Static task
static1
Behavioral task
behavioral1
Sample
ha_RegDllView-v1.20/ha_RegDllView.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ha_RegDllView-v1.20/ha_RegDllView.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
ha_RegDllView-v1.20/新云软件.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
ha_RegDllView-v1.20/新云软件.url
Resource
win10v2004-20231222-en
General
-
Target
9859031232b7718dea46a84cc3274e02
-
Size
32KB
-
MD5
9859031232b7718dea46a84cc3274e02
-
SHA1
7ae0d105b60f73b5ad1c8361948c460c8539b461
-
SHA256
741cced910cfd27a4edd3a41c244fef109f7165f7945117e3e24fc9c70937b68
-
SHA512
425e262a48c1054ddec903e04c990e66ebe09fd5b673fe2e76ededf7825feb8f3ac625c69ae730c6e7366b394096d5cd721ad62e670b30ef19125d0eb1a9c211
-
SSDEEP
768:KJ6R9KL2EsMKlPBOHAM3c/Gf5/1eBpvj4QF1JOEJw6Fr5L:KQRe2FlIHAoc/Gf5/YpvjjF1JO8w6Frl
Malware Config
Signatures
-
Nirsoft 1 IoCs
resource yara_rule static1/unpack001/ha_RegDllView-v1.20/ha_RegDllView.exe Nirsoft -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ha_RegDllView-v1.20/ha_RegDllView.exe
Files
-
9859031232b7718dea46a84cc3274e02.rar
-
ha_RegDllView-v1.20/ha_RegDllView.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 44KB - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
ha_RegDllView-v1.20/新云软件.url.url