855135fe4d3bf906b9e33ec8577fd537
- SHA256 4c3444fba14c364f4a1020ac2dd4b0d84f83b8c71ad45c38ca46cab1023d669e
Behavioral task
behavioral1
Sample
v2009/IconCreater.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
v2009/IconCreater.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
v2009/data/MFC42.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
v2009/data/MFC42.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
v2009/data/RPHOQ.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
v2009/data/RPHOQ.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 855135fe4d3bf906b9e33ec8577fd537
- Size 2.1MB
- Sample240131-28yt3sgcdj
- SHA256 4c3444fba14c364f4a1020ac2dd4b0d84f83b8c71ad45c38ca46cab1023d669e
- MD5 855135fe4d3bf906b9e33ec8577fd537
- SHA1 7a84a70bb6ce2b5cd942c9aacfaa5455158d4e62
- SHA512 ecdba0481249c1f5ec419dbee37763837544cffdf00ced31288f0439381eb8833ed56b6bd489e3cb8327205466e70c3683034a639eaf30d4cf8c167347a21784
- SSDEEP 24576:rIUj3IUj8mcCavlI5NNcqtxvX6UDtLz7n0iSh8sCcpxiVDYALAemUEab0NcgaqxM:cUjYUj81la5Xcg50BhEDY2RbmniONFw
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/v2009/data/MFC42.dll vmprotect static1/unpack001/v2009/data/RPHOQ.dll vmprotect - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/v2009/IconCreater.exe unpack001/v2009/data/MFC42.dll unpack001/v2009/data/RPHOQ.dll
File Explorer
-
855135fe4d3bf906b9e33ec8577fd537.rar 2.1MB
-
v2009/IconCreater.exe.exe 204KB
-
v2009/data/MFC42.dll.dll 248KB
-
v2009/data/RPHOQ.dll.dll 248KB
-
v2009/data/gersangcn.ini379B
-
v2009/data/gersangjp.ini375B
-
v2009/data/skin70KB
-
v2009/hq1.6MB
v2009/IconCreater.exe
- IMPHASH d88039e15f2835e9959972509b1475c3
- SHA256 eb0f3c1ca4b324aff3cacac9fa28a10a9e9944509a37f2bc5667ffccc2b03725
- MD5 c282bd3486c7a66e9e08300b0e89bf4f
- SHA1 1bbbf2a89554d369eec4a611448ca9551215c9a4
- SHA512 a8eaf51dcfdf08d3848bab9ca4fcd77830fe11c404865e05ea49ba5e02ce4e34ffbe4db115968d30634a9f0c71b64f09e20cabe1573c769adb21a5a5fa9bb282
- SSDEEP 3072:5bq2f3wVFQWcOxC7N7dNwM9UsVivem8lIwEF:Xf3wV67KKN7dNwMysVmO2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10352
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
CreateFileA
SetFilePointer
SetEndOfFile
SetStdHandle
VirtualAlloc
HeapReAlloc
HeapAlloc
SetConsoleCtrlHandler
RtlUnwind
VirtualFree
HeapFree
LCMapStringA
MultiByteToWideChar
GetCurrentDirectoryA
FlushFileBuffers
CreateProcessA
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetFileType
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetLastError
CloseHandle
ReadFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
LCMapStringW
user32
LoadStringA
LoadAcceleratorsA
EndDialog
DialogBoxParamA
DestroyWindow
DefWindowProcA
BeginPaint
GetClientRect
DrawTextA
EndPaint
PostQuitMessage
CreateWindowExA
GetDesktopWindow
wsprintfA
MessageBoxA
LoadCursorA
RegisterClassExA
advapi32
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
Name
.text
Size
144KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=14, version=7299,
count=67, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=95, version=2190,
count=11, id=93, version=2179,
count=81, id=1, productName=Unmarked objects,
count=3, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
v2009/data/MFC42.dll
- IMPHASH 94fa43739f7c501c69a4771f178b9d59
- SHA256 823085ae318bef15d41ec27ffa59144ab320d40ddbdb8f9dbc2083d1b8cbcf26
- MD5 e6a8231e861c6d024ad270f1100fb659
- SHA1 a67d3aca8283a6917965beb471047093b598d3dc
- SHA512 f28527f42aaab435f571117bf543fbb52938e32b791fd1c3adf6bba8777fddd57016bd48ff732fb29d3ec0cf482e388b1eb5ceb18ca890ccae95b9be46ee048d
- SSDEEP 6144:p966ec6WLO2LnpUtfTwepMz5W9h7UAZ8:ac/LvjpOfI891Z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
64790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
wsock32
closesocket
kernel32
GetProcAddress
GetModuleHandleA
VirtualProtect
SetCurrentDirectoryA
GetCurrentDirectoryA
Sleep
GetSystemTimeAsFileTime
GetCurrentThreadId
ResumeThread
SuspendThread
LoadLibraryA
GetCommandLineA
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
CloseHandle
SetEnvironmentVariableA
OpenThread
TlsAlloc
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetLastError
FindFirstFileA
FindNextFileA
ExitProcess
TerminateProcess
GetCurrentProcess
ExitThread
CreateThread
GetVersionExA
HeapFree
EnterCriticalSection
LeaveCriticalSection
WriteFile
HeapAlloc
DeleteCriticalSection
SetLastError
TlsFree
TlsSetValue
TlsGetValue
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
RtlUnwind
InterlockedExchange
VirtualQuery
SetFilePointer
CreateFileA
InitializeCriticalSection
MultiByteToWideChar
GetSystemInfo
ReadFile
GetTimeZoneInformation
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapSize
GetACP
GetOEMCP
GetCPInfo
