GetFilterVersion
HttpFilterProc
TerminateFilter
Overview
overview
7Static
static
7LeoBBS 免...arp.js
windows7-x64
1LeoBBS 免...arp.js
windows10-2004-x64
1LeoBBS 免...FO.ps1
windows7-x64
1LeoBBS 免...FO.ps1
windows10-2004-x64
1LeoBBS 免...DN.ps1
windows7-x64
1LeoBBS 免...DN.ps1
windows10-2004-x64
1LeoBBS 免...x.html
windows7-x64
1LeoBBS 免...x.html
windows10-2004-x64
1LeoBBS 免...se.ps1
windows7-x64
1LeoBBS 免...se.ps1
windows10-2004-x64
1LeoBBS 免...x.html
windows7-x64
1LeoBBS 免...x.html
windows10-2004-x64
1LeoBBS 免...x.html
windows7-x64
1LeoBBS 免...x.html
windows10-2004-x64
1LeoBBS 免...x.html
windows7-x64
1LeoBBS 免...x.html
windows10-2004-x64
1Rewrite/Rewrite.dll
windows7-x64
3Rewrite/Rewrite.dll
windows10-2004-x64
3Rewrite/mtbnotif.dll
windows7-x64
1Rewrite/mtbnotif.dll
windows10-2004-x64
ExtClient.dll
windows7-x64
1ExtClient.dll
windows10-2004-x64
1Guide.exe
windows7-x64
1Guide.exe
windows10-2004-x64
1LeoBBS 免...ws.cgi
ubuntu-18.04-amd64
LeoBBS 免...ws.cgi
debian-9-armhf
LeoBBS 免...ws.cgi
debian-9-mips
LeoBBS 免...ws.cgi
debian-9-mipsel
LeoBBS 免...nc.cgi
ubuntu-18.04-amd64
LeoBBS 免...nc.cgi
debian-9-armhf
LeoBBS 免...nc.cgi
debian-9-mips
LeoBBS 免...nc.cgi
debian-9-mipsel
Behavioral task
behavioral1
Sample
LeoBBS 免费版本/addon/CGI/Carp.js
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
LeoBBS 免费版本/addon/CGI/Carp.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
LeoBBS 免费版本/addon/Net/DNS/RR/HINFO.ps1
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
LeoBBS 免费版本/addon/Net/DNS/RR/HINFO.ps1
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
LeoBBS 免费版本/addon/Net/DNS/RR/ISDN.ps1
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
LeoBBS 免费版本/addon/Net/DNS/RR/ISDN.ps1
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
LeoBBS 免费版本/addon/Net/DNS/RR/index.html
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
LeoBBS 免费版本/addon/Net/DNS/RR/index.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
LeoBBS 免费版本/addon/Net/DNS/Resolver/Base.ps1
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
LeoBBS 免费版本/addon/Net/DNS/Resolver/Base.ps1
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
LeoBBS 免费版本/addon/Net/DNS/Resolver/index.html
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
LeoBBS 免费版本/addon/Net/DNS/Resolver/index.html
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
LeoBBS 免费版本/addon/Net/DNS/index.html
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
LeoBBS 免费版本/addon/Net/DNS/index.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
LeoBBS 免费版本/addon/Net/index.html
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
LeoBBS 免费版本/addon/Net/index.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
Rewrite/Rewrite.dll
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
Rewrite/Rewrite.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
Rewrite/mtbnotif.dll
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
Rewrite/mtbnotif.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
ExtClient.dll
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
ExtClient.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
Guide.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
Guide.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
LeoBBS 免费版本/addon/allnews.cgi
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral26
Sample
LeoBBS 免费版本/addon/allnews.cgi
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral27
Sample
LeoBBS 免费版本/addon/allnews.cgi
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral28
Sample
LeoBBS 免费版本/addon/allnews.cgi
Resource
debian9-mipsel-20231222-en
Behavioral task
behavioral29
Sample
LeoBBS 免费版本/addon/getanc.cgi
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral30
Sample
LeoBBS 免费版本/addon/getanc.cgi
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral31
Sample
LeoBBS 免费版本/addon/getanc.cgi
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral32
Sample
LeoBBS 免费版本/addon/getanc.cgi
Resource
debian9-mipsel-20231222-en
Target
19a660ffdffe351d48d20e3255758864
Size
3.5MB
MD5
19a660ffdffe351d48d20e3255758864
SHA1
868d942d4a9d3833a33c43df2e7c6a86484e5fc9
SHA256
3950bb10033178b6cc482ed3cde1bb766db304b5fef87321172741d2144dbb93
SHA512
91fdf64bdab23ac9eaed24d5a76bec9ad76c8590198b2d10d68cbcd7afedbe3a8f8deed47a1c10de68a5c846c555973c6ad2e3e020fed45ef807777ba6bf0ab2
SSDEEP
98304:UfCNeINkOdiSFtg+PdI4/BCf2W14azSycDC:kweIDiS5Pdbgey4azbce
resource | yara_rule |
---|---|
static1/unpack003/ExtClient.dll | aspack_v212_v242 |
static1/unpack003/Guide.exe | aspack_v212_v242 |
Checks for missing Authenticode signature.
