Behavioral task
behavioral1
Sample
维护大师安全中心规则生成器 v1.4.1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
维护大师安全中心规则生成器 v1.4.1.exe
Resource
win10v2004-20230221-en
General
-
Target
维护大师安全中心规则生成器 v1.4.1.exe
-
Size
529KB
-
MD5
3a8ec04b0f3fe6032254ecc962af6dcf
-
SHA1
8f0f407e4c7e765b4fa200126f1cfc0b35cec99a
-
SHA256
916932ba38049ae547c99531e29be6d98ec62fe239102bceffc98d1280ce1160
-
SHA512
6561eda6b9277267df4b831f51b7f3b2325a0d4969ed713384c1dc56d59e9d1bf27360b51e17342600cf8e6b74849b6ccc5e6e6f1fdcf90d633e856d71becdcd
-
SSDEEP
12288:V1gsAgbywLfMvdJ2Ehm8KBv6+EiNXC7ahsYzsPD0zpDQSooSd4:jrywYrJm8KdXw7WFzsPD0zdQS
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 维护大师安全中心规则生成器 v1.4.1.exe
Files
-
维护大师安全中心规则生成器 v1.4.1.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 896KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 441KB - Virtual size: 444KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 87KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE