b32ec81f2616317c870524ee9d5a23e3
- SHA256 dda8dbb86425ea73b9ff11c109ea0e207b2c40745c5c20e9dad86230828c5ddd
Overview
overview
7Static
static
7FSMaxView/...ns.dll
windows7-x64
1FSMaxView/...ns.dll
windows10-2004-x64
1FSMaxView/MaxView.exe
windows7-x64
3FSMaxView/MaxView.exe
windows10-2004-x64
3FSMaxView/...01.dll
windows7-x64
1FSMaxView/...01.dll
windows10-2004-x64
1FSMaxView/...02.exe
windows7-x64
1FSMaxView/...02.exe
windows10-2004-x64
1FSMaxView/...��.url
windows7-x64
1FSMaxView/...��.url
windows10-2004-x64
1Behavioral task
behavioral1
Sample
FSMaxView/FSMVIcons.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
FSMaxView/FSMVIcons.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
FSMaxView/MaxView.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
FSMaxView/MaxView.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
FSMaxView/fsplugin01.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
FSMaxView/fsplugin01.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
FSMaxView/fsplugin02.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
FSMaxView/fsplugin02.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
FSMaxView/新云软件.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
FSMaxView/新云软件.url
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target b32ec81f2616317c870524ee9d5a23e3
- Size 1.3MB
- Sample240304-1nnmyaee2v
- SHA256 dda8dbb86425ea73b9ff11c109ea0e207b2c40745c5c20e9dad86230828c5ddd
- MD5 b32ec81f2616317c870524ee9d5a23e3
- SHA1 a5b30ad58988f7b1894a387a5bf4c83c16fa5a1c
- SHA512 b43d512a0aec583e089a0de90ae7b417c13f949e1fb44d3488234904f74d41e3bafb40f18535f202ed785f87ef364d5c12475e8b8ba23fae587675f00a70181f
- SSDEEP 24576:SvBvVFJ6Q5vbCN7YxHIHjdVh3ltYvexWBYMPJ69x/3GxFyCaqEnfxsNYZmYl0j6:SvBvDRQ7xDz3txUBYi+x/wFy1y6Blw6
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/FSMaxView/fsplugin02.dll aspack_v212_v242 - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/FSMaxView/FSMVIcons.db unpack001/FSMaxView/MaxView.exe unpack001/FSMaxView/fsplugin01.dll unpack001/FSMaxView/fsplugin02.dll
File Explorer
-
b32ec81f2616317c870524ee9d5a23e3.rar 1.3MB
-
FSMaxView/FSMVIcons.db.dll 152KB
-
FSMaxView/FSMVSettings.db3KB
-
FSMaxView/MaxView.exe.exe 1.1MB
-
FSMaxView/Tips.db.gif 37KB
-
FSMaxView/fsplugin01.dll.dll 357KB
-
FSMaxView/fsplugin02.dll.exe 68KB
-
FSMaxView/新云软件.url.url 133B
FSMaxView/FSMVIcons.db
- SHA256 4c0ffaa3020bfeabb1632ff3543bf4ed0f63211ed184bbe2d83549fa8bf350ac
- MD5 ea0a360f315484ba34aba0024c525f10
- SHA1 0661009e526b3014723a8cf74862d0e757e908da
- SHA512 e16e46b85eeb49e0f2aa3aac04b758428b0a716bb19989185f6aa38791bbfb52d02e80ddae22dc59bb700698b05cce78fcdba7cf6cc0c7f98a3ed10df418ea1b
- SSDEEP 768:LyTT3ySfecwZ3U3SMC311SX83fO3U+Yv3W353y7m3z6IdDLb3C8iXC3Ap3RXiaIJ:CjwPPgXWlvJINL+hXH7yaBhWlmpdtg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8072
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
702B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
432B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
145KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
FSMaxView/FSMVSettings.db
- SHA256 7904b0ef3677fa9da09b2816c206795cb96f995920e1349dfb365ce62fdb0690
- MD5 d3f5b505503b556c61bf397b386466d0
- SHA1 a08a90d7ac57aff8719b90d0b80a88fde3cc353e
- SHA512 1f983e03fe69df784c62511158075aef95ea8dccd6efc890b0aab00bbd090cac1e441a55de5b2c8279abd40fb65004a196bf86fe332355ffa0dfa2500dceb8ed
- MD5 SHA1 SHA512
FSMaxView/MaxView.exe
- SHA256 c9b0ee61da0c7deadaeada55bd2c3302fb60080fecc72f62e97cf86841416b8f
- MD5 f800a0dbccb573f58f34ac12d198f052
- SHA1 ae67b030d15863df31bb2ff114cee92723311040
- SHA512 5cb71f32643b28faef78cd978c5523f220cb2f59b57c2061ba9dc9038626ed4bd69279210968aad3db7dd58456fcd07c7e7962086b569ad64b1f75ee8f601033
- SSDEEP 24576:ez9T/9jY5Jkmhh6rVvO/fKUrbC+OacXbvLhRAkQysEL9fG5KLHlZ1I+:eB9jYLkEhQAzuBLFzjsm7lZ17
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3928065
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
Size
837KB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
137KB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
1024B
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
76KB
Virtual Size
452KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aspack
Size
32KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
