🔬 putty.exe

← 보고서 목록

기본 정보

SHA-256
d01fdb5aae8f112526040a39b0bfb9e27d813003178645e65f8d1cfdb2a26c87
크기
1,706,136바이트
형식
PE32+ · x86_64 · 실행 파일 · 섹션 10개
종류
네이티브 코드
Ghidra 분석
함수 3,082개 · 문자열 4,022개 · 가져오는 함수 348개 · 기준 주소 0x140000000
분석
2026-10-16 02:40 · 52.4초 · rea 6.5.0 + Ghidra 12.1.4

눈여겨볼 기능

아래 Windows 기능은 정상 프로그램도 흔히 씁니다. 있다고 악성이라는 뜻이 아니라, 코드를 어디부터 볼지 고르는 기준입니다.

프로세스 실행

다른 프로세스 조작

  • KERNEL32.DLL::OpenProcess — 부르는 함수 1곳 FUN_140044020

동적 로딩

  • KERNEL32.DLL::GetProcAddress — 부르는 함수 20곳 FUN_140005270 FUN_14000d510 FUN_140024b90
  • KERNEL32.DLL::LoadLibraryA — 부르는 함수 1곳 FUN_140043300
  • KERNEL32.DLL::LoadLibraryExA — 부르는 함수 1곳
  • KERNEL32.DLL::LoadLibraryExW — 부르는 함수 3곳

레지스트리 쓰기

  • ADVAPI32.DLL::RegCreateKeyExA — 부르는 함수 1곳
  • ADVAPI32.DLL::RegDeleteKeyA — 부르는 함수 0곳
  • ADVAPI32.DLL::RegSetValueExA — 부르는 함수 3곳

디버거 탐지

  • KERNEL32.DLL::IsDebuggerPresent — 부르는 함수 3곳
  • KERNEL32.DLL::OutputDebugStringW — 부르는 함수 1곳

그 기능을 부르는 코드

Ghidra가 기계어에서 되살린 C 형태의 코드입니다(원래 소스가 아닙니다). 표시한 줄이 위 기능을 부르는 곳이고, 긴 함수는 그 주변만 남겼습니다. 후보 18개 중 8개를 보여 줍니다.

FUN_140001160 0x140001160 · CreateProcessA · 2549줄(일부)
/* WARNING: Removing unreachable block (ram,0x000140004089) */

ulonglong FUN_140001160(HWND param_1,uint param_2,HWND param_3,uint *param_4)

{
  /* … 1444줄 생략 … */
            local_8be[6] = 0x68;
            bStack_8b7 = 0;
            uStack_8b6 = 0;
            local_87c = 0;
            local_876 = 0;
            local_870 = 0;
            local_8b0 = (undefined1  [16])0x0;
            local_8a0 = 0;
            CreateProcessA(local_848,(LPSTR)pauVar40,(LPSECURITY_ATTRIBUTES)0x0,
                           (LPSECURITY_ATTRIBUTES)0x0,BVar26,0x20,(LPVOID)0x0,(LPCSTR)0x0,
                           (LPSTARTUPINFOA)(local_8be + 6),&local_8e0);
            CloseHandle(local_8e0.hProcess);
            CloseHandle(local_8e0.hThread);
            if (hFileMappingObject != (HANDLE)0x0) {
              CloseHandle(hFileMappingObject);
            }
            FUN_14003fe50(pauVar40);
  /* … 1083줄 생략 … */
FUN_140084f20 0x140084f20 · CreateProcessA · 96줄
undefined1 (*) [32] FUN_140084f20(longlong *param_1,ulonglong *param_2,undefined8 *param_3)

{
  BOOL BVar1;
  DWORD DVar2;
  LPSTR lpCommandLine;
  undefined8 *puVar3;
  undefined8 uVar4;
  undefined1 (*pauVar5) [32];
  code *pcVar6;
  LPSECURITY_ATTRIBUTES lpPipeAttributes;
  undefined8 uVar7;
  undefined1 auStackY_158 [32];
  _PROCESS_INFORMATION local_108;
  _STARTUPINFOA local_f0;
  _SECURITY_ATTRIBUTES local_88;
  HANDLE local_70;
  HANDLE local_68;
  HANDLE local_60;
  HANDLE local_58;
  HANDLE local_50;
  HANDLE local_48;
  ulonglong local_40;
  
  local_40 = DAT_140132040 ^ (ulonglong)auStackY_158;
  local_88.nLength = 0x18;
  local_88.lpSecurityDescriptor = (LPVOID)0x0;
  local_88.bInheritHandle = 1;
  lpPipeAttributes = &local_88;
  uVar7 = 0;
  BVar1 = CreatePipe(&local_58,&local_60,lpPipeAttributes,0);
  if (BVar1 != 0) {
    lpPipeAttributes = &local_88;
    uVar7 = 0;
    BVar1 = CreatePipe(&local_50,&local_48,lpPipeAttributes,0);
    pcVar6 = CloseHandle_exref;
    if (BVar1 == 0) {
      CloseHandle(local_58);
      local_50 = local_60;
    }
    else {
      lpPipeAttributes = &local_88;
      uVar7 = 0;
      BVar1 = CreatePipe(&local_68,&local_70,lpPipeAttributes,0);
      pcVar6 = CloseHandle_exref;
      if (BVar1 != 0) {
        SetHandleInformation(local_48,1,0);
        SetHandleInformation(local_58,1,0);
        if (local_68 != (HANDLE)0x0) {
          SetHandleInformation(local_68,1,0);
        }
        local_f0.cb = 0x68;
        local_f0.lpReserved = (LPSTR)0x0;
        local_f0.lpDesktop = (LPSTR)0x0;
        local_f0.lpTitle = (LPSTR)0x0;
        local_f0.dwFlags = 0x100;
        local_f0.cbReserved2 = 0;
        local_f0.lpReserved2 = (LPBYTE)0x0;
        local_f0.hStdInput = local_50;
        local_f0.hStdOutput = local_60;
        local_f0.hStdError = local_70;
        lpCommandLine = (LPSTR)FUN_140047220(param_2);
        CreateProcessA((LPCSTR)0x0,lpCommandLine,(LPSECURITY_ATTRIBUTES)0x0,
                       (LPSECURITY_ATTRIBUTES)0x0,1,0x8000020,(LPVOID)0x0,(LPCSTR)0x0,&local_f0,
                       &local_108);
        FUN_14003fe50(lpCommandLine);
        CloseHandle(local_108.hThread);
        if (param_3 == (undefined8 *)0x0) {
          CloseHandle(local_108.hProcess);
        }
        else {
          puVar3 = FUN_140088d30(local_108.hProcess);
          *param_3 = puVar3;
        }
        CloseHandle(local_50);
        CloseHandle(local_60);
        if (local_70 != (HANDLE)0x0) {
          CloseHandle(local_70);
        }
        FUN_1400a5b70(param_1,(longlong)local_48,(longlong)local_58,(longlong)local_68,0);
        pauVar5 = (undefined1 (*) [32])0x0;
        goto LAB_1400851d1;
      }
      CloseHandle(local_58);
      CloseHandle(local_60);
      CloseHandle(local_48);
    }
    (*pcVar6)(local_50);
  }
  DVar2 = GetLastError();
  uVar4 = FUN_140044850(DVar2);
  pauVar5 = FUN_14003f150(0x14010faec,uVar4,lpPipeAttributes,uVar7);
LAB_1400851d1:
  FUN_1400bf610(local_40 ^ (ulonglong)auStackY_158);
  return pauVar5;
}
FUN_140022270 0x140022270 · ShellExecuteA · 43줄
undefined8 FUN_140022270(HWND param_1,int param_2,undefined8 param_3,undefined8 param_4)

