`gY>�XG��M���wT�Pv���X�{�bF���nI̜�\%���[�C{�lt�G�M�լk���l?V7�V���8��m�y���>��6��Q)э!!��u`{�4ܰ�(p��Դ��o����k|#�,+��b$��������\�9%�ѥhq���;s�}tfg�B߂���0F�o-o�h%|�1��߁�~�\�!��o���F/� '98.�?4*��L��X�Ѐd���vQ��CLa�X:�_��F�Q���k����J���oG���u� ۓ�8/f����ev��u�I�I/��a�Ox��@�!o�4qр����f`d;���$^���� �|4H�)�7�:������� ]���1�k��=��w{e�D�X����ޢ����_Սr ~����o��Q�1Y:I1���r�x��+�2S,l���EҀ����L�t��/�& #�ׂ%P�ƟR�e���$�0�����/��s�rj�A�{f��Z��t��ލ��}�E*dž��L5Z���� �j�2�Wd�i��lB{�?���q��q\��WA�AM ~�88�/�de~��1��KJ~�����0�\1I�5�PlS�hZ<�d@�9�����9�bF�N��?�f�/�o]��+(%�j����������k�=)24�֤����P����g�Aequ�8�r:I>�!���<GJ����b�@��L[�غÔ��{xn��C�� #i�)���m����m9�J$�2.N��vRxځr�iTW}�d��� �t,0)��Zs9)��O�9�o�)�jЌ��b��*�������I�1�9Kxu�aӚkOmY �{�a�H��L�B����i�h��`H���G�=rYX��l����hO��s}v�ꄠia44�т�����6ֆ��Ӹ�Bk�E��݀'��q�\[������B��.��`?�/��KV����i�y����0�GhF�W�� IAl�~��+.w�ta�g%QIZ�wƟR��=���4�lV_%<��*m|�ъ���e%ä{'���N<�`~rT,�D�=��#��Z��m)ũŋ^�t.�d��[=�1���ӹm�<�"Ì��(K"�tcm�_��q��G5:e�{z8��O�HZ?"��v�{�V�IZf�KR� �q�j���}�!�c��-[`��_�ۀ��$��UG�/"��ù�|��ŧLN�����c3�f��!B��_6�07�_�Eό��h�S��z�`m{�gɭCS3����l9�'������D�כi2��Lhw<��5;��2��.� r�#�0��{��;�Lܫe�哯F�!}l=@����� K�3]f��������Y?�!��C}��r����>����P1����a�߬X���,������ˑ��SZZ`���� 6��6+�UY��o���[��\l��Z��Y�s��*w����.�����/mw� ���l��Pxe����a��e���r��q�?�h!�#�y�cu�r��ёr:j���ABY����A���m�ʎ�nP��xm�/�M�f�B�c�ڝq�L�"�4�1T˨��y{�7�#ba���}S�]������i3��A=��d�P�{�CZ:���*C҂YYe*� :q�jt� I����"�~F��N��q���>,NW _�fߓ�q�#����_���o��)a}{֧.�ye`�6�L�^*Y�vic�H�#��E����Q^�-�YKڶ�k���%���\��Q��ͧ�h1�^b��(!�c����}�vy䬸)�U�-{;_Wڈ�>���թ�@["��U���D�T�M���������R�G��_t�L"&�y��"�S��pȖl ��G�j��B�7���o\l��g9 �,m��8a!� ����^w��u������v��p*'��"����)?�o�]��+��6o�.� @�a\��˻If��P������EH�V�,U��[�� �e]�F9ZWj��Ak���J��zJ��k����!O��63)�/N�^���G�SB��jխ�ә@�� �E ����-��a����;�H�tB���{4���x-���� )�`�CՊ0���O�t�c�k<B����/��#Z�Rqo{L�}Q�0�Qsvk�������w�(���x�~��>����z�$@�H����⏑��p�.��|�I8k���>���͔�����I��~��LF$���������_?X��%ϣ�&3�!�gؽ�M�_�}�s���������v���'�5�O�AK����N�CU ��O �����gOs��*�M��+y������ 9�D�]6,!p����f��A���*Lz���}A3UD� ^�b�#@�^� �UA @��䭾�F�q��}��v�-�;�Y�v!�u_�_Ut��Ė\~$��2�$\�����`*Y��<Ԡ�> @�*g�?�FD4<2*���%�b,ޗ��= ���x��E���=�Z����P�-Gk�����ww2���\@�/��5�x7<�;w�9�p�go��n����D�Uqv�a��M���_.lﲻOL0�$��9%|���}I��Jg�Zk�Џ����P��VPG�,I�l#��ޅ��k1�.�4?y z]�\N%|w�_s��ȻZ ��l��J���kN��B�l��\�m����RA�0��y�q���<Ծ2�dqlr�_(��P!��:"�XMM�/�P���K��Z��;ܔ|#���ΰ��7?C5� �����%y����f�V[��=�缊��o|pm6@�� �ҽ{ܛ]��� 3O߫�磊1�;�%?㮥�|���4��{ ����m� �ph�<>����L%C�WH�ݽP�E�=�<w� Y��'�б�p/�}�Xlez������B#�@�S�+DNt2���Q�tVD��� "������~L!I�[�H�n�F���R���B�'�<�9�E�|Y.^w2#,�L;��w�K5���w@ʐ�Ȧ3��P,��ߣ�:@[X�]Q��]}*�1�{�"�j�(�gig���\�n^d����@����9B�˞����t4���oF�
Static task
static1
General
-
Target
AI启动器.exe
-
Size
7.0MB
-
MD5
81bef01570a33087918e7214c87fc53b
-
SHA1
c20279a61f19537fc2b188a4e7be9fd886167c26
-
SHA256
0600c130aad1f4f12d82d13f6c47556c5ee998d8f2363e656620964555d528d2
-
SHA512
82717c03fbb7ea245b70175fba291b29d0bd9d77f0c5025d8fe4772ea64870057405f075e9c5a21ab21095d18789ffe7dbe33804f650660444d370dbf5b37b7d
-
SSDEEP
196608:ReLtgnXby9HBq0KHs6euHan4i1opkIfSdMiugexHYC:RLy9Q0K9ep5KpkJMiug
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AI启动器.exe
Files
-
AI启动器.exe.exe windows x86
9f35e965f6effd939584bb73fc92ab6c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wtsapi32
WTSSendMessageW
kernel32
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 630KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 283KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
AI0 Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
RuanShao Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
AI1 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
AI2 Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