4S����������aY�D�gO�~x\�� OOy�UP�01C��BJpS|�A�����8�\ ����n�O�^��!6$���y�6B�h���G���U����6��f:�^��@T���}��#L���G�{L��ؤ���A�ꔸ�C62գ<�� �QSg��C���!Ov��kÒ�#��=t��ƀ+��,�p��zu���d�5�j��$t �3�V�캅�c,�!Kyi�{ �u@BrG���h�ge�����E}�������\�I�x^b�\�î��Ų� 2��f���������\`��l'�4Ey���ʪ ����b����.A��f �Q/��}*��럣���qd}qMo5��j�N�R�C�$��+��������~�pC�p�z%���z���>׆�\?���'�Ȏdz����v�$�A����Q}X��.�7���,����"���w��W�A�|�H3�����f�w�Fc?U�-<xi�� �.��5�vI��bh�Ѧ��"�XB�žԛ���� ���kSW�eJۛ���m�.��R�[�2ҷν6tʧ§���4.f�����,�����[�5�ZX4�O78s(�C\3F�f�K�'��n�!�p��T)F΄:J�#���f�Zq)��h`����ȳ��bƦ����W��'�>U�Кu�}e%֯c֊��]���Y��I�:ҹ�Ո�FN<t������g�qH��\���M�E��{{(w ���H��.��)�ǻ{k0��')ד�_�4��H� ��>k�ȟ�)��m����T��]2c*�92�aH�c��wUٟ=�$$��3����u�ɹ,q(@���{�"�")��Xؖ�aZy����>�! �3֦�iً��伷���j~~��K�Oņ�6��$����X�ѝV~w���8Ӳ?���/�T�.@fN]�ͮ�����7\�ٗ#,& 9,�3���;��Y��)��$D�Q��cA��K�<�{U�z�T�������w?�\}�.5�)Դ��]�������a)/!�h��1�b�7��o�#b�j���μ�P��N��)�6K-ho�I�����֏�5�0�����G�ew )o�Hn�Е���,j� ��o���C�'?�h�{wb���E���/�o�`�.#���w����������ᑬ���:� ���j�br�"�j=l��4I��S�1)��V��OS�_+O��Ue���n��7h�4t36? ���PV � �Rtk��������`��#� ;�R<���*���rp��&nm>'�����f�!�����o�'�p-˂�/^��'�����\�N�y#_5�f��n�!��!��dhy�o�1�0�M����}���,+��YE�(ۗ'P�Λ�(=�L|3�PNr�,�]�>j��J2kT7?!g.x_�}ӊ`ʹx������=�ɴkDŽ�\X�3,� (�ϣ��d���0�v,S�1�K�[-�or�-�Az�G?W_/����Ǜ�ɽ�3.@�leC�%���n��?�x�k1(���r�M���5wDŽn��W`��f�M-�h���L�a�>���i֑��h^�y܋KJ�k�J�(Ee��|T�jU���J���.��RI+q}��n,�W��4 Y�����E�ZTõ[��6�+�,Ս�"�Խ+��F����P?��f ��6m��NA�IdY+]�S���Pa����l �YZ?i 6yǗAp̈́�A|�WXԉ�Z���M�*I$�����g�zG�\j�S�:R�٩U_��p+�d��/ ����%Y�jn�3o:.�[T�A�T���{/���m�����/��|�lC�<���g�������E?�Ɯ�U�欪l�8��Ҏ��F�ǫ�)��<VGy��tTf�5UM REG��ڭ�2Y��C�(�����S2���x p8�]=䛬����?��ͽ^g�Y������� \2�Tz'��gy�!�kݺB��w-A<![?�Gd���\Չ����\-X��%8��\�nm�aғ�ot���kv[ qm�(>�4���k�����Z��_IShl�I��Z����ğO8�x5�������i`(2a�p����;w�9��u�'���F(�n���(��� ��(w�)}r�VX��@��'�n��2�-�JD�!SA���0�K� ��l��Ru����i�>�#ed��aaz��&4k !�I+���Њ��r�.{0(�b DH�*&J��~�m7L���Z�_|&23�[�Qh�q.'��T�l���ߧ%<�2��%�%?�O2����Ա\��R�': �cX�#X�p�/H�&�9s�/�Eϋ�>Zg��4�0q�x��MVu���8H��g&�E�k֣�S�]���e�Z�RD��m�>3JH� r�)��=b�¹�@Tk���h~QH|�Z���惜eNѫ������;-?7x]D���-~^CW�Bp��+�x<;���\$��u����߾RژAt �Q}����5:�ؐ.�e�K{�^,�(����1�-�`&�;5�I߅|i)�>��~����:U�8����+M܁�R%�9� $�����{�U�P�~�?���*���sn�3I�н�'�l|n~ 6����������p!h}�#x�4��.