���ZRb̊���� ���¡�Ȉ����(-�H ��<K��y'�ѽ� n�:! ��e�jBu߉,��KK~,?;��~2��kZ��>�����v�ML��,fxő+�-�z��MU�)��H쀪��.ݻ��Ⓡm�t�� �qA����$�L�h�-����^��kt�S��p9k��vB֤ɏ?�$��x�T$T�������� ,����ӂ#��6��ŏ}���2��Pt�b�&��U�T-���a��`�r�5g���Ȯd�jU�e�:>�J�*��ع��ß�����F�/:w��f'W)+�I26po��6����� 9 K�T��M ��|noͨ��PW�����ZJD=��)G��OVK�b�<N����CS����a��~�`�CƺC�:8��u�,�;�D_(K�FE�Y�v� -{��*{����7os���S����r>�3(Bk�8k����5ـ���괝!��8��n���`)>7g�o�ו-�$��܍.Q��ƍ�KPm����U7�������vW������+)�2;����]n \�]9͡�b&��/Ҭ�^: �l�K�Z`9� �����I���]+ʇC#T, ;�<�@��O�]�3���'�����K3�����q�'kN"͋vA��dt̓��W��f��,+���@�T)b�ɘc�����8y+��%�%/��I��U��)6T� �� �ʎ���A��s<�U'g�����{���p��j���'����!j���l�G��Seg����ٲ�ó�ǜ�W���Ex{�[�KB�J���J��"�u�x�y!������C=a���2,W䡬�b�F2YaL�1$��h� ��@��,_�w�ZF-�<q�=�k�.������t�,��'p�$���r#��4�M���nn�r;|������V��)�g���S8����OY�-<�B�O�ݲe_�n���}Е$o���R%}0>�$�Ŋ���|z�:z��(T��ǝE���ژ�6 =e��dM@��%Lc������.����tLV�8p��R���+UdG�Ce�������N�ACĢ�F�xG��� �p����F;�h�@� ��A�gY٫��Qi��O��b�Wj)����,�Y�1���uC�2J��$\*/���x�^}�-��ă2�(?�v�L��c��'3��=�mWGUebޒi(Ӳ��JZ5~>�9Q�@�����q��͛qR�#���l�y5�j 羋�Bv�(��M�{b0�;��$�o��� ����:��g�A/J0\!Y�����U ƵBlș��@#ֽ����{TeM���Ll~�>dAP�v�>]�;O2�y���Ir����*~��v�����_ۇ���ܼξ&ڽ'"+wj�]ݍ���A��B������%��J�+�4n���+͠?^�`��A-�� �TO�ݡ���bYu���(��A��B*\�!T����W�� Ҽu�3����f2���퇦š��ᚕ�6[�����hǷ�z�v����H�Y(D�{6���1:x�t>Upb� ^znC�=J�W)�*n���KT�)z 6� ]��{�b誠�k�1x�np��L��ߕ��M4���R���"�ۏ �"�e�{{PS�����M,ϙ���U�� '~�O�7�RV���lוP�ɲ���zX2Ͳ���r�J�w��̕3r�/����NK�_��b~v|�����t k�����[��}��h�Gߒ��M�$\ o�<#��i��:G����t���p�<K�������5�����o�lOV!���yg)8X��]�Yӆ{^ӝM84�V�w<Q�Mb����4�!�?,����G;�22U���Y{��.�JW�e�;>�������W�v�L�^)�>�� �q��F�!+�/���z��X����ڳ�L~�<�����Q�H��P�aV���� U�J=f�1���M�m3�m̖Tf��/���o�Y�g����ī���8��� 8�.ǀ�z�^�~�ğ (�J*���]>�� |=�z�e���������f����&���2�Ԡ-�Eu���{T�d�(E��� ��%UyZ�lT��������p.wpxZCf?��W����I�`�\�߿S6* ��<TJŰȜFх����.���3�2�c�_'(�]�8{���h� �� � ��C�Kz<�G�S,q��J{/��>$D*�{Q�3�:�����@Z���7�����'$|����R�y���7�K�.�w������̸�>��$.lZcdWEZ�;���4�vi��`��w�Pݷ=Ӥp��E����Q]@��� @��G���}�z�G�4��/=0 �I+!�d�N@0�B#���Oz�)X^p��J|�R��*��pb����Ks����J'��8G*e� +�h�&7a]�Tb��O�]��i6g#7b���J_�-|��� ���{Lu��wf�ӓ@z�����sq��)��TIK�>秏��d�f���eV�#o+r~�5��e� �{������1�B�*9@&"�DUo(������-l8�T�Ty����vG��k�bRE�%*�`��5�`�,�awH�JI��_��/��T4�7�O��$�)�DL;�`�V��ww̪b�af����V�lץ�~�7�/͍�8|X�G�B`���r�RML�2�����h�~��Ow31��X�FLw�/��"�_�j:� ��`&��ھ��q͉��T�e��wĐ��w�����N�a2$�φ����?��9�,8�; ���OUGO�]��@Ի�_���-������Q��]:z)��� ���t l��*���z�Sͭ՝Z�7aȀ.ݡ��5��Bc�糼:��Q����\��T��(�T�{���B��J���;�7�l�D���#V�-�2|eGK���j��OE����ߛ��E��C�yyE���X'�����O���sF�V�LV�sSXq;Fci5�R�.�%gi,����~L7!�:Q:���0�����X\��3A5q�!�����^��M��+k�8=��!�I����댖1�qf��S��U���
Overview
overview
8Static
static
8bibiDown.c...ly.dll
windows7-x64
8bibiDown.c...ly.dll
windows10-2004-x64
8bibiDown.c...ly.dll
windows7-x64
8bibiDown.c...ly.dll
windows10-2004-x64
8bibiDown.c...��.url
windows7-x64
1bibiDown.c...��.url
windows10-2004-x64
1bibiDown.c...��.url
windows7-x64
1bibiDown.c...��.url
windows10-2004-x64
1bibiDown.c...�.html
windows7-x64
1bibiDown.c...�.html
windows10-2004-x64
1bibiDown.c...��.exe
windows7-x64
8bibiDown.c...��.exe
windows10-2004-x64
8Behavioral task
behavioral1
Sample
bibiDown.com-飞天v1.18/fly.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bibiDown.com-飞天v1.18/fly.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
bibiDown.com-飞天v1.18/fly.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
bibiDown.com-飞天v1.18/fly.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
bibiDown.com-飞天v1.18/会员购买.url
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
bibiDown.com-飞天v1.18/会员购买.url
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
bibiDown.com-飞天v1.18/比比下载站.url
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
bibiDown.com-飞天v1.18/比比下载站.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
bibiDown.com-飞天v1.18/说明.html
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
bibiDown.com-飞天v1.18/说明.html
Resource
win10v2004-20220901-en
Behavioral task
behavioral11
Sample
bibiDown.com-飞天v1.18/飞天.exe
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
bibiDown.com-飞天v1.18/飞天.exe
Resource
win10v2004-20220812-en
General
-
Target
b4f12274711972ec53e5921c9a01597e6c1f1efadec48f71445317215f1c7aba
-
Size
2.8MB
-
MD5
da796be0b773f18c70357f59d06da86b
-
SHA1
810143d8dab0d80f6a59bd3c914c3f854e72bdf5
-
SHA256
b4f12274711972ec53e5921c9a01597e6c1f1efadec48f71445317215f1c7aba
-
SHA512
4df9147394e8349e332e8a45447a9c6e7f81bb49a002d7afd7f26216b27750ac19be91c0411380c31d6d40d07bbf94d77cc429861e63ee27fb9de2ce13e0d600
-
SSDEEP
49152:eQCw50lLEA+DCeSMQeDwSXelf3WQTmxplN0nmFZQ6pkvS7D0TrAKHBx2CfLkYZo:IHlRldMjDwSOlOQixF0mEEemkrHBxNYH
Malware Config
