Static task
static1
Behavioral task
behavioral1
Sample
@9490.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
@9490.exe
Resource
win10v2004-20230220-en
General
-
Target
方案9(1)(2).zip
-
Size
1.4MB
-
MD5
0259783e52f97d520ccf4c06b0fea0ba
-
SHA1
ae4826e713bb4dafccdb2a08474a1b44ebfca868
-
SHA256
91aef746072643241ec7122c1ea822a9875043bb4f74ac24d860d1d160660a15
-
SHA512
5bef592860c0bd28c0f82a09f4385183469e71bfc6b1fe567777f0f3bc29163e1865d62a34a1d135715aa7cec673bef29943a5dffdea8bf3815ebdb352fa7e4e
-
SSDEEP
24576:aQSvlPOS/X6wyhueVbvkYpeCpiaKiY1Sa+xFxHrIVjOFlAIzFFiADOn92DfM:rS3gu0fLY1r+nVrgaFlFzFFiADOcjM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/@9490.exe
Files
-
方案9(1)(2).zip.zip
-
@9490.exe.exe windows x64
63fff8a74b471ef75ea8d4c30481cbab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
oleaut32
VariantCopy
ole32
CoDisconnectObject
shell32
ShellExecuteA
advapi32
RegEnumKeyExA
winspool.drv
OpenPrinterA
gdi32
CopyMetaFileA
winmm
PlaySoundA
imm32
ImmGetContext
oleacc
CreateStdAccessibleObject
gdiplus
GdipSetInterpolationMode
urlmon
URLDownloadToFileA
uxtheme
GetThemeSysColor
shlwapi
PathFindFileNameA
msimg32
TransparentBlt
user32
GetMenuItemInfoA
kernel32
GetModuleFileNameW
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 500KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 575KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