Static task
static1
Behavioral task
behavioral1
Sample
hps2.5_cn_060117.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
hps2.5_cn_060117.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
非常世纪资源网.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
非常世纪资源网.url
Resource
win10v2004-20231215-en
General
-
Target
71c8e545746486bf532a6fa45cc2f2a4
-
Size
6.8MB
-
MD5
71c8e545746486bf532a6fa45cc2f2a4
-
SHA1
2e56fbd741333ef26abdb12cf23b98231aceb1a5
-
SHA256
cfdbdf3bc875022327c9e9a5c4df2194be844174811fd16819e5023883ee21b5
-
SHA512
acd7bb21cc6a647beebb75e640155b348f577381750253653ad2d9c5f1a959436e166593539af457f6205a5271fe02dc45a3a06cee6863008b3775e077c8eb9b
-
SSDEEP
196608:o6J+8gh/+sZKjSJJu/TEb7vJOl1zb4OanV7LXulTB/vEXN0:o/8gcsZKjSvT7Rg134OanVs/vEXN0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/hps2.5_cn_060117.exe
Files
-
71c8e545746486bf532a6fa45cc2f2a4.rar
-
hps2.5_cn_060117.exe.exe windows:4 windows x86 arch:x86
6d9712f9da2b029381c098de91ab074d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
GetTempPathA
CreateDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryA
LoadLibraryExA
GetFullPathNameA
LoadLibraryExW
WideCharToMultiByte
LoadLibraryA
LoadLibraryW
Sleep
FindNextFileA
SetFileAttributesA
IsBadReadPtr
WriteProcessMemory
GetCurrentProcess
GetModuleHandleA
OpenFile
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileIntA
GetVersionExA
CreateThread
CloseHandle
GetPrivateProfileStringA
GetProcAddress
GetDiskFreeSpaceA
CreateEventA
SetEvent
ResetEvent
WaitForSingleObject
FlushFileBuffers
DeleteFileA
GetVersion
GetACP
GetSystemDirectoryA
OpenEventA
HeapReAlloc
IsBadCodePtr
IsBadWritePtr
SetUnhandledExceptionFilter
VirtualAlloc
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetStdHandle
GetFileType
SetHandleCount
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
ExitProcess
HeapAlloc
HeapFree
HeapSize
GetCommandLineA
GetStartupInfoA
RtlUnwind
RemoveDirectoryA
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
FindFirstFileA
FindClose
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA
_llseek
_lread
_lopen
GetFileSize
_lcreat
_lclose
_lwrite
lstrcmpiA
lstrlenA
GetWindowsDirectoryA
lstrcatA
lstrcpyA
LocalFree
WinExec
LocalAlloc
user32
LoadIconA
GetClientRect
DefWindowProcA
BeginPaint
EndPaint
UpdateWindow
PostQuitMessage
GetMessageA
IsWindow
IsDialogMessageA
TranslateMessage
DispatchMessageA
GetDesktopWindow
RegisterClassA
LoadCursorA
CheckRadioButton
wsprintfA
LoadStringA
SendMessageA
PostMessageA
EndDialog
DialogBoxParamA
DestroyWindow
SetWindowPos
SetForegroundWindow
CreateDialogParamA
ExitWindowsEx
SetWindowTextA
CheckDlgButton
GetDlgItemTextA
MessageBoxA
IsDlgButtonChecked
GetCursorPos
GetClassLongA
SetClassLongA
SetDlgItemTextA
SetTimer
KillTimer
EnableWindow
SetFocus
InvalidateRect
GetDC
ReleaseDC
ShowWindow
CreateWindowExA
GetDlgItem
GetWindowRect
ScreenToClient
gdi32
RealizePalette
StretchDIBits
SelectPalette
SetStretchBltMode
GetDeviceCaps
CreatePalette
CreateDIBitmap
DeleteObject
advapi32
RegQueryValueA
RegDeleteValueA
RegOpenKeyA
RegEnumKeyA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
RegDeleteKeyA
RegSetValueA
RegQueryValueExA
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
ole32
CoUninitialize
CoCreateInstance
CoInitialize
comctl32
ord17
ImageList_LoadImageA
winmm
ord2
Sections
.text Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 182KB - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
下载说明.htm.html .js polyglot
-
使用说明.txt
-
安装说明.txt
-
非常世纪资源网.url.url