0����-���U��'�/�*�Ɵ�P�j]���I̛eh��YՍ�Z�0o#��W���A1^t�����S (Х����$��x6��J��,t�bk%����6�Q��Mj�F �8��n�o&���[ΙfP�h2�����W�=��ȣ�,,�8j��MV"+���䳇�*�B�[A�@@ Ǟnz���<�CY��w�*��k�+���m�N�%�2��ꯇԪ.�C��|���6�]�0���v�BG���:sa��-q�9}�M�' �^��k�Ru�a&� dJl� �P���X�4����˾� HN_�:gt�(������z�jp|�����=���ҭߤ"�ᆑ*2���~�4��DW�L]Tup?`�7S^w�� <�y�5������c���t9�'Ô�����w `3uS�<������k��9���?�,����u�9A��q�1����ٙ�s.A�o_J�� C� �^Ez�.�k�=x�=��Ӝ1/ڨ�k�6�nZ�bin���q�s��啟��)Z�˽���x4K �1= ���T�P��+�� �����;��7N3,������.<����D!����>A;7��@&"� fؙ�PJ$�r�a��_����O�4��f�@��w��s*�]7qs[�I���Z)�2����*��B��.�~�6(Q�a �ޞɚ�h'D2k,0/d��~`�;1�*:������`���?���/.���J�ܘ����.z�&���U��[i�2YB?~��i�9-�y~^�ЛG/��3�7X�vx/�_�^�^&VoF.��u�N���0�3� �Ue'0��2�{��ԒZ�E��I]��n��v�0��@z���h�D���&�n|� �ܦ]���$o�})�1����wBJ<�pG� �1�QPJ�b�@\�i2��Z����3b�2C��(���d�.iW-�G��J�2�q=�0N7�g������)��4f<�V�9/� �mAS��(-7�(�t���,�~����a9��Ӂ�='5�D^T�,"l8�a�gnMi�<<� �:�vY�+����5 ���o����{�o�\��x����}��ڜZ�J�p�=e�t$f |��0�>ݰ�K8�(���Us��+��i�!|�lm�������N��̝Q^\�9�xCӖ횼蟦�$��,���a!k�G�ne�IZ�d��KI N��G�ǨY��yS�(?:�l2��6q��Uq+w�0�������š���peM�?7&���sܸ������ br�,��z��ya��4���O�e&���)'M=�y�*�K_E%>�2�n�Hƭg|t����lOP�P��k�u��!:�MMP�yK�7<T!�?-�/xH�ɺI{I��� ��Z�n�;j4Í«��k��[�W!���dž�7TD�Al~����f��sS�@��z*"���"/�d �3�����P�lr+:9�E��`&D?���C}����v:�U��{k����ҬZ�M(�#ԋO=>d�~�JQC]21�Ʀ��\H��0fg�� �x\�o�r=����08vFl�/5�^=�a������HоLG~!X���}�BȄ�#^�s���z 48*Wt>�0�`Z�̜Hܱ�:S�j���C_�|�|;/�����O�y�FL�P �-��_<�������4��t6 �۪�$��6$� ]1~���=�@b���1& e��1g�B(��.���k*�P�� j�6(.4Q�ˀ�ХО�����/�Ⅿ�{A���S�U�U��������!�4�O�DB���΄���nZNQ���?^c��} �38N�L�lf�Xg�h֘ᴚ�]@ ���0����*����c"�?E//���x�'��G��G���;͇2ȥ��b��X�������x�rEh|�l�n�n=b7a ҫ��ڇT�):����)j��U�[ �z���W�!@}�ӽ37�q�3��,pܬ�3�}E� �ݍ\ʁcedʷ��ƺ�W���l���jH;W}��3th\b ڝ�Y̆4u�bɯ�v��z�߱0%�v!��b0r�]`�?^V��E\�~��|x�����@�D�Lҏ1���� v�Y\��_��O���G� �%��m1�X����Py����^�Sؾ�!�a��`�TtqT�>��߬�ar�A�x�'m3��A48������%���w�����3����3u����Ӂ��5о5N��G=6 S�l���u�Uv=�lZ깠�vȨ�n�~�A��C#T)ˉ\�C�=M(&Q|�IJBw^&Q��TD���B�ۘT4�1�cU%`�ڴ����0)���x�/tG(�=8���?