Behavioral task
behavioral1
Sample
最新QQ软件下载.url
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
最新QQ软件下载.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
飞机4.1.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
飞机4.1.exe
Resource
win10v2004-20221111-en
General
-
Target
402e079d62a9a5735f3300df03c8ff089774432b7025a77627ac02bc4c60b76b
-
Size
1.7MB
-
MD5
b932a9e6546963f15fc9b534e50fc9c5
-
SHA1
14cd3a2c5f45fb9d89c91a83ee4a006958c027c9
-
SHA256
402e079d62a9a5735f3300df03c8ff089774432b7025a77627ac02bc4c60b76b
-
SHA512
e5eb58799c7cf6f6b405f9ec94269a1e885d48f1029ae9ae8368134ad729c998611e75ee14c5e3e8ce1b3d15d16d5b97c8695003ed2d068db023f419063d3584
-
SSDEEP
49152:wwY7lM7ANEO8Y6t7ac3/pOxmU1Wp3vZk+mKf:wwx7bO8Ba8qmfp3v1Df
Malware Config
Signatures
-
resource yara_rule static1/unpack001/飞机4.1.exe upx
Files
-
402e079d62a9a5735f3300df03c8ff089774432b7025a77627ac02bc4c60b76b.zip
-
安装使用说明.txt
-
最新QQ软件下载.url.url
-
飞机4.1.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 60KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