Static task
static1
Behavioral task
behavioral1
Sample
Win10系统下载.url
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Win10系统下载.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
dbfdoctor_v2.9.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
dbfdoctor_v2.9.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
使用必读.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
使用必读.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
需要更多_百度搜索.url
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
需要更多_百度搜索.url
Resource
win10v2004-20220901-en
General
-
Target
df0b625bdcbb10e5a7d152ef6fa3b4a5a297779afec23812d4f219ed5f204e4a
-
Size
2.7MB
-
MD5
1d08030086eb96f2e804b803ed6d4a2e
-
SHA1
c38f74dc1c40f97ed915d581b98cedd34181c4ad
-
SHA256
df0b625bdcbb10e5a7d152ef6fa3b4a5a297779afec23812d4f219ed5f204e4a
-
SHA512
f03b54d3d7fb411f340c7da17199b572468aebdc7d677892f80f7f86802ea254051dbd6d11ea7c1e8f28cba0fbd58676e25c44d6d49f2efd81a27e2287aca3c4
-
SSDEEP
49152:bcfHdIxxOrziyhKuOVdNHuRqx+w9n1g2hUtx3vU/3s6tx5v:bGH6xOrzzgusreqowjhUD3vstbv
Malware Config
Signatures
Files
-
df0b625bdcbb10e5a7d152ef6fa3b4a5a297779afec23812d4f219ed5f204e4a.zip
-
Win10系统下载.url.url
-
dbfdoctor_v2.9.exe.exe windows x86
f34915ea2536f79cad5801876a340dac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareStringW
GetCommandLineW
GetProcessHeap
DeleteFileW
FormatMessageW
MoveFileExW
GetTempPathW
GetSystemDirectoryW
LoadLibraryW
GetTempFileNameW
LocalFree
GetUserDefaultUILanguage
GetLastError
GetCommandLineA
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
HeapSize
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CloseHandle
FlushFileBuffers
lstrlenW
LockResource
SizeofResource
LoadResource
FindResourceExA
CreateFileW
CreateDirectoryW
ole32
StringFromGUID2
user32
LoadStringW
MessageBoxW
EnableWindow
MessageBoxExW
DialogBoxParamW
EndDialog
SetDlgItemTextA
SetWindowTextW
SetDlgItemTextW
IsDlgButtonChecked
GetDlgItem
comctl32
ord17
msi
ord175
ord141
ord70
ord169
ord88
ord190
shell32
CommandLineToArgvW
SHGetFolderPathW
Sections
.text Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
使用必读.url.url
-
使用说明.txt
-
压缩包解压密码:www.win10com.com.txt
-
需要更多_百度搜索.url.url