Static task
static1
Behavioral task
behavioral1
Sample
Microsoft Toolkit.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Microsoft Toolkit.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
下载之家.url
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
下载之家.url
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
下载之家下载说明.html
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
下载之家下载说明.html
Resource
win10v2004-20231023-en
General
-
Target
8f1075f5eb65f165a1f158d62b162eb620d349c78a7a27f333ada1f6b364a4f4.zip.zip
-
Size
53.7MB
-
MD5
847cb10a653887afa3ed1cfb34eeca05
-
SHA1
53de13fbba1b1609b31960798e0e023adffe619c
-
SHA256
4da8b89ce3843890697b8d240a62b0b64e9274e5b93703b1f6ab1d6b32609baa
-
SHA512
ffb0e88e18c1634c50e031d23f9957bad7dd2a03afaf39df03c9dae625a4bdeadac2bdb0f00222b2fd3463403afc4f7ad001a80860d88406988384f6eeb189c8
-
SSDEEP
1572864:CVSvFzqCWUr1bi5W4AXColchekgTFwQ/f:CVSzNWUr1cTAXjKgxwsf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Microsoft Toolkit.exe
Files
-
8f1075f5eb65f165a1f158d62b162eb620d349c78a7a27f333ada1f6b364a4f4.zip.zip.zip
Password: infected
-
8f1075f5eb65f165a1f158d62b162eb620d349c78a7a27f333ada1f6b364a4f4.zip.zip
-
Microsoft Toolkit.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 54.2MB - Virtual size: 54.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 366KB - Virtual size: 365KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
下载之家.url
-
下载之家下载说明.html
-
使用说明.txt