Overview
overview
3Static
static
3mozhua/MoZhua.exe
windows7-x64
1mozhua/MoZhua.exe
windows10-2004-x64
3mozhua/_�...��.url
windows7-x64
1mozhua/_�...��.url
windows10-2004-x64
1mozhua/_�...��.url
windows7-x64
1mozhua/_�...��.url
windows10-2004-x64
1mozhua/_�...��.url
windows7-x64
1mozhua/_�...��.url
windows10-2004-x64
1mozhua/_�...��.url
windows7-x64
1mozhua/_�...��.url
windows10-2004-x64
1mozhua/cor...oft.js
windows7-x64
1mozhua/cor...oft.js
windows10-2004-x64
1mozhua/sit...网.js
windows7-x64
1mozhua/sit...网.js
windows10-2004-x64
1mozhua/tem...nt.htm
windows7-x64
1mozhua/tem...nt.htm
windows10-2004-x64
1mozhua/tem.../js.js
windows7-x64
1mozhua/tem.../js.js
windows10-2004-x64
1mozhua/tem...st.htm
windows7-x64
1mozhua/tem...st.htm
windows10-2004-x64
1mozhua/tem...fo.htm
windows7-x64
1mozhua/tem...fo.htm
windows10-2004-x64
1mozhua/tem...or.htm
windows7-x64
1mozhua/tem...or.htm
windows10-2004-x64
1mozhua/tem...ing.js
windows7-x64
1mozhua/tem...ing.js
windows10-2004-x64
1mozhua/tem...fo.htm
windows7-x64
1mozhua/tem...fo.htm
windows10-2004-x64
1mozhua/tem...ng.htm
windows7-x64
1mozhua/tem...ng.htm
windows10-2004-x64
1mozhua/新...��.url
windows7-x64
1mozhua/新...��.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
mozhua/MoZhua.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
mozhua/MoZhua.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
mozhua/_免费小说下载.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
mozhua/_免费小说下载.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
mozhua/_软件小说资源.url
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
mozhua/_软件小说资源.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
mozhua/_软件帮助中心.url
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
mozhua/_软件帮助中心.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
mozhua/_软件最新下载地址.url
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
mozhua/_软件最新下载地址.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
mozhua/core/__initsoft.js
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
mozhua/core/__initsoft.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
mozhua/siteconfig/u88连锁加盟网.js
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
mozhua/siteconfig/u88连锁加盟网.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
mozhua/template/reader/default/content.htm
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
mozhua/template/reader/default/content.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
mozhua/template/reader/js.js
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
mozhua/template/reader/js.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
mozhua/template/reader/list.htm
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
mozhua/template/reader/list.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
mozhua/template/system/datainfo.htm
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
mozhua/template/system/datainfo.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
mozhua/template/system/goerror.htm
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
mozhua/template/system/goerror.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
mozhua/template/system/js/setting.js
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
mozhua/template/system/js/setting.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
mozhua/template/system/markinfo.htm
Resource
win7-20240215-en
Behavioral task
behavioral28
Sample
mozhua/template/system/markinfo.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
mozhua/template/system/setting.htm
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
mozhua/template/system/setting.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
mozhua/新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
mozhua/新云软件.url
Resource
win10v2004-20240226-en
General
-
Target
b9f448af19ddbfad13800f573de829b7
-
Size
1.0MB
-
MD5
b9f448af19ddbfad13800f573de829b7
-
SHA1
213745fde848efcd4ff8f8c6ae0c2b9467bee91e
-
SHA256
36f7000a8904fa1be3ef0ade2647f1c1746183d41cdfad5f7de8e2613f2a9b9b
-
SHA512
8929f759114ae2bb95822873ec54a334ff10a5b520d9c7feddc94610043582cbcaa56b724e11545d894a98f1ec4b76b8861480d93da6b27f5809a214cabf0ad6
-
SSDEEP