Signatures
-
resource yara_rule static1/unpack001/bibiDown.com-飞天v1.18/fly.dll vmprotect static1/unpack001/bibiDown.com-飞天v1.18/fly.ime vmprotect static1/unpack001/bibiDown.com-飞天v1.18/飞天.exe vmprotect
Files
-
b4f12274711972ec53e5921c9a01597e6c1f1efadec48f71445317215f1c7aba.rar
-
bibiDown.com-飞天v1.18/fly.dll.dll windows x86
e34023be2097a147c5220cd670e91fd9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
WriteConsoleW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsWindow
gdi32
SetTextColor
version
GetFileVersionInfoSizeA
winmm
sndPlaySoundA
advapi32
RegQueryInfoKeyA
ole32
CoGetClassObject
shell32
Shell_NotifyIconA
oleaut32
DispCallFunc
Exports
Exports
Sections
.text Size: - Virtual size: 219KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
bibiDown.com-飞天v1.18/fly.ime.dll windows x86
860a8adcdb8410fab8dc154b7a26d124
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
QueryPerformanceCounter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
Exports
Exports
CandWndProc
CompWndProc
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
StatusWndProc
UIWndProc
Sections
.text Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 195KB - Virtual size: 194KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
bibiDown.com-飞天v1.18/md5.txt
-
bibiDown.com-飞天v1.18/msg.wav
-
bibiDown.com-飞天v1.18/会员购买.url.url
-
bibiDown.com-飞天v1.18/比比下载站.url.url
-
bibiDown.com-飞天v1.18/说明.html
-
bibiDown.com-飞天v1.18/飞天.exe.exe windows x86
0f95ccb81dc2502b61db7c89b72398dd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
RtlUnwind
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
InvalidateRgn
gdi32
CreateSolidBrush
imm32
ImmInstallIMEA
version
VerQueryValueA
advapi32
RegQueryInfoKeyA
ole32
OleInitialize
oleaut32
LoadTypeLi
comctl32
InitCommonControlsEx
Exports
Exports
�3\Rm��GV�/7�;�9���(��=g0�'^S���� ,1��r�дE�S�lN(L���b�!fx"�#/��B�GS*�s��G�rc�PeOJ�n�J5�h=��to�9�-�����S'��zT[P�H�$�Dsуm+߁���u�h�D�*���wJKY0(��D�M�;]s\a��4� t��wy���Щ6��e:����; ��X�q�d��Pk$�\�}���'�*s���[������RO�]� TI,�M��V�L{�缉�%=�u�F�>ޣє�i��Zv����;/WΆ)^Ҋ�h��&l{VO�U*$�� UPE��;�����HfF�M�k���ז���y)ID��OBi��O&aƉ��De���}?!���i���rL��r>��P���q��]�~;RS�ǭ%aaP;����c�>o�9�0�q �×���n�tq�R�dz��X�s>�݅L� �8�f���|�ipR;C3�F�I�`�]��9�.���o5�#����ȣ�\���#?W4�|J0{�Z'���~�����y�X)/��ӛ�9�C��E;��f��~��*$|ڬ��f�rL`,��®��=�MUp{��O(�!