<��T48;Ɍ��z��am�d���(9���s�9<�Y.��l�0v>�O�Pu����Ç�A�My�,��6�@͞����f�g�c܈�w� �-�?��qp��ԋ p9L�����,A��M ~���_V/re��04JWʸ�Q@ z���om��W�-�) ��,��]���~^���p�t,�>+����� wXwR9>�3���`~��W �M�O�K01�ʉ�8m���֮�S������g�v)Kaժ8�.$�⨕�:\�*��� �*�r}kN8Yv��m(�]�#I>!!TQ��Nc&R�<��P�_� ���<*��Qc�{�7��������n��L��?oJ�yQƊ B�nwk��d�'W�rE��3`�ݓ �-wd�ϲ��R���&�&��K��C�RyQP|��ߊ�Rr�*��� ��
Static task
static1
Behavioral task
behavioral1
Sample
xmsyjqqzxdlq_veryhuo.com/小暮色永久QQ在线登陆器v5正式版.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
xmsyjqqzxdlq_veryhuo.com/小暮色永久QQ在线登陆器v5正式版.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
xmsyjqqzxdlq_veryhuo.com/最火软件站.url
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
xmsyjqqzxdlq_veryhuo.com/最火软件站.url
Resource
win10v2004-20220812-en
General
-
Target
77e8312b59cc82a9888b2833f0d24dc743c37a0a7c68dad25169970fb7734b4e
-
Size
3.5MB
-
MD5
a99b37becf60e4d680a95cacef8dbe52
-
SHA1
525f1caa393caff730d5d947a7d53e596270c7d3
-
SHA256
77e8312b59cc82a9888b2833f0d24dc743c37a0a7c68dad25169970fb7734b4e
-
SHA512
5c5a8959a1f757e92207f9c8819a836a4d30a19bf33fb2cb85d30b92d1924a16c13793f51555a3ebe1d82c29039d51b0e7b42bd2db7f8fda1c0e0fd86b9f01a8
-
SSDEEP
98304:NOfGagPWj0r9+RN4PKOiWarX6ZAz7KKjxX8O6e+K:NOfGLeji9kWK/q4FYK
Malware Config
Signatures
Files
-
77e8312b59cc82a9888b2833f0d24dc743c37a0a7c68dad25169970fb7734b4e.rar
-
xmsyjqqzxdlq_veryhuo.com/小暮色永久QQ在线登陆器v5正式版.exe.exe windows x86
2a64d7c5b423f9621a501ffa9ff5ea66
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
winmm
waveOutUnprepareHeader
ws2_32
ntohl
kernel32
VirtualAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
WinHelpA
gdi32
CreateCompatibleBitmap
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
comdlg32
GetSaveFileNameA
advapi32
RegQueryValueExA
shell32
SHChangeNotify
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ImageList_SetBkColor
oledlg
ord8
wininet
InternetSetOptionA
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 518KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.z3veu0e Size: - Virtual size: 955KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.z3veu0e Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
xmsyjqqzxdlq_veryhuo.com/最火软件站.url.url
-
xmsyjqqzxdlq_veryhuo.com/软件说明.txt