Overview

overview

7

Static

static

7

Help.exe

windows7-x64

1

Help.exe

windows10-2004-x64

1

Newtonsoft.Json.dll

windows7-x64

1

Newtonsoft.Json.dll

windows10-2004-x64

1

图片清�...��.exe

windows7-x64

1

图片清�...��.exe

windows10-2004-x64

1

天才小�...PG.exe

windows7-x64

7

天才小�...PG.exe

windows10-2004-x64

7

天才小�...�.docx

windows7-x64

4

天才小�...�.docx

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    e64557666fb26324e0500daa0ca0a944a8fd3023bf290c9abfe9f12c7c5ac640

  • Size

    1.6MB

  • MD5

    8e06c467e3d8e3a29231b3dd7b4ff3b2

  • SHA1

    3a6929667d105eee8cb5887a47410d4acdb6d354

  • SHA256

    e64557666fb26324e0500daa0ca0a944a8fd3023bf290c9abfe9f12c7c5ac640

  • SHA512

    8a43d56bf61e7ba2ca133815d29f90883d4e27e785db1513fff6343f57d6f4e4c7a6f4de2e163ac5fd6116d7c9cc695f9459bcf366c83ef634c1d5aef4d1beaa

  • SSDEEP

    24576:dxXqeAuVpgr+lr29UEWDJ/piodlJ3h3j0gsvTGnOkwtNcXGTlQY586ys3xZ1i5H8:dxaVuMrhURhcUz9fsLJf+e/86ynRyyA

Score
7/10

Malware Config

Signatures

  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • e64557666fb26324e0500daa0ca0a944a8fd3023bf290c9abfe9f12c7c5ac640
    .zip
  • 0 天才小网管推荐的神奇软件.txt
  • 0 软件使用说明.txt
  • Help.exe
    .exe windows:4 windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Newtonsoft.Json.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • 图片清理工具.exe
    .exe windows:4 windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 天才小网管微信DAT转JPG.exe
    .exe windows:4 windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 天才小网管微信DAT转JPG使用说明.docx
    .docx office2007