T襭7�|6\����v�j����ٺ9Ŗ5t�[V�r��,���R�#�nV5�=S� |�z��;�����+�����`-�]������+�&�~[��i]d��%�*M�,�⍾l��\��l$�����u� �1 �4��b`��x�u�6�9��#��eVQ�ܻ�XDp]�gL���t�y2R���D�xl�w���#��̲JgI��W����R����G���}A�g�ˍ��r$�6������':X�_s�l �w��^���H���5�~�@t ���M0�v�X�Xӥ}G+�|tV�{��`���9�:���� �� XO�B��N�W��b�ʫM��B�7��H�?j��gy�2���MO<���nSi�s�H������b����/3�/��1�Z5�Z��.]u��+�J�:T�k80��9XV�|��$�cbL���ck!�0�����[��ʺC.ba����D͠R�|��3�u�aS_k�0%+]�dE�x!|�O��׳� \{Y�*��T��W�,��8}���h/�\���C�ޥ�n9��1��hv)�=���+��g��y��D�!`�I�^��-`����?h��[�uT6�ؤ}�����4A�i���gJ�DSKv����L���{mtm�@/=����Nd���gη��3�|������H�x����`��!Gu4(����;��k�7V=�;��" @r�E3ۤ��!��N�j�����}��pS�Lή�~1>���[�4 =��+x�o���x�D�����`/Ftܮ-FYI�����a�K��ϸ7��H��i&��l�h��s�Q����q"xc�r.=�"@��K�95��B����U��e�(G�Cr�j�g�+�)�� %����b��^��'�,���R����� $����{9��-��غ.�~.�!�ï�I5�h�����������I�]�>\s]����v~��l�^A����p��[V��� ��0X�?1�v��įU�� �� >������F��l�]3,�\����6�(�ja�!l��?�pn)�q߰��%���D���?��^� ���oֶ|'_DK=�(�����?����#�@�m S2����\$0�4J����6��D��F�E�� H�Z��`[�C9�&.���$a��)�ike���\�n��[*���O(�<B�{�=����%�̷���Z&���Hs�%3�=���_��0X���K�*7eGn��碐4ʗ�詽��q�N�+uI[�ی&%,�����GU���d�OAD�����p����*���Tќ�?�7n�=���9�����5b���͉ӑ��_�RՅ�zh>��j� C���Uv�묥.�T���A��[��FL��ᘐ76KY�e���s��O�*�TS�Ϩ����D��p���*U�P���:ox/�4'�3Q���ĜG����́��H�vvk_R��*M��e;������d�%����Co���4 ťb�������D�)�̷k�� �%b!.&~���'���u�d�l"(���nnu�+r�X�n>O����+�iwښ�m�GE�0�0��oQx���ӢpR6!�3�f܆y�!��T������a�Bp dO�h��pfC?�aI�/AY� w�k|����1g��6O.�����V��� �3=ۖV@��ƙժʕb�Bv�l�A�I��J�_�U��`�� ���yI����fNvʺ���Y�r�o,A���v�Lw ��J8Q�0l�@@z��,��D��7�`:� |��_��(瞿�_1;�fC$9�xJk\ΐγ�!�4�*�ѸϒQ7��E�#��5�p|�sU���YS����1��J,��V�M��l� \���>b� m���\{V�#s-��S��ƫ����p���gɀ���J���- !�6��T���' A��-��f��P�:��ex����+ �v���m�%1&�M��\u��R���;�y��Y�^*������/�5DY՚I U:�\M� �ӿG��'r�rBp�], ��{�Q������!Ν�m�M! $AS����6ДE����x���}YY&Y���:m�[� 9�N$���o�zLUb��/U��ު)�����M�9`8�iq�<�hs�9��U��Gꩆ�[Q��05����f��z�Y����΄#�)H�~w�X'B~i1r.�Z/9���"r�7-a�ޏU ��S�h���ڈ����z�"��,4q�q,nz;��J��pZ��<K�f�����s)���O������]"��-*`Cd \���[�}+�4�yO�cYv��R�R�8�$�5�KIXZqt��%��ϿsbޒFT�n�y�H�?�0^[�nFHq�� LFԏD��'f�'��="q�|�ޫ<~���ճa�w���V������8>�`E�~3m�b}�t�R|>��ͯ�z!o~I&-!��Q7|�Dg��e;J<��m6�o�sb���!���RC�N��V8�9����ˆ1������+)��Oe:ЇL�.�V(�|cS��sU4��-ßi�@� T�c�ڻюG�4E�}�Y�&Zy>��#�G�B��<6�RF�Y�LڕqE�V�g�=��n�ü<�"���m��4V���������\���h�3����~��2y n�.G�T5��̪�j�������>���];����a��M'��9I=�,Q ���"�5����;����������N�I��G?> ,� K�����Xz����:��x��RõZ3K� �g��U^��8�2Y}By�S�4K\�Ye)@ �Kv��������YΔF��_'��ɼu���7)��2�������>����,�!��}���yُ�%U�9��n�����Xa���Z�Kj��!Fd����U�D�J�-��t����l,�TG^o�MF=C�ʲ��H{����Y��_^YU�K&Q��!�9�*���M�c�;�,��.����Ѱ�w����{-�24��D"��5ߵ ������9�Z%���%��Rޫ��sN��J�e�]��^�.���b|cm�&�g�r1 �^�B���P(���8�'�+���
Static task
static1
Behavioral task
behavioral1
Sample
www.gg1z.com-QJP2.40/QJP.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
www.gg1z.com-QJP2.40/QJP.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
www.gg1z.com-QJP2.40/挂挂一族.url
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
www.gg1z.com-QJP2.40/挂挂一族.url
Resource
win10v2004-20221111-en
General
-
Target
1c65fafd6322dfdcd4a2390ea1924cb727bf43892acbb96a064b450a90ad12c5
-
Size
1.9MB
-
MD5
9c8862cacdaf5bc4e0bf86200bc83ae7
-
SHA1
382304e6318616eb796662b32d7021158896b169
-
SHA256
1c65fafd6322dfdcd4a2390ea1924cb727bf43892acbb96a064b450a90ad12c5
-
SHA512
276c49d865ea224aefbdb5ece8febf9f0d206b7c3bd450f8d9a9e4d52efaeedfe1bd9dcf8c73c303b73405a9622e958d0f4a8bad75e88ccf894d348631ae1441
-
SSDEEP
49152:gbqov0wMMXDYq+NJSQCue5GLuq84VLM4r6F0DT:geovVMoY/NJSQC3ELugLM4n
Malware Config
Signatures
Files
-
1c65fafd6322dfdcd4a2390ea1924cb727bf43892acbb96a064b450a90ad12c5.rar
-
www.gg1z.com-QJP2.40/QJP.exe.exe windows x86
0c9f285d54f3d8c01c3b986986a792c3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayUnaccessData
advapi32
RegRestoreKeyW
user32
IsCharAlphaW
kernel32
WritePrivateProfileStringW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msimg32
AlphaBlend
gdi32
GetPaletteEntries
version
GetFileVersionInfoSizeW
ole32
OleSetMenuDescriptor
comctl32
ImageList_GetIcon
winspool.drv
DocumentPropertiesW
shell32
ShellExecuteW
wininet
FindNextUrlCacheEntryExW
urlmon
CoInternetCreateZoneManager
comdlg32
GetOpenFileNameW
wsock32
ioctlsocket
crypt32
CertAddCertificateContextToStore
shdocvw
DoOrganizeFavDlg
Exports
Exports
Sections
.text Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 29KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 76B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.QJP0 Size: - Virtual size: 908KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.QJP1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 157KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
www.gg1z.com-QJP2.40/下载说明.txt
-
www.gg1z.com-QJP2.40/挂挂一族.url.url