Behavioral task
behavioral1
Sample
安全模式工具.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
安全模式工具.exe
Resource
win10v2004-20230220-en
General
-
Target
°²È«Ä£Ê½¹¤¾ß.rar
-
Size
61KB
-
MD5
9101c4260361bc2d35a8f1ceac9c581f
-
SHA1
bed2cd0b6a0b016976902642733f41dcdfb7b21f
-
SHA256
8ef64d57fc79fb933f0525460fd458987959c68f8695bcb9a7a89027ebe82c46
-
SHA512
42a6f49a9244e46aa3364a4e34bb9f18339399b9746c716884918b8d0106daedad1e901999e17389c0da68baaee9e7136989fc467d51dee5fd362bd57697923e
-
SSDEEP
1536:TrBgjiiIvSLjhua+MvlONKCftjIBcrkzTGCOKDQtIjpJhtmsxYY:5kPIIjhBvlOcCftjIBqzCOztMOsKY
Malware Config
Signatures
-
resource yara_rule static1/unpack001/安全模式工具.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/安全模式工具.exe
Files
-
°²È«Ä£Ê½¹¤¾ß.rar.rar
-
安全模式工具.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 360KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 45KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 300KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE