7f5e4c72cb406128c2b7cfff9f3e1ce5

Sharing

Copy URL Twitter E-mail

General

Target

7f5e4c72cb406128c2b7cfff9f3e1ce5
Size

126KB
MD5

7f5e4c72cb406128c2b7cfff9f3e1ce5
SHA1

ff941c4c494578ea255c7e54df4da93ec22a6971
SHA256

bc9055aae26e49b702620f21d813b33f060292f2ca9119ad529ca3395c50a345
SHA512

eb513485756175ec6cbe0b558e605309e4852a8b669bc438653494198488189de9c2409efa819d1c54a371417181f68257f977031ac18dbf9141a49cfb4129f5
SSDEEP

3072:VO6ctYdJDCLtj56P6RkxYDQo7aqaLexg9lzn32joW/5+Uz5ZlLuy0YuUNbdkBw:VRNNih7ZaLexg9hmjoW/5+Uz5ZxuOuU9

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/阿男脱机QQ挂机系统 v0.2/qqserver1.dll	aspack_v212_v242

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/阿男脱机QQ挂机系统 v0.2/qqserver.dll
unpack001/阿男脱机QQ挂机系统 v0.2/qqserver1.dll

Files

7f5e4c72cb406128c2b7cfff9f3e1ce5
.rar
阿男脱机QQ挂机系统 v0.2/brush.asp
.html .vbs polyglot
阿男脱机QQ挂机系统 v0.2/inc.asp
阿男脱机QQ挂机系统 v0.2/index.asp
.html .vbs polyglot
阿男脱机QQ挂机系统 v0.2/mb1.css
阿男脱机QQ挂机系统 v0.2/md5.asp
.vbs
阿男脱机QQ挂机系统 v0.2/qq.mdb
阿男脱机QQ挂机系统 v0.2/qqserver.dll
.dll regsvr32 windows:4 windows x86 arch:x86

1aea56803564b6475c82ac792812e026

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaVarTstGt
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
ord693
__vbaFreeVar
__vbaFreeVarList
__vbaVarIdiv
_adj_fdiv_m64
__vbaVarIndexStore
__vbaFreeObjList
ord516
_adj_fprem1
ord518
__vbaI2Abs
__vbaStrCat
__vbaVarCmpNe
ord629
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaVarIndexLoadRefLock
ord593
__vbaVarForInit
ord594
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
__vbaVargVar
__vbaBoolVarNull
__vbaRefVarAry
__vbaVarTstLt
_CIsin
__vbaErase
__vbaVargVarMove
ord632
__vbaChkstk
EVENT_SINK_AddRef
__vbaVarTstEq
__vbaObjVar
__vbaVarOr
__vbaVarLateMemSt
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
_adj_fprem
_adj_fdivr_m64
__vbaVarDiv
ord608
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord535
_CIlog
__vbaErrorOverflow
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
ord573
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
ord101
ord102
__vbaI4Var
ord103
__vbaVarCmpEq
ord104
ord105
__vbaLateMemCall
__vbaVarAdd
__vbaVarDup
__vbaVarMod
__vbaVarLateMemCallLd
__vbaVarCopy
__vbaFpI4
__vbaVarSetObjAddref
_CIatan
__vbaCastObj
__vbaStrMove
__vbaI2ErrVar
_allmul
_CItan
ord546
__vbaFPInt
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeObj
__vbaFreeStr
__vbaI4ErrVar

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
阿男脱机QQ挂机系统 v0.2/qqserver.reg
阿男脱机QQ挂机系统 v0.2/qqserver1.dll
.dll regsvr32 windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

CODE
Size: 72KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
阿男脱机QQ挂机系统 v0.2/下载说明.htm
.html .js polyglot
阿男脱机QQ挂机系统 v0.2/卸载.bat
阿男脱机QQ挂机系统 v0.2/安装.bat
阿男脱机QQ挂机系统 v0.2/安装说明.txt

Sharing

General

Malware Config

Signatures

Files

1aea56803564b6475c82ac792812e026

Headers

File Characteristics

Imports

msvbvm60

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 34KB

.data Size: 4KB - Virtual size: 844B

.rsrc Size: 8KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 2KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 72KB - Virtual size: 188KB

DATA Size: 1KB - Virtual size: 4KB

BSS Size: - Virtual size: 4KB

.idata Size: 1KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.reloc Size: 9KB - Virtual size: 16KB

.rsrc Size: 10KB - Virtual size: 20KB

.aspack Size: 5KB - Virtual size: 8KB

.adata Size: - Virtual size: 4KB

.text
Size: 36KB - Virtual size: 34KB

.data
Size: 4KB - Virtual size: 844B

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 2KB

CODE
Size: 72KB - Virtual size: 188KB

DATA
Size: 1KB - Virtual size: 4KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 1KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.reloc
Size: 9KB - Virtual size: 16KB

.rsrc
Size: 10KB - Virtual size: 20KB

.aspack
Size: 5KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB