Overview
overview
7Static
static
3使用说明.url
windows7-x64
1使用说明.url
windows10-2004-x64
1多任务�...rw.exe
windows7-x64
1多任务�...rw.exe
windows10-2004-x64
1多任务�...IE.exe
windows7-x64
1多任务�...IE.exe
windows10-2004-x64
1多任务�....0.lnk
windows7-x64
3多任务�....0.lnk
windows10-2004-x64
7软件E线下载.url
windows7-x64
1软件E线下载.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
使用说明.url
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
使用说明.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
多任务网页刷新器/Arw.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
多任务网页刷新器/Arw.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
多任务网页刷新器/ArwIE.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
多任务网页刷新器/ArwIE.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
多任务网页刷新器/多任务网页定时刷新器 V3.0.lnk
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
多任务网页刷新器/多任务网页定时刷新器 V3.0.lnk
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
软件E线下载.url
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
软件E线下载.url
Resource
win10v2004-20231215-en
General
-
Target
6bae044059ca735e6bf6a72f96f27e6e
-
Size
762KB
-
MD5
6bae044059ca735e6bf6a72f96f27e6e
-
SHA1
bc9ab270c4083d609904b7e3384e969a2e239345
-
SHA256
9b34e45f8fde40bb40670a05a23753bd6f7cfdf2a03df5d3e3ca2324573a02ec
-
SHA512
94d1ae7071cf8842ce49b003034fd50318d9b7bcc13de13cf90e2e75c6a8cf313c9ba4043276e95c943f0c82d4aeba2048b2f6cfecb5d4201b63162ad0839b7b
-
SSDEEP
12288:P6aMDfjCnqBJ9BT4YPcjiSwOXr5KYcSLHATakSOa2UysQFO6dla95L38RQ41F:FnqVBTvPGFL9vcSLHsa2Uys76ra99sRZ
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/多任务网页刷新器/Arw.exe unpack001/多任务网页刷新器/ArwIE.exe
Files
-
6bae044059ca735e6bf6a72f96f27e6e.rar
-
使用说明.url
-
多任务网页刷新器/Arw.bmp
-
多任务网页刷新器/Arw.dat
-
多任务网页刷新器/Arw.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 91KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
多任务网页刷新器/ArwIE.exe.exe .js windows:4 windows x86 arch:x86 polyglot
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 448KB - Virtual size: 448KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
多任务网页刷新器/Thumbs.db
-
多任务网页刷新器/多任务网页定时刷新器 V3.0.lnk.lnk
-
软件E线下载.url