��u���;JH�n�����ǏoG���E���Yr����H6`�f�'�T��Ap2���ۅ�� 7D�EX[�j���SR���|���P[�3 !0 0l��Sj��Cʆ��/����걢��u5Hd�ڃ���:OR������S�Nƻ� �,�Y�oIC>�� kh������N��ˡ�� ��+dD�?�.x���t0epW>XM촊�HG������=���;� ���c� w���������1�ϋ����Zc���nU�*�o�XV���B�`l����#�Ў��ѫ���uN7�SV��%�I@�ىn��G�#�LF�@�#�UN:[�Tm��QO|� ���Ú�dI�g�7I�0'8+4=, �}{*�k'��}���ʴ��VV{�u �;��b����J���%��u�Pym~����fQI�r�+���/ռ'd�S0C<���oT%y�vc�T�Q� �����GS�и`���;����0��Q�=B�h�e�$gڹ+,�!�.CR�84���g���&��D��Y�߰��H3���{;���O���Ͽ�mqN���ᑯR,1�����s��Wg��q>��s;��M?�5o�F�Ƅ_S��6�L��+�6��ਏ������ S��'&��B�E�i4C�qR�K�օ(���u�W P5j�� 9N�h��A��Gn��i����7�Y���x�x�A��Ò�-� �����x[>����(\�'��QCg'�.8k�W h!��+B��<�����.����57��'r�."i�kW�١���<m<4���~�T�� u6O1�ؑ2b�>���P�ˣ͘�k���W��i�����E��!��lh��W��!P�a!�FWk��W*�f���b�����ø9^XW3����5���UпY]� S�؋�#���߮Ԇ-ü��M恃&���h��8ӥA?K����wz��*��54; �H�� q-1����AӴ&S��e�|W�%����9��m�g'O��L;I�q�ηx��k�@8k��tA�7��+�;�x���樓OU_m�����M!�Z���K *����`�{� xe����+��^���]����z��<}e���hov�/�[�^x�%t*�N��,�ȑ�u�� vG�]0�,ٕ�u��sX'��bN�u�lV���ظ����T�0~�KGemV�gO���O� '��Z�]x'çI�Y�C�}ܭ�x�V@pi$��T�;5r��j�P`����XQ�����5�6�N���Т��|����KZ��>N���B]�-`����� �}��Iܤ�rA����N�t�|������ �" ��<�&�hA�SEDV�k��|�?@��RC�2��:!�e����_0����[�z����-���!�$��ܕR���uk�k�ZX��(�u�\�L �'J��l�F�4�� N���4���I�*`��S5�e��hnL`���"D�A�)�ڬd��!�K�����XV�B�\���U��|V��'Cw�_�l!IZ-���a���[H�.�+���e;J���@�A7�k���qRa���k$p�pDE�{����GJo�Jr'kv3���>�� /d�����åuy�fֱ���bV���B=�s�� I�B3�Dh�#�>��{�C��7� �NR0���%�/!NwCq��âM�����Dz��@��%�CN��; s�t������)�Al6�qJ�������� �X�ḛ��Gk_�͍0t��bf�?$��.��Sa��[7>-�M���<_n��A.����.Ξ��6�����agJ���W����e��I3��h�@�/�Sh��M�u���o% c��0�<�_1�Na�[\�˟�HJ-^�W�|�;��;<�>�@�����'8��j���Y/p����};��3�����> ��]ށ��(��|�o����f��!΄�7�������}��W��Q��L��O�t� ��8�V���-��JE(p�QJ�$)@��e�%!UWl�Ǽ�_Ob�I��Cc¡��L��:��N�!�[L��H���ʍ��D�<�%��h�+I�C�/�r�4��Ë���@�J`8N]���`K�mE��Q���rԩ�w�b�v��E}|�HFԨ2)'Q��� �*f�}B����҆��hy̥w�� 2��CR�]�yS�Ls����Ԓ�<� j��)84@4����2KQ=�#��ש!� |k';�ӛ��v۔'`)�g�V�[ݒB����=g���S��?|��fr����{n�ad�(1j��ِ�'����}� �%/z��B�Ʊ��1�ۓ��[?��(���X�h?v�婽˴���-Js�� t*.�괕C�x���x�}�Wş-I��Jܗ�hc�����=Ǭ+� ��C�!�Ezz��O�W�1�yz@�Ϲ"�����^l�dFM]��,�8s}S A�Ű���b���#��V��?��b��@��ة��� ��!W�n�8x�s�O�����'Fdra���O \muJz�<K��Q8Gxq�q�=ڕHIDܝ�*�v��H�7����{m�%|�r0���G��эT ���)I�`VS�hM�Z!?�-�O��I �#�����7Ff�������nm���4۸h����8���1,���"�?��{�ɚQu{py�����/y<8k�j �D��؊R��}���*�o���S�lSeD��� �dN9J����!�X���E�n�.�����~�܅Z*��c����"���2I�*���>Ų�6��gb��#����d'�]�ED�w��;�aJ�%m� ��1r���~�*�Q��g� ��Q�a�o��.�JaRz�=M�m�:ٙom�m�3܃q���Ѹ���i^>F��&�lٔ��fր�(�魿|g�-萍���y�Apl������6�c��+�P��R�N�*U���e ��#z�W81�ݹ�TR�O.j/p\nͤ$��ѲP*����˄�b��G7�/�-�%g�{Z���9 �*��_�����b2����0�8����JX����_���:�5�#�L�U���5'�f����K�����U��F���o��j��Ba`����W_�;~{�^r��'(��.N���f-q
Static task
static1
Behavioral task
behavioral1
Sample
淘淘淘宝论坛抢沙发软件/淘淘淘宝论坛沙发机.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
淘淘淘宝论坛抢沙发软件/淘淘淘宝论坛沙发机.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
淘淘淘宝论坛抢沙发软件/软件使用教程.doc
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
淘淘淘宝论坛抢沙发软件/软件使用教程.doc
Resource
win10v2004-20220901-en
General
-
Target
64bccd69f3c8c37f199da2cf627fd4e98353c8d58cf54d1670014da5d2ab4032
-
Size
1.8MB
-
MD5
8d5e27b5aa2712b8a4b59d8a6f68b685
-
SHA1
9d93b34acb7d1eef46a547208fd14902231984fa
-
SHA256
64bccd69f3c8c37f199da2cf627fd4e98353c8d58cf54d1670014da5d2ab4032
-
SHA512
3200e826ab590d681976b0c0c209e62b11da1d98169035de3d0c415a73b71cbbec7463c99134c110525fe1780570598bab20e8c3e74096c7277909f1c4346c04
-
SSDEEP
49152:lkEQ2RXMQ7ezKrG8u5vc7iGepN9QiksIhJoRePk7YFG:lPFV7UssGebWHToYPWYk
Malware Config
Signatures
Files
-
64bccd69f3c8c37f199da2cf627fd4e98353c8d58cf54d1670014da5d2ab4032.rar
-
淘淘淘宝论坛抢沙发软件/下载说明.txt
-
淘淘淘宝论坛抢沙发软件/回帖.ini
-
淘淘淘宝论坛抢沙发软件/淘淘淘宝论坛沙发机.exe.exe windows x86
99049d0457259eb7aa646480f6305ca6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
waveOutPrepareHeader
ws2_32
accept
kernel32
FileTimeToSystemTime
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MapWindowPoints
gdi32
GetPixel
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CreateILockBytesOnHGlobal
oleaut32
RegisterTypeLi
comctl32
ImageList_AddMasked
oledlg
ord8
wininet
InternetOpenA
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 359KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx0 Size: - Virtual size: 455KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
淘淘淘宝论坛抢沙发软件/版块.ini
-
淘淘淘宝论坛抢沙发软件/软件使用教程.doc.doc windows office2003