{
  uint uVar1;
  undefined1 (*pauVar2) [32];
  LPVOID pvVar3;
  
  if (param_2 != 0x10) {
    if (param_2 != 0x111) {
      if (param_2 != 0x110) {
        return 0;
      }
      pauVar2 = FUN_14003f150(0x14010f14f,"PuTTY",param_3,param_4);
      SetWindowTextA(param_1,(LPCSTR)pauVar2);
      FUN_14003fe50(pauVar2);
      pvVar3 = (LPVOID)FUN_140049390(&DAT_140120649);
      pauVar2 = FUN_14003f150(0x14010fdd0,"PuTTY","Release 0.85",pvVar3);
      FUN_14003fe50(pvVar3);
      SetDlgItemTextA(param_1,0x3ea,(LPCSTR)pauVar2);
      FUN_140049490(param_1,0x3ea);
      FUN_14003fe50(pauVar2);
      return 1;
    }
    if (1 < (ushort)((short)param_3 - 1U)) {
      uVar1 = (uint)param_3 & 0xffff;
      if (uVar1 == 0x3eb) {
        EnableWindow(param_1,0);
        DialogBoxParamA(DAT_140132ef8,(LPCSTR)0x71,param_1,FUN_140024340,0);
        EnableWindow(param_1,1);
        SetActiveWindow(param_1);
        return 0;
      }
      if (uVar1 != 0x3ec) {
        return 0;
      }
      ShellExecuteA(param_1,"open","https://www.chiark.greenend.org.uk/~sgtatham/putty/",(LPCSTR)0x0
                    ,(LPCSTR)0x0,10);
      return 0;
    }
  }
  EndDialog(param_1,1);
  return 0;
}
FUN_140044020 0x140044020 · OpenProcess · 84줄
PSID FUN_140044020(void)

{
  char cVar1;
  DWORD DVar2;
  int iVar3;
  BOOL BVar4;
  HANDLE hObject;
  undefined8 *hMem;
  PSID pDestinationSid;
  PSID pvVar5;
  LPVOID pvVar6;
  undefined1 auStack_68 [32];
  uint *local_48;
  uint local_3c;
  HANDLE local_38;
  ulonglong local_30;
  
  local_30 = DAT_140132040 ^ (ulonglong)auStack_68;
  local_38 = (HANDLE)0x0;
  pvVar5 = DAT_140134a68;
  if (DAT_140134a68 != (PSID)0x0) goto LAB_140044195;
  cVar1 = FUN_140043e60();
  if (cVar1 == '\0') {
    pvVar5 = (PSID)0x0;
    goto LAB_140044195;
  }
  DVar2 = GetCurrentProcessId();
  pvVar5 = (PSID)0x0;
  hObject = OpenProcess(0x2000000,0,DVar2);
  if (hObject == (HANDLE)0x0) goto LAB_140044195;
  iVar3 = (*DAT_140134a40)(hObject,8,&local_38);
  if (iVar3 == 0) {
LAB_14004415a:
    hMem = (undefined8 *)0x0;
LAB_14004415d:
    pvVar5 = (PSID)0x0;
    pvVar6 = (LPVOID)0x0;
  }
  else {
    local_48 = &local_3c;
    iVar3 = (*DAT_140134a48)(local_38,1,0,0);
    if (iVar3 != 0) {
LAB_1400440df:
      hMem = LocalAlloc(0x40,(ulonglong)local_3c);
      if (hMem == (undefined8 *)0x0) goto LAB_14004415a;
      local_48 = &local_3c;
      iVar3 = (*DAT_140134a48)(local_38,1,hMem,local_3c);
      if (iVar3 != 0) {
        DVar2 = GetLengthSid((PSID)*hMem);
        pvVar5 = (PSID)0x0;
        pDestinationSid = (PSID)FUN_14003fdb0((ulonglong)DVar2,1,0);
        BVar4 = CopySid(DVar2,pDestinationSid,(PSID)*hMem);
        pvVar6 = pDestinationSid;
        if (BVar4 != 0) {
          pvVar5 = pDestinationSid;
          pvVar6 = (LPVOID)0x0;
          DAT_140134a68 = pDestinationSid;
        }
        goto LAB_140044161;
      }
      goto LAB_14004415d;
    }
    DVar2 = GetLastError();
    hMem = (undefined8 *)0x0;
    pvVar5 = (PSID)0x0;
    pvVar6 = (LPVOID)0x0;
    if (DVar2 == 0x7a) goto LAB_1400440df;
  }
LAB_140044161:
  CloseHandle(hObject);
  if (local_38 != (HANDLE)0x0) {
    CloseHandle(local_38);
  }
  if (hMem != (undefined8 *)0x0) {
    LocalFree(hMem);
  }
  if (pvVar6 != (LPVOID)0x0) {
    FUN_14003fe50(pvVar6);
  }
LAB_140044195:
  FUN_1400bf610(local_30 ^ (ulonglong)auStack_68);
  return pvVar5;
}
FUN_140005270 0x140005270 · GetProcAddress · 476줄(일부)
undefined8 FUN_140005270(HINSTANCE param_1,undefined8 param_2,byte *param_3,FILE *param_4)

