\��T��zg�z&�)oFW4'�m̂�f��{��]�h̏7�i��R^6�9�N��L<�\~'6���,*�[��L����w胥@)�5k�zzXd�M>�=�p���kQs3+��}�M+�� ���Jlj1�l6-K\��*�D���Wx�]����|c-�&�^R��vʟ{^�# Jv��+#'�Ei�s�57���o]��z�h*|8k�ð҂�l5�Z���@K�F�%Ś��(��ˈ_���O�����h��Q���o�� ���:���iW�n\������Dդ��7�Q2i�͗��܈���Y!��l�G�*�A\� yu�s��O�@G�r�����Ǣ���`C�p����[���iBڣ���$�kT�S>ING-!,����!���&��FO���{�N�0!+X:�\�vo}���h ʢ>�L����)`�bvFFQ�0�-��UC�̗������X#3;C�.WCQ-e��`��'��wp&¤�B�GV s��l+�m�A�qIJ}�g_��!�;}m��@n�^J����$����g:�Tj=Q���d���t���v*1Q��,zA2�$�P mW��Ї�%��C%�W`^����i��&��_�{űttl�����ډ������Oqf�ʼ���Q6���e}Ǖx�C����Y判�փ��x��v$ˋ�^�xy6�e� L�D�(v;�j��Z�ȴ5�gC��\uY�\s֏a�)ס/�Vl���DaW�O}!�ݙjMo��a�������_���%6 Hڟ�?L�����*��E�������Ig�w�3������pO��*�I���ͬq$�����*����EN�8ᗘ%�U�,���w���Y�3^��眣cЕ+��Nà�e6�j��f�V��P���@E� ��A���K�a��5�d�� �sA�_��[��:�%���Po�5���]�y���u魢!A�b�%�:��4E:��6D,�}F���@F��"��8�"'@1����@�*D� N�� f�+YP:uR�sA����?��T����в��#exPمu8x䪻n�$d��A�LOZ��ڢ ��@ʖ�_���ϻ�ھ���#g�t��6�l�)�H(��\�y/�� i����,��/C.�)�(��pTr��iS6���C�f̡�������HB�B��Ow���r�~i/��������Y�\�/����*- �`��� ��c4Xd����l�U�.��lB���lr�s����jAG�Y�����|L��G<�h�t����c&��n�HWK�����2���\��x�(�M�^�����0ˡ��/nŀ����q����LE�����%3���0(2Y�せ"�-͜��a��3�4��h�$̡)]��x �gϓ��H2�Z�]��%foXaI"�7�k$u"��Gtk�e��kZ[y�byLÐ�����a�-UGB˟7�'����A�N��]1k���k>e7�j]e>�W�kse���� �E(�+�\�$c��>�Zr6� ������Sݏ/D�7�;M�3Kș�%Ϧ�����O��ttv�a����d�m6��R�ddZq�K3W�g2}�� ��xJ�A���Y�#�d�?��kNg� Z�h��G]C�|r���k�)D�6Ȼ�Y���3D|X��X*����_�;C �η{N�0o��������r��H���"t��:�n#^Q�6�_ƪ ���j��� 2����܇��C<�[N^�h��j3��Nv�8y�[.�% >86�����_*�P����g�� }��R�Md�-��� ȇ�a���E����<C/�?�B��)�朳������r�D�Q�[��*J˞��x"�?P���p�/Y��^V�X��Mq�tL� �m�����鞚�)������ ۞F�8tF\�Ʌ��0���9v��ujʮ�c��/��T��8K_����μ@�������)���ð�D�NۓW�mO��u��Dۃ���s�x�u�l��d�����B��&�-La�|Y+|YZ�`+��Lة.:�I<�-�"E ��Y�^EA�&�L~2�.�C�|�G>}���|���7��($h�6#�ڜ+��+��3ը7sI��-�q�X�g*g�Ϡ�Y5�#|Z)���3ر{��A�PQW/�v q,7 la$��Şz�*�/�/�����ͫ #��� ��/�_D"(��*� $�!�� \�1�rr�!�x���� ��J���]�<��ҵe��(H�E�k�)��G���l�|��4��D��h�/��{��ۯ��� �{���{xef���s�q�J����z��B�K%�Y���89��DZ�V���p欍����H*2K��v��ɸ��d��VѸn�ӏs� �I+*��Į���F �lPN���!�Z1O�d5ĥ)&�#Z���:���VQ���y��WI0w�lJ�������Y�a�����bA�+C�鴂�SpVk�v^�\[��!I�-��\����'�G?� =^��sR�`��5�AK��hN`�~]�L~���d��yn�F�F���5'�>~�/�vظa����u��XX�x&�S�L��A2��R�<��%X��wEYt/>MsVa�fk�u2���&ϳ�U�?