Overview
overview
3Static
static
3Mutithreading.exe
windows7-x64
1Mutithreading.exe
windows10-2004-x64
1Tutorial.htm
windows7-x64
1Tutorial.htm
windows10-2004-x64
1VB程序太平洋.exe
windows7-x64
1VB程序太平洋.exe
windows10-2004-x64
1clsThreading.vbs
windows7-x64
1clsThreading.vbs
windows10-2004-x64
1frmTest.vbs
windows7-x64
1frmTest.vbs
windows10-2004-x64
1modFunctions.vbs
windows7-x64
1modFunctions.vbs
windows10-2004-x64
1程序太�...et.exe
windows7-x64
1程序太�...et.exe
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Mutithreading.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Mutithreading.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Tutorial.htm
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
Tutorial.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
VB程序太平洋.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
VB程序太平洋.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
clsThreading.vbs
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
clsThreading.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
frmTest.vbs
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
frmTest.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
modFunctions.vbs
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
modFunctions.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
程序太平洋dapha.net.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
程序太平洋dapha.net.exe
Resource
win10v2004-20231215-en
General
-
Target
c62c77313bb74061b0a75311d7d486c6
-
Size
18KB
-
MD5
c62c77313bb74061b0a75311d7d486c6
-
SHA1
61f4d4ecbee1174597f41fb35b5c0c3560bce593
-
SHA256
b6874e681106f9e21d63bfae78685118631737089a429b023ae8e504f2903601
-
SHA512
931c49628a75c79e79744aa2b2709e4b87aca82b5360fb54787ecfc2eeb889f0c2278e713d81b75952a1ef0787aca4309ff2866de109a381f1883f8023f769cd
-
SSDEEP
384:TTBw7CJ45lGNJ5ObcqU6tFrBrmZ8gLryG14w4/QMKrU:XBnylGBYcrerBj8Kw44MKY
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Mutithreading.exe unpack001/VB程序太平洋.EXE unpack001/程序太平洋dapha.net.EXE
Files
-
c62c77313bb74061b0a75311d7d486c6.rar
-
Mutithreading.exe.exe windows:4 windows x86 arch:x86
35790ae3444c93b9c33af059ad9aaac0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
MethCallEngine
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
ord100
Sections
.text Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Mutithreading.vbp
-
Mutithreading.vbw
-
Tutorial.htm.html
-
VB程序太平洋.EXE.exe windows:4 windows x86 arch:x86
d2649867cedca90066a116140657c3c4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
_adj_fptan
__vbaFreeVar
__vbaEnd
_adj_fdiv_m64
_adj_fprem1
_adj_fdiv_m32
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
_adj_fpatan
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
_adj_fdiv_m32i
_adj_fdivr_m32i
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarDup
_CIatan
_allmul
_CItan
_CIexp
Sections
.text Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
clsThreading.cls.vbs
-
frmTest.frm.vbs
-
frmTest.frx
-
modFunctions.bas.vbs
-
下载说明.htm.html .js polyglot
-
程序太平洋dapha.net.EXE.exe windows:4 windows x86 arch:x86
d2649867cedca90066a116140657c3c4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
_adj_fptan
__vbaFreeVar
__vbaEnd
_adj_fdiv_m64
_adj_fprem1
_adj_fdiv_m32
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
_adj_fpatan
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
_adj_fdiv_m32i
_adj_fdivr_m32i
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarDup
_CIatan
_allmul
_CItan
_CIexp
Sections
.text Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