Behavioral task
behavioral1
Sample
iTVsetup/Update.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
iTVsetup/Update.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
iTVsetup/iTVstar.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
iTVsetup/iTVstar.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
大量破解软件下载....url
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
大量破解软件下载....url
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
更多软件.url
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
更多软件.url
Resource
win10v2004-20231215-en
General
-
Target
07e7854c366b08b85c4ec7550bbd8556
-
Size
419KB
-
MD5
07e7854c366b08b85c4ec7550bbd8556
-
SHA1
29af9e296489c52b0f1dbcbac9a2b68de53a1f6f
-
SHA256
6ac8104bea529b6b780556a842e366822be83ed03edb7c69caed1ff00e5e3d43
-
SHA512
3f66e866540d313cdacd7119ea05f42d6bb924881fc432de7c58b5737467cff6836211fb7d95d03d4440f0ce2dbfccd3dccd55c8b4b0bdb9716fbf75ceedbcd8
-
SSDEEP
6144:tGaa+9BQox+wBu7hA4pEzZmKJk4NuJucNX2qS5rEXnXiOi4xB8T3B0P4uAJuMb+H:IgB1IUyy1z2YPOdcT3B0PIuvxE6
Malware Config
Signatures
-
resource yara_rule static1/unpack001/iTVsetup/Update.exe upx -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/iTVsetup/Update.exe unpack002/out.upx unpack001/iTVsetup/iTVstar.exe
Files
-
07e7854c366b08b85c4ec7550bbd8556.rar
-
iTVsetup/Update.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 18KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 916B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
iTVsetup/iTVstar.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 775KB - Virtual size: 774KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 12KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 28B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
大量破解软件下载....url
-
更多软件.url
-
注脚.txt
-
软件使用帮助.txt