Behavioral task
behavioral1
Sample
游侠网最新单机游戏.url
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
游侠网最新单机游戏.url
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
游侠网热门MOD补丁.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
游侠网热门MOD补丁.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
甜心选择2汉化补丁/HS2.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
甜心选择2汉化补丁/HS2.exe
Resource
win10v2004-20231222-en
General
-
Target
9affe6347df2442a7077ce6556e08609
-
Size
8.9MB
-
MD5
9affe6347df2442a7077ce6556e08609
-
SHA1
3a07e25574c32ce6d35cfedbdc0d771f01fe412d
-
SHA256
482af46eda824729aeacec9527a40e97372136c1bcfd767521dc7642c461d71d
-
SHA512
548ce286da8ebbff379d250bdbdc978a45ddf8e37d732884ec1b9b7e963135bf6fc3bf8defebd2329a185df4767081c448ce8fafff7ce408553110bd7fad888f
-
SSDEEP
196608:o1WABAQDyZddIXPmng0pxOE021XDa+EPoNMny74:W7AAyZd6OfPj021TtEgOnyE
Malware Config
Signatures
-
resource yara_rule static1/unpack001/甜心选择2汉化补丁/HS2.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/甜心选择2汉化补丁/HS2.exe unpack002/out.upx
Files
-
9affe6347df2442a7077ce6556e08609.rar
-
ALI213.txt
-
游侠网最新单机游戏.url
-
游侠网热门MOD补丁.url
-
甜心选择2汉化补丁/HS2.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 563KB - Virtual size: 564KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 500KB - Virtual size: 499KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