��W���M�]�&Gd��{�Z�7K��;��_mRMd��tf�NS�5�F�d[<�wW��U`���Z�69#`����$]OqϹ� ���`ؔ�ã��j�l��mi����'˲�L�!U�-����6�r:�s\�:�:xԒ �_����w�gp2�\ϝ�o���Êo`�VN�GH���8G8#͊�����{�#�'fD�Jj�ya,X<�u"^�ѐ`� 3�B�d��v�*bpAN�̅� C�a9柳.���'�,!o�a�$�5|?3��=���*0��p1>-m�D|��tK�8���q ��AZ3�U�l��9��u(%+� ��1<��y�&�^q���؍�y�y`��.��)�K2�0p-[���1���jl:%�J @�[�rK����z��:��h~�D��g�Ium5G�����;�B?�����L��Cc�J������X䧸}�"�&i�l��Jf������3�V2
Overview
overview
7Static
static
7【乐乐T...��.url
windows7-x64
1【乐乐T...��.url
windows10-2004-x64
1【乐乐T...��.exe
windows7-x64
7【乐乐T...��.exe
windows10-2004-x64
7【乐乐T...wx.dll
windows7-x64
7【乐乐T...wx.dll
windows10-2004-x64
7【乐乐T...��.htm
windows7-x64
1【乐乐T...��.htm
windows10-2004-x64
1【乐乐T...��.url
windows7-x64
1【乐乐T...��.url
windows10-2004-x64
1Behavioral task
behavioral1
Sample
【乐乐T】无敌改技能随时买卖版.rar/92wg在线购买外挂卡.url
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
【乐乐T】无敌改技能随时买卖版.rar/92wg在线购买外挂卡.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
【乐乐T】无敌改技能随时买卖版.rar/T莪獨傲吣【无敌技能卖修】.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
【乐乐T】无敌改技能随时买卖版.rar/T莪獨傲吣【无敌技能卖修】.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
【乐乐T】无敌改技能随时买卖版.rar/hxwdllwx.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
【乐乐T】无敌改技能随时买卖版.rar/hxwdllwx.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
【乐乐T】无敌改技能随时买卖版.rar/就爱外挂网.htm
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
【乐乐T】无敌改技能随时买卖版.rar/就爱外挂网.htm
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
【乐乐T】无敌改技能随时买卖版.rar/就爱外挂网交流论坛 欢迎您的参与.url
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
【乐乐T】无敌改技能随时买卖版.rar/就爱外挂网交流论坛 欢迎您的参与.url
Resource
win10v2004-20231215-en
General
-
Target
14f6cbd2e78142a421a9478e0f264647
-
Size
1.7MB
-
MD5
14f6cbd2e78142a421a9478e0f264647
-
SHA1
340e3237db8415763f6966ad30423fa1ac6a592d
-
SHA256
6b8a00e4c54563d4a0f79c33829c6f186836997a160fd29bceae0650c985c8e0
-
SHA512
938af8d57a377373a4254ff8e4c23655a667e6ee9c91d4850b0fdb45a39e3a6461b6a5a9c9deb88e31078dfc919e95527d471bba49dd41bc175bef5504f153e9
-
SSDEEP
49152:GyebdqgJr83/jKEzgQFBl5/i994WE367uT+arW4m:GJdvpybUmAM1qCKarWr
Malware Config
Signatures
-
