Overview
overview
10Static
static
3edit/editor/editor.js
windows7-x64
1edit/editor/editor.js
windows10-2004-x64
1edit/index.html
windows7-x64
1edit/index.html
windows10-2004-x64
1帮助.chm
windows7-x64
1帮助.chm
windows10-2004-x64
1自动更新.exe
windows7-x64
1自动更新.exe
windows10-2004-x64
1黑马博�...��.exe
windows7-x64
10黑马博�...��.exe
windows10-2004-x64
10Static task
static1
Behavioral task
behavioral1
Sample
edit/editor/editor.js
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
edit/editor/editor.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
edit/index.html
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
edit/index.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
帮助.chm
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
帮助.chm
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
自动更新.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
自动更新.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
黑马博客群发.exe
Resource
win7-20231215-en
General
-
Target
3f240598ed2dc2216d202f3f8d237e93
-
Size
3.7MB
-
MD5
3f240598ed2dc2216d202f3f8d237e93
-
SHA1
1fdd32f8d6a3941bb95132b9da8553662d77608d
-
SHA256
43e2ad864d9ede51d5caec8632d673473929127edb53ed984613e48218bb33d5
-
SHA512
cd36b30926fe60bab4cc67980c85aeb5cddc762a8d4dc79cf683a748dc555214b41a32df90244bb19f93d4d88943868ec515d9f5346a8126eeaeb90e36c0a35f
-
SSDEEP
98304:CLOZO0jCc3Nu8s5eN+p0u9OGtJdxwo2neBCQi:QcjDeE+p0u0GBxw9fl
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/自动更新.exe unpack001/黑马博客群发.exe
Files
-
3f240598ed2dc2216d202f3f8d237e93.zip
-
code/jinti.cds
-
code/meixun.cds
-
code/tianya.cds
-
data/Article.mdb
-
data/Logs.mdb
-
data/Rank.mdb
-
data/User.mdb
-
edit/editor/editor.js.js
-
edit/editor/images/editor.css
-
edit/editor/images/editoricon.gif.gif
-
edit/index.html.html
-
script/笑话大全.drule
-
word/dict.txt
-
word/footer.txt
-
word/header.txt
-
word/keylink.txt
-
word/sign.txt
-
word/taglink.txt
-
word/title.txt
-
word/type.txt
-
帮助.chm.chm
-
自动更新.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
CODE Size: 4KB - Virtual size: 1.0MB
IMAGE_SCN_MEM_READ
heimabok Size: 704KB - Virtual size: 704KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
heimabok Size: 536KB - Virtual size: 544KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
heimabok Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
heimabok Size: 24KB - Virtual size: 24KB
IMAGE_SCN_MEM_READ
-
黑马博客群发.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
CODE Size: 2KB - Virtual size: 4.0MB
IMAGE_SCN_MEM_READ
heimabok Size: 260KB - Virtual size: 260KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
heimabok Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
heimabok Size: 5KB - Virtual size: 8KB
IMAGE_SCN_MEM_READ
heimabok Size: 19KB - Virtual size: 20KB
IMAGE_SCN_MEM_READ