Overview
overview
3Static
static
3ppdong/Top....1.asp
windows7-x64
3ppdong/Top....1.asp
windows10-2004-x64
3ppdong/adm...add.js
windows7-x64
1ppdong/adm...add.js
windows10-2004-x64
1ppdong/adm...ds.vbs
windows7-x64
1ppdong/adm...ds.vbs
windows10-2004-x64
1ppdong/adm...ak.vbs
windows7-x64
1ppdong/adm...ak.vbs
windows10-2004-x64
1ppdong/adm...ig.vbs
windows7-x64
1ppdong/adm...ig.vbs
windows10-2004-x64
1ppdong/adm...g1.vbs
windows7-x64
1ppdong/adm...g1.vbs
windows10-2004-x64
1ppdong/adm...rt.vbs
windows7-x64
1ppdong/adm...rt.vbs
windows10-2004-x64
1ppdong/adm...ex.vbs
windows7-x64
1ppdong/adm...ex.vbs
windows10-2004-x64
1ppdong/adm...nk.vbs
windows7-x64
1ppdong/adm...nk.vbs
windows10-2004-x64
1ppdong/adm...st.vbs
windows7-x64
1ppdong/adm...st.vbs
windows10-2004-x64
1ppdong/adm...mb.vbs
windows7-x64
1ppdong/adm...mb.vbs
windows10-2004-x64
1ppdong/adm..._p.vbs
windows7-x64
1ppdong/adm..._p.vbs
windows10-2004-x64
1ppdong/adm...te.vbs
windows7-x64
1ppdong/adm...te.vbs
windows10-2004-x64
1ppdong/adm...pl.vbs
windows7-x64
1ppdong/adm...pl.vbs
windows10-2004-x64
1ppdong/adm...re.asp
windows7-x64
3ppdong/adm...re.asp
windows10-2004-x64
3ppdong/adm...ch.vbs
windows7-x64
1ppdong/adm...ch.vbs
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
ppdong/Toppdong1.1.asp
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ppdong/Toppdong1.1.asp
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
ppdong/admin/admin_add.js
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
ppdong/admin/admin_add.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
ppdong/admin/admin_ads.vbs
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
ppdong/admin/admin_ads.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
ppdong/admin/admin_bak.vbs
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
ppdong/admin/admin_bak.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
ppdong/admin/admin_config.vbs
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
ppdong/admin/admin_config.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
ppdong/admin/admin_config1.vbs
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
ppdong/admin/admin_config1.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
ppdong/admin/admin_import.vbs
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
ppdong/admin/admin_import.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
ppdong/admin/admin_index.vbs
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
ppdong/admin/admin_index.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
ppdong/admin/admin_link.vbs
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
ppdong/admin/admin_link.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
ppdong/admin/admin_list.vbs
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
ppdong/admin/admin_list.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
ppdong/admin/admin_mb.vbs
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
ppdong/admin/admin_mb.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
ppdong/admin/admin_p.vbs
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
ppdong/admin/admin_p.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
ppdong/admin/admin_picupdate.vbs
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
ppdong/admin/admin_picupdate.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
ppdong/admin/admin_pl.vbs
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
ppdong/admin/admin_pl.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
ppdong/admin/admin_re.asp
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
ppdong/admin/admin_re.asp
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
ppdong/admin/admin_search.vbs
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
ppdong/admin/admin_search.vbs
Resource
win10v2004-20231215-en
General
-
Target
8ddcdba7973a82f37ef33376bc3d2858
-
Size
1.3MB
-
MD5
8ddcdba7973a82f37ef33376bc3d2858
-
SHA1
7aeac7fe3e2b41ec6361bae5a0fa8ed7397f3b5b
-
SHA256
f9c166c6c67e8cf45ad342362234281d557ceaed1e7176e379aa0b8c23ea8900
-
SHA512
f672afcca3cfae68cada1f50f51a02fe07cb7d29a63a63c3784d2edf66fa72bf7ba5540bafc7d739ecc2431df59f5935d8b8101ef7c8d5a6c441300656983cf7
-
SSDEEP
24576:2Fl8X1lTI+U3zAtPxAZqylB8fq/czTzujls9qL43OTwmlkbJU/U+PaX3/Gkhmp8E:8WllIaPxKTCfq/cqlL43OTxo1NvGsmp1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ppdong/inc/IESearch_zjdream.exe
Files
-
8ddcdba7973a82f37ef33376bc3d2858.rar
-
ppdong/SQL版说明.txt
-
ppdong/Toppdong1.1.asp.asp .vbs polyglot
-
ppdong/admin/admin.css
-
ppdong/admin/admin_add.asp.js
-
ppdong/admin/admin_ads.asp.vbs
-
ppdong/admin/admin_bak.asp.vbs
-
ppdong/admin/admin_config.asp.vbs
-
ppdong/admin/admin_config1.asp.vbs
-
ppdong/admin/admin_import.asp.vbs
-
ppdong/admin/admin_index.asp.vbs
-
ppdong/admin/admin_link.asp.vbs
-
ppdong/admin/admin_list.asp.vbs
-
ppdong/admin/admin_mb.asp.vbs
-
ppdong/admin/admin_p.asp.vbs
-
ppdong/admin/admin_picupdate.asp.vbs
-
ppdong/admin/admin_pl.asp.vbs
-
ppdong/admin/admin_re.asp
-
ppdong/admin/admin_search.asp.vbs
-
ppdong/admin/admin_share.asp.vbs
-
ppdong/admin/admin_type.asp.vbs
-
ppdong/admin/admin_update.asp.vbs
-
ppdong/admin/admin_webmaster.asp.vbs
-
ppdong/admin/check.asp.vbs
-
ppdong/admin/conn.asp
-
ppdong/admin/fckeditor/editor/css/fck_editorarea.css
-
ppdong/admin/fckeditor/editor/css/fck_internal.css
-
ppdong/admin/fckeditor/editor/css/fck_showtableborders_gecko.css
-
ppdong/admin/fckeditor/editor/dialog/common/fck_dialog_common.css
-
ppdong/admin/fckeditor/editor/dialog/common/fck_dialog_common.js.js
-
ppdong/admin/fckeditor/editor/dialog/common/fcknumericfield.htc.js
-
ppdong/admin/fckeditor/editor/dialog/fck_about.html.html .js polyglot
-
ppdong/admin/fckeditor/editor/dialog/fck_about/logo_fckeditor.gif.gif
-
ppdong/admin/fckeditor/editor/dialog/fck_image.html.html
-
ppdong/admin/fckeditor/editor/dialog/fck_image/fck_image.js.js
-
ppdong/admin/fckeditor/editor/dialog/fck_link.html.html
-
ppdong/admin/fckeditor/editor/dialog/fck_link/fck_link.js.js
-
ppdong/admin/fckeditor/editor/dialog/fck_media.html.html
-
ppdong/admin/fckeditor/editor/dialog/fck_media/fck_media.js.js
-
ppdong/admin/fckeditor/editor/dialog/fck_table.html.html .js polyglot
-
ppdong/admin/fckeditor/editor/fckdialog.html.html .js polyglot
-
ppdong/admin/fckeditor/editor/fckeditor.html.html .js polyglot
-
ppdong/admin/fckeditor/editor/images/spacer.gif.gif
-
ppdong/admin/fckeditor/editor/js/fckeditorcode_gecko.js.js
-
ppdong/admin/fckeditor/editor/js/fckeditorcode_ie.js.js
-
ppdong/admin/fckeditor/editor/lang/zh-cn.js
-
ppdong/admin/fckeditor/editor/plugins/insertcode/fck_insertcode.html.js
-
ppdong/admin/fckeditor/editor/plugins/insertcode/fckplugin.js.js
-
ppdong/admin/fckeditor/editor/skins/default/fck_dialog.css
-
ppdong/admin/fckeditor/editor/skins/default/fck_editor.css
-
ppdong/admin/fckeditor/editor/skins/default/fck_strip.gif.gif
-
ppdong/admin/fckeditor/editor/skins/default/images/toolbar.buttonarrow.gif.gif
-
ppdong/admin/fckeditor/editor/skins/default/images/toolbar.start.gif.gif
-
ppdong/admin/fckeditor/fckconfig.js
-
ppdong/admin/fckeditor/fckeditor.asp.vbs
-
ppdong/admin/images/ht_head_bg.png.png
-
ppdong/admin/images/ht_head_logo.png.png
-
ppdong/admin/images/ht_nav_bg.png.png
-
ppdong/admin/images/ht_nav_hbg.png.png
-
ppdong/admin/images/ht_nav_ico.png.png
-
ppdong/admin/images/ht_nav_ico2.png.png
-
ppdong/admin/images/ht_nav_ico3.png.png
-
