Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
[sus]MicrosoftOffice.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
[sus]MicrosoftOffice.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
mal.exe
Resource
win7-20231025-en
Behavioral task
behavioral4
Sample
mal.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
淘宝采集下单VV28.exe
Resource
win7-20231023-en
Behavioral task
behavioral6
Sample
淘宝采集下单VV28.exe
Resource
win10v2004-20231023-en
Target
12X.rar
Size
23.1MB
MD5
d883906ad103ded4eab29bece4111c64
SHA1
d228d0709c536cc8dabab7cf5d6e01cb9d0bca82
SHA256
e9ece01a6eca9300135fb86e026d112f3a225ab7f7dc7ee3b84db5a7a09c6255
SHA512
aaeb82e3e1b2f7f79b0fc13440f496b3818f0f31acc3a2f693917fed0bc04cdf6898ce21927c9a4f6c06652b48d3efb08fe36b1497546581ace4afbc3fa54562
SSDEEP
393216:GtYt+BV9pUEGE8ginrE3uLygYL8G9cKK5R54BSMt0eN5J5xqlic1ejtoaAOg8TU3:GtYYwW8giI+eF9qR5US2J5xVcAt6cUv/
Checks for missing Authenticode signature.
Processes:
resource |
---|
unpack001/[sus]MicrosoftOffice.exe.vir |
unpack001/淘宝采集下单VV28.exe.vir |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SuspendThread
Sleep
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
midiOutPrepareHeader
ioctlsocket
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetMenuCheckMarkDimensions
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
LineTo
GradientFill
ClosePrinter
RegQueryValueExA
Shell_NotifyIconA
OleRun
UnRegisterTypeLi
ImageList_Draw
ord29
ChooseColorA
WTSSendMessageW
���������8RO�����cJ�$���B�$������9C�w8/��h�L�:�?���w����O�G} ��&c��V��!e�aA�-��e�G\�(+*:�d�=#y��XgI-�z���'�4U�g�qbx��b�oS�$FP t��ATt1��i�� ���ܱBlR�lD^$������Ēy��Ə�nk<��))AH̝2ĺ�Q8��$��t�0��g �~��tA�q��V��fx�@A�^D���ڿ[���N�����Jt+�&�Y)�,�Bn�*�%� ������]�$�Jj���jMMܲW��t��}q��n��_���ub��Ϳ-)���Yʎ����U�����f!`�{3#�8�HM���"x�����dv��q�m!9�@�� ��� T��j$�bO��pc^���Jvl�����%�f�[�g���""װ�A[���e���>g�2�AG�����a�@�L���k�����c�Ȱ�ާ>b�"�^A3?J��~��%�X��v��������r�|�\3JD� J�u��DvEx0�ڀkm��f���L�0=%[$��H���^s ��s�Y6Z�8v�c���>.:�3G �� ��7�h�i�>����{������:�U���~�w}B"���Zc�D�鑅��l�vE9���;�?�pP����m�B�i���*[��ݳ>��<�:�4w��J��ÕB�Ln� ��}])1�mZ�]ȋ�����qQ���3��ME�F����3�Z���ەh���S���;wS�-�x��� ��Ua�E��1��|�Ŷ���Y>Y06�+���;t�����ޑHҦ����r���ؤ��Lg���l_1���=- ������+ڛ@W� �m����6��M���1>&�]�h`�;]�(�K�4ܙ̗����r2����Q^E=�X���B���O��t4{`eXU��ФP:�&���]6n����;���ݰ@n4~m�ԣ�.v�99pz��b�[�i 9�g~'��2�����8Md���(�U�0�z 6��y�*��dA��<7O6�"���m�E�a��a�.Wh���䆸bb�=�Rqa0�]eP�Z�.e� �t���n���+������iI��m�eo�p��_͕��ڒ087�� #��Ps� +RTJ�!�ݿ6�<�V&���]�#����ľAd��LG�M�gsxs�6]�Z1^E_t�E��0L�ѩ�_fD�c5K -��t��9�G(}���'���j ���G�pO���b)��b�bi�4���?���F�Y� n���(�D�y���� }��k{ٺ��3HhG�|�����<���{# �ta[,G5�bk�e�l�)��a�Ԑ��!�ٖ����r.[�����Y{O�g0_S�㋡�G��<�%��*u�N�m�N\�����@� s=n�#{�|�]���b���S�lY0t��s]�CO;&������w^ ����S���'>~���]��EW鰞��Y "�ݲ�D��\��t�+��>9�V�n��g�>����A�y#�*i:m",���I��X���CXcPj��;�Sԋ_��4^�<w�6���yuBq��wP� S�tsSvy9���EE��3KQ���LA�8�dܻN!{���B�y�7�` �����OR^���.�:��RT&�����#�*�ńnư?��T�NY�:������G��6M=wb��z�Q>'��l�s<�-F4V*5��xO�V6_k���C9G�2�H|!�b֝E�o�ռ���|��]�#����V��7+�I���\���*2n�&{*��g��*������1�$�p�#���Q@�� ];�o� �W��zM)�^gF14J2�����-��p�qT�>�{�.xU3���;d��n:���b�BX��mۇ��~Q��bV��1�����~����*i(�����̌6����t��h���əW�Nj"�T�e-�d~�����������y� $���Ms5����k��� ���M�Xiiި纪��9�NDŽ��S�u������DR�k0�Z��1'�7h�4��}�@���������(��'�င�i��κ������~M�����}���M�W P�b�D6�S��t�F�ٷ"��Q�;��r�������f3�2���,��ԇ7:�IP��a3Ӽ�eWA}29 *�IB�qH�)Ǿ���[Ly�z�W�.�nJ}�Š��&�ބ����q7#��Y�>X{���Q?��Z8Iڲ�X���s,����"c��pR{ہ�:?O P�z�*���N>����fUZ���Ӯ��.�����E����v������B!Pk>F,����&C"kv�0/.p��ڣ��!hS���1Z�=��� �Fc����vGi�="�K��M:����_f�ݘ(�? ��V�О��ޗE�ٯ������o.�1ۑ��Ko>����&��Xg�Ç3� &���~�ώCK�� ��W��^�:`++ W��[��!���y�|�3/���^-�l�h���C%�;\�2H'5#zdc�;S�l� �8.��9N�T �*�!C��X�[ܺ8��9�S���"���l"2{�T1[?��t����Mp�ۈ�S�2�i���@��HK�;4��a+�={ $�Q�����¨���Ֆt0��P��k��15[���'�\_h�1L��`)�d�Uq�<Ƕ�nC� �3��u?<�v�џ���UI?���e ��pB<�$=�S��н��s.~H����$G����A�դz |��ˬ���m�����ҋ2�Ӝ1�a���-'�A���U�&\ �{m�E��"�nNb\'�Cp�f�K5�M���^�������nj\ ,V9Og���˕�����w��d*g�s�E�s�Y*,ˮww�M?_mf�`���--!DÊ����Z��y� NM/ā���꺶� �\5� ��^�K�,I���p�Ԣ��@;f+g?�����7`�bV���m���D�T.j��$�5]��k�nBȘ{����$���I�����z���
e2ee_CacheClear
e2ee_CacheDecr
e2ee_CacheDelete
e2ee_CacheExists
e2ee_CacheGet
e2ee_CacheGetMulti
e2ee_CacheGetMultiText
e2ee_CacheGetText
e2ee_CacheIncr
e2ee_CacheSet
e2ee_CacheSetExpire
e2ee_CacheSetText
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