{
  /* … 72줄 생략 … */
  hModule = FUN_140043300(0x140112044);
  hModule_00 = FUN_140043300(0x140111fe7);
  hModule_01 = FUN_140043300(0x140112008);
  if (hModule == (HMODULE)0x0) {
    DAT_140132f48 = (FARPROC)0x0;
    DAT_140132f88 = (FARPROC)0x0;
  }
  else {
    DAT_140132f48 = GetProcAddress(hModule,"FlashWindowEx");
    DAT_140132f88 = GetProcAddress(hModule,"ToUnicodeEx");
  }
  if (hModule_00 == (HMODULE)0x0) {
    DAT_140132f38 = (FARPROC)0x0;
    DAT_140132f40 = (FARPROC)0x0;
  }
  else {
    DAT_140132f38 = GetProcAddress(hModule_00,"PlaySoundW");
    DAT_140132f40 = GetProcAddress(hModule_00,"PlaySoundA");
  }
  if (hModule == (HMODULE)0x0) {
    DAT_140132f78 = (FARPROC)0x0;
    DAT_140132f80 = (FARPROC)0x0;
    DAT_140132f70 = (FARPROC)0x0;
  }
  else {
    DAT_140132f78 = GetProcAddress(hModule,"GetMonitorInfoA");
    DAT_140132f80 = GetProcAddress(hModule,"MonitorFromPoint");
    DAT_140132f70 = GetProcAddress(hModule,"MonitorFromWindow");
  }
  if (hModule_01 == (HMODULE)0x0) {
    DAT_140132f68 = (FARPROC)0x0;
  }
  else {
    DAT_140132f68 = GetProcAddress(hModule_01,"GetDpiForMonitor");
  }
  if (hModule == (HMODULE)0x0) {
    DAT_140132f50 = (FARPROC)0x0;
    DAT_140132f58 = (FARPROC)0x0;
  }
  else {
    DAT_140132f50 = GetProcAddress(hModule,"GetSystemMetricsForDpi");
    DAT_140132f58 = GetProcAddress(hModule,"AdjustWindowRectExForDpi");
  }
  FUN_1400430b0();
  dwNewLong = (longlong *)FUN_14003fdb0(1,0x1350,0);
  uVar28 = 0x1340;
  FUN_1400c0f30((undefined1 (*) [32])(dwNewLong + 2),0,0x1340);
  puVar34 = PTR_LOOP_140132008;
  dwNewLong[1] = (longlong)PTR_LOOP_140132008;
  *dwNewLong = (longlong)&PTR_LOOP_140132000;
  /* … 351줄 생략 … */
FUN_14000d510 0x14000d510 · GetProcAddress · 50줄
void FUN_14000d510(void)

