Static task
static1
Behavioral task
behavioral1
Sample
8bcd9cf9d5139863527d47809ccb575e.rar
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8bcd9cf9d5139863527d47809ccb575e.rar
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
管家婆辉煌版v8.0/setup.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
管家婆辉煌版v8.0/setup.exe
Resource
win10v2004-20231222-en
General
-
Target
8bcd9cf9d5139863527d47809ccb575e
-
Size
2.6MB
-
MD5
8bcd9cf9d5139863527d47809ccb575e
-
SHA1
d6656d22bfd358325b4176320e45d37082a606a6
-
SHA256
a1d62ca161ebaf830b6d7446e82d738fd25d4016e843a1389217d69bcd236546
-
SHA512
6b023f9374c8bd477dd032518d88e8cbeabff36c73d254e3423b640161835985dd8e35f1240d51835ab3b6f9dd339f0470745b1db6c4197b0de0fcbcb25b1460
-
SSDEEP
49152:gdETtwrpt4MfDpqVMXQ+dTm1InY0v9+jOZ56DN/cQIbVHP8Mdntb5xqGXIu:lM5tqVCTYjOZADBcPXPgs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/管家婆辉煌版v8.0/setup.exe
Files
-
8bcd9cf9d5139863527d47809ccb575e.rar .zip polyglot
-
管家婆辉煌版v8.0/365.zip.zip
-
365.DBF
-
管家婆辉煌版v8.0/ACTYPE.ZIP.zip
-
Actype.DBF
-
管家婆辉煌版v8.0/AUTOCOL.zip.zip
-
AUTOCOL.DBF
-
管家婆辉煌版v8.0/AZ.EX_
-
管家婆辉煌版v8.0/BAKDLY.zip.zip
-
BAKDLY.DBF
-
管家婆辉煌版v8.0/BAKDLYND.zip.zip
-
BAKDLYND.DBF
-
管家婆辉煌版v8.0/BORROW00.zip.zip
-
BORROW00.DBF
-
管家婆辉煌版v8.0/BORROWIN.zip.zip
-
BORROWIN.DBF
-
管家婆辉煌版v8.0/Back.zip.zip
-
Back.bmp
-
管家婆辉煌版v8.0/Btype.zip.zip
-
管家婆辉煌版v8.0/CASHANLY.zip.zip
-
管家婆辉煌版v8.0/CHANGE.zip.zip
-
管家婆辉煌版v8.0/COME_GO.zip.zip
-
管家婆辉煌版v8.0/CONFIG.CFG
-
管家婆辉煌版v8.0/DISK1
-
管家婆辉煌版v8.0/DISK2
-
管家婆辉煌版v8.0/DISK3
-
管家婆辉煌版v8.0/DLY.zip.zip
-
管家婆辉煌版v8.0/DLYNDX.zip.zip
-
管家婆辉煌版v8.0/Employ.zip.zip
-
管家婆辉煌版v8.0/FACE.zip.zip
-
管家婆辉煌版v8.0/FAKEGZ.zip.zip
-
管家婆辉煌版v8.0/FAKEGZMX.zip.zip
-
管家婆辉煌版v8.0/Filelist
-
管家婆辉煌版v8.0/GONGZI.zip.zip
-
管家婆辉煌版v8.0/GONGZIMX.zip.zip
-
管家婆辉煌版v8.0/GRASPP.DL_
-
管家婆辉煌版v8.0/GZHELP.HLP
-
管家婆辉煌版v8.0/GZRECNO.zip.zip
-
管家婆辉煌版v8.0/GZSET.zip.zip
-
管家婆辉煌版v8.0/GZSUBMIT.zip.zip
-
管家婆辉煌版v8.0/Grasp.zip.zip
-
管家婆辉煌版v8.0/Gzgrasp.zip.zip
-
管家婆辉煌版v8.0/HISTORY.zip.zip
-
管家婆辉煌版v8.0/LEND00.zip.zip
-
管家婆辉煌版v8.0/LENDOUT.zip.zip
-
管家婆辉煌版v8.0/MHELP.HLP
-
管家婆辉煌版v8.0/MODINDEX.zip.zip
-
管家婆辉煌版v8.0/MODULE.zip.zip
-
管家婆辉煌版v8.0/NEW.HLP
-
管家婆辉煌版v8.0/PASS.DAT
-
管家婆辉煌版v8.0/PASSWORD.zip.zip
-
管家婆辉煌版v8.0/PINFO.zip.zip
-
管家婆辉煌版v8.0/PMORE.zip.zip
-
管家婆辉煌版v8.0/PPASS.zip.zip
-
管家婆辉煌版v8.0/PRICE.zip.zip
-
管家婆辉煌版v8.0/PRINT.zip.zip
-
管家婆辉煌版v8.0/PTYPEdat.zip.zip
-
管家婆辉煌版v8.0/PrintDbf.zip.zip
-
管家婆辉煌版v8.0/PtypedBF.zip.zip
-
管家婆辉煌版v8.0/SUBSET.zip.zip
-
管家婆辉煌版v8.0/SYSCON.zip.zip
-
管家婆辉煌版v8.0/SYSDATA.zip.zip
-
管家婆辉煌版v8.0/Stock.zip.zip
-
管家婆辉煌版v8.0/TABLE_B.zip.zip
-
管家婆辉煌版v8.0/TDMD.SY_
-
管家婆辉煌版v8.0/TDMD.VV_
-
管家婆辉煌版v8.0/TEMPLATE.zip.zip
-
管家婆辉煌版v8.0/TMPDLY.zip.zip
-
管家婆辉煌版v8.0/TMPDLYND.zip.zip
-
管家婆辉煌版v8.0/VCHCON.zip.zip
-
管家婆辉煌版v8.0/VCHTYPE.zip.zip
-
管家婆辉煌版v8.0/WARNING.zip.zip
-
管家婆辉煌版v8.0/backup.zip.zip
-
管家婆辉煌版v8.0/bmpdll.zip.zip
-
管家婆辉煌版v8.0/empdly.zip.zip
-
管家婆辉煌版v8.0/empdlynd.zip.zip
-
管家婆辉煌版v8.0/gongzi.dat
-
管家婆辉煌版v8.0/grasp71.zip.zip
-
管家婆辉煌版v8.0/graspdat.zip.zip
-
管家婆辉煌版v8.0/help.txt
-
管家婆辉煌版v8.0/move.zip.zip
-
管家婆辉煌版v8.0/ntdriver.dl_
-
管家婆辉煌版v8.0/odly.zip.zip
-
管家婆辉煌版v8.0/odlyndx.zip.zip
-
管家婆辉煌版v8.0/remote.zip.zip
-
管家婆辉煌版v8.0/setup.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 988B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
管家婆辉煌版v8.0/unsale.zip.zip