Static task
static1
Behavioral task
behavioral1
Sample
ColorSchemerStudio_1b5_WestKing_HAP.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ColorSchemerStudio_1b5_WestKing_HAP.exe
Resource
win10v2004-20231215-en
General
-
Target
8f23a83c5c47da910c94f69f3f0b6dd0
-
Size
2.2MB
-
MD5
8f23a83c5c47da910c94f69f3f0b6dd0
-
SHA1
1cf3e4bc0f76d69d73c89337de135b0e97d321e9
-
SHA256
cb75c9d4067badf04ce878c01dc44f60bcdcd532dbd8aac91cbd9086bfbc46c8
-
SHA512
b1a212f571aa31a96fd9ea4fc0dfe3309a0ebbe1cbd2d24afd8a8e2a83789383772c1881c684e8cc890bc3987a61ea4e573733b6f0dc8377ab44f01e91f7574f
-
SSDEEP
49152:WX3JAoRvkLoT2UX5zmBrRGsnDs/d4GjpStMoLsJrY3NxLBPzE/AMhql1TZ:WXm0MLUBgrR7aOG9SqoLorKNxL1zcAE8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ColorSchemerStudio_1b5_WestKing_HAP.exe
Files
-
8f23a83c5c47da910c94f69f3f0b6dd0.rar
-
ColorSchemerStudio_1b5_WestKing_HAP.exe.exe windows:4 windows x86 arch:x86
22b1d33cc59791fd53b4a9983e84da85
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHGetValueA
SHSetValueA
kernel32
FreeResource
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
GetShortPathNameA
CreateDirectoryA
lstrlenA
InterlockedDecrement
GetVersionExA
GetModuleFileNameA
GetTempPathA
WinExec
DeleteFileA
WaitForSingleObject
GetWindowsDirectoryA
GetStartupInfoA
FindResourceA
LoadResource
SizeofResource
LockResource
GetEnvironmentVariableA
GetModuleHandleA
user32
GetPropA
RemovePropA
GetCursorPos
PtInRect
LoadCursorA
SetCursor
TrackMouseEvent
InvalidateRect
GetParent
PostMessageA
DefWindowProcA
ShowWindow
CopyRect
ClientToScreen
GetDC
DrawTextA
ReleaseDC
SetPropA
SetWindowLongA
UpdateWindow
DialogBoxParamA
SendMessageA
IsWindow
CheckDlgButton
BeginPaint
GetClientRect
FillRect
EndPaint
EndDialog
IsDlgButtonChecked
LoadStringA
GetDlgItem
GetWindowRect
ScreenToClient
GetWindowTextA
gdi32
GetStockObject
CreateFontIndirectA
GetObjectA
DeleteObject
SelectObject
SetTextColor
SetBkMode
GetDeviceCaps
shell32
ShellExecuteA
ShellExecuteExA
ole32
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
msvcrt
strrchr
strncpy
_snprintf
fopen
fwrite
fclose
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
??3@YAXPAX@Z
__CxxFrameHandler
strstr
??2@YAPAXI@Z
_acmdln
free
malloc
_except_handler3
__dllonexit
_onexit
_exit
_XcptFilter
__set_app_type
__p__fmode
__p__commode
exit
_controlfp
Sections
.text Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
下载说明.htm.html .js polyglot
-
汉化新世纪.txt
-
汉化说明.txt