{
  HMODULE hModule;
  HGLOBAL hResData;
  LPBYTE pBVar1;
  
  if (DAT_140132fb0 != '\0') {
    return;
  }
  DAT_140132fb0 = 1;
  hModule = FUN_140043300(0x14010c6ab);
  if (hModule == (HMODULE)0x0) {
    DAT_140132fb8 = (FARPROC)0x0;
  }
  else {
    DAT_140132fb8 = GetProcAddress(hModule,"HtmlHelpA");
    if (DAT_140132fb8 != (FARPROC)0x0) {
      if (DAT_140132fd9 == '\0') {
        DAT_140132fd9 = '\x01';
        if (DAT_140132fa0 != '\x01') {
          DAT_140132fa0 = '\x01';
          DAT_140132fa8 = FindResourceA((HMODULE)0x0,(LPCSTR)0x7d0,(LPCSTR)0x7d0);
        }
        if (((DAT_140132fa8 != (HRSRC)0x0) &&
            (DAT_140132fdc = SizeofResource((HMODULE)0x0,DAT_140132fa8), DAT_140132fdc != 0)) &&
           (hResData = LoadResource((HMODULE)0x0,DAT_140132fa8), hResData != (HGLOBAL)0x0)) {
          DAT_140132fd0 = LockResource(hResData);
        }
      }
      if (DAT_140132fd0 != (LPVOID)0x0) {
        return;
      }
      pBVar1 = FUN_140043a30((HKEY)0xffffffff80000002,"Software\\SimonTatham\\PuTTY64\\CHMPath",
                             (LPCSTR)0x0);
      if ((pBVar1 == (LPBYTE)0x0) &&
         (pBVar1 = FUN_140043a30((HKEY)0xffffffff80000002,"Software\\SimonTatham\\PuTTY\\CHMPath",
                                 (LPCSTR)0x0), pBVar1 == (LPBYTE)0x0)) {
        return;
      }
      DAT_140132fc0 = pBVar1;
      DAT_140132fc8 = 0;
      return;
    }
  }
                    /* WARNING: Could not recover jumptable at 0x00014000d599. Too many branches */
                    /* WARNING: Treating indirect jump as call */
  FreeLibrary(hModule);
  return;
}
FUN_140024b90 0x140024b90 · GetProcAddress · 17줄
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_140024b90(void)

{
  HMODULE hModule;
  
  hModule = FUN_140043300(0x14011204f);
  _DAT_140133830 = GetProcAddress(hModule,"InitCommonControls");
  DAT_140133838 = GetProcAddress(hModule,"MakeDragList");
  DAT_140133840 = GetProcAddress(hModule,"LBItemFromPt");
  DAT_140133848 = GetProcAddress(hModule,"DrawInsert");
                    /* WARNING: Could not recover jumptable at 0x000140024bfe. Too many branches */
                    /* WARNING: Treating indirect jump as call */
  (*_DAT_140133830)();
  return;
}
FUN_140043300 0x140043300 · LoadLibraryA · 13줄
HMODULE FUN_140043300(longlong param_1)

{
  undefined1 (*pauVar1) [32];
  char *lpLibFileName;
  HMODULE pHVar2;
  
  pauVar1 = FUN_14007a360();
  lpLibFileName = FUN_14003eed0((ulonglong *)pauVar1,(ulonglong *)&DAT_140116c60,param_1,0);
  pHVar2 = LoadLibraryA(lpLibFileName);
  FUN_14003fe50(lpLibFileName);
  return pHVar2;
}

시작 지점(entry)

void entry(void)

{
  __security_init_cookie();
  __scrt_common_main_seh();
  return;
}

눈여겨볼 문자열

URL·IP 주소·레지스트리 경로·명령어·실행 파일 이름이 들어간 문자열 39개.

