Static task
static1
Behavioral task
behavioral1
Sample
神仙道外挂v2.0安装/新云软件.url
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
神仙道外挂v2.0安装/新云软件.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
神仙道外挂v2.0安装/神仙道外挂v2.0版.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
神仙道外挂v2.0安装/神仙道外挂v2.0版.exe
Resource
win10v2004-20231215-en
General
-
Target
419af7f03c8c3a09445fdfc7576f714c
-
Size
3.0MB
-
MD5
419af7f03c8c3a09445fdfc7576f714c
-
SHA1
c8667101ce168db13ec330dfe1b521e1fca9deaf
-
SHA256
d280569bbe849c0080756e5d7723b7d32ea523af39e39b5b8e4bde32b6a5531f
-
SHA512
9e78b6b3acb6b217b404d2a59ee7231a3d1047fe0d19ad8d36a5934cf1ecd5537045d636b889b4e46c4d59911586e21ea1d8ecf0072f7a9ec2b1c52d5639e312
-
SSDEEP
49152:pfQyZroosKg09ztGugq9Wwfogixg/YE/cCdu9iKEZwO26ipC99tCNLjGxtHZWiGU:pYyZiKg09zRn9W+piGg8IiK3rXpUtCNo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/神仙道外挂v2.0安装/神仙道外挂v2.0版.exe
Files
-
419af7f03c8c3a09445fdfc7576f714c.rar
-
神仙道外挂v2.0安装/新云软件.url.url
-
神仙道外挂v2.0安装/神仙道外挂.log
-
神仙道外挂v2.0安装/神仙道外挂.md5
-
神仙道外挂v2.0安装/神仙道外挂v2.0版.exe.exe windows:4 windows x86 arch:x86
26b27b8bb82fd207b19adb9d0f9397ef
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessA
WriteFile
CreateDirectoryA
GetTempPathA
ReadFile
CloseHandle
GetFileSize
CreateFileA
GetModuleFileNameA
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
HeapAlloc
HeapFree
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
GetStringTypeW
user32
MessageBoxA
wsprintfA
SetWindowTextA
SetWindowPos
ShowWindow
UpdateWindow
EndDialog
DialogBoxParamA
Sections
.text Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