LCMapStringA
LCMapStringW
SetEndOfFile
user32
SetWindowsHookExA
CallNextHookEx
EnumDisplaySettingsA
ChangeDisplaySettingsA
ShowWindow
SetFocus
MessageBoxA
GetForegroundWindow
PostMessageA
advapi32
RegQueryValueExA
RegCloseKey
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
_pRecv
_pRecv1
_pSend
Name
.text
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
mydata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp0
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.vmp1
Size
88KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=105, version=2067,
count=24, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=123, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=7, id=93, version=2179,
count=113, id=1, productName=Unmarked objects,
count=7, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
v2009/data/RPHOQ.dll
- IMPHASH 94fa43739f7c501c69a4771f178b9d59
- SHA256 823085ae318bef15d41ec27ffa59144ab320d40ddbdb8f9dbc2083d1b8cbcf26
- MD5 e6a8231e861c6d024ad270f1100fb659
- SHA1 a67d3aca8283a6917965beb471047093b598d3dc
- SHA512 f28527f42aaab435f571117bf543fbb52938e32b791fd1c3adf6bba8777fddd57016bd48ff732fb29d3ec0cf482e388b1eb5ceb18ca890ccae95b9be46ee048d
- SSDEEP 6144:p966ec6WLO2LnpUtfTwepMz5W9h7UAZ8:ac/LvjpOfI891Z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
64790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
wsock32
closesocket
kernel32
GetProcAddress
GetModuleHandleA
VirtualProtect
SetCurrentDirectoryA
GetCurrentDirectoryA
Sleep
GetSystemTimeAsFileTime
GetCurrentThreadId
ResumeThread
SuspendThread
LoadLibraryA
GetCommandLineA
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
CloseHandle
SetEnvironmentVariableA
OpenThread
TlsAlloc
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetLastError
FindFirstFileA
FindNextFileA
ExitProcess
TerminateProcess
GetCurrentProcess
ExitThread
CreateThread
GetVersionExA
HeapFree
EnterCriticalSection
LeaveCriticalSection
WriteFile
HeapAlloc
DeleteCriticalSection
SetLastError
TlsFree
TlsSetValue
TlsGetValue
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
RtlUnwind
InterlockedExchange
VirtualQuery
SetFilePointer
CreateFileA
InitializeCriticalSection
MultiByteToWideChar
GetSystemInfo
ReadFile
GetTimeZoneInformation
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapSize
GetACP
GetOEMCP
GetCPInfo
LCMapStringA
LCMapStringW
SetEndOfFile
user32
SetWindowsHookExA
CallNextHookEx
EnumDisplaySettingsA
ChangeDisplaySettingsA
ShowWindow
SetFocus
MessageBoxA
GetForegroundWindow
PostMessageA
advapi32
RegQueryValueExA
RegCloseKey
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
_pRecv
_pRecv1
_pSend
Name
.text
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
mydata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp0
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.vmp1
Size
88KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=105, version=2067,
count=24, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=123, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=7, id=93, version=2179,
count=113, id=1, productName=Unmarked objects,
count=7, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
v2009/data/gersangcn.ini
- SHA256 8743bc7171d9c5eb2992be1694504ee6133c7e7c8b3f28133824cdd438eefc9b
- MD5 b30ac4044b1c9ef112a0fcec0b2158bb
- SHA1 3237e7987405a53ab18b3735a446258964de7c43
- SHA512 7da6aca9efe1a086c933d659592619719079459316dbab02c36c5fc08f727ae4d68bdedc7bec6adbea8f9f4e70039552a38f3d0990aaf3306dbcc3d27f270ed4
- MD5 SHA1 SHA512
v2009/data/gersangjp.ini
- SHA256 86f285d49aa7e398754aa259839dba8d0d69f25fef1f3e2e3e15d17b64b2b4de
- MD5 a5cf208fa7f5e5d47e1bbe5bf19ef879
- SHA1 c79a078d0c7874d3a794ef91d957b10fa57c5600
- SHA512 ce182026c7653ae0f4603206f888e2a0ad915cc1303a80155883dfc1317cd82d2281b0815ae94c565230ab0638e30724bbe748e24a3afcf8f94622f6eb305014
- MD5 SHA1 SHA512
v2009/data/skin
- SHA256 0e807c014e081b024ec5cbef0b822930d3a9718fa97d9980ef16405affdee00a
- MD5 583424f2e7e9e851e531d4d60bc0645b
- SHA1 f6f307dfc1b3c059ecb1c2eae1b2c36b54d4c0e7
- SHA512 2955bf5d2735481679fc2f6bcac3d52563f26207e73d267ad61104772643c558e06257b5ae0de5fc33384822c9fb8ccf5406b91f39d46048365bba3cfbae4bd0
- SSDEEP 1536:6/ozNq+kpTQR51/DBA6GA5zPbPtqCQJBz4CH/vd6mjITgu2JlZ:6GqxpTM5172yzFqCaR4CH3d6S3Jr
- MD5 SHA1 SHA512 SSDEEP
v2009/hq
- SHA256 b45360b991b26effd1454c04cb1e52ab7773fdd6a61defabbc01d5931e0d4efe
- MD5 b7f183e895cab9209c03ff7b1c14bc6d
- SHA1 16f8c3014f92552ea7e31106b6c9987538e94789
- SHA512 cbfdde2f5659fd4e25a62f02024decdcaf0aaeffa901a679c452ca5a778803b6dccbdc82a395fc50f9d7ca9449b0fadc387822f90d51aa7a47f87e599f53bdd8
- SSDEEP 24576:fUqopH/RMIAl+nx0YyEbNNRy75T9JDTCmDtYyTghQx6k6c4joAl+nxA:8ffRHjx2ETY7TsoYbhFk6cnjxA
- MD5 SHA1 SHA512 SSDEEP