��/�0p��&���K��ݻ��G�d�����YV��z�Ƭ��� ��;�)E�}�=�gN��߉����+�wV0���kI"ue*:���0�B���*p�"��[�K'���^� :��`��_��յ���aa?#Ϭ� t �)����.}8�)Fiy�2�e�,!)J7��T�c1�b�W��dg�RA��,"��v;{�[���z>h'D����f��d��Fw��'t�®�?���=��Um ek}d �#T+�:-\;�FyeHq�<QS�X:�@=lgsʷ�!��2[�����/����*���XH�a� ߇IT�3�G��e��Z�� w�� >�-Պ��rǞ+[�v�B�M�a\�J�x��N��,��#FJ�W�IM�?�G�e������.ų������nQ�F�`;�.�&�ȃ`��B���<�L =-�]x�ʓ|�M ��B���H4I^��O^f��lF��j~�-�+���F� ǫ{��� ��%��mA����!�_��1Ea��EW��k:-\���z211K�F��b�9�OS�T��k��H�9�Lc7&r��|$z8�X��5")ƣ�>wo��<�����A#�����Z����[�%�@��l5 b8�W���bt��OF��e̱@%�)X(�6bq_��җ�\J�C���F��,-�%���9��o�<r���X��,Z��#���5����rA��v�t ��&G���#*Q̿p;���!M�zK�c�G^��Y���٭��N��A�c�ajHoz!s�D�'�������Fd:�>䌨�D��s�`{����^`X�����5�q�����j��6h.�R��yx1�^���j��=f����R������ٵӼQ�{�P�?�[L��)�@M���bc���Or[���'�4rp�����F�/��d̻?M��&��V?�0��7JS���t�Ȗ�͕�%�b� �z��~���,�Ô��.�8�c�?�G��N3.��HR�o��[��V�W͑�]���ba;��" ����'Z�eG�ҢN#��1��ZE��8rՏ'e����t���9���]�^a/�Z�r܋s��=N��ꇄ�BH6̽�ǁ�s�#'�=o ̱�^pܤ����s�tI��H��t[l}7~�)MHT�e��*��=w(����Tl�?�*�� �0i�w��#�ʉ>��8B��lSK�붳��}ߓ��3'�?c�-�_�e�Oy�N���̭f�ATޞ,�7�8Ij���4�v�&��*�͡�#�k�{�u�����)�oN�z܊�ڽ��Rޔ����nw���� ��%��R/¾�qs���T9!sv�%�=�|�����@F:���k��Q������C�7����A ����w��Դz��D�u@�$tG�&U�M�1��{�Eߢ/7��BVWT�����j�����ɨ럚�8��b3|������7��j;�'�+�ɘd�_h@ �NH��(��ᨒq�����auW[������ۙ#]]k�ӜV8��S�-�n<�(��X:������;䉥�� M/�ޢ`�<��#�.C�{+����:��P�f���2���WE��� m���$GU�;����j�Hi����љ$��R&T�����T�I��֩���B�9�E���U�*碮A������Ӻ�,#� <�F��n9�$%+o�Vj����7$?)�+�Q�M���G���E���ם� �O��{a�H�`��̀g}l2�IPM-��@n&������W0C�<d\ð�9�3;��ZȒ�-��G��s�u�uZ���@�i�� �&ҙ�M�o�5_�V���]��H>�-)�d<�Z��%1���f;�7�\��b\O������zy��MI�M���6ؗ�����D����g�S��چ.[:��H��G��}�x�e�����&�_%shyI=$��yf��D1�J&e��A�+��=9n Ʈ\�U��K\��1�Fl�[2D�~�)��i�q7M�H���Jy��u�+O#�!����Ȁɗ���3�}Z�PK���pB��]��>��l趩^}"`c��&�"���\=|{4�\�VP8�#۾F����y�Lh���1�Zft�l@���[�V���+��9�.?��Hf$~�� �|ăY��t+é��U)�j.�����q��_zg�t��C:�ty�������{J�����<s�j$�5E��XA_�p�X''���8�5iц���ޙ��e�%/�wK�d���j��/5#-���J����J��N戀Һ4ɲ��g�_� �l���BGa�4�V4leh2�+U�L���@Ƚ���tm��� 8E?\� �&�a��+L���_$�j���n�_e�B���b��g�b�C�l;�z�}�6亜��|k��↩jy�H#;%���k�>�+���-�-m ��°�f]�C?P[S؇AT����$DGh��p����_0� ��>���H���H���cn�SGʆwR���e�ۉ��s'�d�VRX7|�4�����Ł�<���<�M����3f��<���nN�)�fx����3T&e�JQ�� ���i=�N� g��-��hY��|�/Hvى"���B�:�p9ww�u��@\���I��dR�� ��wn~���r3=�$k��{V�C�Q�����x���U���?#��-�R��\�b_�|�N�T�(*�{^�T"�g��l�kz$�WS�kzQMW����nu�'"��A��ֺ���BhaMuB׆�p$Z��1gCJ��~�Z�9)�TVg=M?������[%�8��<p�|�\p]�M���WD�����~ʝ-&����/��vZ����C8A֏u)�E���v�[m���KI��8^H�KG�Óqׁ2��)���,� ѝ�1qK�j���Sސ�*�Z�����K3����!� ��hײ�� �Lo5Mo�Њh�wC[�ݳ%8�I��#)�W�k�ڛd��fF��3�/}Cߙ�^�����Y�SU^�3qbg�20���:)���<�S�C,SҜt�1K?M�a;����隸�����* ��\�[A̡[�i�%k�\�2���R/ ����Ģ`�,�$+3p0ɛ�-��Zg�]D y��ARr�+,
Static task
static1
Behavioral task
behavioral1
Sample
豆包传世.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
豆包传世.exe
Resource
win10v2004-20240412-en
General
-
Target
4c89bc7783849d402454935db068b60a.bin
-
Size
7.5MB
-
MD5
69254fa88c7f597433f4bd76c42b7e8f
-
SHA1
2241b62145bf1e972d237ce145ffd07843713c49
-
SHA256
235374367797c6cac7604c6997590d2c7fb5c06057ebdba2af57f14a1442d5de
-
SHA512
d640e3adabae209e0dbbf3f42788690272cd71db56176effaf4f33563780d39bdbc36003c6f168a4cc8ccf104a947a7241fd4bf42002ced13b6c9d6a218ba620
-
SSDEEP
196608:XrNC8FKLsAKkPJo6eeV4goVZYjjGgZea6webY/qAzH2+QeAJSGY+aAGF2Z:xC8FKIMy6HVUVujjF96w/qU2+mw2GF2Z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/豆包传世.exe
Files
-
4c89bc7783849d402454935db068b60a.bin.zip
Password: infected
-
a8a7e4e27a8136b50fde35628e3a2ad6301bdf3a8c1d880b9a1ee469a41b5381.zip.zip
Password: infected
-
豆包传世.exe.exe windows:5 windows x86 arch:x86
Password: infected
eebe7e0c598b0289076d8ef2550211ad
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
RegQueryValueExA
user32
EnumChildWindows
kernel32
GetACP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
SetMapMode
version
GetFileVersionInfoA
ole32
IsAccelerator
comctl32
ImageList_Create
urlmon
URLDownloadToFileA
shell32
SHGetMalloc
wsock32
htons
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 50KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