Overview
overview
7Static
static
7BHONLINE.exe
windows7-x64
1BHONLINE.exe
windows10-2004-x64
1BHVPN.exe
windows7-x64
3BHVPN.exe
windows10-2004-x64
7使用指南.chm
windows7-x64
1使用指南.chm
windows10-2004-x64
1新云软件.url
windows7-x64
1新云软件.url
windows10-2004-x64
1极速网�...��.exe
windows7-x64
1极速网�...��.exe
windows10-2004-x64
1连接不�...��.bat
windows7-x64
1连接不�...��.bat
windows10-2004-x64
1Behavioral task
behavioral1
Sample
BHONLINE.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
BHONLINE.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
BHVPN.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
BHVPN.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
使用指南.chm
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
使用指南.chm
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
新云软件.url
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
新云软件.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
极速网络测试工具.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
极速网络测试工具.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
连接不上运行本程序.bat
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
连接不上运行本程序.bat
Resource
win10v2004-20231215-en
General
-
Target
476d83ee1e718c311854f0bcc719b97b
-
Size
566KB
-
MD5
476d83ee1e718c311854f0bcc719b97b
-
SHA1
8fedf6460d08403bfa85c6e3b2807dfb6212da20
-
SHA256
f5c297b6f07a928632105f732bac20f64bcee378ef8e8da1cc11a82e7b75e26e
-
SHA512
c913f48bfd8b95ab19c3104d6ba6b348b5a9a36c8f8c18fca9c6e24a6bd64fd3ba3ad16c831b3a31f43caa83446aa5e23a70459536f15de759cecd305b0e6aaf
-
SSDEEP
12288:bdOy/e/yeN69ZwG2s7K+ZTjVETEdKsogLZ+L3J+IXBCpuzq8D:R7YNNVJ0VEQd9oh3oIXBCpuVD
Malware Config
Signatures
-
resource yara_rule static1/unpack001/极速网络测试工具.exe aspack_v212_v242 -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/BHONLINE.exe unpack001/BHVPN.exe unpack001/极速网络测试工具.exe
Files
-
476d83ee1e718c311854f0bcc719b97b.rar
-
BHONLINE.exe.exe windows:4 windows x86 arch:x86
5a566cc0049874f5a53c37d7404e1196
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalAlloc
GlobalFree
lstrcatA
WriteFile
CreateFileA
GetFileTime
CloseHandle
GetFileAttributesA
lstrcpyA
CompareStringW
CompareStringA
lstrlenA
lstrcmpiA
GetVersion
GetLastError
MultiByteToWideChar
GlobalGetAtomNameA
ConvertDefaultLocale
GetModuleHandleA
lstrcmpA
GlobalLock
GetCurrentThreadId
GetCurrentThread
CreateEventA
lstrcpynA
WritePrivateProfileStringA
FreeResource
GlobalUnlock
lstrcmpW
GlobalFindAtomA
LocalFree
FormatMessageA
MulDiv
SetLastError
InterlockedDecrement
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
LocalAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
ReadFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetCurrentProcess
GetVolumeInformationA
GetFullPathNameA
InterlockedIncrement
GlobalFlags
GlobalReAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetCPInfo
GetOEMCP
SetErrorMode
GetTickCount
RtlUnwind
ExitProcess
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
TerminateProcess
HeapReAlloc
HeapSize
SetStdHandle
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
GetTimeZoneInformation
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetEnvironmentVariableA
GlobalDeleteAtom
WaitForSingleObject
GetModuleFileNameA
GlobalAddAtomA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
LoadLibraryA
GetProcAddress
FreeLibrary
OpenMutexA
CreateMutexA
EnumResourceLanguagesA
ReleaseMutex
user32
MapWindowPoints
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
GetTopWindow
GetForegroundWindow
IsChild
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassInfoExA
GetClassLongA
CreateWindowExA
GetCapture
WinHelpA
DestroyMenu
GetDC
ReleaseDC
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
ClientToScreen
GetWindowDC
BeginPaint
EndPaint
SetCapture
LoadCursorA
ReleaseCapture
GetSysColorBrush
CharNextA
IsRectEmpty
SetRect
CopyAcceleratorTableA
InvalidateRect
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
RegisterClipboardFormatA
PostThreadMessageA
GetClassInfoA
RegisterClassA
UnregisterClassA
DefWindowProcA
GetSubMenu
OffsetRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetNextDlgTabItem
EndDialog
GetWindow
MapDialogRect
wsprintfA
GetWindowTextA
SetWindowPos
SetFocus
ShowWindow
MoveWindow
SetWindowLongA
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
GetDlgItem
SetMenuItemBitmaps
GetFocus
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowsHookExA
CallNextHookEx
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
MessageBoxA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
SetCursor
PostQuitMessage
GetMenuItemID
GetMenuItemCount
BroadcastSystemMessageA
TranslateMessage
DispatchMessageA
GetMessageA
RegisterWindowMessageA
DrawIcon
AppendMenuA
SendMessageA
PostMessageA
GetSystemMenu
IsIconic
GetClientRect
SetTimer
KillTimer
EnableWindow
LoadIconA
GetSystemMetrics
FindWindowA
CharUpperA
GetSysColor
AdjustWindowRectEx
SetForegroundWindow
UpdateWindow
IntersectRect
GetMenu
EqualRect
CallWindowProcA
SetWindowContextHelpId
shell32
ShellExecuteA
oleaut32
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
SysStringLen
SysAllocStringByteLen
OleCreateFontIndirect
SafeArrayDestroy
SysAllocString
SystemTimeToVariantTime
SysFreeString
VariantCopy
comctl32
ord17
shlwapi
PathStripToRootA
PathFindFileNameA
PathFindExtensionA
PathIsUNCA
oledlg
ord8
rasapi32
RasHangUpA
oleacc
LresultFromObject
CreateStdAccessibleObject
gdi32
GetBkColor
GetTextColor
GetRgnBox
GetMapMode
PtVisible
SetTextColor
SetBkColor
GetObjectA
GetDeviceCaps
ExtTextOutA
CreateRectRgnIndirect
SaveDC
RestoreDC
SetMapMode
RectVisible
TextOutA
GetStockObject
DeleteDC
ExtSelectClipRgn
GetClipBox
DeleteObject
GetViewportExtEx
GetWindowExtEx
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
CreateBitmap
winspool.drv
DocumentPropertiesA
ClosePrinter
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
ole32
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoRevokeClassObject
Sections
.text Size: 160KB - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
BHVPN.exe.exe windows:4 windows x86 arch:x86
8fbb990f4428ef80ebfe3a5dfcf7db43
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeResource
GlobalLock
GlobalUnlock
MulDiv
CreateEventA
ResumeThread
CloseHandle
GetWindowsDirectoryA
lstrcatA
WinExec
lstrcpyA
CompareStringW
CompareStringA
lstrcmpiA
GetVersion
GetLastError
MultiByteToWideChar
WaitForSingleObject
GlobalAddAtomA
Sleep
GlobalGetAtomNameA
GlobalDeleteAtom
GetModuleFileNameA
ResetEvent
SetEvent
GlobalAlloc
GlobalFree
lstrlenA
LoadLibraryA
GetProcAddress
FreeLibrary
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
OpenMutexA
CreateMutexA
ReleaseMutex
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
SetEnvironmentVariableA
IsBadCodePtr
IsBadReadPtr
GetTimeZoneInformation
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
SetStdHandle
HeapSize
HeapReAlloc
TerminateProcess
GetCommandLineA
GetStartupInfoA
CreateThread
ExitThread
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
RtlUnwind
ExitProcess
GetTickCount
SetErrorMode
GetOEMCP
GetCPInfo
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
RaiseException
EnumResourceLanguagesA
ConvertDefaultLocale
GetModuleHandleA
lstrcmpA
GetCurrentThreadId
GetCurrentThread
SetThreadPriority
SuspendThread
SetLastError
WritePrivateProfileStringA
lstrcpynA
lstrcmpW
GlobalFindAtomA
LocalFree
FormatMessageA
InterlockedDecrement
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FindClose
FindFirstFileA
CreateFileA
GetFileAttributesA
GetFileSize
GetFileTime
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetCurrentProcess
GetVolumeInformationA
GetFullPathNameA
InterlockedIncrement
GlobalFlags
user32
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
SetWindowsHookExA
GetMenuCheckMarkDimensions
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetFocus
SetMenuItemBitmaps
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
EndDialog
GetNextDlgTabItem
GetDlgItem
DestroyWindow
CreateDialogIndirectParamA
SetActiveWindow
GetDesktopWindow
wsprintfA
MapDialogRect
SetWindowContextHelpId
GetWindow
GetWindowPlacement
IntersectRect
CallWindowProcA
DefWindowProcA
GetDlgCtrlID
UnregisterClassA
RegisterClassA
GetClassInfoA
EqualRect
AdjustWindowRectEx
GetMenuItemCount
GetMenuItemID
GetMenu
UpdateWindow
IsWindowEnabled
GetMessageTime
UnhookWindowsHookEx
GetTopWindow
GetForegroundWindow
GetActiveWindow
GetWindowTextLengthA
IsChild
SetFocus
SendDlgItemMessageA
SetPropA
GetClassNameA
GetClassInfoExA
GetClassLongA
CreateWindowExA
WinHelpA
IsDialogMessageA
SetWindowTextA
MoveWindow
ShowWindow
GetSysColorBrush
CharNextA
IsRectEmpty
CopyAcceleratorTableA
InvalidateRgn
GetNextDlgGroupItem
EnableWindow
PostThreadMessageA
PostQuitMessage
GetClientRect
SetWindowRgn
PostMessageA
LoadBitmapA
GetKeyState
PeekMessageA
ValidateRect
MessageBoxA
GetWindowLongA
GetWindowTextA
GetLastActivePopup
SetRect
DrawIcon
SendMessageA
IsIconic
RegisterWindowMessageA
BroadcastSystemMessageA
MapWindowPoints
SetCapture
FrameRect
OffsetRect
CopyRect
FillRect
CopyIcon
MessageBeep
IsWindow
GetMessagePos
GetParent
KillTimer
ReleaseDC
ScreenToClient
GetWindowRect
InflateRect
PtInRect
DrawFocusRect
ClientToScreen
WindowFromPoint
GetSysColor
GetDC
DrawEdge
GetCapture
ReleaseCapture
CharUpperA
SystemParametersInfoA
SetWindowPos
SetDlgItemTextA
SetTimer
FindWindowA
GetCursorPos
LoadMenuA
GetSubMenu
SetMenuDefaultItem
TrackPopupMenu
DestroyMenu
GetWindowThreadProcessId
EnumThreadWindows
GetSystemMetrics
LoadIconA
LoadCursorA
SetCursor
GetPropA
SetWindowLongA
RemovePropA
LoadImageA
SetForegroundWindow
SetParent
IsWindowVisible
InvalidateRect
RegisterClipboardFormatA
gdi32
GetClipBox
SetMapMode
SetTextColor
GetDeviceCaps
CreateSolidBrush
GetTextExtentPoint32A
CreateFontIndirectA
ExtTextOutA
SelectClipRgn
CreateRectRgn
CombineRgn
DeleteDC
SetBkMode
SetBkColor
RestoreDC
SaveDC
GetRgnBox
GetTextColor
GetBkColor
GetMapMode
CreateRectRgnIndirect
CreateBitmap
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetObjectA
CreateCompatibleDC
StretchBlt
CreateRoundRectRgn
FrameRgn
CreateFontA
CreateCompatibleBitmap
SelectObject
BitBlt
GetPixel
GetTextMetricsA
DeleteObject
advapi32
RegDeleteKeyA
RegOpenKeyA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
RegQueryValueA
RegEnumKeyA
shell32
ShellExecuteA
Shell_NotifyIconA
ole32
CLSIDFromString
CLSIDFromProgID
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CreateStreamOnHGlobal
StgOpenStorageOnILockBytes
CoGetClassObject
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
oleaut32
VariantCopy
SysAllocString
SafeArrayDestroy
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocStringByteLen
SysStringLen
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysFreeString
OleLoadPicture
comctl32
InitializeFlatSB
_TrackMouseEvent
ord17
shlwapi
PathFindExtensionA
PathFindFileNameA
UrlUnescapeA
PathStripToRootA
PathIsUNCA
rasapi32
RasGetErrorStringA
RasGetProjectionInfoA
RasDialA
RasGetConnectStatusA
RasSetEntryPropertiesA
RasDeleteEntryA
RasHangUpA
oledlg
ord8
iphlpapi
GetAdaptersInfo
GetIpForwardTable
DeleteIpForwardEntry
CreateIpForwardEntry
wininet
HttpOpenRequestA
InternetConnectA
HttpEndRequestA
HttpSendRequestA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetSetOptionExA
InternetQueryDataAvailable
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
HttpQueryInfoA
setupapi
SetupDiCallClassInstaller
SetupDiGetClassDevsA
SetupDiOpenClassRegKey
SetupDiEnumDeviceInfo
SetupDiSetClassInstallParamsA
netapi32
Netbios
ws2_32
WSACleanup
gethostbyname
gethostbyaddr
WSAStartup
inet_addr
oleacc
CreateStdAccessibleObject
LresultFromObject
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
comdlg32
GetFileTitleA
Sections
.text Size: 256KB - Virtual size: 253KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 968KB - Virtual size: 967KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
JisuSpeeds.ini
-
使用指南.chm.chm
-
新云软件.url.url
-
极速网络测试工具.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 74KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 18KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
极速闪电l2tp(连接需要证书问题).reg
-
连接不上运行本程序.bat