24576:gx4rzPIayhUYcnIuqkMaxA/gV0PGcB4I8KMJ:LrzPbWUTb3auc98D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/mozhua/MoZhua.exe
Files
-
b9f448af19ddbfad13800f573de829b7.rar
-
mozhua/MoZhua.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.nsp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp1 Size: 993KB - Virtual size: 996KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp2 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
mozhua/_免费小说下载.url
-
mozhua/_软件小说资源.url
-
mozhua/_软件帮助中心.url
-
mozhua/_软件最新下载地址.url
-
mozhua/core/__initsoft.txt.js
-
mozhua/core/cfg_filter_url.txt
-
mozhua/core/cfg_global_replace.txt
-
mozhua/core/cfg_reader_replace.txt
-
mozhua/core/script_global.txt
-
mozhua/core/tips.dat
-
mozhua/ocr/jjvip/一.1.GIF.gif
-
mozhua/ocr/jjvip/一.2.GIF.gif
-
mozhua/ocr/jjvip/一.GIF.gif
-
mozhua/ocr/jjvip/了.1.GIF.gif
-
mozhua/ocr/jjvip/了.2.GIF.gif
-
mozhua/ocr/jjvip/了.GIF.gif
-
mozhua/ocr/jjvip/你.1.GIF.gif
-
mozhua/ocr/jjvip/你.2.GIF.gif
-
mozhua/ocr/jjvip/你.GIF.gif
-
mozhua/ocr/jjvip/哦.1.GIF.gif
-
mozhua/ocr/jjvip/哦.2.GIF.gif
-
mozhua/ocr/jjvip/哦.GIF.gif
-
mozhua/ocr/jjvip/天.1.GIF.gif
-
mozhua/ocr/jjvip/天.2.GIF.gif
-
mozhua/ocr/jjvip/天.3.gif.gif
-
mozhua/ocr/jjvip/天.4.gif.gif
-
mozhua/ocr/jjvip/天.5.GIF.gif
-
mozhua/ocr/jjvip/天.GIF.gif
-
mozhua/ocr/jjvip/女.1.GIF.gif
-
mozhua/ocr/jjvip/女.2.GIF.gif
-
mozhua/ocr/jjvip/女.3.GIF.gif
-
mozhua/ocr/jjvip/女.GIF.gif
-
mozhua/ocr/jjvip/她.1.GIF.gif
-
mozhua/ocr/jjvip/她.2.GIF.gif
-
mozhua/ocr/jjvip/她.GIF.gif
-
mozhua/ocr/jjvip/我.1.GIF.gif
-
mozhua/ocr/jjvip/我.2.GIF.gif
-
mozhua/ocr/jjvip/我.GIF.gif
-
mozhua/ocr/jjvip/点.1.GIF.gif
-
mozhua/ocr/jjvip/点.2.GIF.gif
-
mozhua/ocr/jjvip/点.3.GIF.gif
-
mozhua/ocr/jjvip/点.GIF.gif
-
mozhua/ocr/jjvip/男.1.GIF.gif
-
mozhua/ocr/jjvip/男.2.GIF.gif
-
mozhua/ocr/jjvip/男.GIF.gif
-
mozhua/ocr/jjvip/说.1.GIF.gif
-
mozhua/ocr/jjvip/说.2.GIF.gif
-
mozhua/ocr/jjvip/说.GIF.gif
-
mozhua/ocr/jjvip/这.1.GIF.gif
-
mozhua/ocr/jjvip/这.2.GIF.gif
-
mozhua/ocr/jjvip/这.3.gif.gif
-
mozhua/ocr/jjvip/这.4.gif.gif
-
mozhua/ocr/jjvip/这.GIF.gif
-
mozhua/siteconfig/GOOGLE图书.txt
-
mozhua/siteconfig/u88连锁加盟网.txt.js
-
mozhua/skin/gridimages/bookname.gif
-
mozhua/skin/gridimages/booksite.gif
-
mozhua/skin/gridimages/bookurl.gif
-
mozhua/skin/gridimages/downtime.gif
-
mozhua/skin/gridimages/info.gif.gif
-
mozhua/skin/gridimages/name.gif
-
mozhua/skin/gridimages/nowprc.c.gif
-
mozhua/skin/gridimages/savedir.gif.gif
-
mozhua/skin/gridimages/saveext.i.c.gif
-
mozhua/skin/gridimages/saveinone.i.c.gif
-
mozhua/skin/gridimages/speed.gif
-
mozhua/template/bg/001.gif.gif
-
mozhua/template/bg/002.gif
-
mozhua/template/bg/003.gif.gif
-
mozhua/template/bg/004.gif
-
mozhua/template/bg/005.gif.gif
-
mozhua/template/bg/006.gif.gif
-
mozhua/template/bg/007.gif.gif
-
mozhua/template/bg/008.gif
-
mozhua/template/bg/009.gif
-
mozhua/template/bg/010.gif.gif
-
mozhua/template/bg/011.gif
-
mozhua/template/bg/012.gif.gif
-
mozhua/template/bg/013.gif.gif
-
mozhua/template/bg/014.gif.gif
-
mozhua/template/bg/015.gif.gif
-
mozhua/template/bg/016.gif
-
mozhua/template/reader/bg1.jpg.jpg
-
mozhua/template/reader/bg2.jpg.jpg
-
mozhua/template/reader/bg3.jpg.jpg
-
mozhua/template/reader/bg4.jpg.jpg
-
mozhua/template/reader/bg5.jpg.jpg
-
mozhua/template/reader/default/content.htm.html
-
mozhua/template/reader/default/style.txt
-
mozhua/template/reader/js.js.js
-
mozhua/template/reader/list.htm.html
-
mozhua/template/reader/style.css
-
mozhua/template/save.txt
-
mozhua/template/system/datainfo.htm.html
-
mozhua/template/system/goerror.htm.html
-
mozhua/template/system/img/error.gif.gif
-
mozhua/template/system/img/setsoft.gif.gif
-
mozhua/template/system/js/setting.js.js
-
mozhua/template/system/markinfo.htm.html
-
mozhua/template/system/reading.htm.html .js polyglot
-
mozhua/template/system/setting.htm.html
-
mozhua/template/system/style/css.css
-
mozhua/template/不显示章节标题.txt
-
mozhua/template/压缩不显示章节标题.txt
-
mozhua/template/压缩显示章节标题.txt
-
mozhua/template/显示章节标题+备注.txt
-
mozhua/template/显示章节标题.txt
-
mozhua/template/标准文章模板.txt
-
mozhua/template/章节和内容带空行.txt
-
mozhua/安装说明.txt
-
mozhua/新云软件.url.url
-
mozhua/更新历史.txt
-
mozhua/用户第一次使用问题.txt
-
mozhua/用户自定义模板手册.txt
-
mozhua/脚本事件及开发说明.txt.js