Static task
static1
Behavioral task
behavioral1
Sample
advancement.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
advancement.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
˵ .lnk
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
˵ .lnk
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
Ѷvpn.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Ѷvpn.exe
Resource
win10v2004-20220901-en
General
-
Target
e42dce8bd62517af2adaac64ed7e4af2211a2fb45958aafac6b45640103f4231
-
Size
2.3MB
-
MD5
aed4e8bb5c12f2bfc3d194ae508781f5
-
SHA1
0b9818b6aa25dd51ab3baefa2d47d5bb9e99755e
-
SHA256
e42dce8bd62517af2adaac64ed7e4af2211a2fb45958aafac6b45640103f4231
-
SHA512
44f4bd4050a5c0aaf72d7946e7acbfeb89a0771daea2959beee11abbe02da3f87a0a3bee0c48f072f02b4891ab96c63891262dcdddc85a83e9e7eef1ff8f2dcc
-
SSDEEP
49152:oEagHRBWyxhzsuACljaEmTPJOPpBCYZSzleqJ2el4sXIqp+ddBfMXgXY:oEPRLQEle1zJOPvK2w42bp+b2go
Malware Config
Signatures
Files
-
e42dce8bd62517af2adaac64ed7e4af2211a2fb45958aafac6b45640103f4231.zip
-
advancement.exe.exe windows x86
175d870f6def865bce6063d08f58c92b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
kernel32
SetLastError
user32
GetMenu
gdi32
Escape
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
VariantChangeType
comctl32
ord17
comdlg32
ChooseColorA
msvcrt
malloc
psapi
GetMappedFileNameW
Sections
.text Size: 320KB - Virtual size: 832KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
xiaohu.skn
-
˵ .lnk.lnk
-
下载说明.htm.html .js
-
Ѷvpn.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.nsp0 Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp2 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE