Static task
static1
Behavioral task
behavioral1
Sample
1534018646/老虎机.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1534018646/老虎机.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
1534018646/老虎机.vbs
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
1534018646/老虎机.vbs
Resource
win10v2004-20240226-en
General
-
Target
cd381a433c0c50aeb0505dbaf9020855
-
Size
63KB
-
MD5
cd381a433c0c50aeb0505dbaf9020855
-
SHA1
a6bc249b444009f32ca4588795c9113331ba6f36
-
SHA256
7276c49c0c22d650e832c4bf360cc0ac6e8aeafe6c32b7e52b191ca7df5eff53
-
SHA512
5bdf2f64c9baa9b1fb312d12b2e5218d5595ea20b28900a09b3f93f11991d013bfad3d706b14230e4b1eb5252e8e944900f3a6ee594aefdd8e4faec6cb26f71b
-
SSDEEP
1536:MN+Eatt4EXo/eD2bPvsIyt+hhf00Ww5XDYsa0wy68KRnW:MN+s/FGtCh7WEXciwj8KRnW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/1534018646/老虎机.exe
Files
-
cd381a433c0c50aeb0505dbaf9020855.rar
-
1534018646/1.gif.jpg
-
1534018646/11.GIF.gif
-
1534018646/2.GIF
-
1534018646/21.gif.gif
-
1534018646/3.GIF
-
1534018646/31.gif.gif
-
1534018646/4.GIF
-
1534018646/41.gif.gif
-
1534018646/5.GIF
-
1534018646/51.gif.gif
-
1534018646/6.gif.jpg
-
1534018646/7.GIF
-
1534018646/8.GIF
-
1534018646/9.GIF
-
1534018646/下载说明.htm.html .js polyglot
-
1534018646/工程1.vbp
-
1534018646/工程1.vbw
-
1534018646/老虎机.exe.exe windows:4 windows x86 arch:x86
0835665888056075a20cc06f174363fe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaHresultCheckObj
_adj_fdiv_m32
ord593
ord594
__vbaObjSet
ord595
_adj_fdiv_m16i
_adj_fdivr_m16i
__vbaBoolVarNull
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaVarTstEq
__vbaVarOr
_adj_fpatan
__vbaStrR8
EVENT_SINK_Release
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaI2Var
_CIlog
__vbaErrorOverflow
__vbaNew2
__vbaR8Str
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarCmpEq
__vbaVarDup
_CIatan
__vbaStrMove
_allmul
_CItan
__vbaFPInt
_CIexp
__vbaFreeObj
__vbaFreeStr
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
1534018646/老虎机.frm.vbs