Static task
static1
Behavioral task
behavioral1
Sample
CF和平绝地联盟原神辅助最稳.url
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
CF和平绝地联盟原神辅助最稳.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
minty1.38/Launcher.exe
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
minty1.38/Launcher.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
minty1.38/minty.dll
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
minty1.38/minty.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
更多免费优质资源双击进入.url
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
更多免费优质资源双击进入.url
Resource
win10v2004-20230915-en
General
-
Target
cefab65376abc9c144492aeb4e7e6a63672cf364f9377b448329891ea70688b2
-
Size
3.5MB
-
MD5
b3e11b88498ab9180ff4d1e6063f23b0
-
SHA1
09a4b81d1680432b7e56c7b94c4256b990d831de
-
SHA256
cefab65376abc9c144492aeb4e7e6a63672cf364f9377b448329891ea70688b2
-
SHA512
b1ffdf3668413a02357ff9a8e5ece558af10d311e875ce0c25f5921e4c0daf621f5a98da9052c43de89776694a2884a78e1b8a2c5cb8a5342477f4355afacccd
-
SSDEEP
98304:UK8CIKP6UU2xRrMfMfGjoCqL5ouIw2CTRHg+vM:UK8NHUUjfM5CC5ou8C1o
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/minty1.38/Launcher.exe unpack001/minty1.38/minty.dll
Files
-
cefab65376abc9c144492aeb4e7e6a63672cf364f9377b448329891ea70688b2.zip
-
CF和平绝地联盟原神辅助最稳.url.url
-
README.txt
-
minty1.38/Launcher.exe.exe windows:6 windows x64
f1330650339d6af4c032ca4827fd4f6d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
FreeLibrary
QueryPerformanceCounter
WriteProcessMemory
GetModuleHandleExW
GetModuleFileNameW
WaitForSingleObject
ResumeThread
GetExitCodeThread
GetLastError
CloseHandle
VirtualAllocEx
GetModuleHandleW
CreateRemoteThread
CreateProcessA
VirtualFreeEx
HeapSize
HeapReAlloc
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
CreateProcessW
GetExitCodeProcess
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
HeapFree
WideCharToMultiByte
MultiByteToWideChar
WriteConsoleW
IsDebuggerPresent
HeapAlloc
GetFileType
ReadConsoleW
GetConsoleMode
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
SetEndOfFile
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetFileInformationByHandleEx
LocalFree
FormatMessageA
GetLocaleInfoEx
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RtlUnwind
ReadFile
ExitProcess
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
SetFilePointerEx
comdlg32
GetOpenFileNameA
Sections
.text Size: 291KB - Virtual size: 290KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 118KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 314KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
minty1.38/minty.dll.dll windows:6 windows x64
7e8ab85d38ca9ddc32f9ba426542109f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
GetModuleHandleA
LockResource
LoadResource
GetModuleFileNameA
VirtualProtect
GetCurrentProcess
Sleep
CreateFileA
GetProcAddress
lstrcmpiW
GetCurrentThreadId
OpenThread
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
LoadLibraryExA
FormatMessageA
CreateThread
AllocConsole
QueueUserAPC
GetModuleHandleW
FreeResource
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualFree
SizeofResource
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
GetLocaleInfoEx
GetCurrentThread
GetTickCount64
MultiByteToWideChar
GetModuleFileNameW
lstrlenW
WaitNamedPipeW
GetCurrentProcessId
CloseHandle
GetLastError
CreateFileW
AreFileApisANSI
PeekNamedPipe
WriteFile
FindResourceA
ReadFile
SuspendThread
VirtualQuery
user32
CloseClipboard
EmptyClipboard
ReleaseCapture
OpenClipboard
GetCursorPos
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
EnumWindows
GetClassNameA
ScreenToClient
GetWindowThreadProcessId
RegisterClassExA
SetWindowLongPtrA
CreateWindowExA
DefWindowProcA
CallWindowProcA
FindWindowA
LoadCursorA
SetClipboardData
GetKeyState
GetClipboardData
GetMessageExtraInfo
SetCursorPos
advapi32
RegCreateKeyExW
RegSetValueExW
RegCloseKey
shell32
ShellExecuteA
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?uncaught_exceptions@std@@YAHXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?good@ios_base@std@@QEBA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_frequency
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
_Thrd_sleep
_Query_perf_counter
_Thrd_detach
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$codecvt@_SDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_SDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_SDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_S1AEAPEB_SPEAD3AEAPEAD@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?_Random_device@std@@YAIXZ
_Cnd_broadcast
_Mtx_unlock
_Xtime_get_ticks
_Cnd_do_broadcast_at_thread_exit
_Mtx_init_in_situ
_Mtx_lock
_Mtx_destroy_in_situ
_Cnd_timedwait
?_Throw_C_error@std@@YAXH@Z
?_Xbad_alloc@std@@YAXXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_init_in_situ
_Mtx_current_owns
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
msvcp140_codecvt_ids
?id@?$codecvt@_SDU_Mbstatet@@@std@@2V0locale@2@A
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
NtQuerySection
NtProtectVirtualMemory
RtlVirtualUnwind
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
__std_exception_copy
__C_specific_handler
__std_terminate
__intrinsic_setjmp
memmove
memcmp
__std_type_info_destroy_list
_CxxThrowException
__current_exception_context
__current_exception
memset
memcpy
strrchr
longjmp
strstr
strchr
memchr
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_seh_filter_dll
abort
_wassert
exit
_errno
system
_beginthreadex
_configure_narrow_argv
terminate
strerror
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
ftell
__stdio_common_vsprintf_s
fseek
feof
fread
fputc
tmpnam
__stdio_common_vswprintf
fflush
fgetc
fwrite
__stdio_common_vfprintf
__stdio_common_vsprintf
__acrt_iob_func
fgetpos
setvbuf
_ftelli64
_popen
tmpfile
ungetc
_pclose
clearerr
fgets
fsetpos
_fseeki64
fclose
getc
fopen
ferror
freopen
_get_stream_buffer_pointers
_wfopen
__stdio_common_vsscanf
api-ms-win-crt-heap-l1-1-0
realloc
malloc
free
_callnewh
api-ms-win-crt-time-l1-1-0
_gmtime64
strftime
_mktime64
clock
_difftime64
_time64
_localtime64
api-ms-win-crt-string-l1-1-0
isblank
isalnum
toupper
strcmp
isspace
strspn
isdigit
isxdigit
_strdup
strpbrk
strcoll
islower
ispunct
iscntrl
isalpha
strncmp
strncpy
isgraph
isupper
tolower
api-ms-win-crt-convert-l1-1-0
atof
strtod
strtoull
strtoul
strtoll
api-ms-win-crt-math-l1-1-0
sinf
sin
pow
logf
tan
log10
log
fmodf
fmod
_dsign
ldexp
_dclass
acos
acosf
asin
atan2
frexp
atan2f
ceil
ceilf
sqrtf
cos
sqrt
cosf
exp
floor
floorf
powf
api-ms-win-crt-filesystem-l1-1-0
remove
_lock_file
rename
_unlock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
setlocale
localeconv
api-ms-win-crt-utility-l1-1-0
qsort
srand
rand
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 963KB - Virtual size: 963KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 113KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 329KB - Virtual size: 329KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
更多免费优质资源双击进入.url.url