Overview
overview
1Static
static
gxð...��.htm
windows7-x64
1gxð...��.htm
windows10-2004-x64
1gxð...aot.js
windows7-x64
1gxð...aot.js
windows10-2004-x64
1gxð...a/d.js
windows7-x64
1gxð...a/d.js
windows10-2004-x64
1gxð...-zb.js
windows7-x64
1gxð...-zb.js
windows10-2004-x64
1gxð...a/c.js
windows7-x64
1gxð...a/c.js
windows10-2004-x64
1gxð.../o.htm
windows7-x64
1gxð.../o.htm
windows10-2004-x64
1gxð..._v2.js
windows7-x64
1gxð..._v2.js
windows10-2004-x64
1gxð...s/c.js
windows7-x64
1gxð...s/c.js
windows10-2004-x64
1gxð.../cc.js
windows7-x64
1gxð.../cc.js
windows10-2004-x64
1gxð...ore.js
windows7-x64
1gxð...ore.js
windows10-2004-x64
1gxð...002.js
windows7-x64
1gxð...002.js
windows10-2004-x64
1gxð...unt.js
windows7-x64
1gxð...unt.js
windows10-2004-x64
1gxð...unc.js
windows7-x64
1gxð...unc.js
windows10-2004-x64
1gxð...oad.js
windows7-x64
1gxð...oad.js
windows10-2004-x64
1gxð...002.js
windows7-x64
1gxð...002.js
windows10-2004-x64
1gxð...s/f.js
windows7-x64
1gxð...s/f.js
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
gxðԼ_v2.50_9.htm
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
gxðԼ_v2.50_9.htm
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
gxðԼ_v2.50_9_files/9haot.js
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
gxðԼ_v2.50_9_files/9haot.js
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
gxðԼ_v2.50_9_files/9haot_data/d.js
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
gxðԼ_v2.50_9_files/9haot_data/d.js
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
gxðԼ_v2.50_9_files/9ht-zb.js
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
gxðԼ_v2.50_9_files/9ht-zb.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
gxðԼ_v2.50_9_files/9ht-zb_data/c.js
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
gxðԼ_v2.50_9_files/9ht-zb_data/c.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
gxðԼ_v2.50_9_files/9ht-zb_data/o.htm
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
gxðԼ_v2.50_9_files/9ht-zb_data/o.htm
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
gxðԼ_v2.50_9_files/bds_s_v2.js
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
gxðԼ_v2.50_9_files/bds_s_v2.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
gxðԼ_v2.50_9_files/c.js
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
gxðԼ_v2.50_9_files/c.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
gxðԼ_v2.50_9_files/cc.js
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
gxðԼ_v2.50_9_files/cc.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
gxðԼ_v2.50_9_files/core.js
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
gxðԼ_v2.50_9_files/core.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
gxðԼ_v2.50_9_files/core_002.js
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
gxðԼ_v2.50_9_files/core_002.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
gxðԼ_v2.50_9_files/count.js
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
gxðԼ_v2.50_9_files/count.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
gxðԼ_v2.50_9_files/downFunc.js
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
gxðԼ_v2.50_9_files/downFunc.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
gxðԼ_v2.50_9_files/downLoad.js
Resource
win7-20220901-en
Behavioral task
behavioral28
Sample
gxðԼ_v2.50_9_files/downLoad.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
gxðԼ_v2.50_9_files/downLoad_002.js
Resource
win7-20220901-en
Behavioral task
behavioral30
Sample
gxðԼ_v2.50_9_files/downLoad_002.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
gxðԼ_v2.50_9_files/f.js
Resource
win7-20221111-en
Behavioral task
behavioral32
Sample
gxðԼ_v2.50_9_files/f.js
Resource
win10v2004-20220901-en
General
-
Target
1f3c16a105f9632c1180c1a90ece963a362118eaa9de544d1016d06fa9a33df8
-
Size
1.4MB
-
MD5
d45f67f3e3aee20fd06e0873c5e640c9
-
SHA1
6db88720aed36392b9eb25886b682f45daa73353
-
SHA256
1f3c16a105f9632c1180c1a90ece963a362118eaa9de544d1016d06fa9a33df8
-
SHA512
bb835140dd61bf8a8033e2faf255a9c24ea8442201f057d58ccee5b0639903bc4fe0d942104e0ca50695537876ccd1a89c5d3e09839a13cfebcdb06fce1e5f60
-
SSDEEP
24576:dvhOXdY0kOpY87iFomeB2VeXmQ4BvS7KJbCiyJRT7O1Flp1P7n59T6GbKzqqzi7H:CXdYepDiom0ABvwgbCiyJRnO17rl9T4e
Malware Config
Signatures
Files
-
1f3c16a105f9632c1180c1a90ece963a362118eaa9de544d1016d06fa9a33df8.zip
-
config.gx
-
frm.er
-
fwq.ini
-
gxðԼ_v2.50_9.htm
-
gxðԼ_v2.50_9_files/2013101088151836385.jpg.jpg
-
gxðԼ_v2.50_9_files/2013108152039.jpg.jpg
-
gxðԼ_v2.50_9_files/5.gif.gif
-
gxðԼ_v2.50_9_files/9haot.htm.js
-
gxðԼ_v2.50_9_files/9haot_data/201322617579.jpg.jpg
-
gxðԼ_v2.50_9_files/9haot_data/d.js.js
-
gxðԼ_v2.50_9_files/9haot_data/e2te_760100.gif.gif
-
gxðԼ_v2.50_9_files/9ht-zb.htm.js
-
gxðԼ_v2.50_9_files/9ht-zb_data/490-60n1.gif.gif
-
gxðԼ_v2.50_9_files/9ht-zb_data/c.js.js
-
gxðԼ_v2.50_9_files/9ht-zb_data/ecom
-
gxðԼ_v2.50_9_files/9ht-zb_data/ecom.htm.html .js
-
gxðԼ_v2.50_9_files/9ht-zb_data/ecom_data/adx.gif.gif
-
gxðԼ_v2.50_9_files/9ht-zb_data/o.htm.html
-
gxðԼ_v2.50_9_files/bds_s_v2.js.js
-
gxðԼ_v2.50_9_files/bdsstyle.css
-
gxðԼ_v2.50_9_files/c.php.js
-
gxðԼ_v2.50_9_files/cc.js.js
-
gxðԼ_v2.50_9_files/core.php.js
-
gxðԼ_v2.50_9_files/core_002.php.js
-
gxðԼ_v2.50_9_files/count.js.js
-
gxðԼ_v2.50_9_files/down.css
-
gxðԼ_v2.50_9_files/downFunc.js.js
-
gxðԼ_v2.50_9_files/downLoad.htm.js
-
gxðԼ_v2.50_9_files/downLoad_002.htm.js
-
gxðԼ_v2.50_9_files/ecom
-
gxðԼ_v2.50_9_files/ecom_002
-
gxðԼ_v2.50_9_files/ecom_003
-
gxðԼ_v2.50_9_files/ecom_004
-
gxðԼ_v2.50_9_files/ecom_005
-
gxðԼ_v2.50_9_files/ecom_006
-
gxðԼ_v2.50_9_files/f.js.js
-
gxðԼ_v2.50_9_files/fixed7o.js.js
-
gxðԼ_v2.50_9_files/foot.js
-
gxðԼ_v2.50_9_files/h.js.js
-
gxðԼ_v2.50_9_files/highslide-with-html.htm
-
gxðԼ_v2.50_9_files/highslide.htm
-
gxðԼ_v2.50_9_files/innerhtml.js.js
-
