1�:�R�� V���@�5�|�{��p��c���w��0������u1o�؋�5-M��{�� e'&kh�lB���>����+��&��n���s�E�Mk�#����^E�ӽ0�����,]��݆��/ⴟ��U_6/h��G@��ׂЕ�[���?��q`�x�e�`;"�E�;ʙ6��P���v��2{6��ȱ`c�<�����Ѭڨ�,@Z\\`�V�?�)'�H�/��=�q�������`���zZ%�Őj��@V-�A4� �`,�FժO@M�%v�����,\/l��7�r'p@?J�����2Ņ+�SP ��ca�v�3\��n�#Ԗ��&���NƱ^)��9,L�.\שy~6�B��)����<�9�˪�{���#q�]�hݳ.K^�3䜠�xҜ�JMr4��'��6�f��� )Ac��L�`�Gp�A�HCGbUz���Dc���n�$K~)�`UV�Hم��f ��L!0�� ��V*�n��!��M��B�{���A�J����]�#/x�։�1'��[���\�Y_��:0(3�q;t�u�W������O�D�`��%d�7��`O� 3�����vN)�b��J���:m>���<s�ɑ����ݡ���|�"������M���ww�7�ju#S�d��1��j�N�a �e��,(mW��W��L�螣��Y-v~!����Hpc�TT\Q��퉺e/7� 6������H6���4�~���(�t5��Y��B�5#��L�9��@�O[�<�嫚�c6����H���xh5����6}W�U�����,����x�ް��`����<��ó��{���٠ �P�� �A��XKk0�[?����U>&R�ucH��g����1�t�[����}�2 h4:���tIG8�R�:VYs�;Ϫ9�S �7��[��;�{��#���i��ME��(o�k镉45q{�8�D�'!�@��V����������S��r�r���ӌD�η=@5F(�z��ʀϞ��I�*C�V����ց�@�{`�ó��h}�/�O����:��;u&آW����;�B���y"J���q��� )y�W�w�ݧ6����P*`֤����Cz�m��C��怬E�ZG��|�4��-��:^-�g^-�-$��%fc�+��u� ia<~~ƽ8h�>���^6����������c4|�2��Ǝ���u0d�C!�������%a���lL�G���(���sa��[��CRT_e�P\��jaĉ�~��<f)�N��+� �|��ϯs-����#H���9�O5(����IPhP�w�2�FA&�o��V���'".��gC�e�|��n�m��n�����jZ�߬ ��Ո@:恋R��#�+���<O��Z����?8J���s~gH��*��Ǩ�@�tZ��t#v��;]Ȯ��z�ذ�ˌ�������gU���P���4 z�+�A����mcT:���M���S����T#��P���D����%�h:6�����Z3�p+6Flg�~ɧz�"J�7\�R7���S��$��Mx�ʳk��m�P=gQ�mys�,CuBe��2���=�HK�*���d���E�z�WWQhX��c�U����9M���\f�x7�� 8��v�C��6y���)��5]�Hu��<��@�v�q�N\�F��lj�H���P�E�7&����;�w����@g�s]���,*���j)?���!����߁Ӣ�$�K\}�b���W��>�}�n%N ]�ӌ0�GE�6���ě�w[��Ě��y�-x�Yϻ�5ZX�n�f�U,�%q�?.!2���Sw��ٌ�*�M ���UE5,�+��v����Wa�Y����{p�|#?K3�h̹���� KY,�xk]�����C�����N4da}��ʐ��.�'��Kb؋�}���)ǵ�n�2�����_˵�fm F��J}�-�H�C���U���R��#���ԒM��:���>! 1���h8]CMw;�~M���f�fP��}�W7O�,`���U�Oq��]}�r\9��Z�M1�r��Yרޢ�Ѓl��#��T���� *J@��ݳ��X>���L��0�c�*�^�$�ɣR��,�f6-��3@{� #�aj_��_���5��(��2n<3y���#���";����<�,A�E�`c`Y�����3� ilf�+��C���]�*�'�%gG�d�"�[�.���tb�K���_&���������]w%=�oU����w<����@��z]C����uL�(�!� ,~���I�>�R!]`�����<�^3B��7�sm��sY�z��4����Q������`�� v�!��{RxD{������>����ƴ6���L(M��3u�B����*�GSL3/��|,��l퇽4�b�>��*�J�?`�Dž���k��k9���~�.��}�LD�g^��Ƨ�&���[�Q �R�ȸ���e>G{���{�L�g�gj�{�&��M�����Ü�(#=�` ��j:�Ɍ�T �0ulD�AOС�M�!�����:����(�HCAO����"a�8*y��@�C�;Tvfݾ��ddY��o��A[q���j,=�,��*bӘ�!���(����9�����DO�-��DE6f����}I� �2#�=��o� ]��BCs�X�6&�|g�Q]{�(�d����sm�+��D�xl��k��������BD-�y(�&�fͲ�ˀ��-l|�+BjH���>2:M�R�YN?xf߶?~�h�����O��dZm���9H��ae�j]�LJ�O+t-��}V��r����WCx��)�m����4���F��NO٧��k@�+U�M�yD��0ě]�$�q�'O����q���ܣ���&���A��ן�:ݕ�f�K���*�*�f����H�q}��&.W�Mw�{sS�RpQ�=U���e������;9���>�b�tD��iBd+峐��3�`C{QH�>�\�+5hv̹mڸ�ݽ���;ٶ���8@�ԑ�c5���4+�����I���~��z����{�O�~�p4�h�B��U�::�6"�j���(Њ".-�^�r%4֧��#���.�'��ԙ�_
Static task
static1
Behavioral task
behavioral1
Sample
BatchDoc_veryhuo.com/BatchDoc.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
BatchDoc_veryhuo.com/BatchDoc.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
BatchDoc_veryhuo.com/最火软件站.url
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
BatchDoc_veryhuo.com/最火软件站.url
Resource
win10v2004-20221111-en
General
-
Target
e35d3dab57599a454df62a00e8533bf780a9efa2d1034ec919cff7628a47f793
-
Size
1.2MB
-
MD5
4959affa0f33889fb75916aa77e7c996
-
SHA1
13f592ae62bcf431dbdb2f2af456d47527422906
-
SHA256
e35d3dab57599a454df62a00e8533bf780a9efa2d1034ec919cff7628a47f793
-
SHA512
07d285d1fa39a7c3a0357615147979c2d9f45bf6543aab1e6f1363625c4a3c5cd49d1adc70e116f7fab0bf4c8f952bc932aa68b9af915d6dee8bc29d07220e42
-
SSDEEP
24576:TAu49RBE/FgKBdhklsAzU2Pr3NjNJDw8oNH0jtxMfwD40N0/9IGRI:TRME/FgKZV/K9c8oyJxFJnGO
Malware Config
Signatures
Files
-
e35d3dab57599a454df62a00e8533bf780a9efa2d1034ec919cff7628a47f793.rar
-
BatchDoc_veryhuo.com/BatchDoc.exe.exe windows x86
116d0328d560f27b694160771e4cc89e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstLt
kernel32
FindResourceExW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 447KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.se0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.se1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
BatchDoc_veryhuo.com/最火软件站.url.url
-
BatchDoc_veryhuo.com/软件说明.txt