Behavioral task
behavioral1
Sample
魔力神器_大家来找茬辅助.exe
Resource
win7-20220812-en
General
-
Target
385b0ef67843d7b640b616b16b2a764d636112645eb63682e054b8b55e84686c
-
Size
7.2MB
-
MD5
37d6d52976510793424f099062ca75d3
-
SHA1
2f69b2252f9a9f3830acd1016364b92fc6335e91
-
SHA256
385b0ef67843d7b640b616b16b2a764d636112645eb63682e054b8b55e84686c
-
SHA512
d493be49730d994cae7d210ceaa5e27aa96396da59641b795037cf7d11dbcbf5f14e6415a6567dbd533f401c37095ff60fc59e8b9d2e7636aab9342de7a96004
-
SSDEEP
196608:f12iC5HZqTNjMdyPMAKQcEcDeFmniXGRa7h0D:f12TRZOoEPbLctDimni4KE
Malware Config
Signatures
-
Processes:
resource yara_rule static1/unpack001/魔力神器_大家来找茬辅助.exe vmprotect
Files
-
385b0ef67843d7b640b616b16b2a764d636112645eb63682e054b8b55e84686c.zip
-
下载说明.htm.html .js
-
魔力神器_大家来找茬辅助.exe.exe windows x86
b022054f001d96196a46ec55b25c0f87
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
waveOutGetNumDevs
ws2_32
socket
rasapi32
RasHangUpA
kernel32
GetVersionExA
GetVersion
GetLastError
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetRect
gdi32
TextOutA
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
DragQueryFileA
ole32
CLSIDFromString
oleaut32
VariantCopyInd
comctl32
ImageList_DragMove
wininet
InternetGetConnectedState
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 774KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 287KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 374KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