Behavioral task
behavioral1
Sample
西西猴子网.url
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
西西猴子网.url
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
跑跑游侠辅助免费版0920.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
跑跑游侠辅助免费版0920.exe
Resource
win10v2004-20220812-en
General
-
Target
684a40c998ff81b08296be20dd395e6347314847074ead2e63f52a4201f4e06f
-
Size
1.9MB
-
MD5
a480c9a69600aaa0f25f136d4dc1a9c7
-
SHA1
6dddcb67fd013e66dcba0178616874475dc6a67c
-
SHA256
684a40c998ff81b08296be20dd395e6347314847074ead2e63f52a4201f4e06f
-
SHA512
06ebbbeeea12b75446c8220440de98cad6003a0121205fe9eb7a05dce5f40edb952bd840689e0950f2df9b970d9a409ae958f94f01f5f4322ea0bb95e75b7b1f
-
SSDEEP
49152:DoaW90QCOSqT+/KRdVC3QgOovF9te/be8x6UNv5:saW9DCHqTM6vJoPte/bH15
Malware Config
Signatures
-
resource yara_rule static1/unpack001/跑跑游侠辅助免费版0920.exe vmprotect
Files
-
684a40c998ff81b08296be20dd395e6347314847074ead2e63f52a4201f4e06f.zip
-
使用说明.txt
-
西西猴子网.txt
-
西西猴子网.url.url
-
跑跑游侠辅助免费版0920.exe.exe windows x86
15f3829f9bffd6a6d446f6e61e8aa7e3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutOpen
ws2_32
recvfrom
kernel32
GetStartupInfoA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetForegroundWindow
gdi32
PtVisible
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
SysAllocStringLen
comctl32
ord17
oledlg
ord8
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 523KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 303KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 216KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
辅助界面.jpg.jpg