resource yara_rule static1/unpack001/【乐乐T】无敌改技能随时买卖版.rar/T莪獨傲吣【无敌技能卖修】.exe upx static1/unpack001/【乐乐T】无敌改技能随时买卖版.rar/hxwdllwx.dll upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/【乐乐T】无敌改技能随时买卖版.rar/T莪獨傲吣【无敌技能卖修】.exe unpack001/【乐乐T】无敌改技能随时买卖版.rar/hxwdllwx.dll
Files
-
14f6cbd2e78142a421a9478e0f264647.rar
-
【乐乐T】无敌改技能随时买卖版.rar/92wg在线购买外挂卡.url
-
【乐乐T】无敌改技能随时买卖版.rar/92wg说明.txt
-
【乐乐T】无敌改技能随时买卖版.rar/MD5跟必须要看的使用说明.txt
-
【乐乐T】无敌改技能随时买卖版.rar/T莪獨傲吣【无敌技能卖修】.exe.exe windows:4 windows x86 arch:x86
3e25f5d200cfb9a618cb5056444e36af
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalDeleteAtom
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
UpdateWindow
MessageBoxA
gdi32
OffsetViewportOrgEx
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
advapi32
RegEnumKeyA
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
shlwapi
PathFindExtensionA
oledlg
ord8
ole32
StgOpenStorageOnILockBytes
oleaut32
SysAllocString
Exports
Exports
Sections
.text Size: - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 12KB - Virtual size: 671KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 924KB - Virtual size: 921KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 672KB - Virtual size: 671KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
【乐乐T】无敌改技能随时买卖版.rar/hxwdllwx.dll.dll windows:4 windows x86 arch:x86
9f8a784ffb283935ad7fc944948b2741
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
HeapFree
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
SetWindowsHookExA
MessageBoxA
Exports
Exports
sstop
start
state
�M7�簻eu�J�����ۈ�+cHp�Ou���"�:]_�~�ލzR���=y0�H9ҕrQ�������`����؝gk����m��m1��������A\Ͼ������Q(�O�X����s�(J�M�,�bb⍆��G&4�w%S�� F1r_~?<Ĕ@�1;�H�o�:i�/h��.�qM�M����{�F�U|O-;� �������(]LN��t�nW3ʋn��P ��f�%��~����cy1>"��[k�e�ޮA�Pv�Ӕ�Z�� �N����a���P��n/0�j�$�MV����ї�K�����K;ׅ7�\���I>���\�;��&lz��/�|��B���S�P6�^�(gpN4�Ӊ� ]�����̴[�g�W�^��'ב!}�F�lG� 2#������2����3Λ�v8��1%�#��:���q��XE��5�y����?rH%�t��WMg�uV�����Ǩ�'M+_Nv���A�:�?�΅X�6aw��Cs٣L�N*�u0��S�Ie�LJ}����C���U�%�QA�5ǚ�|�#@à��-zf�ԔU�O*-��(�֗Ia*��i�� Q�� ��A�q���Q�L ST'f/��uC ��^��]SS�`|�{�p�����n*u�a=�t4bҮi �Rb��o���w'���!k��,��͠n�����#��DW�&B�����3{W�\��[���3�� G��L�!�"]����~]Bj�;��H�ߐ�I�<�E��?1��$���p5j�� V����XK{@p�|$�v��O*�#<Y����vfrf�Zpb���hЄ��w,ծ���������Bb� T�xH����LD�%���13���M_J��^Isȥ������g�N�c��gJ=9�/�@9���\N�j����u�(�8�g�!