276edb6c84e141afd55d8cd68afb11bd
- SHA256 a36472a76e10fcc53afbcc8ecd7430c5e2c309964fd456348f8474aac02d9dc9
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cvery.comvc61544667824/exe/1sass.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
cvery.comvc61544667824/exe/1sass.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
cvery.comvc61544667824/exe/uiQQ盗.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
cvery.comvc61544667824/exe/uiQQ盗.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 276edb6c84e141afd55d8cd68afb11bd
- Size 24KB
- Sample231231-ens2rsfedm
- SHA256 a36472a76e10fcc53afbcc8ecd7430c5e2c309964fd456348f8474aac02d9dc9
- MD5 276edb6c84e141afd55d8cd68afb11bd
- SHA1 6ebffbbf021f4987cb03553dc9c15b8e4870b1ce
- SHA512 b897fb9cbca1824b6a43973bdcfc22e0ffb95b09dbe785cd2c3ad8990d28075f875c4d813b0ce5695e3d328e698d1f2a5db6d0b3db2cd3fe44aadd19f716f9f2
- SSDEEP 384:OBEa8J+O7onxNZazyPuu/+WhwZHEGxNNK/tyiPhlm5Wcyj95IpLVMV:OihQO7onxNLH/iriyQ45W5fy8
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/cvery.comvc61544667824/exe/1sass.dll unpack001/cvery.comvc61544667824/exe/uiQQ盗.exe
File Explorer
-
276edb6c84e141afd55d8cd68afb11bd.rar 24KB
-
cvery.comvc61544667824/code/UiHook.cpp2KB
-
cvery.comvc61544667824/code/uiQQ.cpp2KB
-
cvery.comvc61544667824/exe/1sass.dll.dll 32KB
-
cvery.comvc61544667824/exe/uiQQ盗.exe.exe 28KB
-
cvery.comvc61544667824/exe/x.ico3KB
-
cvery.comvc61544667824/下载说明.htm.html .js 5KB
-
cvery.comvc61544667824/说明文件.txt8KB
cvery.comvc61544667824/code/UiHook.cpp
- SHA256 ee55f49dafc1f7f92ba56a0ce93b8f630fecc338e9166f74f7c0d87539c59b7d
- MD5 6229f093ae8f75a3d4f6ac1821f699e4
- SHA1 11b705eb489c22520f24d2ba79ddb361440f9649
- SHA512 69271da212b90bca043bb4b9e81088ff0d8aedee3fdb959c0ffaa086120d87da844a59169e16062f417f318c81442340238be6b5bc1bbd332b741a1c1da374ea
- MD5 SHA1 SHA512
cvery.comvc61544667824/code/uiQQ.cpp
- SHA256 4752c6ced07b154a18efcb4c450343bae95ad17b417ba513b350d36e62687582
- MD5 286c7beef1da552a781ef12d31aff85e
- SHA1 5a738daa529842d615cf9bbe616b30f92ce45770
- SHA512 8994af8139032492887f7d89f2aefb8fb0470292c96c96ab7d29a45d6938345b6937d2928c146186b1687cadde57d9ed23801d0647625c7c034767a53e331861
- MD5 SHA1 SHA512
cvery.comvc61544667824/exe/1sass.dll
- IMPHASH 36e754250ff63d56cf2de5fbd07b2bec
- SHA256 a9c8de61278740ff5d0bf4258c38545353a7093faab5b1ec99a51f01e95fbb5a
- MD5 5bf6e6b6de744585ab9e8b73fb786394
- SHA1 856719a21a34df6629ae17ada220e39018f40405
- SHA512 bdb1b9ad9d1f6f286e8eaaf7167d217f9d37ae01ac91ff2f44d4a29804c2919ebca2052c71b2bf0b0944ada652fbb776ae49b7d7337189a23f9547aaba35e5e5
- SSDEEP 384:hkyPzazml//tBZTZ3PjNXpkqlyyx6mG1o9z:hDvtBZTZ/bk22J1o9z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5285
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
WriteFile
CreateFileA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
GetOEMCP
HeapAlloc
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
HeapFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetCPInfo
GetACP
RtlUnwind
user32
GetWindowThreadProcessId
GetDlgItem
MessageBoxA
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetWindowTextA
?SetQQHook@@YGHPAUHWND__@@@Z
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
shared
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=9, id=14, version=7299,
count=5, id=19, version=8034,
count=57, id=1, productName=Unmarked objects,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
cvery.comvc61544667824/exe/uiQQ盗.exe
- IMPHASH c5e4176f4c36c9d71667002ae109528f
- SHA256 a19e9ee1d12c67ddadf12901f741e1e885d65319ffb5dcb00d1fb4c0fc11014a
- MD5 ceaae2176f72a7726d74d2439e91a2ac
- SHA1 ab83a8cd270515b080028b6c62e4cc02434c6276
- SHA512 68c47b72757ad9a93b47d5dbdaa678f420a5c4c1bf3abade0f8078baec933da6923d3da18e5eb18ff6694cc584bc5e161802178698fe3ac8c914ffd384669595
- SSDEEP 384:qwNw10ZVhcgwml4pindXFyyDFA8qjXrh6oZv:vTnFywOj7h6o
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
DialogBoxParamA
EndDialog
PostQuitMessage
GetWindowRect
GetSystemMetrics
SetWindowPos
IsWindow
FindWindowExA
KillTimer
MessageBoxA
SetTimer
1sass
?SetQQHook@@YGHPAUHWND__@@@Z
kernel32
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetStringTypeW
GetProcAddress
HeapReAlloc
VirtualAlloc
HeapAlloc
LoadLibraryA
GetEnvironmentStrings
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
GetCPInfo
GetACP
GetOEMCP
Name
.text
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=22, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=9, id=14, version=7299,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=49, id=1, productName=Unmarked objects,
count=5, id=19, version=8034,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
cvery.comvc61544667824/exe/x.ico
- SHA256 577854d7dd3c2fee567f95323e902d3d88c76b11245a6b47e615d56337289576
- MD5 11fcc576eae00925e4d16310e6e72599
- SHA1 fb33a5fe1d298c2199aeb97833dabfdc587a0722
- SHA512 04f513800bb4a39fa9ecf097235193c3eeb3e1dbcbf1e009b1799f7e78b389675bff1e8bf44fe8c057142769262cb64309a49cdaacf3f2b1345033440f433ed2
- MD5 SHA1 SHA512
cvery.comvc61544667824/下载说明.htm
- SHA256 e4ebd3a562014143ad591012573a11d29865d316aaee1fc1e4ffdf5843c568d4
- MD5 6f3eb28a2956fcf3c1e5d80bb52b04d2
- SHA1 b567d21a706593c95b36596b1a56984afe46dee9
- SHA512 cc04b125df0834c8821e838d15b6787d4a152cde53f02f5a5e45cb17353cb6e26c3601afcd8cbcd08a9c6fb25e3b8a5e277f91ca0b84c1c451b5d93fbd1e5e68
- SSDEEP 96:v7OQeRA2RWhsFf6HIvtVg0zU/KNe/idddddddddddddddddddddddddNddddddav:zX8A0JFyLqs4/z5w1U4j2NckC
- MD5 SHA1 SHA512 SSDEEP
cvery.comvc61544667824/说明文件.txt
- SHA256 41f357fa190c57998ef1d84afb48348de73e4382c43c6e389f7654bd743facb9
- MD5 a910572698b6e7ae01ea71310cbc2217
- SHA1 64105221edce4a951ea927e7898e89f6212c7578
- SHA512 0ea207b8e3b0b889507459fda98afdad4ed6fee7fe33a622666c8a37f829409d693892096e823335f57366c02a82b5c5ec5b1f33197b4882da8b8bf1eb1e1b30
- SSDEEP 192:vHUGswJHEkz47d9iWLU7ohiW7wxDfTJChIy/ZkrmCDZIbs2kplzwF13FgvhIIX:vUGskEvViDfyYqs/pe1+vh7
- MD5 SHA1 SHA512 SSDEEP