fc6d3cd59588db62afcd01140526c1b6ce6a5bf801079da62d228371457ad93f

Sharing

Copy URL

Twitter E-mail

General

Target

fc6d3cd59588db62afcd01140526c1b6ce6a5bf801079da62d228371457ad93f
Size

4.1MB
MD5

0a2458c348befdf1c48e1afc10284fb0
SHA1

bd02e945fcd56a51a815c4722f3d7736e2a6421a
SHA256

fc6d3cd59588db62afcd01140526c1b6ce6a5bf801079da62d228371457ad93f
SHA512

b89db380a4a14206b553c594b02504bb2641bdba1c5a04beaa9ad3f703ef7b1e320487381ff3e8a7b863daa822e965fd7fc7a664641c8d7bdc918730150a540c
SSDEEP

98304:4JWhVsKzxoc+Z1ACDDY6ma62TFA0/lKo9/NvvpBYCkgvGjFucefG7V:K8xopAaDY/2xAkNpmCkhsc

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/EV去除录屏检测工具v2.81/EV去除录屏检测工具v2.81/dm.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/EV去除录屏检测工具v2.81/EV去除录屏检测工具v2.81/dm.dll	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/EV去除录屏检测工具v2.81/EV去除录屏检测工具v2.81/Main.exe
unpack001/EV去除录屏检测工具v2.81/EV去除录屏检测工具v2.81/RegDll.dll
unpack001/EV去除录屏检测工具v2.81/EV去除录屏检测工具v2.81/dm.dll
unpack002/out.upx

Files

fc6d3cd59588db62afcd01140526c1b6ce6a5bf801079da62d228371457ad93f
.zip
EV去除录屏检测工具v2.81/EV去除录屏检测工具v2.81/Main.exe
.exe windows:4 windows x86 arch:x86

293ecf39b00ce2b95265106a9cd8bc7b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaR8FixI4

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

kernel32

GetModuleFileNameW

user32

GetWindow

advapi32

RegDeleteKeyA

shell32

SHGetFolderPathW

Sections

.text
Size: 68KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp
Size: 952KB - Virtual size: 952KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EV去除录屏检测工具v2.81/EV去除录屏检测工具v2.81/Main报错解决方法.txt
EV去除录屏检测工具v2.81/EV去除录屏检测工具v2.81/RegDll.dll
.dll regsvr32 windows:4 windows x86 arch:x86

f076a1e4fbab4d2c4bccbdc4ea8a1b72

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord3831
ord3825
ord3079
ord4080
ord4424
ord614
ord1206
ord2623
ord290
ord825
ord1223
ord4622
ord4226
ord2486
ord4003
ord446
ord743
ord1569
ord1196
ord1168
ord6467
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord3830
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3262
ord3081
ord3738
ord561
ord815
ord5500
ord1132
ord1131
ord6354
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord2976
ord2985
ord3136
ord4465
ord3147
ord3259
ord2982
ord1799
ord1089
ord823
ord1578
ord600
ord826
ord269
ord1116

msvcrt

__CxxFrameHandler
wcstombs
__dllonexit
_onexit
free
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm

kernel32

LocalFree
LoadLibraryA
FreeLibrary
GetProcAddress
LocalAlloc

advapi32

RegSetValueExA
RegCloseKey
RegCreateKeyExA

ole32

OleInitialize
CoTaskMemFree
StringFromCLSID
OleUninitialize

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 722B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EV去除录屏检测工具v2.81/EV去除录屏检测工具v2.81/dm.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

UPX0
Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 224KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 92KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
EV去除录屏检测工具v2.81/EV去除录屏检测工具v2.81/使用说明.txt
EV去除录屏检测工具v2.81/EV去除录屏检测工具v2.81/关闭系统杀毒.bat
.bat .vbs
EV去除录屏检测工具v2.81/EV去除录屏检测工具v2.81/软件截图.png
.png

Sharing

General

Malware Config

Signatures

Files

293ecf39b00ce2b95265106a9cd8bc7b

Headers

File Characteristics

Imports

msvbvm60

msvcrt

iphlpapi

psapi

kernel32

user32

advapi32

shell32

Sections

.text Size: 68KB - Virtual size: 176KB

.vmp Size: 952KB - Virtual size: 952KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 4KB

.vmp Size: 4KB - Virtual size: 4KB

f076a1e4fbab4d2c4bccbdc4ea8a1b72

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

advapi32

ole32

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 722B

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 2.3MB

UPX1 Size: 2.5MB - Virtual size: 2.5MB

.rsrc Size: 51KB - Virtual size: 52KB

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 224KB - Virtual size: 220KB

.data Size: 92KB - Virtual size: 200KB

.rsrc Size: 64KB - Virtual size: 62KB

.reloc Size: 2.9MB - Virtual size: 2.9MB

.text
Size: 68KB - Virtual size: 176KB

.vmp
Size: 952KB - Virtual size: 952KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

.vmp
Size: 4KB - Virtual size: 4KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 722B

UPX0
Size: - Virtual size: 2.3MB

UPX1
Size: 2.5MB - Virtual size: 2.5MB

.rsrc
Size: 51KB - Virtual size: 52KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 224KB - Virtual size: 220KB

.data
Size: 92KB - Virtual size: 200KB

.rsrc
Size: 64KB - Virtual size: 62KB

.reloc
Size: 2.9MB - Virtual size: 2.9MB