe Zillya: Trojan.FlyStudio.Win32.21065 K7AntiVirus: Trojan ( 0051f4e91 ) K7GW: Trojan ( 0051f4e91 ) Cybereason: malicious.215ad3 Arcabit: Adware.Generic.DC0F076 TrendMicro: TROJ_GEN.R002C0GL217 Baidu: Win32.Trojan.WisdomEyes.16070401.9500.9706 F-Prot: W32/Agent.EW.gen!Eldorado Symantec: Trojan.Gen.6 TotalDefense: Win32/Oflwr.A!crypt TrendMicro-HouseCall: TROJ_GEN.R002C0GL217 Paloalto: generic.ml ClamAV: Win.Trojan.Generic-6260335-1 Kaspersky: not-a-virus:HEUR:RiskTool.Win32.BitMiner.gen BitDefender: Adware.GenericKD.12644470 NANO-Antivirus: Riskware.Win32.BitMiner.evrujf ViRobot: Trojan.Win32.Z.Onlinegames.1622016 AegisLab: Backdoor.W32.Agent.liRL Rising: Trojan.Win32/64.XMR-Miner!1.ADCC (CLASSIC) Ad-Aware: Adware.GenericKD.12644470 Emsisoft: Adware.GenericKD.12644470 (B) DrWeb: Trojan.KillProc.53965 VIPRE: Trojan.Win32.Generic!BT Invincea: heuristic McAfee-GW-Edition: BehavesLike.Win32.Generic.th Cyren: W32/Agent.EW.gen!Eldorado Jiangmin: RiskTool.BitMiner.pr Avira: TR/CoinMiner.agdsu Antiy-AVL: RiskWare[RiskTool]/Win32.BitMiner Endgame: malicious (high confidence) Microsoft: Trojan:Win32/Pynamer.A!ac SUPERAntiSpyware: Trojan.Agent/Gen-OnlineGames ZoneAlarm: not-a-virus:HEUR:RiskTool.Win32.BitMiner.gen GData: Win32.Application.CoinMiner.T@gen Sophos: Generic PUA OL (PUA) AhnLab-V3: Trojan/Win32.CoinMiner.C2266243 McAfee: Artemis!ECD6FF7F8E74 AVware: Trojan.Win32.Generic!BT MAX: malware (ai score=100) Malwarebytes: Spyware.OnlineGames Panda: Trj/GdSda.A ESET-NOD32: a variant of Win32/FlyStudio.OPD Tencent: Win32.Risk.Adw.Aota Yandex: Trojan.Pasta.Gen.1 SentinelOne: static engine - malicious eGambit: Unsafe.AI_Score_55% AVG: Win32:Malware-gen Avast: Win32:Malware-gen CrowdStrike: malicious_confidence_100% (W) Qihoo-360: Win32/Virus.RiskTool.46f |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x110 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2017-Dec-01 14:11:35 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x6a000 |
| SizeOfInitializedData | 0x121000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0004B58C (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x6b000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1be000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
Imports
| RASAPI32.dll |
RasHangUpA
RasGetConnectStatusA |
|---|---|
| WINMM.dll |
midiOutPrepareHeader
midiStreamRestart midiStreamClose midiOutReset midiStreamStop midiStreamOut waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause waveOutReset waveOutClose waveOutGetNumDevs midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen |
| WS2_32.dll |
#19
#18 #116 #115 #12 #3 #101 #1 #5 #16 #10 #17 |
| KERNEL32.dll |
WideCharToMultiByte