gxðԼ_v2.50_9_files/jquery-min.js.js
-
gxðԼ_v2.50_9_files/m.js.js
-
gxðԼ_v2.50_9_files/main7o.js.js
-
gxðԼ_v2.50_9_files/newcommon.js.js
-
gxðԼ_v2.50_9_files/o.htm.html
-
gxðԼ_v2.50_9_files/o_data/wh.js.js
-
gxðԼ_v2.50_9_files/share.js
-
gxðԼ_v2.50_9_files/sj-sofe.js.js
-
gxðԼ_v2.50_9_files/stat.php.js
-
gxðԼ_v2.50_9_files/tlAd.js.js
-
gxðԼ_v2.50_9_files/uijs.htm.js
-
gxðԼ_v2.50_9_files/uijs_002.htm.html .js
-
gxðԼ_v2.50_9_files/uijs_003.htm.html .js
-
gxðԼ_v2.50_9_files/uijs_004.htm.html .js
-
gxðԼ_v2.50_9_files/uijs_005.htm.html .js
-
gxðԼ_v2.50_9_files/uijs_006.htm.html .js
-
gxðԼ_v2.50_9_files/uijs_data/0f0002tOZ--qBkYVN9r_v0.swf
-
gxðԼ_v2.50_9_files/uijs_data/AC_RunActiveContent.js.js
-
gxðԼ_v2.50_9_files/uijs_data_002/0f000QNXZKmFe5Yb4Qu4l6.swf
-
gxðԼ_v2.50_9_files/uijs_data_002/cpro.js.js
-
gxðԼ_v2.50_9_files/uijs_data_003/0f000cbB0--7gwKIf87TXs.gif.gif
-
gxðԼ_v2.50_9_files/uijs_data_005/0f000PC3L7rMhYp88bcCNf.swf
-
gxðԼ_v2.50_9_files/uijs_data_005/cpro.js.js
-
gxðԼ_v2.50_9_files/uijs_data_006/0f000ZjjVa1T3W4-irPKSs.swf
-
hpc.er
-
mxqy.11.GX.R.exe.exe windows x86
8a5a6b636431c6919b9f8a0c520cd0bf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc90u
ord2969
ord1440
ord3681
ord5656
ord6410
ord3354
ord4378
ord5293
ord5296
ord4800
ord4805
ord4802
ord4820
ord4823
ord4807
ord5209
ord5016
ord4596
ord4589
ord5418
ord4810
ord5214
ord4622
ord5224
ord4865
ord4866
ord4109
ord5356
ord4987
ord5487
ord4861
ord4789
ord4927
ord5279
ord5407
ord4955
ord4904
ord5408
ord5105
ord4618
ord5384
ord5228
ord4707
ord4797
ord4798
ord5400
ord5230
ord5142
ord5239
ord5491
ord5401
ord5079
ord5382
ord4933
ord5397
ord5106
ord4549
ord1376
ord2194
ord4550
ord2645
ord2646
ord2647
ord2644
ord2643
ord3070
ord5093
ord3741
ord5371
ord2337
ord430
ord4764
ord4516
ord4785
ord4009
ord3577
ord2282
ord4512
ord2130
ord1357
ord6666
ord1299
ord2596
ord3982
ord3773
ord3993
ord729
ord5982
ord4799
ord4804
ord4819
ord4822
ord4801
ord4806
ord491
ord3852
ord670
ord4685
ord2138
ord3225
ord6375
ord4697
ord1380
ord2369
ord5657
ord2070
ord5598
ord4344
ord1681
ord4430
ord2650
ord2651
ord3287
ord5803
ord6381
ord3230
ord6379
ord3229
ord5338
ord3233
ord4553
ord4730
ord5451
ord5447
ord2860
ord2079
ord2445
ord5354
ord4985
ord1697
ord5448
ord5618
ord981
ord2656
ord5076
ord450
ord4507
ord4765
ord4012
ord4043
ord794
ord589
ord3670
ord3115
ord6018
ord5663
ord5680
ord4996
ord4347
ord5676
ord5674
ord3217
ord2087
ord4213
ord5830
ord6741
ord5548
ord1048
ord4179
ord6035
ord2206
ord2251
ord4747
ord6803
ord4173
ord6801
ord4423
ord4448
ord2447
ord617
ord5675
ord5567
ord341
ord996
ord457
ord1098
ord1156
ord1155
ord3803
ord4004
ord388
ord4684
ord4906
ord6553
ord6439
ord3035
ord3340
ord4641
ord2090
ord5171
ord5285
ord4677
ord5945
ord3009
ord5861
ord1462
ord6044
ord5606
ord2239
ord2204
ord6762
ord2867
ord2859
ord4994
ord650
ord5137
ord4545
ord3396
ord3717
ord2667
ord4207
ord3333
ord3033
ord3208
