Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
新建文件夹/4354f07c674a42dca5f0b7683cee22396e5ce4f619c45b7e4d8440db5d8dcbe4.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
新建文件夹/4354f07c674a42dca5f0b7683cee22396e5ce4f619c45b7e4d8440db5d8dcbe4.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral3
Sample
新建文件夹/新建文件夹 (2)/BEIL.exe
Resource
win7-20230621-en
Behavioral task
behavioral4
Sample
新建文件夹/新建文件夹 (2)/BEIL.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral5
Sample
新建文件夹/新建文件夹/akwhxy.exe
Resource
win7-20230621-en
Behavioral task
behavioral6
Sample
新建文件夹/新建文件夹/akwhxy.exe
Resource
win10v2004-20230621-en
Target
新建文件夹.7z
Size
882KB
MD5
e06e026e959e78e29f78e5f09d811eb5
SHA1
1a0649289c56436297c9a4807441ab93a028b56e
SHA256
681f79129739b9c5d94a8a165363fd4de9f4843946d05c9fa68b427071c79a7d
SHA512
ff1879810ebae346c8fa802ac70cb7bf280ec4ab8470ffb16c53f8f8075ca3d60547a3bc829138f1aabe38c5a531fc2bcbf7aac2b223ac4190a21bdec7285796
SSDEEP
24576:28UlNbLUKDSe/CNXddc93dH50VQC3DwnSFhkjJ4bI:8pJ2e/mT8dH2dB3lk
resource | yara_rule |
---|---|
static1/unpack001/新建文件夹/新建文件夹/hodll.dll | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
unpack001/新建文件夹/4354f07c674a42dca5f0b7683cee22396e5ce4f619c45b7e4d8440db5d8dcbe4.exe |
unpack001/新建文件夹/新建文件夹 (2)/BEIL.exe |
unpack001/新建文件夹/新建文件夹/hodll.dll |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
SCardListReadersA
SCardFreeMemory
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
strstr
malloc
fopen
fclose
free
_setmbcp
_strupr
strrchr
sprintf
??3@YAXPAX@Z
__CxxFrameHandler
ord6052
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord641
ord2514
ord1200
ord1168
ord2621
ord1134
ord2725
ord5265
ord4376
ord4853
ord4998
ord4710
ord1576
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord324
ord4234
ord1146
ord4224
ord6215
ord800
ord4160
ord540
ord2863
ord1768
ord2864
ord2379
ord6453
WaitForSingleObject
GetStartupInfoA
lstrlenA
CreateThread
SetThreadPriority
ResumeThread
GetProcAddress
WaitForMultipleObjects
CreateMutexA
GetLastError
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA
Sleep
FreeLibrary
LoadLibraryA
AppendMenuA
SendMessageA
EnableWindow
LoadIconA
GetSystemMenu
GetDesktopWindow
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
ShellExecuteA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetConsoleOutputCP
WriteConsoleW
CreateFileA
ReadFile
GetLocaleInfoW
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetModuleHandleW
GlobalDeleteAtom
GlobalAlloc
lstrcmpW
GlobalLock
lstrcmpA
EnumResourceLanguagesW
GetVersion
ConvertDefaultLocale
SetThreadPriority
ResumeThread
SuspendThread
CreateEventW
GlobalAddAtomW
FreeResource
GlobalFree
GlobalUnlock
GlobalFindAtomW
MulDiv
LockFile
WriteConsoleA
GetFileSize
DuplicateHandle
FindFirstFileW
GetVolumeInformationW
GetFullPathNameW
CreateFileW
LocalFree
FormatMessageW
WritePrivateProfileStringW
GlobalFlags
LocalAlloc
GlobalReAlloc
GlobalHandle
LocalReAlloc
lstrlenA
GetFileAttributesW
GetFileTime
SetStdHandle
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
InterlockedExchange
InitializeCriticalSection
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetDateFormatA
GetTimeFormatA
HeapSize
FlushFileBuffers
SetFilePointer
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
CloseHandle
GetTimeZoneInformation
GetCurrentThread
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetModuleFileNameA
GetStdHandle
WriteFile
GetModuleHandleA
HeapCreate
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetVersionExA
ExitThread
VirtualQuery
GetCommandLineA
GetCurrentThreadId
GetSystemTimeAsFileTime
FindClose
FindNextFileA
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetFileAttributesA
RaiseException
RtlUnwind
HeapReAlloc
GetLastError
LoadResource
LockResource
SizeofResource
FindResourceW
SetEvent
ResetEvent
ExitProcess
CreateThread
CreateProcessW
WaitForSingleObject
GetShortPathNameW
CreateDirectoryW
Sleep
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
lstrlenW
GetThreadLocale
HeapFree
IsBadReadPtr
VirtualProtect
SetLastError
GetSystemInfo
GetProcessHeap
HeapAlloc
FreeLibrary
GetProcAddress
LoadLibraryA
VirtualFree
UnlockFile
VirtualAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
DestroyMenu
RegisterClipboardFormatW
PostThreadMessageW
GetSysColorBrush
ReleaseCapture
LoadCursorW
SetCapture
CharUpperW
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
SetFocus
GetWindowTextW
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
EqualRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
UnhookWindowsHookEx
ReleaseDC
GetDC
CopyRect
SetTimer
KillTimer
WaitMessage
GetWindow
SetWindowContextHelpId
MapDialogRect
SetWindowPos
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
CopyAcceleratorTableW
RemovePropW
CharNextW
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
MessageBoxW
SetCursor
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetParent
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
PostMessageW
PostQuitMessage
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
SendMessageW
GetWindowLongW
SetWindowLongW
EnableWindow
LoadIconW
UnregisterClassA
ExtSelectClipRgn
DeleteDC
TextOutW
GetStockObject
GetDeviceCaps
GetBkColor
GetTextColor
GetRgnBox
GetMapMode
RectVisible
PtVisible
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
CreateBitmap
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
GetObjectW
SetBkColor
SetTextColor
GetClipBox
CreateRectRgnIndirect
ExtTextOutW
GetFileTitleW
DocumentPropertiesW
OpenPrinterW
ClosePrinter
RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
PathFindFileNameW
PathStripToRootW
PathFindExtensionW
PathIsUNCW
OleUIBusyW
CoTaskMemFree
OleIsCurrentClipboard
CLSIDFromProgID
OleFlushClipboard
CoRegisterMessageFilter
CoTaskMemAlloc
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
CLSIDFromString
VariantCopy
SysAllocString
SafeArrayDestroy
SystemTimeToVariantTime
VariantTimeToSystemTime
OleCreateFontIndirect
SysStringLen
VariantInit
VariantChangeType
VariantClear
SysFreeString
SysAllocStringLen
ntohs
inet_ntoa
WSAStartup
WSACleanup
gethostbyname
closesocket
htonl
htons
inet_addr
accept
socket
select
bind
WSAGetLastError
WSASetLastError
connect
sendto
recvfrom
WSAAsyncSelect
send
recv
?KeyboardProc_EAL@@YGJHIJ@Z
AuxAddFirFoxRootCert
AuxCheckPINValid
AuxDebugTrace
AuxDebugTraceEx
AuxEnablePrivilege
AuxGetConfDword
AuxGetConfString
AuxGetIEProp
AuxGetTempCertDIR
AuxGetTempCertDIRForDaemon
AuxGetWatchSafeDllDIR
AuxIsCertInIEStore
AuxIsProcessRunning
AuxIsUsersPri
AuxIsWDCCID
AuxIsWDDev
AuxIsWDHID
AuxIsWDUDK
AuxIsWDUNICCID
AuxIsWin2K
AuxIsWin2K3
AuxIsWin7
AuxIsWin98
AuxIsWinVista
AuxIsWinXP
