Behavioral task
behavioral1
Sample
安装说明.url
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
安装说明.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
硬盘安装工具3.1.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
硬盘安装工具3.1.exe
Resource
win10v2004-20231222-en
General
-
Target
1236265820b97ca621b91b297097c9f4
-
Size
2.9MB
-
MD5
1236265820b97ca621b91b297097c9f4
-
SHA1
e023db4b683fa57a3082e873c9cf942d05043983
-
SHA256
94faa5d865a1b9cb025a03eab72ac3a145bbde367a833d88f5699090b1caaa77
-
SHA512
95cf52bb58dda835c265b4d61f33770a097b75618423ce575db3a82e3c6b7c0b3a672fb9efc4cc761c5dd290a552f6795de4f2c581fef84bb464d31c69a81f91
-
SSDEEP
49152:Zb41lHFrhJqxhAO4C754/ytPNLDw/Ni6q/OC83cy3D3Iik3/fVf1xzKl+HwyNkFn:Zb41lHFrOXr4QqyPNLsVTTC83cy3DK36
Malware Config
Signatures
-
resource yara_rule static1/unpack001/硬盘安装工具3.1.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/硬盘安装工具3.1.exe unpack002/out.upx
Files
-
1236265820b97ca621b91b297097c9f4.rar
-
安装说明.url.url
-
硬盘安装工具3.1.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 348KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 349KB - Virtual size: 348KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