Static task
static1
Behavioral task
behavioral1
Sample
hms1.1_cn_060515.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
hms1.1_cn_060515.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
非常世纪资源网.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
非常世纪资源网.url
Resource
win10v2004-20231215-en
General
-
Target
1ef2b8552209ea1e1562b7324f61c57c
-
Size
10.8MB
-
MD5
1ef2b8552209ea1e1562b7324f61c57c
-
SHA1
31648822d80ddff3e505e627d19c356571a0c76a
-
SHA256
cd5f44031551ad94a3b3cf83e90be2bcb3f1330b080099c74b921b797e28eb21
-
SHA512
be07aa4811a162de18ea7a739cad20e77b8b83528cb67b370df1633122b685ea39fde3a670741226e4e8218e1399a375ee8254d2365fc07c0b2983aba1b49e20
-
SSDEEP
196608:6vSsZt7TZU9JIdnhKDjbUWQA0KNdjf4vssvbbxIoXrT25I2rpOY9Y55Pc8LQ9/At:6vSsZtfZU9JEn8v5T4vskNIoXr65I+Ox
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/hms1.1_cn_060515.exe
Files
-
1ef2b8552209ea1e1562b7324f61c57c.rar
-
hms1.1_cn_060515.exe.exe windows:4 windows x86 arch:x86
a7cf189e2d78263ca6e3a50b168fb9e6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetDiskFreeSpaceA
FindFirstFileA
CreateThread
LocalFree
ResumeThread
SuspendThread
LocalAlloc
Sleep
CloseHandle
_lread
_llseek
GetFileSize
FreeLibrary
GetTickCount
GetTempPathA
LoadLibraryExA
GetFullPathNameA
LoadLibraryExW
_lopen
lstrcmpiA
LoadLibraryW
IsBadReadPtr
WriteProcessMemory
GetCurrentProcess
SetFileAttributesA
FindNextFileA
DeleteCriticalSection
GetProcAddress
GetWindowsDirectoryA
FlushFileBuffers
WinExec
GetVersion
GetACP
CreateEventA
OpenEventA
GetSystemDirectoryA
MultiByteToWideChar
GetCurrentDirectoryA
SetCurrentDirectoryA
CreateDirectoryA
_lcreat
_lwrite
_lclose
DeleteFileA
lstrlenA
OpenFile
GetModuleFileNameA
GetPrivateProfileIntA
lstrcatA
WritePrivateProfileStringA
FindClose
GetModuleHandleA
RemoveDirectoryA
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryA
VirtualAlloc
SetUnhandledExceptionFilter
WriteFile
VirtualFree
lstrcpyA
HeapDestroy
GetStdHandle
HeapCreate
SetHandleCount
GetOEMCP
GetFileType
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCPInfo
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetEnvironmentStrings
ExitProcess
HeapAlloc
TerminateProcess
GetCommandLineA
GetStartupInfoA
HeapFree
IsBadWritePtr
IsBadCodePtr
RtlUnwind
HeapReAlloc
HeapSize
user32
SetDlgItemTextA
GetCursorPos
ScreenToClient
EnableWindow
ShowWindow
GetDlgItem
GetWindowRect
SetWindowPos
SendMessageA
MoveWindow
ReleaseDC
DrawIcon
GetDC
IsDlgButtonChecked
KillTimer
LoadCursorA
GetClassLongA
LoadIconA
LoadStringA
wsprintfA
PostMessageA
UpdateWindow
RegisterClassA
CreateWindowExA
BeginPaint
GetClientRect
DefWindowProcA
GetMessageA
EndPaint
PostQuitMessage
TranslateMessage
IsWindow
IsDialogMessageA
DialogBoxParamA
DispatchMessageA
EndDialog
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
MessageBoxA
SetClassLongA
GetDesktopWindow
GetDlgItemTextA
CheckDlgButton
gdi32
DeleteObject
StretchDIBits
RealizePalette
SelectPalette
CreatePalette
SetStretchBltMode
advapi32
RegSetValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
RegOpenKeyA
RegQueryValueA
RegDeleteKeyA
RegEnumKeyA
shell32
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
ole32
CoInitialize
CoUninitialize
CoCreateInstance
comctl32
ImageList_LoadImageA
ord17
winmm
ord2
Sections
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
下载说明.htm.html .js polyglot
-
安装说明.txt
-
非常世纪资源网.url.url