Behavioral task
behavioral1
Sample
ӰOL˸/µַ.url
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ӰOL˸/µַ.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
ӰOL˸/ӰOL˸.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
ӰOL˸/ӰOL˸.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
ӰOL˸/°汾.bat
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
ӰOL˸/°汾.bat
Resource
win10v2004-20221111-en
General
-
Target
231c16c278c0d093715fb8c887ac0eff2ff25f10e482b83a7e1177f70c0fd982
-
Size
2.8MB
-
MD5
bbbb730d3f2e752de2870cd0e2914a9a
-
SHA1
ce85e846198c5352608db4ca807356971403a504
-
SHA256
231c16c278c0d093715fb8c887ac0eff2ff25f10e482b83a7e1177f70c0fd982
-
SHA512
63414f21869fa23724dde0d3baeec6afdb418e78fea363ae4a62bab6cafb552c36eea931fc600f046f25dc9d94b9fcb03f50d852eb93270dd0934d23ac6cd031
-
SSDEEP
49152:k7c3Ao+KoJ+FJBVd/zunypdNGTYScWPG4qSdAc2gzZFIfwHdVmNSghlosFGAvJ2Q:k7c3ArKg+FJBV5qnypc0r4BmizZKfa6v
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ӰOL˸/ӰOL˸.exe vmprotect
Files
-
231c16c278c0d093715fb8c887ac0eff2ff25f10e482b83a7e1177f70c0fd982.zip
-
ӰOL˸/ͼ.jpg.jpg
-
ӰOL˸/µַ.url.url
-
ӰOL˸/ӰOL˸.exe.exe windows x86
8b020290ec195417207dd2232109b7a6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersionExA
GetVersion
GetEnvironmentStrings
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharNextA
gdi32
GetViewportExtEx
winmm
midiStreamStop
winspool.drv
DocumentPropertiesA
comdlg32
GetSaveFileNameA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
CoRegisterMessageFilter
oleaut32
SafeArrayGetElement
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
recv
wininet
InternetTimeFromSystemTime
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 358KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
ӰOL˸/°汾.bat
-
ӰOL˸/ܰ.txt