ppdong/admin/images/ht_nav_ico4.png.png
-
ppdong/admin/images/ht_nav_icon.png.png
-
ppdong/admin/images/ht_right_bg.png.png
-
ppdong/admin/images/ht_right_ico.png.png
-
ppdong/admin/images/html_no.gif.gif
-
ppdong/admin/images/html_ok.gif.gif
-
ppdong/admin/images/ico1.png.png
-
ppdong/admin/images/ico2.png.png
-
ppdong/admin/images/login_bg.png.png
-
ppdong/admin/images/login_foot.png.png
-
ppdong/admin/images/login_input.png.png
-
ppdong/admin/images/login_left_bg.png.png
-
ppdong/admin/images/login_logo.png.png
-
ppdong/admin/images/login_main_bg.png.png
-
ppdong/admin/images/login_right_bg.png.png
-
ppdong/admin/images/name.gif.gif
-
ppdong/admin/images/style.css
-
ppdong/admin/index.asp
-
ppdong/admin/login.asp.vbs
-
ppdong/admin/make.asp.vbs
-
ppdong/admin/make_index.asp.vbs
-
ppdong/admin/make_js.asp
-
ppdong/admin/make_map.asp
-
ppdong/admin/make_new.asp.vbs
-
ppdong/admin/make_sitemap.asp.vbs
-
ppdong/admin/make_type.asp.vbs
-
ppdong/admin/make_view.asp.vbs
-
ppdong/admin/mysql.asp.vbs
-
ppdong/admin/tool_get.asp.asp .vbs polyglot
-
ppdong/admin/tool_ppdongcj.asp.vbs
-
ppdong/admin/tool_ppmaxcj.asp.vbs
-
ppdong/admin/tool_riwen.asp.vbs
-
ppdong/admin/tool_ztpic.asp.vbs
-
ppdong/admin/up/upload.asp.asp .vbs polyglot
-
ppdong/admin/up/upload.htm
-
ppdong/admin/up/upsave.inc.vbs
-
ppdong/admin/xml_server.asp.vbs
-
ppdong/comment.asp.vbs
-
ppdong/gb.asp.js
-
ppdong/images/exe.gif.gif
-
ppdong/images/faces/1.gif.gif
-
ppdong/images/faces/10.gif.gif
-
ppdong/images/faces/11.gif.gif
-
ppdong/images/faces/12.gif.gif
-
ppdong/images/faces/13.gif.gif
-
ppdong/images/faces/14.gif.gif
-
ppdong/images/faces/15.gif.gif
-
ppdong/images/faces/16.gif.gif
-
ppdong/images/faces/17.gif.gif
-
ppdong/images/faces/2.gif.gif
-
ppdong/images/faces/3.gif.gif
-
ppdong/images/faces/4.gif.gif
-
ppdong/images/faces/5.gif.gif
-
ppdong/images/faces/6.gif.gif
-
ppdong/images/faces/7.gif.gif
-
ppdong/images/faces/8.gif.gif
-
ppdong/images/faces/9.gif.gif
-
ppdong/images/nopic.gif.gif
-
ppdong/images/nopic.jpg.jpg
-
ppdong/inc/Conn.asp
-
ppdong/inc/Flashget_base64.asp.html .vbs polyglot
-
ppdong/inc/IESearch_zjdream.exe.exe windows:4 windows x86 arch:x86
53d51489baf864600141a34a5666ce17
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempFileNameA
WaitForSingleObject
CloseHandle
GetTempPathA
LoadLibraryA
DeleteFileA
GetVersionExA
CreateProcessA
GetCommandLineA
GetCurrentDirectoryA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetLastError
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
GetModuleHandleA
GetStartupInfoA
GetVersion
ExitProcess
HeapFree
ReadFile
TerminateProcess
GetCurrentProcess
SetFilePointer
GetFullPathNameA
GetProcAddress
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
GetModuleFileNameA
CompareStringW
SetEnvironmentVariableA
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
CreateFileA
GetCPInfo
GetACP
GetOEMCP
GetTimeZoneInformation
SetEndOfFile
GetStringTypeA
GetStringTypeW
CompareStringA
advapi32
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
FreeSid
RegCreateKeyA
AllocateAndInitializeSid
user32
MessageBoxA
Sections
.text Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 928B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
ppdong/inc/LableFunction.asp.vbs
-
ppdong/inc/Xunlei_base64.asp.vbs
-
ppdong/inc/base64.asp.vbs
-
ppdong/inc/config.asp
-
ppdong/inc/datas.asp
-
ppdong/inc/db.asp.vbs
-
ppdong/inc/fso.asp.vbs
-
ppdong/inc/gbook.asp.vbs
-
ppdong/inc/hits.asp.vbs
-
ppdong/inc/md5.asp.vbs
-
ppdong/inc/sqlin.asp.vbs
-
ppdong/inc/sub.asp.vbs
-
ppdong/inc/type.xml.xml
-
ppdong/inc/update_api.asp.vbs
-
ppdong/inc/空数据库.mdb
-
ppdong/js/Fav.js.js
-
ppdong/js/Fav/365key.gif.gif
-
ppdong/js/Fav/baidu.gif.gif
-
