�C�c�+�=l��ej�t�u�A�sԲ� �Jua��'�2�� ����PR&�z֠8���hQ��nL�{�.��3��5v�Zo��g"�����20{9��ʖ�ů6U�Uo��I��[�iWe�f���� ��;�������b%}���H��0������(��l��xJL����eBN���s4A���(8K/��P��"l����S��J=e�|Q=v�s&���]'�!����Ȍ���s�� i���ɪ*�����\��Y�"����ټ�\VWz�o�� 8�_e.����x� �����VM����It�Dym�2�b1��|�sh��XS.G=�fGJ�%�p�J�� ����[���><Ӱ��"���J���Kʻ����Bk1�����vN� :!6)�u+�_s��$��0������i����q��������S��t��2f�B�!g�,��Е]��Lj�T�D�VG.{1EM�&��z��C W/UrF���O���#�5�ڵ��R)��% �\摩ɑPe����r�xj�E^{���S��J�wXh�e~2?!��I��2�[�kp�Ψ z,=���I���"(Ak��,�x_fbz�'C!�D!B�@R��MG�#���,���טtF�MZa�+�O�B�Yd�n��1�/� z:�A!�ٱH��T�9\����;8G}d=��F�K��1���5 ]2r�� �|��>�p�=��Pˁ4gD-]�.��X K�Z��?����(�����������+Z��H�d���?��_��ٓ�}��$�y����9�=iٜ����Q�� )+ٍ�ԫ�rRS�YG��9�u(�/_���}��Y�Gt.$CC��u�K�$l�����'g�-'$>A����25�\��}#ԍ���oQ�ò9m�Q(�>�^�簄<��BE�*�5Z|�|��*4`�h#�{fK�R�����2q�8o�R+F��Dy���Q��������?�Q��zn�\v��X/qZ��v�/T,yI.�k�7��(�����!]Z˥� �g ˴Na��n�} o!��[SJֺ Sc�\�>�*n��oX��+xq'�6�':���| H�\>�cR�ϲ�0,��T�Hbh��O~����ˋ���7��N� X����1��\�3��#B&F�� 9?���V|�C��L������'ڰ� IԒ6Eg�H�h� 7D�/���qY�'��9睲oKn:��Wj����U]Hz��@���i�MK[��\r�ɚFr]�zk��@��/��R�vQ��/{�B�����|�'ZXN����v�}p���!%���l�R1��3��S�j����4!�pJ��8��b�Lv�5�G���UmhkLSyL�b��-��,�/������p�a�&- QR� (���Љ!�0��`*q<L�Ϫ+g ��D_<�ZP7���r'�߯u����o��u�+��BI�sV�(�z�ؼ4�1�r��6&m��Y(�q$D,��LE/�Sf���^q��5#^�tp�.Ϫʭ1�_k�n���@�Y������ +vW�� ��6�a���;�g����b���~��������V��~�'w����N��O���]�4_P�q��C �+�F�J�©J�<PjAS]��ꦰ�}��KDS�6X�L���g&�X#�����D��_`}F�|����b�X�k�ے[KRA������������Ab�� �� ������W�o48D�����j�[Uj�V����Lޤ%pg]YxS�a�,��i#����"��\k�U-�������(����@��pd�io���� QU S�O�����4���3���Z��6jG��29j�$U�����^|t'}l?Np�y�s�&V3��F,�- �?=��b v <�X���F����%�PcWF�M:堫rt�$�#(��3��2�0#L�9?��:�=�������T�z�UD���#�W=dXyE =�Hע2�Th�����O��]������Xm���뿷c7�zE��h��ꍅ�+8�tuy��:(�?u^��n�K���� Z���sرZ������ś�]��!���$��u��e����?S��9gj"�Mmm���V��6dV Y�q�Ƨ+��"�,aL[w]��#8'��~��>pPz����*��3p�k�`I�e�R���7��l�NY?(0��A�-#G\A��9����Ow_�3���~>3�� �4k� !�� ��S��+H�H�8���B���7���5��d�����IE�^i�Uo,�J��F$�������!+1�u(��K|3�E���ؼ�6���O����=a .Y3�5�B�Ε/��/+T�Z����3���A�b�{� �Ċ!g^��7�L��J��'h[��;�ċ�_�nj#��b*��yf$��h�������8�#������r�r�qL>�W탫 ħ����y��C����hP!��ݕF>\m��U�ѸĂ�5v"8��Z���rx:�5�"��!�����Yd��~\��'���|Wgn`��Q�H{�C�6��!m�xkCF��;.�G�ڇ��D�w�9��C욝ԛ>!Y3B��{s2��w���� ͣKX ����T��@�d+xY�����V���h�2X�m4�Ln�l��ax2�*ȕ10��ZHi�(R�<��A�Б���`��1,^\�� ��P4:Q�V�ӎ�a�5��(�m�o�E��<��@'. ���\0��Q'��ы��`4a�%�i����Ԏ�Ýh�I�Ȋ���35(���R�`"���1�T��\�x�6��TaI���!A^P�@�� ����Ɓ�3��N{�u �m4���Z6}\�ז��3<��7���<���5� �ck�=~2r��!�g����l�z�O3��S(�4��!�e�w��~*+B%��F�rG܂��֔��֟�z����b�Lr�(>.q*���C�T�`' �G\�af=���1����r�נ���$S���G�w'H?� *c�q� ���mr�g`r a��^R�ݓW�D�0�9�8��:��I���G���Q�W��R;d�*�B� ��&�� ��4�>�(N�ȩd"��>��
Behavioral task
behavioral1
Sample
大天使之剑夜涩辅助.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
大天使之剑夜涩辅助.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
更多软件下载.url
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
更多软件下载.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
飘荡软件.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
飘荡软件.url
Resource
win10v2004-20221111-en
General
-
Target
ab49367c7151cbcefe3e962e52581e770706511e97c155f080b567314a07c53d
-
Size
5.8MB
-
MD5
f2c4f6e771beecae1d0e4aca2b10d80d
-
SHA1
7b4d0eeae6e88f4ab0b724378d79e483a9da875a
-
SHA256
ab49367c7151cbcefe3e962e52581e770706511e97c155f080b567314a07c53d
-
SHA512
fd62d428e363aaf6cdfa3f4f4fc9d5df7e22b65a35ebf5409847fa8ba2e4271fcdcf8719442f3ee209eb0b68854e83bce0544b83c62a2dd63ed5d8b8897f2f91
-
SSDEEP
98304:oJPrZBQE6Ojple6E76tC4ubMEbuOwqdbX/X6n32O8wYgKEQSe8uKIWV:MQEPtM6E7kmtu8Kn3ljCJKFV
Malware Config
Signatures
-
Processes:
resource yara_rule static1/unpack001/大天使之剑夜涩辅助.exe vmprotect
Files
-
ab49367c7151cbcefe3e962e52581e770706511e97c155f080b567314a07c53d.rar
-
W7/1次.bmp
-
W7/2次.bmp
-
W7/45级.bmp
-
W7/50级.bmp
-
W7/55级.bmp
-
W7/60级.bmp
-
W7/65级.bmp
-
W7/BOSS之家.bmp
-
W7/lyzk.txt
-
W7/一键回收.bmp
-
W7/一键回收1.bmp
-
W7/交付灵兽.bmp
-
W7/交付镖车.bmp
-
W7/仙尾灵狐.bmp
-
W7/会员挂机.bmp
-
W7/传送到庄园.bmp
-
W7/传送员传.bmp
-
W7/传送员图.bmp
-
W7/传送员标题.bmp
-
W7/元宝领取.bmp
-
W7/元宝领取1.bmp
-
W7/元宝领取2.bmp
-
W7/免费领取.bmp
-
W7/军需官.bmp
-
W7/军需官标题.bmp
-
W7/冥界.bmp
-
W7/冰火地狱.bmp
-
W7/凌霄幻境.bmp
-
W7/刷新等级.bmp
-
W7/副本使者.bmp
-
W7/副本使者图标.bmp
-
W7/卧龙村1.bmp
-
W7/原地复活.bmp
-
W7/叉.bmp
-
W7/叉1.bmp
-
W7/回城复活.bmp
-
W7/回收武器.bmp
-
W7/回收首饰.bmp
-
W7/在线奖励.bmp
-
W7/天机老人.bmp
-
W7/太阳水.bmp
-
W7/太阳水包.bmp
-
W7/套装.bmp
-
W7/套装1.bmp
-
W7/套装2.bmp
-
W7/学习技能.bmp
-
W7/安全挂机.bmp
-
W7/完成任务.bmp
-
W7/完成任务1.bmp
-
W7/寒霜白虎.bmp
-
W7/封魔岭入口.bmp
-
W7/庄园看护人.bmp
-
W7/开始旅途.bmp
-
W7/当前护送灵兽.bmp
-
W7/快捷出售.bmp
-
W7/我知道了.bmp
-
W7/招财进宝.bmp
-
W7/挂机.bmp
-
W7/接受任务.bmp
-
W7/接受任务1.bmp
-
W7/接受开始押镖.bmp
-
W7/提交.bmp
-
W7/提交多余.bmp
-
W7/整理包裹.bmp
-
W7/新手指南.bmp
-
W7/新手指南1.bmp
-
W7/服饰.bmp
-
W7/武器.bmp
-
W7/武器1.bmp
-
W7/死亡陵墓.bmp
-
W7/沙漠土城1.bmp
-
W7/海底世界.bmp
-
W7/灵片.bmp
-
W7/灵片1.bmp
-
W7/炎龙神殿.bmp
-
W7/烈焰城.bmp
-
W7/烈焰城1.bmp
-
W7/烈焰镖局.bmp
-
W7/烈焰镖局1.bmp
-
W7/烈焰镖局标题.bmp
-