ord2800
ord5895
ord619
ord3528
ord654
ord4319
ord1533
ord3156
ord5619
ord1220
ord2146
ord788
ord555
ord585
ord4687
ord4698
ord5658
ord2071
ord4431
ord2652
ord980
ord6382
ord6380
ord3232
ord5452
ord5449
ord2080
ord1733
ord4126
ord988
ord6424
ord6338
ord4720
ord4670
ord2787
ord3853
ord4731
ord4766
ord4543
ord6187
ord2470
ord2137
ord5652
ord5595
ord1423
ord2227
ord2265
ord2269
ord2288
ord2297
ord2289
ord2078
ord4396
ord5802
ord4320
ord6524
ord451
ord4013
ord744
ord524
ord6794
ord4693
ord1087
ord2263
ord613
ord337
ord2592
ord2901
ord2551
ord937
ord2481
ord2081
ord1496
ord785
ord3661
ord3278
ord4663
ord1722
ord1786
ord2286
ord4268
ord2360
ord4398
ord376
ord6109
ord2909
ord3934
ord576
ord5622
ord4661
ord1430
ord5428
ord1433
ord4615
ord1720
ord1784
ord2284
ord779
ord4035
ord2571
ord1707
ord3953
ord6494
ord3689
ord2469
ord1934
ord791
ord3665
ord3160
ord4457
ord1766
ord4040
ord4252
ord782
ord277
ord280
ord6170
ord6171
ord1599
ord4044
ord6065
ord6579
ord636
ord2758
ord6063
ord6572
ord6060
ord6566
ord4579
ord6569
ord6372
ord6547
ord6183
ord6096
ord6101
ord5974
ord6040
ord5863
ord5850
ord6418
ord6174
ord3513
ord367
ord2597
ord6091
ord1353
ord1354
ord3486
ord2106
ord2537
ord1183
ord3543
ord6493
ord3685
ord797
ord3674
ord1603
ord6813
ord404
ord5535
ord663
ord3187
ord5770
ord1552
ord757
ord5893
ord2904
ord1144
ord6169
ord553
ord406
ord2490
ord2501
ord3018
ord665
ord4000
ord1938
ord374
ord3355
ord6411
ord1493
ord5664
ord3286
ord4681
ord595
ord1298
ord5632
ord4631
ord5167
ord5324
ord5008
ord2208
ord1810
ord1809
ord1675
ord3353
ord6408
ord1754
ord1751
ord4345
ord1492
ord4664
ord5602
ord2074
ord5512
ord6800
ord4603
ord5653
ord3743
ord5154
ord4702
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord969
ord967
ord971
ord2615
ord2635
ord2619
ord2625
ord2623
ord2621
ord2638
ord2633
ord2617
ord2640
ord2628
ord2610
ord2612
ord2630
ord2375
ord2368
ord1641
ord6802
ord4174
ord6804
ord3682
ord5404
ord6376
ord683
ord2069
ord1254
ord5601
ord4719
ord5825
ord1686
ord3082
ord3110
ord3830
ord3959
ord474
ord2451
ord2452
ord321
ord2449
ord1867
ord1866
ord1750
ord5762
ord1397
ord1387
ord2342
ord6310
ord6309
ord2359
ord4397
ord6603
ord6576
ord4542
ord6270
ord2900
ord4129
ord6578
ord4529
ord4526
ord2970
ord3739
ord6023
ord6450
ord3427
ord4293
ord6453
msvcr90
malloc
_CxxThrowException
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
memcmp
_memicmp
_ltow
_time64
_localtime64_s
srand
_stricmp
memmove_s
atol
strstr
_wtoi
_CIpow
_CIcos
_CIsin
_CItan
_CIsqrt
floor
_CIlog
ceil
_wtof
wcstoul
strtoul
wcstol
memcpy
__CxxFrameHandler3
memset
memcpy_s
rand
free
kernel32
GetProcessHeap
FindClose
FindFirstFileA
FindNextFileA
GetCommandLineW
lstrcmpiW
GlobalFree
lstrlenW
lstrlenA
GetTickCount
HeapFree
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemInfo
GetFileSize
SetFilePointer
ReadFile
VirtualQueryEx
ReadProcessMemory
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentProcess
WritePrivateProfileStringW
CreateDirectoryW
lstrcatW
GetCurrentProcessId
OpenProcess
SetProcessWorkingSetSize
GlobalLock
GlobalUnlock
CreateFileW
DeviceIoControl
lstrcpynW
CloseHandle
WinExec
GetSystemDefaultLangID
VirtualProtect
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
lstrcmpW
GetPrivateProfileStringW
GetModuleFileNameW
GetLastError
SetLastError
GetProcAddress
GetModuleHandleW
LoadLibraryW
UnmapViewOfFile
GetVersion
FileTimeToSystemTime
GetLocalTime
SystemTimeToFileTime
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
WideCharToMultiByte
MultiByteToWideChar
GlobalAlloc
GetPrivateProfileSectionW
InterlockedDecrement
GetCurrentThread
lstrcpyW
CreateThread
user32
wsprintfW
wsprintfA
InvalidateRect
SetMenuItemInfoW
FindWindowExW
GetClassNameW
GetActiveWindow
EnableWindow
CreatePopupMenu
InsertMenuItemW
AppendMenuW
GetMenuItemInfoW
GetWindowRect
GetMenuItemCount
TrackPopupMenu
GetCursorPos
DestroyMenu
GetSubMenu
GetClientRect
GetWindow
IsWindowVisible
SendMessageW
DrawEdge
GetDC
DrawFrameControl
SetRect
SetWindowLongW
SetLayeredWindowAttributes
RegisterHotKey
GetWindowLongW
ReleaseCapture
SendDlgItemMessageW
SetCapture
ReleaseDC
ClientToScreen
DrawIconEx
GetSysColor
GetSystemMetrics
IsMenu
LoadIconW
GetClassInfoW
PtInRect
LoadMenuW
KillTimer
GetDesktopWindow
ShowWindow
SetForegroundWindow
UpdateWindow
MessageBoxW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
PostMessageW
GetAsyncKeyState
IsWindow
AdjustWindowRectEx
SetTimer
IsIconic
CharLowerW
ScreenToClient
LoadBitmapW
wvsprintfW
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetParent
gdi32
Escape
ExtTextOutW
TextOutW
RectVisible
GetStockObject
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
PtVisible
Rectangle
GetTextExtentPoint32W
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegEnumValueW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyW
RegQueryInfoKeyW
shell32
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
ShellExecuteW
comctl32
ord17
shlwapi
StrStrIW
StrChrW
StrStrW
StrRChrW
StrCmpW
StrToIntExW
PathMatchSpecW
StrCmpIW
StrRStrIA
StrToIntW
StrFormatKBSizeW
GetMenuPosFromID
PathFindFileNameW
StrDupW
ws2_32
listen
WSACleanup
WSAStartup
ole32
CoInitialize
CoCreateInstance
OleRun
oleaut32
SysAllocString
SysStringByteLen
SysAllocStringByteLen
VariantClear
GetErrorInfo
VariantCopy
VariantInit
SysFreeString
wininet
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
CreateUrlCacheEntryW
DeleteUrlCacheEntryW
FindCloseUrlCache
CommitUrlCacheEntryW
iphlpapi
GetAdaptersInfo
winmm
timeKillEvent
timeSetEvent
psapi
GetProcessMemoryInfo
gdiplus
GdipAlloc
GdiplusStartup
GdipCreateFromHDC
GdipDrawImageI
Sections
.text Size: 194KB - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
mxqy.ini
-
mxqy_qa.ini
-
option.ini
-
sal.er
-
smg.er.rar
-
ʹ˵ؿ.txt
-
˵.html
-
ע̳.jpg.jpg
-
ֵ.url.url
-
ź˵.txt