ppdong/js/Fav/delicious.gif.gif
-
ppdong/js/Fav/digit.gif
-
ppdong/js/Fav/google.gif.gif
-
ppdong/js/Fav/hexun.gif.gif
-
ppdong/js/Fav/live.gif.gif
-
ppdong/js/Fav/poco.gif.gif
-
ppdong/js/Fav/qq.gif.gif
-
ppdong/js/Fav/vivi.gif.gif
-
ppdong/js/Fav/yahoo.gif.gif
-
ppdong/js/Fav/yesky.gif.gif
-
ppdong/js/PageJs.js
-
ppdong/js/ajax.js.js
-
ppdong/js/cookies.js.js
-
ppdong/js/flv.js
-
ppdong/js/foot.js
-
ppdong/js/head.js
-
ppdong/js/hot/0.jpg.jpg
-
ppdong/js/hot/1.jpg.jpg
-
ppdong/js/hot/2.jpg.jpg
-
ppdong/js/hot/3.jpg.jpg
-
ppdong/js/hot/4.jpg.jpg
-
ppdong/js/hot/js.js.js
-
ppdong/js/hot/pic.swf
-
ppdong/js/hot/pic.xml.xml
-
ppdong/js/index.js
-
ppdong/js/item.js
-
ppdong/js/list_bottom.js
-
ppdong/js/list_top.js
-
ppdong/js/loading.gif.gif
-
ppdong/js/loading2.gif.gif
-
ppdong/js/local.swf
-
ppdong/js/maxz.swf
-
ppdong/js/maxz_bg.swf
-
ppdong/js/playerbg.fla
-
ppdong/js/playmid.js
-
ppdong/js/stat.js.js
-
ppdong/js/tj.js.js
-
ppdong/js/top.js
-
ppdong/js/uplayer.js.js
-
ppdong/js/view.js
-
ppdong/js/view1.js
-
ppdong/p.htm.html .js polyglot
-
ppdong/play.asp.vbs
-
ppdong/ppdong.gif.gif
-
ppdong/ppdong.sql
-
ppdong/robots.txt
-
ppdong/search.asp.vbs
-
ppdong/template/default/html/foot.html
-
ppdong/template/default/html/head.html
-
ppdong/template/default/html/index.html.html
-
ppdong/template/default/html/item.html.html
-
ppdong/template/default/html/map.html.html
-
ppdong/template/default/html/notice.htm.html
-
ppdong/template/default/html/play.html.html .js polyglot
-
ppdong/template/default/html/search.html.html
-
ppdong/template/default/html/topic_js.html
-
ppdong/template/default/html/view.html.html .js polyglot
-
ppdong/template/default/images/C_bg_61.gif.gif
-
ppdong/template/default/images/default.css
-
ppdong/template/default/images/demo2red_17.gif.gif
-
ppdong/template/default/images/demo2red_32.gif.gif
-
ppdong/template/default/images/demo2red_45.gif.gif
-
ppdong/template/default/images/film_more_icon.gif.gif
-
ppdong/template/default/images/index_02.gif.gif
-
ppdong/template/default/images/index_05.gif.gif
-
ppdong/template/default/images/index_07.gif.gif
-
ppdong/template/default/images/index_22.gif.gif
-
ppdong/template/default/images/index_23.gif.gif
-
ppdong/template/default/images/index_26.gif.gif
-
ppdong/template/default/images/index_28.gif.gif
-
ppdong/template/default/images/index_34.gif.gif
-
ppdong/template/default/images/index_39.gif.gif
-
ppdong/template/default/images/index_42.gif.gif
-
ppdong/template/default/images/logo.gif.gif
-
ppdong/template/default/images/rec_44.gif.gif
-
ppdong/template/default/images/users.gif.gif
-
ppdong/template/default2/html/Down.html.html .js polyglot
-
ppdong/template/default2/html/New.html.html
-
ppdong/template/default2/html/foot.html
-
ppdong/template/default2/html/head.html
-
ppdong/template/default2/html/index.html.html
-
ppdong/template/default2/html/item.html.html
-
ppdong/template/default2/html/map.html.html
-
ppdong/template/default2/html/play.html.html .js polyglot
-
ppdong/template/default2/html/search.html.html
-
ppdong/template/default2/html/topic_js.html
-
ppdong/template/default2/html/view.html.html .js polyglot
-
ppdong/template/default2/images/bullet_green.gif.gif
-
ppdong/template/default2/images/bullet_red.gif.gif
-
ppdong/template/default2/images/loading.gif.gif
-
ppdong/template/default2/images/logo.gif.gif
-
ppdong/template/default2/images/more+bg.gif.gif
-
ppdong/template/default2/images/style.css
-
ppdong/template/default2/images/topbg.gif.gif
-
ppdong/template/default2/images/topicbar.gif.gif
-
ppdong/template/default2/images/ulbg.gif.gif
-
ppdong/template/default2/images/zbar.gif.gif
-
ppdong/功能介绍.txt
-
ppdong/友情提醒.txt
-
ppdong/新云软件.url.url