W7/熔岩地狱.bmp
-
W7/玄角青龙.bmp
-
W7/王城城主.bmp
-
W7/玛雅神殿.bmp
-
W7/白银镖车.bmp
-
W7/确定进入.bmp
-
W7/神兽小草.bmp
-
W7/神威魔狱.bmp
-
W7/神石.bmp
-
W7/立即参与.bmp
-
W7/立即开始膜拜.bmp
-
W7/立即护送.bmp
-
W7/等级小于.bmp
-
W7/红花草.bmp
-
W7/继续任务.bmp
-
W7/美女镖车.bmp
-
W7/背包.bmp
-
W7/背包图标.bmp
-
W7/荒漠王城1.bmp
-
W7/蘑菇.bmp
-
W7/装备回收.bmp
-
W7/角.bmp
-
W7/返回上页.bmp
-
W7/邪灵天界.bmp
-
W7/采集.bmp
-
W7/金币领取.bmp
-
W7/金币领取1.bmp
-
W7/金币领取2.bmp
-
W7/锁头.bmp
-
W7/镇魔殿.bmp
-
W7/雪域冰原.bmp
-
W7/零次.bmp
-
W7/青铜镖车.bmp
-
W7/驯兽师.bmp
-
W7/魂力丹.bmp
-
W7/魔龙深渊.bmp
-
W7/黄金镖车.bmp
-
XP/1次.bmp
-
XP/2倍奖励.bmp
-
XP/2次.bmp
-
XP/3倍奖励.bmp
-
XP/45级.bmp
-
XP/50级.bmp
-
XP/55级.bmp
-
XP/60级.bmp
-
XP/lyzk.txt
-
XP/一键回收.bmp
-
XP/一键回收1.bmp
-
XP/交付灵兽.bmp
-
XP/交付镖车.bmp
-
XP/仙尾灵狐.bmp
-
XP/传送到庄园.bmp
-
XP/传送员标题.bmp
-
XP/元宝领取.bmp
-
XP/元宝领取1.bmp
-
XP/元宝领取2.bmp
-
XP/免费领取.bmp
-
XP/军需官.bmp
-
XP/军需官标题.bmp
-
XP/刷新等级.bmp
-
XP/副本使者.bmp
-
XP/副本使者图标.bmp
-
XP/卧龙村1.bmp
-
XP/叉.bmp
-
XP/叉1.bmp
-
XP/回城复活.bmp
-
XP/回收武器.bmp
-
XP/回收首饰.bmp
-
XP/在线奖励.bmp
-
XP/天机老人.bmp
-
XP/套装.bmp
-
XP/套装1.bmp
-
XP/套装2.bmp
-
XP/学习技能.bmp
-
XP/完成任务.bmp
-
XP/完成任务1.bmp
-
XP/寒霜白虎.bmp
-
XP/封魔岭入口.bmp
-
XP/幽冥宫殿.bmp
-
XP/庄园看护人.bmp
-
XP/开始旅途.bmp
-
XP/快捷出售.bmp
-
XP/我知道了.bmp
-
XP/我要赚钱.bmp
-
XP/招财进宝.bmp
-
XP/挂机.bmp
-
XP/接受任务.bmp
-
XP/接受任务1.bmp
-
XP/接受开始押镖.bmp
-
XP/提交.bmp
-
XP/提交多余.bmp
-
XP/整理包裹.bmp
-
XP/新手指南.bmp
-
XP/新手指南1.bmp
-
XP/武器.bmp
-
XP/武器1.bmp
-
XP/沙漠土城1.bmp
-
XP/灵片.bmp
-
XP/灵片1.bmp
-
XP/烈焰城.bmp
-
XP/烈焰城1.bmp
-
XP/烈焰镖局.bmp
-
XP/烈焰镖局1.bmp
-
XP/烈焰镖局标题.bmp
-
XP/牛魔洞窟.bmp
-
XP/玄角青龙.bmp
-
XP/王城城主.bmp
-
XP/白银镖车.bmp
-
XP/确定进入.bmp
-
XP/神兽小草.bmp
-
XP/神石.bmp
-
XP/立即护送.bmp
-
XP/继续任务.bmp
-
XP/美女镖车.bmp
-
XP/背包.bmp
-
XP/背包图标.bmp
-
XP/荒漠王城.bmp
-
XP/装备回收.bmp
-
XP/角.bmp
-
XP/诅咒殿堂.bmp
-
XP/赤血魔狱.bmp
-
XP/返回上页.bmp
-
XP/金币领取1.bmp
-
XP/金币领取2.bmp
-
XP/零次.bmp
-
XP/零次1.bmp
-
XP/青铜镖车.bmp
-
XP/驯兽师.bmp
-
XP/黄金镖车.bmp
-
大天使之剑夜涩辅助.exe.exe windows x86
9981ed34ec14b01d49b11dfdf67ea807
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
waveOutClose
ws2_32
WSAStartup
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetCurrentProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetCapture
gdi32
CreatePen
winspool.drv
DocumentPropertiesA
comdlg32
GetSaveFileNameA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
VariantInit
comctl32
ord17
oledlg
ord8
Exports
Exports
Sections
.text Size: - Virtual size: 851KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 405KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
更多软件下载.url.url
-
飘荡软件.url.url