1068fe09f8f77c054a68c4a3178e818f

Sharing

Copy URL Twitter E-mail

General

Target

1068fe09f8f77c054a68c4a3178e818f
Size

2.1MB
MD5

1068fe09f8f77c054a68c4a3178e818f
SHA1

d41c484d28dcb818a5aeb843b2078ab318607cb4
SHA256

cee981bc3544fd2075e6a47512a2a9e9db060ebb5bdb63bd8521987935460b93
SHA512

fb1ca5369e9256232d8ab19942b99e92adfefb9c356d8fa223ede1c6bd52914c01ce8dd48b496edf6192d0b3858f9b298bcdece615b7840a92ead2a9f6f7ef19
SSDEEP

49152:SVX/SIgGvnekZmKLOVaCgwxq1uHWNbBKzlMuIW3TZvIP:SN/SIvn5chVpUisBslTIW39vIP

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack002/学生机/coolstudent-new/STUDENT.exe
unpack003/教师机/coolteacher-new/HOOK.DLL
unpack003/教师机/coolteacher-new/TEACHER.exe
unpack004/注册码生成器/key/Project1.exe

Files

1068fe09f8f77c054a68c4a3178e818f
.rar
275627136/下载说明.htm
.html .js polyglot
275627136/学生机.rar
.rar
学生机/coolstudent-new/Gmovie.dcu
学生机/coolstudent-new/Gmovie.dfm
学生机/coolstudent-new/Gmovie.pas
学生机/coolstudent-new/Guangbo.dcu
学生机/coolstudent-new/Guangbo.dfm
学生机/coolstudent-new/Guangbo.pas
学生机/coolstudent-new/JUSHOU.DCU
学生机/coolstudent-new/JUSHOU.PAS
学生机/coolstudent-new/JUSHOU.dfm
学生机/coolstudent-new/MAIN.DCU
学生机/coolstudent-new/MAIN.dfm
学生机/coolstudent-new/MAIN.pas
.js
学生机/coolstudent-new/STUDENT.DPR
学生机/coolstudent-new/STUDENT.RES
学生机/coolstudent-new/STUDENT.cfg
学生机/coolstudent-new/STUDENT.dof
学生机/coolstudent-new/STUDENT.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 1023KB - Virtual size: 1022KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 387KB - Virtual size: 387KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
学生机/coolstudent-new/TaoLun.dcu
学生机/coolstudent-new/TaoLun.dfm
学生机/coolstudent-new/TaoLun.pas
学生机/coolstudent-new/Tongz.dcu
学生机/coolstudent-new/Tongz.dfm
学生机/coolstudent-new/Tongz.pas
学生机/coolstudent-new/aboutf.dcu
学生机/coolstudent-new/aboutf.dfm
学生机/coolstudent-new/aboutf.pas
学生机/coolstudent-new/heipin.dcu
学生机/coolstudent-new/heipin.dfm
学生机/coolstudent-new/heipin.pas
学生机/coolstudent-new/logo.bmp
学生机/coolstudent-new/soundf.dcu
学生机/coolstudent-new/soundf.dfm
学生机/coolstudent-new/soundf.pas
学生机/coolstudent-new/student.ico
275627136/教师机.rar
.rar
教师机/coolteacher-new/BRUSHP.DCU
教师机/coolteacher-new/BRUSHP.PAS
教师机/coolteacher-new/BRUSHP.dfm
教师机/coolteacher-new/Banji.dcu
教师机/coolteacher-new/Banji.dfm
教师机/coolteacher-new/Banji.pas
教师机/coolteacher-new/Chongqi.dcu
教师机/coolteacher-new/Chongqi.dfm
教师机/coolteacher-new/Chongqi.pas
教师机/coolteacher-new/FastShe.dcu
教师机/coolteacher-new/FastShe.dfm
教师机/coolteacher-new/FastShe.pas
教师机/coolteacher-new/Guangbo.dcu
教师机/coolteacher-new/Guangbo.dfm
教师机/coolteacher-new/Guangbo.pas
教师机/coolteacher-new/Guanji.dcu
教师机/coolteacher-new/Guanji.dfm
教师机/coolteacher-new/Guanji.pas
教师机/coolteacher-new/HOOK.DLL
.dll windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DisableMouseHook
EnableMouseHook

Sections

CODE
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 102B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
教师机/coolteacher-new/LockSystem.dcu
教师机/coolteacher-new/LockSystem.dfm
教师机/coolteacher-new/LockSystem.pas
教师机/coolteacher-new/MAIN.DCU
教师机/coolteacher-new/MAIN.dfm
教师机/coolteacher-new/MAIN.pas
教师机/coolteacher-new/Pingmu.dcu
教师机/coolteacher-new/Pingmu.dfm
教师机/coolteacher-new/Pingmu.pas
教师机/coolteacher-new/Sxinxi.dcu
教师机/coolteacher-new/Sxinxi.dfm
教师机/coolteacher-new/Sxinxi.pas
教师机/coolteacher-new/TEACHER.DPR
教师机/coolteacher-new/TEACHER.INI
教师机/coolteacher-new/TEACHER.RES
教师机/coolteacher-new/TEACHER.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 7KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
教师机/coolteacher-new/TELock.dcu
教师机/coolteacher-new/TELock.dfm
教师机/coolteacher-new/TELock.pas
教师机/coolteacher-new/TMovie.dcu
教师机/coolteacher-new/TMovie.dfm
教师机/coolteacher-new/TMovie.pas
教师机/coolteacher-new/TaoLun.dcu
教师机/coolteacher-new/TaoLun.dfm
教师机/coolteacher-new/TaoLun.pas
教师机/coolteacher-new/Teacher.cfg
教师机/coolteacher-new/Teacher.dof
教师机/coolteacher-new/TeacherMessage.dcu
教师机/coolteacher-new/TeacherMessage.dfm
教师机/coolteacher-new/TeacherMessage.pas
教师机/coolteacher-new/Unit1.dcu
教师机/coolteacher-new/YuanC.dcu
教师机/coolteacher-new/YuanC.dfm
教师机/coolteacher-new/YuanC.pas
教师机/coolteacher-new/aboutf.dcu
教师机/coolteacher-new/aboutf.dfm
教师机/coolteacher-new/aboutf.pas
教师机/coolteacher-new/duijiangf.dcu
教师机/coolteacher-new/duijiangf.dfm
教师机/coolteacher-new/duijiangf.pas
教师机/coolteacher-new/exitf.dcu
教师机/coolteacher-new/exitf.dfm
教师机/coolteacher-new/exitf.pas
教师机/coolteacher-new/jGuangbo.dcu
教师机/coolteacher-new/jGuangbo.dfm
教师机/coolteacher-new/jGuangbo.pas
教师机/coolteacher-new/jingcheng.dcu
教师机/coolteacher-new/jingcheng.dfm
教师机/coolteacher-new/jingcheng.pas
教师机/coolteacher-new/logo.bmp
教师机/coolteacher-new/soundf.dcu
教师机/coolteacher-new/soundf.dfm
教师机/coolteacher-new/soundf.pas
教师机/coolteacher-new/teacher.ico
教师机/coolteacher-new/title.bmp
275627136/注册码生成器.rar
.rar
注册码生成器/key/Project1.cfg
注册码生成器/key/Project1.dof
注册码生成器/key/Project1.dpr
注册码生成器/key/Project1.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
注册码生成器/key/Project1.res
注册码生成器/key/Unit1.dcu
注册码生成器/key/Unit1.dfm
注册码生成器/key/Unit1.pas
注册码生成器/key/key.ICO

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

CODE Size: 1023KB - Virtual size: 1022KB

DATA Size: 22KB - Virtual size: 22KB

BSS Size: - Virtual size: 4KB

.idata Size: 12KB - Virtual size: 12KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 62KB - Virtual size: 61KB

.rsrc Size: 387KB - Virtual size: 387KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 44KB - Virtual size: 44KB

DATA Size: 1KB - Virtual size: 1KB

BSS Size: - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 2KB

.edata Size: 512B - Virtual size: 102B

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 4KB

Headers

File Characteristics

Sections

CODE Size: 1.4MB - Virtual size: 1.4MB

DATA Size: 13KB - Virtual size: 12KB

BSS Size: - Virtual size: 7KB

.idata Size: 13KB - Virtual size: 13KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 86KB - Virtual size: 86KB

.rsrc Size: 1.5MB - Virtual size: 1.5MB

Headers

File Characteristics

Sections

CODE Size: 323KB - Virtual size: 323KB

DATA Size: 4KB - Virtual size: 3KB

BSS Size: - Virtual size: 2KB

.idata Size: 9KB - Virtual size: 8KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 22KB - Virtual size: 21KB

.rsrc Size: 151KB - Virtual size: 151KB

CODE
Size: 1023KB - Virtual size: 1022KB

DATA
Size: 22KB - Virtual size: 22KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 12KB - Virtual size: 12KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 62KB - Virtual size: 61KB

.rsrc
Size: 387KB - Virtual size: 387KB

CODE
Size: 44KB - Virtual size: 44KB

DATA
Size: 1KB - Virtual size: 1KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 102B

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

CODE
Size: 1.4MB - Virtual size: 1.4MB

DATA
Size: 13KB - Virtual size: 12KB

BSS
Size: - Virtual size: 7KB

.idata
Size: 13KB - Virtual size: 13KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 86KB - Virtual size: 86KB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

CODE
Size: 323KB - Virtual size: 323KB

DATA
Size: 4KB - Virtual size: 3KB

BSS
Size: - Virtual size: 2KB

.idata
Size: 9KB - Virtual size: 8KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 22KB - Virtual size: 21KB

.rsrc
Size: 151KB - Virtual size: 151KB