�����&�w��,�#T���o�U�sf�5�؉��rn-*�T4b�*�X�x�}�sHA�G�I��A��e��\�_yB�ry3,=o � �/P�$5~�:;9����m���Ő�V��`�-u �^͍�Դ`k::ˤ�x�CLcҢ#�C�ֽK�f,4��+l�_({߳�`�*QF ��\]���(Z�a�b���?G�r�4��Η�s���&���2pd�OOp� п����\.�@Hpm3���<�zQ�� �.��o=xle:�)bTͩ���O�WC�i��W/��T�(�#��ዐ<��rVO0��$�,�����������������@�a]C|�RQ7�r5��S�]6�j��5�*�o�e���m����>�#��W.��8����qE��}�$#�>����D��j@�Y�+q���?˼���J��]�,r�y:��l�a���W ^o ���M`��[�;���Qool��S���W��if�n�����ߩ�i�'��.}(�ˀI'4`OEJ}��D��n$3��&�L>n��|�ܕ,���D�� �;4��M=jݡ�i��ׅ�s�5�3ڷ��ǧYk�R�L�wg�z#��x^�� k3����I�r�o�黹��~��G%���m��n���#ܼ�Xi��u4W���m&#T�£/Q2��2���J�����p��~�����.���,�l��XR^�����;�fԳJ|ư�Qo��;���ך��+��D�EJ��x������s1�+��GO����gI������eZ��k=y�>&���� ���t�_�P�Y� ��s-�� �6��*{r�>h�%.^e�v�D'bDQ2��g\<�I���X1Bn��H��<X&���O�W����LD"Hz)7�-������e��<��\�}�9��M� P� iU�~�U�o�=�M���7x47u�������� �>�-�X�A=��Cu�Un?��0t�ラ�$��j����j�kX���Q%?=�w؉��/HV�쨢�Ł=C�Ӊ�}!��'0.Ζ�绗ݚ2tN���ͼ9%��id�~]TU��8���[Ʃ_�D[j���ö�Y��}����Q����2�/��z0����r{Ǵ�\2C����R,CKY�ص"���!8��7L�G3���_��P���`�rS�z����;�g�!S�M!����k��N�/��~1��$��]�S���i�6Jj1zY��-��]�@p�1!��J�`ʗ�G|5얄��~����W�!��i�?� �@� �
Static task
static1
Behavioral task
behavioral1
Sample
TdxW_zyb7.61普行补丁.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
TdxW_zyb7.61普行补丁.exe
Resource
win10v2004-20220812-en
General
-
Target
aa6d296e8e563c9e76e0a81385f569f4c569918c454aa73875a33dc9a75d57c6
-
Size
3.5MB
-
MD5
9a0572cc6e5bf3e93d8ba2c194101552
-
SHA1
0f943d6a59ee68a7371d54d20d1a3b66651c8c40
-
SHA256
aa6d296e8e563c9e76e0a81385f569f4c569918c454aa73875a33dc9a75d57c6
-
SHA512
bc877069b9c6647d375dbb20b089411d1964cc2a93964ba7cf7a28f52b7b1102b138ce06ef9981f90d8ea6f59727b8bceee86d821b30de8e668fd8a6649fa0a0
-
SSDEEP
98304:9jntc+yqf+U5nQPzkFMcsIrXmVLC+k3F1OT0f5lr05neLt/:xxNQPzkFn7LmVW+k1YT0f5lr0mh
Malware Config
Signatures
Files
-
aa6d296e8e563c9e76e0a81385f569f4c569918c454aa73875a33dc9a75d57c6.rar
-
TdxW_zyb7.61普行补丁.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 68KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.1MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 537KB - Virtual size: 540KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
l2plugin.cfg
-
nccomte.dat