Behavioral task
behavioral1
Sample
果果记帐本 1.3.2.1-CR/PszU.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
果果记帐本 1.3.2.1-CR/PszU.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
果果记帐本 1.3.2.1-CR/新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
果果记帐本 1.3.2.1-CR/新云软件.url
Resource
win10v2004-20240221-en
General
-
Target
a3aa1cae170927366c8f14e6fd4c0da5
-
Size
1.4MB
-
MD5
a3aa1cae170927366c8f14e6fd4c0da5
-
SHA1
cca7defa41626287c91135f794aafb45db351321
-
SHA256
be26544a1767b2b9f862ed4eb1dc284a685f85c584d347ea3da887d4a983b053
-
SHA512
8f81c7edc3ab9ad1bc3cc6c8557de408b2fdbbcd0cc34ea2f82ecd216f8b41082dc99c7b1d5cdadf1a01b2fb367ee84cafaa59ab4796efccf5d56e4f3ab92ca4
-
SSDEEP
24576:vMLxKY23S3zkRPp7JosUTrZ4aFCeaNrd2RN9ZmBKBKxbK9lmjMeasy3b0:7YXzwVOhrGICds7oKcxbOn53I
Malware Config
Signatures
-
resource yara_rule static1/unpack001/果果记帐本 1.3.2.1-CR/PszU.exe aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/果果记帐本 1.3.2.1-CR/PszU.exe
Files
-
a3aa1cae170927366c8f14e6fd4c0da5.rar
-
果果记帐本 1.3.2.1-CR/PszU.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 1.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 25KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.!rc! Size: - Virtual size: 856KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 39KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ap0x Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 176KB - Virtual size: 856KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 137KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
果果记帐本 1.3.2.1-CR/db/data_1
-
果果记帐本 1.3.2.1-CR/db/report/rep1.fr3.xml
-
果果记帐本 1.3.2.1-CR/db/report/rep2.fr3.xml
-
果果记帐本 1.3.2.1-CR/新云软件.url.url
-
果果记帐本 1.3.2.1-CR/说明.txt