���ɋ���$/��9k�gT� �r���p��4}�_{���a6hlRb���/�� �S�O��m�]������,�� TZj�Pؒ�����qj�S�c:2$���[�,��6��Q�������}}+� *�{z�eZ��#���NrA��|d؉��u-zK�?l��M���IP�i:��]nD1�]/�jI��AJ ��<�1�YG>�����uD�AY�A�fC�i�9� �_.���w�#�u!�5�[�U���Z���iٌȚ�μػ�k~��$C�}��H���+7��s�վm��q��ؠ�=DW8T���8�_og�@Tu�~�m�w���B"�������D���Q�*�k�5x_��2�v��rn-�e�_f���s?���3洲�����`����a_Ch��?*�I����9�SC��D����w���9״0-!�Y���2r�0�SӞ`��k����7 �q��xl@��:�����b� CvP��D,�"�f= ���OZ�y�Cј��=�y���BU�t:{}1磜3�`丆�Ώ�B7dqt٘�i�F���FB�5�M��ǓR=��]��܃���k���]:���>3� yal��Km*o��(��7� UV#DY����yTzE`B�7��̬���?��;����Ԩ��v$�U���@Z�m�s���aGx�gr[��R��[D��L�l���\5�:� NN����mI��]ab�=3���R�!t��i �>r8k<�FP�.=$���a��Pu'6�=N8Z�a�|�݊����}� �]Hl8���c^����}/�ˡ������@�~ms�]���*oP�ʲ]ͯ�/�۵�ƆvF<k7����M���ݷi��=��$5���?�F!Z�n��⸮?��\��LS,�KR�u%�"X��o ma���lM��!�E��SÄu]��$����m�|�C�L n���pyB��r�豳e.�tiu���8�wc��.kBO*h��&�����2����B�����;ل��L��E@�xfצ��e�������:ƕ��ai� ?�.)�+��B3��cڷn[��5֦>�����R��@��#]F��>1���K���74�%�c����imu� �2�"��p�8B�XJtj��ո��(>���*�k�͚�g[ݝ@R�r잒���\>���,)r��9��,�����k���R�]��C�bZ't3P�2j��%%�a�:A����>�Z�Qڹ����'?�9^V�;ckh#��&� D|��g�D��6�Fp�A�eC�#�����2�ulL�������� �b���`�������N[��.�xΙJd������&t{��1%�;�����r�xT[:��a1c,��� 5�ȓ��ZB�&^�ln�O^�H%��\��:���8�`�|C6�?�!>�m�8�ۀ�$��5\y��Pǿ�4�nٻP.�f����j��3��r����D�B�Wࣃ�i_�|n��%�6��# ��K��|��AV�� k*�c[�u�0q������7�*���q�6�������ᨹ�⅂�z�y���?�%A�P. �<ִ�VF#P����%��IK�e �w4�Ϝ~ݢ�so��q���*Z�G�B�����P����%e~�����٘��_� �4o���0�7�SQ��H�?�7ݧ�Q�T��}�!#Φ���I��=��g�Q��Y$+�vgs Z¦6���dR m})��yW�.u�;,��lc�Iw&D"����톏*�3����V3������' Ǯ�Ah�j)u�l�^�wUT.����Ic/����}r4�%K��/7\{Z�LqӶ\$�E���&(��Н&�4��N=�,t�;UY�9'����@��7�Ņ�� .7�<�#�VTC�1.�&@�3e?���^;�-����/�$�A��K�j`+ӓ�V�×jO4�'�i��E�z�>=��7����V�P-Dž�������hڞv�q@�*p�/��[�#�Yi������"��_�h�|�t����������Xj�"M�3���b��6�|9D+��b/YW(!{T+7�o�mڷ�� �%Zh4�Ƴ��\��Z�$KS'Q�#Vh����"c����|Nx:GQ�6n��;&<;�b� ��E�1���\�>�7W�,�=e�+�.����CR�������^�e�{ޘ쿻ݔH�j��5,��p�hਈ\�]�$JЈ�dA*�1�< ����L��{��q{�О���Ҿ��[W?�h�^\k��}�,XY��������>vv,G���9��O[�M�=[���uh�+鳹FN��V2㡿d�>���?�ǚ�X�c�R� ���t���G�TS���ry�*b�⾜�rh�6IJ�2g�:z{)�i1x����LF���f�X� r������|����c��v� �� Tq����ϴi/i?�P�={?�_/m]�� �6��T�ҙ�d��.t��2gnuȶ�Gk���ˇ[�( ˿r0��K�Aĭ�E[<A�CaE-�{l6��T_�A,�� ����_on%���g a�N�c"�L���m�.Rَ����o����~>kH�K�s����E�)1ۮ2*4-Ԕ�'�P�N�7��"UM��*5��P�"���(�� ӭ��ɭd�qh���d/���o��d%*M��F��5�1OQv]lO=>�]�/c����fKJ�>C���|�n5du��-QW�� ���QQ"�1��m�q��������G�)�����s�oܔh[j���Q���}���3Q�lG��:�$�}e�����~�,�d�z�7���Y�kB7n���� )Lih�����/>�*M}���]];͊2�7�Ϧ@���T��A��j �G ��d�� �ϑ)��ʼn1����XdF�d#�&��og�pZ"�\����p���4�Χ�f��F��T����C+�^�O�%����� �w��}���KT���U�'ʛ��*ş ��S�s(:�� �v�W����bt���_O�- �̀����)�;ݳܦ��������}kQK �l��T�U{�����D�D�e)B(%�u3;$��Fq,�
Static task
static1
Behavioral task
behavioral1
Sample
DV 文件恢复系统 v1.3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
DV 文件恢复系统 v1.3.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20231215-en
General
-
Target
453b959971773699a0efd820045bb78c
-
Size
1.6MB
-
MD5
453b959971773699a0efd820045bb78c
-
SHA1
d752c7bc1a8dd210d3bdc81d03f0b5c7dec1466a
-
SHA256
970d577aeee6f6410c91c4c0badf7cec684fcaab86ff616e098dc0a70afb36d8
-
SHA512
c5e53a191d28077be5a1dae6c131f696218860af8153566e11a07c5ffd490460cb99c80558cfc6f775b564e93e4a89cf1d30a24b902308f0a7f74ed237a77ce8
-
SSDEEP
49152:PPH5fnkECmHQ4/qQwgd7SjVTMwAfUHDtW:HZfkzmHQQgs7SOOW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/DV 文件恢复系统 v1.3.exe
Files
-
453b959971773699a0efd820045bb78c.rar
-
DV 文件恢复系统 v1.3.exe.exe windows:4 windows x86 arch:x86
cec9e4188b2a3bf930752c9557a77e1d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GlobalFindAtomA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetCursorPos
advapi32
RegCloseKey
oleaut32
VariantClear
version
GetFileVersionInfoSizeA
gdi32
GetBrushOrgEx
ole32
CoUninitialize
comctl32
ImageList_GetIconSize
shell32
SHGetMalloc
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
CODE Size: - Virtual size: 826KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 132KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.DV0 Size: - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DV1 Size: 528KB - Virtual size: 528KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DV2 Size: - Virtual size: 536KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DV3 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 528KB - Virtual size: 527KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
新云软件.url.url