Static task
static1
Behavioral task
behavioral1
Sample
23-FlsEngine.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
23-FlsEngine.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral3
Sample
core/23-FlsEngine-Easy-Core.dll
Resource
win7-20230621-en
Behavioral task
behavioral4
Sample
core/23-FlsEngine-Easy-Core.dll
Resource
win10v2004-20230621-en
Behavioral task
behavioral5
Sample
必看使用说明.xls
Resource
win7-20230621-en
Behavioral task
behavioral6
Sample
必看使用说明.xls
Resource
win10v2004-20230621-en
General
-
Target
23FlsEngineEasy.zip
-
Size
18.8MB
-
MD5
85a34c445cf87ff5b55c7b1482836f40
-
SHA1
03e173c8e7c2dc3c93c6f3cbffe6b5ba42397c2c
-
SHA256
743e206f9c40a8cd2b453720dc9def574620bf3e98e0d2f32cf71d3d6a940570
-
SHA512
e2795f15ea5102c5a13171aa391ebab89094064e176b234b982a83742e66a430bcb54c5da2ec25e97e047e0bfd27674269f2ba428c48c47badcd61b82bec7a38
-
SSDEEP
393216:Uxma0p89D4gETJkGPzotWqcQcq/YGULoHOsdlxs/on60L8:+mar4VaOqRHOMww60Y
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/23-FlsEngine.exe unpack001/core/23-FlsEngine-Easy-Core.dll
Files
-
23FlsEngineEasy.zip.zip
-
23-FlsEngine.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.f23 Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.|BI Size: 7.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
core/23-FlsEngine-Easy-Core.dll.dll windows x64
545db75f75bd389fe97c0b11f3d6761a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlUnwindEx
d3dcompiler_47
D3DCompile
user32
CallWindowProcA
CharUpperBuffW
kernel32
GetCommandLineW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
imm32
ImmReleaseContext
Sections
.text Size: - Virtual size: 610KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.'.r Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.%|k Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.OPY Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
必看使用说明.doc.xls .doc windows office2003