Behavioral task
behavioral1
Sample
新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
新云软件.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
纤纤连续剧.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
纤纤连续剧.exe
Resource
win10v2004-20240226-en
General
-
Target
bc29e7522519fe5b5ce36eee382e6185
-
Size
110KB
-
MD5
bc29e7522519fe5b5ce36eee382e6185
-
SHA1
0f723dc64f6384f7b9a39dea253723e45e5a60c2
-
SHA256
db9e8b7d2b35afcb8709d07de59e5d4968194b92f379de175f7e974a5c231b81
-
SHA512
6d3db439b3161c7526ce14c7b5ae999fc4f69a08bbec1a1e1b686e9017cb9bbee5c9d8df3dd8ceabde7972efe979a7c5b3bb5d01c8a1e75a7567d5ebb445cd50
-
SSDEEP
3072:9XKt+N0IQmpWBEGxlHJhwj1VAl/SWXZjRMAWMdW:96tS0IQGWBEGxlH7cMSWXZjO8dW
Malware Config
Signatures
-
resource yara_rule static1/unpack001/纤纤连续剧.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/纤纤连续剧.exe
Files
-
bc29e7522519fe5b5ce36eee382e6185.rar
-
新云软件.url.url
-
纤纤连续剧.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 121KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE