LoadEnvi
MemoryCompare
MemoryCopy
MemorySet
WndProc1
WndProc1_
WndProc2
WndProc2_
WndProc3
WndProc3_
Behavioral task
behavioral1
Sample
火绒断网修复.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
火绒断网修复.exe
Resource
win10v2004-20231215-en
Target
030bb8bc52138f394bf28e7ad19e3572c02aad9b9883bd67b3b892c5637c6db8
Size
1.9MB
MD5
0a3c4d75b35deb682a614efa1d69a632
SHA1
9f7fd104272fc2af8ae9ff9b7202d2b76e82e2da
SHA256
030bb8bc52138f394bf28e7ad19e3572c02aad9b9883bd67b3b892c5637c6db8
SHA512
ccf1a0d63cfef110e57c5430a4bfe360ff46a25f53e67df6eaf54f835a4a89246bace2f9b7c30fa0b2290476883382ab81e04a5471c27765220d1c09723f752e
SSDEEP
49152:UZ98c1jOcKRywMWEmgxVMpVNr9jvaAMObjCRlgbVJQh:4bScKRyvWPom5FvXxb2IBK
resource | yara_rule |
---|---|
static1/unpack001/火绒断网修复.exe | upx |
Checks for missing Authenticode signature.
resource |
---|
unpack001/火绒断网修复.exe |
unpack002/out.upx |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
LoadEnvi
MemoryCompare
MemoryCopy
MemorySet
WndProc1
WndProc1_
WndProc2
WndProc2_
WndProc3
WndProc3_
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