Behavioral task
behavioral1
Sample
AU3代码混淆工具X64版.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
AU3代码混淆工具X64版.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
AU3代码混淆工具X86版.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
AU3代码混淆工具X86版.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
西西软件园.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
西西软件园.url
Resource
win10v2004-20221111-en
General
-
Target
66562612a70ad6c68e8fee7fa33edc4dbcf4efea811f107a414a1c0891af3153
-
Size
764KB
-
MD5
6537e376ebd4fdfaaac990feb4c888ec
-
SHA1
8ce37caf7397ec67b659b4370a80ad9f28cd3c99
-
SHA256
66562612a70ad6c68e8fee7fa33edc4dbcf4efea811f107a414a1c0891af3153
-
SHA512
e07b09d85cdae9514ec09c82f27207f769aafe592845fa0ad1cd2c1280b725e0b65cbd54b90132b932f7585ecfc018954a5bb899fd7f1ad1b55ad870fa4c197e
-
SSDEEP
12288:/3ny33I96NfciZEf7x7nzuV2llAKCt1eNo53lsfvCGnxa/VwM65HvgXh2hSR6UxM:/3ny33jFajSV2It4OUiGxm6h7UZzoqU
Malware Config
Signatures
-
resource yara_rule static1/unpack001/AU3代码混淆工具X86版.exe upx
Files
-
66562612a70ad6c68e8fee7fa33edc4dbcf4efea811f107a414a1c0891af3153.zip
-
AU3代码混淆工具X64版.exe.exe windows x64
f579db87480b0a22c749b3bab442cb5b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
wsock32
__WSAFDIsSet
version
VerQueryValueW
winmm
timeGetTime
comctl32
ImageList_Remove
mpr
WNetGetConnectionW
wininet
FtpOpenFileW
psapi
EnumProcesses
userenv
LoadUserProfileW
user32
GetDC
gdi32
LineTo
comdlg32
GetSaveFileNameW
advapi32
GetAce
shell32
DragFinish
ole32
CoInitialize
oleaut32
VarR8FromDec
Sections
.MPRESS1 Size: 293KB - Virtual size: 860KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
AU3代码混淆工具X86版.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 444KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
西西软件园.txt
-
西西软件园.url.url