Process32Next Process32First CreateToolhelp32Snapshot SetFilePointer GetFileSize TerminateProcess OpenProcess GetVersion MultiByteToWideChar GetCurrentProcess SetLastError GetTimeZoneInformation FileTimeToSystemTime CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA InterlockedExchange IsBadCodePtr IsBadReadPtr CompareStringA GetStringTypeW GetStringTypeA SetUnhandledExceptionFilter IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetFileType SetStdHandle GetACP HeapSize RaiseException GetLocalTime GetSystemTime RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers DuplicateHandle lstrcpynA FileTimeToLocalFileTime LocalFree InterlockedDecrement InterlockedIncrement WriteFile ReadFile GetLastError WaitForMultipleObjects CreateFileA CloseHandle WaitForSingleObject CreateProcessA GetTickCount GetCommandLineA MulDiv GetProcAddress GetModuleHandleA GetVolumeInformationA SetCurrentDirectoryA SetEvent FindResourceA LoadResource LockResource GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetFullPathNameA FreeLibrary LoadLibraryA lstrlenA GetVersionExA WritePrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock FindFirstFileA FindClose GetFileAttributesA CompareStringW |
| USER32.dll |
CloseClipboard
WaitForInputIdle wsprintfA DestroyMenu GetClipboardData OpenClipboard SetClipboardData EmptyClipboard GetSystemMetrics GetCursorPos MessageBoxA SetWindowPos GetWindowTextA GetDlgItem FindWindowA GetWindowThreadProcessId GetClassNameA GetDesktopWindow GetForegroundWindow SetWindowTextA SystemParametersInfoA TranslateMessage LoadIconA DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx SendMessageA DestroyCursor SetParent IsWindow GetSysColorBrush LoadStringA GetMenuCheckMarkDimensions GetMenuState SetMenuItemBitmaps CheckMenuItem MoveWindow IsDialogMessageA ScrollWindowEx SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx GetScrollPos RegisterClassA GetMenuItemCount GetMenuItemID CreateWindowExA SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetSystemMenu DeleteMenu GetClassInfoA DefWindowProcA GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos InflateRect SetRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild UnregisterClassA SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx |
| GDI32.dll |
Escape
ExtTextOutA TextOutA RectVisible PtVisible GetViewportExtEx ExtSelectClipRgn LineTo MoveToEx CreateRectRgnIndirect GetTextMetricsA SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject GetObjectA CreatePen PatBlt FillRgn CreateRectRgn CombineRgn CreateSolidBrush GetStockObject CreateFontIndirectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps SetBkColor SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect |
| WINSPOOL.DRV |
ClosePrinter
OpenPrinterA DocumentPropertiesA |
| ADVAPI32.dll |
RegQueryValueA
RegSetValueExA RegOpenKeyExA RegCloseKey RegCreateKeyExA |
| SHELL32.dll |
Shell_NotifyIconA
ShellExecuteA |
| ole32.dll |
CLSIDFromString
