Behavioral task
behavioral1
Sample
绿色太极.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
绿色太极.exe
Resource
win10v2004-20220812-en
General
-
Target
192eef14f023775556d4897cd0a43941b01d60944607fa64ac54cb9bd65e3c7f
-
Size
6.0MB
-
MD5
d83269c9aa161fafeead67d5f7713911
-
SHA1
face51b5a92b94fdbb83c30e39c4a6f0d1a06a51
-
SHA256
192eef14f023775556d4897cd0a43941b01d60944607fa64ac54cb9bd65e3c7f
-
SHA512
79affcac961facfa720a5480c25089550548898fab9605fbf29249f5b534b7f28ad58a1e46c8dd743a84ace7562330f570679699c5afde724b1cae6ac39c8dd4
-
SSDEEP
98304:QFG2v7RYWE9gyDEjiuU5xrVgzP0UAFx66ugzSCZqdxTeLnyFaaDV2fjFP:WvRFE9g6u6xrGr0b66ZxeTeWac+
Malware Config
Signatures
-
resource yara_rule static1/unpack001/绿色太极.exe upx
Files
-
192eef14f023775556d4897cd0a43941b01d60944607fa64ac54cb9bd65e3c7f.rar
-
logdq.bmp
-
logon.bmp
-
selchrdaq.bmp
-
selectchar.bmp
-
华信互联.txt
-
绿色太极.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 420KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 440KB - Virtual size: 437KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