Behavioral task
behavioral1
Sample
QQ玫瑰小镇管家辅助v22.3/QQ玫瑰小镇管家辅助v22.3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
QQ玫瑰小镇管家辅助v22.3/QQ玫瑰小镇管家辅助v22.3.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
QQ玫瑰小镇管家辅助v22.3/亿家QQ管家系列辅助自动更新update .exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
QQ玫瑰小镇管家辅助v22.3/亿家QQ管家系列辅助自动更新update .exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
QQ玫瑰小镇管家辅助v22.3/亿家好网-hao123网址导航.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
QQ玫瑰小镇管家辅助v22.3/亿家好网-hao123网址导航.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
QQ玫瑰小镇管家辅助v22.3/官方网站.url
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
QQ玫瑰小镇管家辅助v22.3/官方网站.url
Resource
win10v2004-20220812-en
General
-
Target
98f76a4ec859da0c3afcda98b75650446865a040b6e6e5d37a919f2f9ea0eff9
-
Size
2.4MB
-
MD5
cc0dea6bcaa4374b9225740798d529e8
-
SHA1
e6f17bc5d0ef38e893742e33234ba97fe7a8845f
-
SHA256
98f76a4ec859da0c3afcda98b75650446865a040b6e6e5d37a919f2f9ea0eff9
-
SHA512
16cd2568497d968fdb2155a32c110c88b708abcc79bd48ff75f0fb031f1dc7ce90e0f6f1d1856a6466757cfa951ea14a64c4590ed84d850c8d4102d7f6d5d51c
-
SSDEEP
49152:PY6zJac2jCsSirbXPEFb+fxDR2Ms+x8tEJJYZBtwXSHj+dqYz2i:PY6tac2+sSir7PEV+JDR2MwtuIBa6+d/
Malware Config
Signatures
-
resource yara_rule static1/unpack001/QQ玫瑰小镇管家辅助v22.3/亿家QQ管家系列辅助自动更新update .exe upx
Files
-
98f76a4ec859da0c3afcda98b75650446865a040b6e6e5d37a919f2f9ea0eff9.rar
-
QQ玫瑰小镇管家辅助v22.3/QQ玫瑰小镇管家辅助v22.3.exe.exe windows x86
02b7bb1d47b3b7341001b57ecc656257
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
winmm
PlaySoundA
ws2_32
inet_ntoa
rasapi32
RasGetConnectStatusA
kernel32
GetTimeZoneInformation
user32
GetSysColorBrush
gdi32
EndPage
msimg32
GradientFill
winspool.drv
ClosePrinter
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
CoRegisterMessageFilter
oleaut32
VariantInit
comctl32
ImageList_Destroy
oledlg
ord8
wininet
InternetSetOptionA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 924KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
QQ玫瑰小镇管家辅助v22.3/下载站下载说明.htm.html .js
-
QQ玫瑰小镇管家辅助v22.3/亿家QQ管家系列辅助自动更新update .exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
QQ玫瑰小镇管家辅助v22.3/亿家好网-hao123网址导航.url.url
-
QQ玫瑰小镇管家辅助v22.3/免责更新说明.txt
-
QQ玫瑰小镇管家辅助v22.3/官方网站.url.url
-
QQ玫瑰小镇管家辅助v22.3/打开程序图标或者软件不见了必看.txt