종류위치문자열
URL0x14011c10fhttps://www.chiark.greenend.org.uk/~sgtatham/putty/
URL0x1401a1098<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <!-- Do not attempt to do anything clever with this file, as some versions of Windows are very sensitive to the exact format. Hence, some facts below are fibs. --> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="0.0.0.0" processorArchitecture="*" name="PuTTY" type="win
IP 주소0x14011c0a50.0.0.0
레지스트리0x14010f05dUnable to create registry key HKEY_CURRENT_USER\%s\%s
실행 파일 이름0x140111fdbspoolss.dll
실행 파일 이름0x140111fe7winmm.dll
실행 파일 이름0x140111ff1dwmapi.dll
실행 파일 이름0x140111ffcsspicli.dll
실행 파일 이름0x140112008shcore.dll
실행 파일 이름0x140112013wship6.dll
실행 파일 이름0x14011201e\gssapi64.dll
실행 파일 이름0x14011202ccrypt32.dll
실행 파일 이름0x140112038secur32.dll
실행 파일 이름0x140112044user32.dll
실행 파일 이름0x14011204fcomctl32.dll
실행 파일 이름0x14011205cshell32.dll
실행 파일 이름0x140112068Shell32.dll
실행 파일 이름0x140112074kernel32.dll
실행 파일 이름0x140112081wsock32.dll
실행 파일 이름0x14011208dadvapi32.dll
실행 파일 이름0x14011209aws2_32.dll
실행 파일 이름0x14011791fMIT Kerberos GSSAPI64.DLL
실행 파일 이름0x140117939Using GSSAPI from GSSAPI64.DLL
실행 파일 이름0x140117958Using SSPI from SECUR32.DLL
실행 파일 이름0x140117974Microsoft SSPI SECUR32.DLL
실행 파일 이름0x140120705Pageant.exe
실행 파일 이름0x140120711PuTTYgen.exe
실행 파일 이름0x14012072bDynamic Library Files (*.dll)
실행 파일 이름0x140121a7c.dll
실행 파일 이름0x1401277f4Dynamic Library Files (*.dll)
실행 파일 이름0x140129b48mscoree.dll
실행 파일 이름0x14012e87aGDI32.dll
실행 파일 이름0x14012e884IMM32.dll
실행 파일 이름0x14012e88eole32.dll
실행 파일 이름0x14012e898USER32.dll
실행 파일 이름0x14012e8a3KERNEL32.dll
실행 파일 이름0x14012e8b0SHELL32.dll
실행 파일 이름0x14012e8bcCOMDLG32.dll
실행 파일 이름0x14012e8c9ADVAPI32.dll

가져오는 함수(import) 348개

ADVAPI32.DLL 15개

AllocateAndInitializeSid CopySid EqualSid GetLengthSid GetUserNameA InitializeSecurityDescriptor RegCloseKey RegCreateKeyExA RegDeleteKeyA RegEnumKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA SetSecurityDescriptorDacl SetSecurityDescriptorOwner

COMDLG32.DLL 6개

ChooseColorA ChooseFontA GetOpenFileNameA GetOpenFileNameW GetSaveFileNameA GetSaveFileNameW

GDI32.DLL 51개

BitBlt CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateFontA CreateFontIndirectA CreatePalette CreatePen CreateSolidBrush DeleteDC DeleteObject ExcludeClipRect ExtTextOutA ExtTextOutW GetBkMode GetCharABCWidthsFloatA GetCharWidth32A GetCharWidth32W GetCharWidthA GetCharWidthW GetCharacterPlacementW GetCurrentObject GetDIBits GetDeviceCaps GetObjectA GetOutlineTextMetricsA GetPixel GetStockObject GetTextExtentExPointA GetTextExtentPoint32A GetTextExtentPointA GetTextMetricsA IntersectClipRect LineTo MoveToEx Polyline RealizePalette Rectangle SelectObject SelectPalette SetBkColor SetBkMode SetMapMode SetPaletteEntries SetPixel SetTextAlign SetTextColor TextOutA TranslateCharsetInfo UnrealizeObject UpdateColors

