Behavioral task
behavioral1
Sample
QQ玫瑰小镇管家辅助v22.9/QQ玫瑰小镇管家辅助v22.9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
QQ玫瑰小镇管家辅助v22.9/QQ玫瑰小镇管家辅助v22.9.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
QQ玫瑰小镇管家辅助v22.9/亿家QQ管家系列辅助自动更新update .exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
QQ玫瑰小镇管家辅助v22.9/亿家QQ管家系列辅助自动更新update .exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
QQ玫瑰小镇管家辅助v22.9/亿家好网-hao123网址导航.url
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
QQ玫瑰小镇管家辅助v22.9/亿家好网-hao123网址导航.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
QQ玫瑰小镇管家辅助v22.9/官方网站.url
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
QQ玫瑰小镇管家辅助v22.9/官方网站.url
Resource
win10v2004-20220901-en
General
-
Target
b3ff59aa4b70ae4a991210696b2f4b380fe456ef980188bf9afe68993ced6096
-
Size
2.4MB
-
MD5
417a89cfc39eab13e37690d53137efbc
-
SHA1
6d929740d881dfbb44d8cd6e4b59c48570ef7569
-
SHA256
b3ff59aa4b70ae4a991210696b2f4b380fe456ef980188bf9afe68993ced6096
-
SHA512
f6c8e8a374c79ccd88953497161f426e8f3b38983ff0bbc30c927a1d638a9081f9503ab7397b8009e0f99e7c4bfc9b8dec28a59ebc6337e716922aa4f010a1e3
-
SSDEEP
49152:Imhys3m1toBCH2dpA+fMFghoG1VZ/3jApwXSHj+dqYz2H:IGys21tmCHEF0FghHN0G6+dJ6H
Malware Config
Signatures
-
resource yara_rule static1/unpack001/QQ玫瑰小镇管家辅助v22.9/亿家QQ管家系列辅助自动更新update .exe upx
Files
-
b3ff59aa4b70ae4a991210696b2f4b380fe456ef980188bf9afe68993ced6096.rar
-
QQ玫瑰小镇管家辅助v22.9/QQ玫瑰小镇管家辅助v22.9.exe.exe windows x86
02b7bb1d47b3b7341001b57ecc656257
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
winmm
PlaySoundA
ws2_32
inet_ntoa
rasapi32
RasGetConnectStatusA
kernel32
GetTimeZoneInformation
user32
GetSysColorBrush
gdi32
EndPage
msimg32
GradientFill
winspool.drv
ClosePrinter
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
CoRegisterMessageFilter
oleaut32
VariantInit
comctl32
ImageList_Destroy
oledlg
ord8
wininet
InternetSetOptionA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 924KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
QQ玫瑰小镇管家辅助v22.9/下载站下载说明.htm.html .js
-
QQ玫瑰小镇管家辅助v22.9/亿家QQ管家系列辅助自动更新update .exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
QQ玫瑰小镇管家辅助v22.9/亿家好网-hao123网址导航.url.url
-
QQ玫瑰小镇管家辅助v22.9/免责更新说明.txt
-
QQ玫瑰小镇管家辅助v22.9/官方网站.url.url
-
QQ玫瑰小镇管家辅助v22.9/打开程序图标或者软件不见了必看.txt