Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
keygen.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
keygen.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
新云软件.url
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
新云软件.url
Resource
win10v2004-20231215-en
General
-
Target
98c8aa42154d687cd0674aee5c53fe4b
-
Size
1.9MB
-
MD5
98c8aa42154d687cd0674aee5c53fe4b
-
SHA1
1206cb1b9c14bb870a62b4fb213ecf5e0bad06bd
-
SHA256
e8b26c98bc10e37686bd7e150425133d10a1ccb843aa98a18b6ef26a0cc3419e
-
SHA512
d372398a1819fc94dd258266cd84f9b702589f6d24e026c78b58981894972b10991d45516fa4b37c3fc8c4b62502b696bf0d5a711c622a33f0424ceaa9d05173
-
SSDEEP
49152:6jGVOUpCfZxJy075UVjrULuwiSnleYRfbpoVwbx4Ly1im:1OsYZXyiiVjxwPlYaF4Ly11
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/Setup.exe unpack002/keygen.exe
Files
-
98c8aa42154d687cd0674aee5c53fe4b.rar
-
SFVChecker-v1.19.rar.zip
-
Setup.exe.exe windows:4 windows x86 arch:x86
610cc130aaaa220345df89231335738d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
version
VerInstallFileA
kernel32
GetModuleHandleA
GetStartupInfoA
ExitProcess
AddAtomA
lstrcpyA
GetCommandLineA
OpenEventA
FindResourceA
FindResourceExA
SetErrorMode
LocalFree
SetEvent
LoadResource
CreateFileA
LockResource
RemoveDirectoryA
GetTempPathA
WaitForSingleObject
GetShortPathNameA
CreateDirectoryA
lstrcpynA
lstrcatA
GetLastError
GetFileAttributesA
SetFileAttributesA
GlobalLock
GlobalAlloc
GetAtomNameA
DeleteFileA
GetPrivateProfileStringA
GetUserDefaultLangID
GlobalUnlock
GlobalFree
GetModuleFileNameA
RtlUnwind
Sleep
CloseHandle
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetPrivateProfileIntA
GetTempFileNameA
FormatMessageA
CreateProcessA
CopyFileA
user32
EndPaint
BeginPaint
CreateDialogParamA
MessageBoxA
EndDialog
GetDlgItem
SendMessageA
GetWindowLongA
LoadImageA
DestroyWindow
CreateDialogIndirectParamA
SetDlgItemTextA
GetDesktopWindow
GetClientRect
MoveWindow
CharNextA
CharUpperA
ReleaseDC
SetWindowLongA
GetDC
DialogBoxIndirectParamA
wsprintfA
CharLowerA
GetWindowRect
gdi32
BitBlt
UnrealizeObject
DeleteDC
GetObjectA
GetDeviceCaps
CreateHalftonePalette
CreatePalette
GetSystemPaletteEntries
CreateCompatibleDC
SelectPalette
GetDIBColorTable
RealizePalette
SelectObject
advapi32
RegOpenKeyA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
ole32
CoInitialize
CoFreeAllLibraries
CoUninitialize
CoCreateInstance
oleaut32
SysAllocString
SysAllocStringLen
SysFreeString
VariantClear
SafeArrayGetElement
SysStringLen
SafeArrayGetLBound
SafeArrayGetUBound
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Setup.ini
-
data1.cab
-
data1.hdr
-
data2.cab
-
ikernel.ex_
-
keygen.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 65KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
layout.bin
-
setup.bmp
-
setup.inx
-
˵.htm.html .js polyglot
-
新云软件.url.url