IMM32.DLL 5개

ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCompositionFontA ImmSetCompositionWindow

KERNEL32.DLL 148개

Beep ClearCommBreak CloseHandle CompareStringW ConnectNamedPipe CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeA CreatePipe CreateProcessA CreateThread DeleteCriticalSection DeleteFileA EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FindResourceA FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommState GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryA GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableA GetExitCodeProcess GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoA GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemTimeAsFileTime GetTempPathA GetThreadTimes GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatus GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDBCSLeadByteEx IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadResource LocalAlloc LocalFileTimeToFileTime LocalFree LockResource MapViewOfFile MulDiv MultiByteToWideChar OpenProcess OutputDebugStringW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetCommBreak SetCommState SetCommTimeouts SetCurrentDirectoryA SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter SizeofResource TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile WaitForSingleObject WaitNamedPipeA WideCharToMultiByte WriteConsoleW WriteFile

OLE32.DLL 3개

CoCreateInstance CoInitialize CoUninitialize

SHELL32.DLL 1개

ShellExecuteA

USER32.DLL 119개

AppendMenuA BeginPaint CheckDlgButton CheckMenuItem CheckRadioButton CloseClipboard CreateCaret CreateDialogParamA CreateMenu CreatePopupMenu CreateWindowExA CreateWindowExW DefDlgProcA DefWindowProcA DefWindowProcW DeleteMenu DestroyCaret DestroyIcon DestroyWindow DialogBoxParamA DispatchMessageA DispatchMessageW DrawEdge DrawIconEx EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint FindWindowA FlashWindow GetCapture GetCaretBlinkTime GetClientRect GetClipboardData GetClipboardOwner GetCursorPos GetDC GetDesktopWindow GetDlgItem GetDoubleClickTime GetForegroundWindow GetKeyboardLayout GetKeyboardState GetMessageA GetMessageTime GetParent GetQueueStatus GetScrollInfo GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetWindowLongPtrA GetWindowPlacement GetWindowRect GetWindowTextA GetWindowTextLengthA GetWindowTextLengthW GetWindowTextW HideCaret InsertMenuA InvalidateRect IsDialogMessageA IsDlgButtonChecked IsIconic IsWindow IsZoomed KillTimer LoadCursorA LoadIconA LoadImageA MapDialogRect MessageBeep MessageBoxA MessageBoxIndirectW MoveWindow MsgWaitForMultipleObjects OffsetRect OpenClipboard PeekMessageA PeekMessageW PostMessageA PostQuitMessage RegisterClassA RegisterClassW RegisterClipboardFormatA RegisterWindowMessageA ReleaseCapture ReleaseDC ScreenToClient SendDlgItemMessageA SendMessageA SetActiveWindow SetCapture SetCaretPos SetClassLongPtrA SetClipboardData SetCursor SetDlgItemTextA SetDlgItemTextW SetFocus SetForegroundWindow SetKeyboardState SetScrollInfo SetTimer SetWindowLongPtrA SetWindowPlacement SetWindowPos SetWindowTextA SetWindowTextW ShowCaret ShowCursor ShowWindow SystemParametersInfoA ToAsciiEx TrackPopupMenu TranslateMessage UpdateWindow

메모리 구역

이름시작크기(바이트)
Headers0x1400000001,024
.text0x140001000971,776
.rdata0x1400ef000273,408
.data0x14013200016,908
.pdata0x14013700029,184
.00cfg0x14013f000512
.gxfg0x14014000011,264
.tls0x140143000512
_RDATA0x140144000512
.rsrc0x140145000378,368
.reloc0x1401a20008,704
tdb0xff000000006,224

자동 정적 분석 결과이며 악성 여부 판정이 아닙니다. 패킹·난독화된 파일은 실제 동작이 보이지 않을 수 있습니다.