Overview
overview
1Static
static
CAD绘图�...rt.dll
windows7-x64
1CAD绘图�...rt.dll
windows10-2004-x64
1CAD绘图�...rt.dll
windows7-x64
1CAD绘图�...rt.dll
windows10-2004-x64
1CAD绘图�...rt.exe
windows7-x64
1CAD绘图�...rt.exe
windows10-2004-x64
1CAD绘图�...ib.dll
windows7-x64
1CAD绘图�...ib.dll
windows10-2004-x64
1CAD绘图�...��.xls
windows7-x64
1CAD绘图�...��.xls
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
CAD绘图助手/CADChart.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
CAD绘图助手/CADChart.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
CAD绘图助手/DXFExport.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
CAD绘图助手/DXFExport.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
CAD绘图助手/HydroCADChart.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
CAD绘图助手/HydroCADChart.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
CAD绘图助手/HydroLib.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
CAD绘图助手/HydroLib.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
CAD绘图助手/原始数据.xls
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
CAD绘图助手/原始数据.xls
Resource
win10v2004-20221111-en
General
-
Target
3a5affcaaf77599f725bfaabae18beea76d0d8167226bd56b4e14c224091122d
-
Size
774KB
-
MD5
ef2e9d78cc161a15327ddc4658328c92
-
SHA1
bcee7097b76b6cc04944d393bb0395a61d96aff5
-
SHA256
3a5affcaaf77599f725bfaabae18beea76d0d8167226bd56b4e14c224091122d
-
SHA512
89a83888b146244911040b0fd89b2bb0855328dd8303712d3ae976264e59f7949f12d7cd62bc4bc461c77ae23b68cb244837217492768259125f1638e9e53e8a
-
SSDEEP
24576:xKXouJ0H48tBjXwztUcRDkCdJI8P/u/rBtQbR:2ouJ0PXXwTpkaIoC+bR
Malware Config
Signatures
Files
-
3a5affcaaf77599f725bfaabae18beea76d0d8167226bd56b4e14c224091122d.rar
-
CAD绘图助手/CADChart.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
CAD绘图助手/DXFExport.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 4KB - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
CAD绘图助手/HydroCADChart.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
CAD绘图助手/HydroLib.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 188KB - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
CAD绘图助手/原始数据.xls.xls windows office2003
-
CAD绘图助手/水位流量关系数据文件.txt
-
CAD绘图助手/调洪图.dxf
-
CAD绘图助手/调洪图数据文件.txt
-
CAD绘图助手/贾村站Z~Q关系图.dxf