OleUninitialize OleInitialize |
| OLEAUT32.dll |
#186
#163 #161 |
| COMCTL32.dll |
ImageList_Destroy
#17 |
| WININET.dll |
InternetCanonicalizeUrlA
InternetCrackUrlA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetReadFile InternetConnectA InternetSetOptionA InternetCloseHandle InternetOpenA |
| comdlg32.dll |
GetSaveFileNameA
GetFileTitleA GetOpenFileNameA ChooseColorA |
Delayed Imports
1
2
3
1 (#2)
2 (#2)
3 (#2)
4
1031
1038
1138
1139
1140
1141
1142
1143
1144
1145
26567
30994
30995
30996
1 (#3)
2 (#3)
3 (#3)
4 (#2)
5
127
1039
150
286
554
1037
1084
1124
1134
1150
30721
30722
3841
3842
3843
3857
3858
3859
3865
3866
3867
3868
3869
1032
1033
30977
DEFAULT_ICON
1151
1152
1 (#4)
String Table contents
| 打开 |
| 保存为 |
| 所有文件 (*.*) |
| 无标题 |
| 一未命名文件 |
| 隐藏(&H) |
| 得不到出错信息。 |
| 试图执行系统不支持的操作。 |
| 必需的资源无法得到。 |
| 内存不足。 |
| 出现了未知的错误 |
| 无效的文件名。 |
| 打开文档失败。 |
| 保存文档失败。 |
| 将改动保存到 %1？ |
| 建立空文档失败。 |
| 该文件太大，无法打开。 |
| 无法启动打印作业。 |
| 启动帮助失败。 |
| 内部应用程序出错。 |
| 命令失败。 |
| 没有足够的内存执行操作。 |
| 系统注册项已被移除并且相应的 INI 文件（假如存在）也被删除。 |
| 不是所有的系统注册项（或 INI 文件）都被移除。 |
| 在系统中没有找到此程序需要的文件%s。 |
| 此程序连接到文件 %s 中丢失的输出 %s 。此机器可能有一个 %s 不兼容的版本。 |
| 请键入一个整数。 |
| 请键入一个数。 |
| “请填入一个在%1和%2之间的整数。” |
| “请填入一个在%1和%2之间的数字。” |
| “请填入不多于%1个的字符。” |
| 请选择一个按钮。 |
| “请填入一个在0和255之间的整数。” |
| “请填入一个正整数。” |
| “请填入一个日期和/或时间值。” |
| “请填入一个货币值。” |
| 非预期的文件格式。 |
| 无法找到该文件。 |
| 请验证给出的路径和文件名是否正确。 |
| 目的磁盘驱动器已满。 |
| 无法对 %1 进行读操作，它已经被其他人打开。 |
| 无法对 %1 进行写操作，因为它是只读文件或已经被其他人打开。 |
| 在对 %1 进行读操作时发生了一个非预期的错误。 |
| 在对 %1 进行写操作时发生了一个非预期的错误。 |
| 无法读只写特性。 |
| 无法写只读特性。 |
| 无法装入邮件系统支援。 |
| 邮件系统 DLL 无效。 |
| 传递邮件未能传递信息。 |
| 无错误发生。 |
| 在对 %1 进行访问时发生了一个不明错误。 |
| 没有找到 %1。 |
| %1 中包含无效的路径。 |
| 无法打开 %1 因为太多文件已被打开。 |
| 对 %1 的存取被拒绝。 |
| 一个无效的文件柄与 %1 相关联。 |
| 无法删除 %1 因为它是当前目录。 |
| 该目录已满，无法创建 %1。 |
| 对 %1 进行查找失败。 |
| 在存取 %1 时一个硬件输入/输出错误被报告。 |
| 在存取 %1 时发生共享违例。 |
| 在存取 %1 时发生锁违例。 |
| 在存取 %1 时磁盘已满。 |
| 试图越过其尾端对 %1 进行读写。 |
| 无错误发生。 |
| 在对 %1 进行访问时发生了一个不明错误。 |
| 试图在对 %1 进行读操作的同时对其进行写操作。 |
| 试图越过其尾端对 %1 进行读写。 |
| 试图在对 %1 进行写操作的同时对其进行读操作。 |
| %1 格式错。 |
| %1 含有非预期的对象。 |
| %1 包含错误的模式。 |
| 象素 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | Chinese - PRC |
| FileVersion (#2) | 1.0.0.0 |
| FileDescription | 易语言程序 |
| ProductName | 易语言程序 |
| ProductVersion (#2) | 1.0.0.0 |
| LegalCopyright | 作者版权所有 请尊重并使用正版 |
| Comments | 本程序使用易语言编写(http://www.eyuyan.com) |
| Resource LangID | Chinese - PRC |
|---|
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0xb602d6d8 |
|---|---|
| Unmarked objects | 0 |
| 12 (7291) | 5 |
| C++ objects (8047) | 9 |
| C objects (8047) | 6 |
| 14 (7299) | 44 |
| 19 (8022) | 44 |
| Imports (2179) | 2 |
| Total imports | 680 |
| 19 (8034) | 29 |
| C++ objects (VS98 SP6 build 8804) | 111 |
| C objects (VS98 SP6 build 8804) | 200 |
| C++ objects (VS98 build 8168) | 80 |
| Unmarked objects (#2) | 84 |
| Resource objects (VS98 SP6 cvtres build 1736) | 1 |