resource |
---|
unpack002/Rewrite/Rewrite.dll |
unpack002/Rewrite/mtbnotif.dll |
unpack003/ExtClient.dll |
unpack003/Guide.exe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileW
GetFileAttributesExW
GetSystemTimeAsFileTime
ReleaseMutex
GetLastError
CreateMutexW
GetCurrentProcessId
GetModuleFileNameW
PulseEvent
DeleteCriticalSection
GetACP
GetLocaleInfoA
GetVersionExA
DisableThreadLibraryCalls
UnmapViewOfFile
GetTickCount
InterlockedIncrement
WriteFile
CreateEventA
CreateThread
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
CloseHandle
SetEvent
InitializeCriticalSection
WaitForSingleObject
QueryPerformanceCounter
VirtualQuery
GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
GetUserDefaultLCID
LCMapStringW
GetStringTypeA
LoadLibraryA
FreeLibrary
RtlUnwind
RaiseException
GetCurrentThreadId
TlsSetValue
GetCommandLineA
HeapAlloc
HeapFree
TlsFree
SetLastError
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
HeapReAlloc
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
GetOEMCP
GetCPInfo
VirtualProtect
GetSystemInfo
LoadStringA
wsprintfA
wsprintfW
RegQueryValueExW
RegCloseKey
CryptAcquireContextA
CryptImportKey
CryptCreateHash
CryptHashData
CryptVerifySignatureA
CryptDestroyHash
CryptGetHashParam
CryptDestroyKey
CryptReleaseContext
RegOpenKeyExW
CoUninitialize
CoInitializeEx
CoCreateInstance
GetFilterVersion
HttpFilterProc
TerminateFilter
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WaitForSingleObject
SetEvent
CreateEventW
CloseHandle
lstrlenW
InitializeCriticalSection
DeleteCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
lstrcatW
ResetEvent
DisableThreadLibraryCalls
lstrcpynW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
lstrcpyW
LeaveCriticalSection
EnterCriticalSection
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
GetModuleFileNameW
InterlockedExchange
VirtualQuery
GetSystemInfo
VirtualProtect
LCMapStringW
LCMapStringA
LoadLibraryA
GetStringTypeW
GetStringTypeA
GetCPInfo
GetOEMCP
GetVersionExA
RtlUnwind
RaiseException
HeapAlloc
HeapFree
HeapReAlloc
GetCurrentThreadId
TlsSetValue
GetCommandLineA
ExitProcess
SetUnhandledExceptionFilter
TlsFree
SetLastError
TlsGetValue
TlsAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
WriteFile
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
IsBadReadPtr
IsBadCodePtr
CharNextW
LoadStringW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
CoTaskMemFree
CoCreateInstance
ProgIDFromCLSID
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CreateErrorInfo
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SetErrorInfo
PathFindExtensionW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
HandleClientEvent
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
@@Unit1@Finalize
@@Unit1@Initialize
_Form1
__GetExceptDLLinfo
___CPPdebugHook
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE