酒鬼＊迷失＊100倍充值[0806][云[.]exe | Triage

Sharing

General

Target

酒鬼＊迷失＊100倍充值[0806][云.exe
Size

25.6MB
MD5

17bceb4da62f4de024b159ded6462d47
SHA1

ffbbaaadc0577f8e0d36e3e8ff49dc837a2f5ea9
SHA256

db9084b91819dcf7fc10ee6929abcd402dd141fcb64f3d612552c402e8426fa5
SHA512

4f95da15d1f547babefe20256e3a5bfd7c83609489e5d0114655fcd39954080dca739471fd8274243bca2013082db0f1c0d97f19dcf16f566996806f972b47f6
SSDEEP

393216:21n6+GPJKP3wBit1qPR/lzaxoZONzhJoi6YIhJgZNYlKMYNp6zKy:21nvkJKfwRPkoZShJS/JQNYHYPvy

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
aspackv2

Processes:

resource yara_rule

sample aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
酒鬼＊迷失＊100倍充值[0806][云.exe

Files

酒鬼＊迷失＊100倍充值[0806][云.exe
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 848KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 108KB - Virtual size: 376KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 23KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data0
Size: 8.6MB - Virtual size: 10.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data2
Size: 3.2MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 264KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE