Overview

overview

8

Static

static

7

PYJJ_Plus_4018.exe

windows7-x64

7

PYJJ_Plus_4018.exe

windows10-2004-x64

7

$PLUGINSDI...sh.dll

windows7-x64

3

$PLUGINSDI...sh.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$SYSDIR/$0.dll

windows7-x64

1

$SYSDIR/$0.dll

windows10-2004-x64

1

$TEMP/CPlug.exe

windows7-x64

1

$TEMP/CPlug.exe

windows10-2004-x64

8

Tools/imetool.exe

windows7-x64

7

Tools/imetool.exe

windows10-2004-x64

7

Tools/indicdll.dll

windows7-x64

1

Tools/indicdll.dll

windows10-2004-x64

1

Tools/internat.exe

windows7-x64

1

Tools/internat.exe

windows10-2004-x64

1

about.htm

windows7-x64

1

about.htm

windows10-2004-x64

1

jj_biaod.htm

windows7-x64

1

jj_biaod.htm

windows10-2004-x64

1

license.rtf

windows7-x64

4

license.rtf

windows10-2004-x64

1

py/lib/$0.exe

windows7-x64

6

py/lib/$0.exe

windows10-2004-x64

6

pytips.htm

windows7-x64

1

pytips.htm

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    76978c74055733ffcd535a17dd4c269d

  • Size

    8.1MB

  • MD5

    76978c74055733ffcd535a17dd4c269d

  • SHA1

    5656d4e18a622a6c1b22f1974a8a985314513bb5

  • SHA256

    1a5ef099f121e447a22acad18d24462d02589d9e76960b0c6b67fbd58df9eb98

  • SHA512

    6a346213551d16cebbbbb6ff9b13addfaf17d3d22acf05d49d1e9594b433460e6c7d9c02e94186639f8db9043172a4440805ab6611ea23f2a4bc303fe69f223f

  • SSDEEP

    196608:ihA9CllGCBvVFZdMXxm/+eF0aOsNjxSITe4d+nhem:ill0HBm2ej5xSCeo+h/

Score
7/10
upxaspackv2

Malware Config

Signatures

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 14 IoCs

    Checks for missing Authenticode signature.

Files

  • 76978c74055733ffcd535a17dd4c269d
    .rar
  • PYJJ_Plus_4018.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/AdvSplash.dll
    .dll windows:4 windows x86 arch:x86

    741b6bafe355b63a372d737b30543a95


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/CNNIC.ini
  • $PLUGINSDIR/Contset.ini
  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    7868cd55f358bfb360f9eb8ce1512ca0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    6bc108eed3ca99f68adee56e9c99fac6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/splash.bmp
  • $PLUGINSDIR/splash.wav
  • $SYSDIR/$0
    .dll windows:4 windows x86 arch:x86

    8190aaa05a848b49f8c39a3521426aed


    Headers

    Imports

    Exports

    Sections

  • $TEMP/CPlug.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Skins/Plusdz.jsn
  • Skins/SirSɫƤ.jsn
  • Skins/fjayɫĬ.jsn
  • Skins/xcyfq01.jsn
  • Skins/xcyfq02.jsn
  • Skins/ʥ.jsn
  • Skins/ͳ Windows.jsn
  • Skins/.jsn
  • Skins/ӥɫˮ.jsn
  • Skins/.jsn
  • Skins/ͨ.jsn
  • Skins/̲.jsn
  • Skins/.jsn
  • Tools/imetool.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Tools/indicdll.dll
    .dll windows:5 windows x86 arch:x86

    e849a4fb4c69e579ec1b546f9edc4a93


    Headers

    Imports

    Sections

  • Tools/internat.exe
    .exe windows:5 windows x86 arch:x86

    6ec4b9854181010bb09f30f0c6b36520


    Headers

    Imports

    Sections

  • Tools/readme.txt
  • about.htm
    .html
  • bd/abc.txt
  • bd/jiajia.txt
  • bd/weiruanpy.txt
  • bd/ziguanpy.txt
  • bd0.txt
  • bd1.txt
  • bd2.txt
  • bd3.txt
  • bd4.txt
  • bd5.txt
  • bd6.txt
  • bd7.txt
  • bihua.bin
  • clc.bin
  • cs.bin
  • dz.bin
  • fh0.txt
  • fh1.txt
  • fh2.txt
  • fh3.txt
  • fh4.txt
  • fh5.txt
  • fh6.txt
  • fh7.txt
  • fzm.bin
  • jj_biaod.htm
    .html
  • license.rtf
    .rtf
  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • pinyin.bin
  • py/lib/$0
    .exe windows:4 windows x86 arch:x86

    7b77a9431cd2e1a48da23f16c7f84614


    Headers

    Imports

    Sections

  • py/lib/ʿ.txt
  • py/lib/ʮ.txt
  • pyfu.bin
  • pytips.htm
    .html
  • readme.htm
    .html
  • skins/BlueWonder(Big Font).jsn
  • skins/BlueWonder(Classical).jsn
  • skins/BlueWonder(Small Font).jsn
  • skins/BlueWonder(΢ź).jsn
  • top0.txt
  • top1.txt
  • top2.txt
  • top3.txt
  • top4.txt
  • top5.txt
  • top6.txt
  • top7.txt
  • uh.txt
  • users/$0/_pytmp.bin
  • users/$0/bd0.txt
  • users/$0/fh0.txt
  • users/$0/jj.bin
  • users/$0/jj.ini
  • usrword.txt
  • ע.txt
  • 新云软件.url
    .url
  • 注意事项.txt
  • 自述文件.txt