�� Uq�d_��� �����&��D���6�DU��B*�����d�Z�4~�T?���a��-M�Kǐp�zc����o��*���1O""u+��PL��Jŝ�������Uq�o�F4}ӨY5 m9�����V����i�M�V��ҥ��.�"�8����S��o��H(��}��q2�!(Z<J ב���C6q}9:-'�p6�(bp�(���7��&O LH�o��j�� �*e��9;A��K�(�D�d��}��Z�!#�P��<u�$�0X��7�|r��/���c"Φ!�,��'�Qn��w����L����̅��F�̸!w��3,�x��ʁ��5��CK 5�\{m� �����F�2���^0J�}o�6]ݗ���;��m������!&������{_�j����{�V���y9֒�<����st��^�A�^��w�i�H&�A3�Ct�&#R.����?��4fEi!��k����ѧ�_����|�)��a�A>\f��'PYQ8��8Bx�U���&�d'=V=�%|�gPO�3k�o�5x������4�)$� 4��j 60�P�5.Z̮��n))������c�e��&s�;4=��L�r$�=r��M�n]�?۹�6P�����z����4������d#"�Z�����ЇN�� zߐ&��z����4�����9�.�K���zy�4E�dd^���l�[Pܠ�� ��g=�Uo�h��aJ�.Of(�ţ p4'"��8�Қ��Z�������z�T#iz����l�����i���B�R{�=@+�+�/Rv� �Ba#>_ְc�w\F���>9�HU��:�A��^ �X'�*[��!�.���l۔H�8�Dd�[���S��~>�nZ�������:�Q���b�~�]0!6}���Y�e\�p���[W[����p�↕��f���y�q���F�yAg�uk=�6�E���N��У�l#�6d 3�kr�Y��ɁDJ:4��o��@D��r��Z2����x��f_R�&)6��:]ٗ@��E0�v$�6�=����m�j��q7Ie*����6� �7��|��9���)���2hV�h�*-��(�i��b�z��W� ����Y��g�7P��1�\!@���Xq[��L�p�4yrYx���~'��v�G�eԀ;��U6�� ����oP��.�#����{ܐ״N� s�Z7�f������T�>ww0>����$�d��* ��0(1��=l �o� �C��g�"����:����e��U�u���?��^0�*a�����RU.M��xc��O����$�JT�YX �gC-5�#�Ʈd�r���S�Ƶ�ڹ2�ESq�/Xv�yo���?B;�#����G�ioO��K�=r�KY��a>�I���a��2 yQgT�w����%d�t�)u�y)-�i�N��,��@�*��D� �?���I,o&b*���#��0�mi4 ��ລ�hm��L�𑖽��I;�u{�@h��l��0#?UA�ׂ8l��e8EuȈ( q�r!d@iO��˄�RZ�+��d��R����@��dѮb����{��W*�k]ާ 7���"B��$��ڗ�� ٟs(����l�����;#!���7�Q;�1ya^ B�&9���[�Mi @P�Z�����A�/"�qI�[�%��!ҝ��� M���U"J����HC����ќ7�AW�W���AX�Ybi��v]�,�髝�� �zl��՟�A�R��'Ƌ 4>���qGP�A�s���5@O��2��n�J˕ҏ��x�FN�'8�=�`���[���&r��%�ϓ�F��)<L�|V�'�I� ���8��=��2�-�zߛ��d���j{Յ�S�A�;T�_���}6�(���8���ۤFa1�*�o&@�:��'��O�����Xl�Vڊ5���.ڂ4 ���|`�e-�8��`o���1�I0�X�VK ��RS�X|qM�Ux���O=ʖ~ֹ���;C�$��7fV,���.X�#��-*���y��F��z��7w �]�l�?Յ�V��K������[3y�3!�'�]Mu�M1ԑ�q a�����/�hϟ϶�~�܋��^�7� "x�6S�߷�����De�G���rm/��j������}�J�+_��a���r^�y9\dk��!;�۲U�S�2�#@o��\FВ�P"�Wr��qX�W�[�M�����NA�(814��7x�b���qt۳_R�9�YN�XGR*�#����'�Q3xG����l���y\�D�O�L�`|Mhxؓ���S(��Ҹ@ �[D�?�� .1n �d;���U�������Q������s n�ʫ@ y�:-��}J����uwʭ�3�r�^��N�ݢL!���P�&1os���bX(��+��<���e:� �Х*b&M�.2����В�T1ʭ���.�,���F��\P{1\���\�1.���h�&��aR`�#@M5��=��zk�X��v.szL��t�dE���3M�]D�a4�
Sections
.text Size: - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 965KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