FSMaxView/Tips.db
- SHA256 732c32c846b21b334012740512176d2cab90c670bb69ce645273d0e2578879c8
- MD5 bc6786168f21eb4f3c3e7030780a80da
- SHA1 372815f9acf0f4b3ca9488a98c6fb9fd9cdc831f
- SHA512 a72b1ce7c3c95a51338080ed0eb059d5e6cee14d06ea56d6503526df21a77c84bc83272581cf9fc4038653dc6c8ae6c3df78da4817e60e0b75dd6a36fdab37f2
- SSDEEP 768:D48d+UHFstiUMKFg53HDC4HiskXhVhqLnZKJpD+nZKtjc+l:D48cxFVetnHidXjhqbISEtl
- MD5 SHA1 SHA512 SSDEEP
FSMaxView/fsplugin01.dll
- IMPHASH 933368af2946af8f4bc77ab0457ed8f1
- SHA256 4f0fcb75aaeb4d25d075fb01ee55d8c6cb18f30aae40bc0d914af05c518f8b84
- MD5 0ee59b3adbf3efcb48215f4cd089200e
- SHA1 22d1f047213e99f1cbbdc26c6a8878b3785f2652
- SHA512 8ab61590d03a35143f425ab22a9a71b05ca5002f4358d36abc70ec5d798687ceb495092b79676ec903cb46350611b819e9696aab3c929ea357a58fa319498b82
- SSDEEP 6144:7Paly7XiaHTV66Lik/kR48WC9149rAstoKN5zpXwkV5cEsEcch65i:7yoriaH53RkRhWC9C9rwuVmXE965
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4464
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
kernel32
CloseHandle
CompareStringA
CreateEventA
CreateFileA
CreateFileW
DeleteCriticalSection
EnterCriticalSection
EnumCalendarInfoA
ExitProcess
FindClose
FindFirstFileA
FormatMessageA
FreeEnvironmentStringsA
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCurrentDirectoryA
GetCurrentThreadId
GetDateFormatA
GetDiskFreeSpaceA
GetEnvironmentStrings
GetFileAttributesA
GetFileAttributesW
GetFileSize
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetLocaleInfoA
GetLogicalDrives
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeExA
GetStringTypeW
GetSystemDefaultLangID
GetThreadLocale
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
GlobalAlloc
GlobalFree
GlobalHandle
GlobalLock
GlobalMemoryStatus
GlobalReAlloc
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsValidLocale
LCMapStringA
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LocalAlloc
LocalFileTimeToFileTime
LocalFree
MultiByteToWideChar
RaiseException
ReadFile
ResetEvent
RtlUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetEnvironmentVariableA
SetEvent
SetFilePointer
SetFileTime
SetHandleCount
SetLastError
SetThreadLocale
Sleep
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcpynA
lstrlenA
wsock32
htonl
htons
ntohl
ntohs
user32
CharNextA
EnumThreadWindows
GetKeyboardType
GetSystemMetrics
LoadStringA
MessageBoxA
wsprintfA
oleaut32
SafeArrayCreate
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayRedim
SysAllocStringLen
SysFreeString
SysReAllocStringLen
VariantChangeType
VariantClear
VariantCopy
VariantCopyInd
VariantInit
@@Utils2@Finalize
@@Utils2@Initialize
@@Utils@Finalize
@@Utils@Initialize
IEX_AddParameter
IEX_ExecuteRead
IEX_ExecuteTry
IEX_ExecuteWrite
IEX_Finalize
IEX_GetInfo
IEX_Initialize
IEX_SetCallBacks
IEX_SetInfo
___CPPdebugHook
Name
.text
Size
289KB
Virtual Size
292KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
34KB
Virtual Size
464KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
22KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
FSMaxView/fsplugin02.dll
- SHA256 82cb861944afb2acb2a28d4f19b8cb30fbceef48376ede91cdca5ca04f77e138
- MD5 3eddc696f946582b29cc7bd9d278cc13
- SHA1 9b952108dcb576534030736a76e182396e905017
- SHA512 19013f6dbcd613bc086c71ef4b0a68b68ac72101967333e44dc93c64f2eff0cb9759edebce0fad9edb655f970338fdeadb3d1487b3a59d3a1d97186a8471ed76
- SSDEEP 1536:B1lIMfuxdNmaozbcm9HBhGB9CvRtdCLV+/+74tO17B37:5jANmaokmxXUCvj4LV+mweV3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
147457
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
55KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
4KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.Andrew
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=12, version=7291,
count=1, id=11, version=8797,
count=21, id=14, version=7299,
count=109, id=10, version=8797,
count=73, id=1, productName=Unmarked objects,
count=3, id=19, version=8034,
count=28, id=10, version=8799,
FSMaxView/新云软件.url
- SHA256 df65af1fc1e09f6effbde7e0ef1cb64d6caeef1f62b0e6467821efa032533678
- MD5 4f0017b3b346bd0626f0c3b915e6e734
- SHA1 823bf3ff9e16cd636c9dc0dc690d6a586fcbfe92
- SHA512 0f5eb5024cf6a0323f7998d419995a707c48de917a5899a185369e6acfeb17c09ffa03f7d110adc87b8de20b7d4bf30d50c72479bfb18614d2e21cbe169dc5a6
- MD5 SHA1 SHA512