�b�5%4L�qnb$��E'"��(y�����$mP�J8�*�O��pj�7��?��B���վ�^' d�%W���4�M�����o�m���^�7���!т;�D ~|Ed���7#���H��Dc���O�¯��R� �6Ҳ;[�*o3K�l�E5�\���i��N"��D� ���;Y�Uf���"uy�.ϸ���oO�L��!V��y/� �ﯽ��M�ٻ~l e�XX�RНX��.?)3�����V��ݟ��7,1�ۛ7L��h���fW��rm?�Գ/u�s��֖r�>�e�i��������/6���;l@�eU�BieA����܈�@�Y����TՓ���*�HeԢ����"��+�h2"f�Z{�Z_EʜFK�6,h���y�q�.Ȟm�D�"�$��l��s�Mp�a�W��Z)��R�MǪ�Vc{^�״B�>_9i�� L�/�ށ����/��)I���2E������j���1�X5�Ud+��̕> a�Sf��uT�íw�F3cy�3{D�92�Ξh�C��IP�~6�|D�Ҵ��^�6�k�FQ|M/��2���/��&z� �w�L ���.����L�4)���5w��ӟu���$�z��3U����-�E� i����L�͞�LJ����40TZGF+�ә�\)��xr��Iʂ[�U�����Fw���xLA�d=��f���"lT�K�������?��kEpL�^\d��3��i�~"6Go������z ��_�ljR�^��q^���<�ل9�E-�~���^��&���#�7B��'.���.��S�G�B�4:c�E���G �P�3�_Q����E�z�N��A� ����9��I��|�R�e�!iv�7�c��p�Y�I�q����l�m��x�v�-e��v�ɺ�ۈ{?U�Rx����j���� ;�Ob�lհ�&g��h��]��Fp���`b������O�\"�����^0[|�v�n�D ��`�|�,XU?Q��>[���P~R���#T�Iq�Uh����uX{?\�6��`�ʖ��v-���Ή�����,1�&莧�Z=� A��"�\�1;��^/��6� �- a��<|�ș�����*p�,���),<�(i�����a)�*|�ͫ/;������g�-���ɼ�5�Y7-���۟m�D+��С(�����M��7�?w�@lk�ec��b�@��|L1�0��Hy��=�3� w��W����ꍺ�羅.�����]^��7����i���/�;� �ns'm�>gH��W8T��Pd�s!/�%A�A��_j�,����e=� ��Ƌ�x����xG���G�0�{�2ⅴu� ���}�7�n�'5f�x�����<�`d2�:� �N��a/q�`;۵�F\i2��C6��a��{���"�iB��@&�aKf{8��AQlJ}��V=5���A�c7s�b�A��|^��D�c;�����g�M_b���ͪu��i�i숿���1W�Q.m�7�Y��fj��8����&�Oq�M�M���׆x�ةd���mV���#X��h�_t#G)�z��V����z��d����$��.%��u�Ty` �47�S����?82W�$A���̃7'K��<��:�0,tGZ����lӹ�=���*3���qZ��P���Ŏ�"c�������7�� Wb���l�#��v/ R֨�?�|�Ԓ����ʂ4������b���������Th@m�(�l��W��?ᨛXJ7Ӳ�!�25~uZ�G?X��B\&�)[()�� �.(~yj���d_{ύ�"���I�Hk�F��GQ洆�ۂR�q�ai�ީ��Ń�ո5���q5��^k��kZ��l �/ލ{kY5M�)�d���p*�W~`[?l$]3��T����!�9c_�+(3�^]�n�x`��`-V���B�apB�'J]ȫS��D��K~��U쉑H%F���<§Q"��nZ����A�&�P�kq��b"����/*,wU�C5��9lz�ʫ�z͡����@ӛ0�`��-�5�Ƅ�j�f��h��V��8��[�P�Z Z��-�=�P.+Lm��|{�����*˴N� ��D~��&� ���)]X؊ͺ1_������;�IގxҤ �jA|�$�Ĭ=հ�����@ɶ/,t)����?���j�H���Ns�
Sections
.text Size: - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
mysechx Size: 4KB - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 359KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 484KB - Virtual size: 481KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
【乐乐T】无敌改技能随时买卖版.rar/就爱外挂网.htm.html
-
【乐乐T】无敌改技能随时买卖版.rar/就爱外挂网交流论坛 欢迎您的参与.url.url