Static task
static1
Behavioral task
behavioral1
Sample
Settings/新云软件.url
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Settings/新云软件.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
hstwintoolbox.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
hstwintoolbox.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
iShowFX Azure II.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
iShowFX Azure II.exe
Resource
win10v2004-20231215-en
General
-
Target
4fb86cbdf29291d4cc6c090c51d7ae02
-
Size
226KB
-
MD5
4fb86cbdf29291d4cc6c090c51d7ae02
-
SHA1
b6c56ed01fa7652df7f750d7565b09d1baddb7c6
-
SHA256
59de47a4029f2cb21317fd6ce8056edcd4e40d5d6c3c8281ea58337f62980d78
-
SHA512
254e50473fb8ca7f1fbc5cca6b4a97f922bb8473bcc779593fddac56cc5f7a4e7f4bf4d742fe46f33697d9971f08b4fbdb9894bcc848c9bafc44d4670d929577
-
SSDEEP
6144:nRvIsyo2tyJ/yUKo/mr9H/Xng/6SxA6XlEZFNK:RgsyoqqWjFPg/6ONl5
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/hstwintoolbox.dll unpack001/iShowFX Azure II.exe
Files
-
4fb86cbdf29291d4cc6c090c51d7ae02.rar
-
Settings/6188Support.xml
-
Settings/AolSupport.xml
-
Settings/BaiduSupport.xml
-
Settings/BiZhiSupport.xml
-
Settings/BingSupport.xml
-
Settings/CndeskSupport.xml
-
Settings/DeskcitySupport.xml
-
Settings/HuidSupport.xml
-
Settings/ZhuokuSupport.xml
-
Settings/新云软件.url.url
-
hstwintoolbox.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
iShowFX Azure II.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 336KB - Virtual size: 333KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
iShowFX软件介绍.txt
-
设置文档说明.txt