AuxKillProcess
AuxRegCACert
AuxRegDevMsg
AuxRegTrustSite
AuxRegUserCert
AuxSetConfFilePath
AuxSignFile
AuxStartApp
AuxStartKeyMutex
AuxStopKeyMutex
AuxSystemOSCheck
AuxTransSKBStyle
AuxUnRegUserCert
AuxVerifyFile
AuxWriteLog
AuxWriteLogHex
GUgd
KeyboardProc
PWD_ChangeUserPIN
PWD_CheckNewPIN
PWD_CheckNewPINRule
PWD_CheckNewPINStrength
PWD_ClearAllPINAndKey
PWD_ClearStoreAndKey
PWD_GetString
PWD_PreparePINOperation
PWD_SetCurPwdType
PWD_SetUserPIN
PWD_VerifyDefaultUserPIN
PWD_VerifyUserPIN
SKBCreate
SKBDestroy
SKBSetEncMode
SKBSetOutEditData
SKBSetOutEditWnd
SKBShow
installhook
installhook_EAL
unhook
�ʧ.<�5�<څvpoa�0���Fd��:.Z���e��`�錶<�*���=: `��Z�@�FNT;����x���OGE���6�FŁw�CH_E�R.�����1��4W�*����S������ {t�$9�e��x}@�gR��q4l.jq�2e�������Z*�ݎ�n���\ ,�_�t��3�����S©��D'Y�k�A���i�}�6�$Y����_�w9���Y�I~�N�3 �"�B���^a�y�}'S�%�Ԛa����GF�f�[T��N�j������,�����T"���1��t��F�dI{�r�V>�{�]����x ���M���'�BC���6u�<�ќ�����i��=!�[��a"��z{sA'���=p8�s'�Q^H���O��(W��Bw5���E��d?Wٓ���T�V�lw� mrˎ�=��hL�4>�GV��%{�C�?�~����p��=�!�����4� ��{Z��gTu[qI�7~�T��L�iy���4���e4��i��zXߕ��B;0��Lx���燽$dD�?���b�z�eU��a�[Z�U)f��z!w�c�^�}��)� L$��Ă�UOf�)\���E�3���:n'[�ne�-^��(��Mx ���%qʾ;+z~�+P�A�V���~a�y�]�����>�NJا�,���,�k�ܽ|Hb��@��ā����$�pG&����K������L���M�uY�]�+���0ONy��#�R����� ���[&B�3���M��L�� �M�3��M��m}����.�t����ؾ�L��xl�r�n���ñ�-�2$\�^��l���եa1��r�r�Q�����kPP�+�}��(�4�\����Čvd���7�`����r��4-�\�5�r��GF@��q� Z�r8�<�y`kƪ'54��*�m\��F�KᛲE"�'".��dv[�=�G���E��Mt�*�t@*�p�s��{���mAE��BC�Tc8������Ta:->,ejF��u�MJn*��)���(0J<�\�5C�o�:� ���sH2��pJ�&��C˷�X~��ܦz��e���C��ry �5Ɨ5�D+v���!v|��b����T:?�Z�͝��&Y�=;6ʅ��UM| Nla)f@ۣ���K�u�"�np�۵���ۤL��������!e[9�+����L�7W�s�9�pF�}�M�0h���n��Ӱ�����]u���{'��ʚ)v ��C�#��)�c��U�$X�9���ēb��4Y-�3�^i��V���DwinO�o��3+�1��4oW���>a���hU����I�e���^�S��+`����^j֘�oδ���n���=�W(�kߜj5�l��>�訧A\-U.1�k�2<7|�b���g �A�豉����@z|�������h�P��hTl���* ��E���Ȋ�2�r��{������.��������0rl��� 0�{���xּ�ѯT��7o��rz�p�d��<t�#V��k�_�o:t�&*鑠\��Y�a�X��c��<�~8A7�3{?�_�(���慲7z���qtn�����PfC��0ק����^�L6����m�N-����zp]�bW�T')jH��2T��v���釤�&�K:����j��q��l�L��l���U0+��@f������E�Ŀ,��&$_2mv��v�vfe�=o�{����ӻ٪s:�z�ZQT��C %�\�%�-����ߟ=mǜ?���)��_�@@vცۑU���'�C�4 �m%kB^H~��m�k���+�����&B>�<Nȍ ~u���X�ij\����p�+��(^]*��La#�Y�2�Jf\�:/no�} ��Zn$�ea5�J1�CH���!p��Y��^8ڕ_��w��eN#V�#U��5��7�۳�8�۹+Z](�d1���%Ϛh��# ��0�?�V��� �Rn����6���W��9�����|5HA�ޠ��䣫��.p��i� Xk�`;xO��~�9xIڍ��6�zp������֙�� ���p�X�r�]-<��c����۟H:¢���b*DC�_�4<���ڨ��kB���5�.ǘ�X}�"��˒��L�&g<d��q "��k��v&{T��,��Ų_jX��L��f��ij��[L"��T�8�;�ȲY�,'p\�)0�S,2�~2������,3<y��8��>����m�my�I���Դslٚ���F����ٖ[�)�\�_ԫ�����)�j��y�`5�:��s�g�f���O��Tt���9�#���[�D�y��͟�1�p�%c)�+�0��]��MZ`�.�?���)�V�+���]C��[4��.�c���u\�J�h����Y�&2PX�)�0��5����0��Ú�R��_���,������\;��.�et���08쀏�EL�/6`2�i� j��)�EQz�6s�A�;3,�1�Yv[ �c�$���HU��_��̵�\NLPٲkK Q�|�Q�±I��1.��\4~�.���6"dݥ����MH�B���qIo�P\6���>��U�P�(��������3(�B'�����##�h5��kO�z�+��t-TM���<�[�����������2� �Ħ�W��7�������Z�Ջ��Ͽ:a�E�D��.��D����sF�t۵/PaR�s1N���Z�B�j�QN�Z'yl��I�x8�\�� ���QV��5 ##�V��1 I��*�>w |�a[E|�C�'^��%��ߠ�����G�3���jsVn ���`|D�#�{K��j�YA-��}�̾C��3i�"d��%B�Ɯ�tXr5�z�m1�����8JkƵa+�%����v�L*G��=9t�عOirK���.����ic�M�N�`�¼��h5��%�;>�k��R��5L'Q ��"�a�酿8�ݣ~�����x�[&a�g��_������PL�O`+�������w�v��]Pc��L�X�K�?�1�F�x�`��ֹ� n�,|�#�f�fc�������l�G6s���5��\�)�!��,�a�,>�oh��{�G
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