Q�?}�Q�8$J�~5 x?^P�S�ԭ��p�, 畯z�jx����n�iP�+s_�L��3C.�"�E�X�#�4$E��ӄ���s�gY�N%���ZH��O���F�Q�,$8������A�Z�M.�u�F�ۊ^s�fW28ZRa��|$�3�W`�Z\����:�>����i���~g����\�J�9�4�|uR��CMd94���ʏ�:�5�5��|L��&^38����,j�{k+DW�b�y�:��H�U�c�����.��T��u�>S�^O�y�!S��w��m��{}���7x�/L��Ř��/��2��<�C%����5~F�d��o�җ���Ap��^R���L �J��\�,^��^5],s0@З8�9ή5�|�ݻ�c}�����6�ܕ��`�e#�]�0ԔwO�*��%C�K����e^Hy��߹/`M�� !�3�j�5}w<1-�U�1̺ع��^�����Xo��V��P$���0���������oXuEkP��� ��]�c�<�%�%��i���p̆�w* w':K �(t#��FW<�RSA0 ]G)� �p���R�_����V<:�� ���l�B�aQ�&2��Enq�9���꠨eyЄXF�{(�b�7����3�ɋ�B����?�3�~eTM����h��B����`���ު����l�ad��:w���y�֨kU�+zx�7=ňP�YuUG�>d�ͷ���f��1T�6�Q��;���zs/|R�M0GkѲ��[�k6?������¸�]O���JX^k�c�m��s���a4��f�� ��$�$�;���IJZa3i��/`���a��#݈�C�$�=���EO�'��{��A�d%� �r2�g��y����$zI�uy_sy8� ��؊V����M{�7,]hT~pP������![Х!�h�+��8.C�m�Gې�|�~����)�hյon��(��zS6���G�`�YϦ%��t4?� �� �������4�K�[50#LO���H��C���a��~���r�R�L�R�f�UW�R�e¡0�IA��E%�Q�ދ�\��t[�ތ�֏>L�Kr��I��ݶ�����l�-3\(*E�+96��) �:@��#�G�e,�����WzjT(�{����ofݦS_�}��>�X� �V�m�yk�C��rQ�.�Z�=�n��H^ w��_/�ܺ�X� '�I��!�Nd�v��-a�t�Z�R�W����f�M�$Mh��"��L $Lk���. �m�b������>+vJS�h/�[�Ft�ʼn�a���b���u���P��-�."٬� k|ck���ls8=Q��MdT}���9����N� &9�\2����<籰��=x�g�h)f_�q�PͪF����գ2��/�1T���aq���P����J����e����i�H�8�KO���cs���tIw���$�ő��@�/X������BVb�}Vox�G%r]���wa�Ml�]?�����ٱ��Cn�R2��Kj��R�_Ø�j�o�}�v�;>��A])�3��F��j[|��ď�%xz�ٹ�R���8��j���䙹�[�9�p���e5u)��mh� �`P�a�g?.�G����^�~"�Y~�;5/@u���o�ji���[O�;)�6N.�Q���;T�o������P���]�͞��\�h��$�u5�$1>+�B���ʚ��r�9��R���Oo�wu�\痩������"��f���{��H#��.�½���*u*վ��&SP����d��p���� ΞM_bR���Q��#���V�q���B��L;h�����`��CN����WW��|(k�>�I�ݨ�u�I�4�m�2�������6ˣ�TB�8Lc�����א��3k��o �5��)���]V��@!ʃ�Ք%ib���!��6�����1z 裹v-0�T ��tGs�W��ӝu�͏�&�i'~U0(�+GyXb^���������E�~9�㰾�� �b�� pq13��c�x�I�����%`�/v f���;C|=��f^:viׅ��δG��<��!��T�n+y1;�S_^Wu�?�Q����c��W1�0��I/��d��U��a(2��F:w�T&t��������P��E�����߀�8�S9ʷ���J�����Ed���ű�7���.f0".��n���mdS��G#�W�J�b���s�Y��;u�������{�����t���+C�}��P�z:�;����2n��|>�-☎���d`��PÁ�-@ħ��g{�����h�$���(�7�?(ۇ5�o�T�Eܐ��U#oփ� u��2�҉Gי�+�]<-���c�C��Z��L�4�0Q��V��2�"Ϣƣ������[4Q�&�!��T�.k���ނ��.��EH�5���)z���]�q5=8�������U�(��p�z�(���iV��E���Y���~n��0�@�?i�C�����&!F� �+)�X��0�^���zT��a=����ܿC� �s��s��;��W �xx��ĥ�V��S�JJ= ��mg��w�7 ��T�Ʈ��~1P�����hMmp/�b�ֆ��O{� =�PSЏ��D��3��`er��}Ϡ'&�3$�wS��2�vUM�=G���ɴK8=�ja[����\u����G d��ꤢ��� �� ���H ^HU�e�Ѭkr���c6��H�Y���,�����֛Y %��w��Ƈ #�+�2�� ��$qu�@����WP@��0@�������Ӭ� V2��0��BSc�B��� ���Z���gsSKW�"`u��z��� olN�$B]ͭ!�}��!�}��x�A|yH��Pv���O2́��tp� [�d��!��,� ��ё� `��[�n�i��-�^�K�: �'��r����"[ZR,Z{>�IqF�e v���sp���]�a�X}Y�ދ��9�'���F���D�|�>�Mنe� ����5�2��h���դ���αkU��S�c}Rk�X���6�s�����w���'WHK���i�Rd���#�wP/ ��
Static task
static1
Behavioral task
behavioral1
Sample
云购多功能助手v6.0/1元云购首页地址.url
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
云购多功能助手v6.0/1元云购首页地址.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
云购多功能助手v6.0/云购多功能助手v6.0.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
云购多功能助手v6.0/云购多功能助手v6.0.exe
Resource
win10v2004-20220812-en
General
-
Target
41eda159f22c342e6fb6d75e681e2ac48f13572859d76479895378464ffe71f2
-
Size
9.5MB
-
MD5
5d510cf8f75c1639c01e66b66367e7fe
-
SHA1
cbbcd386cd1f2362a72a9dbe2a3255fe6d75ebf8
-
SHA256
41eda159f22c342e6fb6d75e681e2ac48f13572859d76479895378464ffe71f2
-
SHA512
44df4ec89f17fbafd9072a68a4f3330a50b27e3eb42fa13cf176bc3d7e26ad649182a8993a4e8315b8774dfc6501084fc2eb57e719c4faa2f7ed231603e9ec98
-
SSDEEP
196608:lNW5d3yizO8GzXoSH80iiW5Z7VBZKy7LFQHyh6RP3bfSU5ymBwD6EjxLqSiD:i3C8rS6ZVB5FxhafSUxB1ELqXD
Malware Config
Signatures
Files
-
41eda159f22c342e6fb6d75e681e2ac48f13572859d76479895378464ffe71f2.zip
-
云购多功能助手v6.0/1元云购首页地址.url.url
-
云购多功能助手v6.0/云购多功能助手v6.0.exe.exe windows x86
3e46a8ad1095675df68ee4b79304198e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
winmm
midiStreamOut
ws2_32
getsockname
kernel32
LocalAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetPropA
gdi32
SetPixelV
msimg32
GradientFill
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
SafeArrayGetLBound
comctl32
ImageList_GetImageInfo
wininet
HttpQueryInfoA
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 446KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 9.7MB - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
云购多功能助手v6.0/更新说明.txt