Behavioral task
behavioral1
Sample
记住还原窗口位置大小.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
记住还原窗口位置大小.exe
Resource
win10v2004-20231020-en
General
-
Target
17295c6f901db984bb42433701c60b93e4bf33eef2be3a86a7ef3b1ebb75bb82
-
Size
374KB
-
MD5
b0dfe19a52e39064887bf29603972587
-
SHA1
98375c322f74c95ef027b48a14ef1f46beed281a
-
SHA256
17295c6f901db984bb42433701c60b93e4bf33eef2be3a86a7ef3b1ebb75bb82
-
SHA512
5426d56b026a681aa1e8f30e10b7acdca25dab0ea19eff260288b221899e413a42525faf7743aa736c7bd375f55bcd6a95011a735913570772727f637ea841ad
-
SSDEEP
6144:5HsIFXatPa/Q2wz9dr+nNyulDISkvdvK0e1UzQtRVRB0Wc/Td0+w+5LqPH5PMsAM:h1ati/9wzHr+nNvtkw6mPRB05d071NUM
Malware Config
Signatures
-
resource yara_rule static1/unpack001/记住还原窗口位置大小.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/记住还原窗口位置大小.exe unpack002/out.upx
Files
-
17295c6f901db984bb42433701c60b93e4bf33eef2be3a86a7ef3b1ebb75bb82.rar
-
窗口位置大小.txt
-
记住还原窗口位置大小.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 856KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 372KB - Virtual size: 376KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 41KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 708KB - Virtual size: 704KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 96KB - Virtual size: 345KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