H:\c++\1.01\MUSource102 - 奋战奇迹\WGClient\Release\WGClient.pdb
Behavioral task
behavioral1
Sample
3f2b2b62a10811ad863a1051add83987cce5e306c7784216fc09691764ae73d4.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3f2b2b62a10811ad863a1051add83987cce5e306c7784216fc09691764ae73d4.exe
Resource
win10v2004-20240426-en
General
-
Target
3f2b2b62a10811ad863a1051add83987cce5e306c7784216fc09691764ae73d4
-
Size
3.5MB
-
MD5
f461a70302f4d96a023442f0171d8ce4
-
SHA1
aaefa19fb82f57832a56e957b1662bbf8095c319
-
SHA256
3f2b2b62a10811ad863a1051add83987cce5e306c7784216fc09691764ae73d4
-
SHA512
04a54aa6a4cf728dbc2d39f096a902dc986a6e19e9154354ff8d085c37f84402feb6ad8fef62be377347c2fb6769d1cfdb89d6e06c4ff8f36c6610f5c04a13a7
-
SSDEEP
98304:egjrfQ+muM9j7JT5P1N8qnPb2Z1CxFmnqPQ:tfXq9j7Jtwo2kxFmn+Q
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f2b2b62a10811ad863a1051add83987cce5e306c7784216fc09691764ae73d4
Files
-
3f2b2b62a10811ad863a1051add83987cce5e306c7784216fc09691764ae73d4.exe windows:5 windows x86 arch:x86
2cbf7e05470b00cd5aa10581eedfef77
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LocalFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowTextA
gdi32
CreateCompatibleDC
advapi32
RegDeleteKeyA
shell32
ShellExecuteA
ole32
CoTaskMemRealloc
oleaut32
SysAllocString
shlwapi
StrStrA
gdiplus
GdipGetImageHeight
ws2_32
WSAStartup
wininet
InternetCloseHandle
Exports
Exports
��-��l���B�F6�J�|Q`/k� ���X�����B遜/εBM�`IP�2!(I�C]�Sb�6�����~�����i�<�x��dꍉ�|��l�{�BV��խ�UK��Ge�. ����>�կ���y�HEn@ ��;���!D��֝3���VO5p��8�`$o���T�\3�4�mqVT�eѮA\-<[�ɾۦ�i0�F�WG�X�E`5h���(���(V %'�����@��>�B'�ͱ��K; �uK���(Y����MW+w������������m xN<w*���Fn����(�S�#$a�j|��J<�� r<O�2Ր�_���a��E�'t���q����a����F��$31{���t*s��|�al��4��`�9ڗvL\H8 <T���,��av�%��n���i��@$����:K�a$nu-��~k��ǯ,(�O�7�*&�0���U&�x�~d[�k��1Q���<LA�V�ڠ3��fˀ�*��+��Y����><��G'�w~h:��̺�9Ɲ��3����^p�� �����MB����t{7.j�� ���"{�m���� �&���7���N�%�� ��TM+�ėv�M��&g�F!D��'㨎r��he���=Ɲ�4�b�;�H�P����5���`��l����q�W���I͇6j�Oǯ�x�����>�~"�n;K���k���ɶ?i%H=�U�kU��Q. �v��vw+��C$����"�N�t}�{������!����&�)'�_���Pk����� �x8͢��C�Bv��J>��0#{�u41X���Er1v{�^4֏��n�ߞ(èj��m<$�sè�<�m���Nѕ�B�cB|nQXa���^1�Vϊ@�U��5L�E�#Ǡ����|���Rm���g�7�0N!�M�������sw��k1�a�!����Ş���ey��$��qHR���ԉ�\�Y�\�����0��mE��x��m��5�/T&.��R�}T!�8�C��&����e�R4�V�R���0v���7�yܟ��Z�l��ۧ�b1pI�J���Jj�:�EK�U�`imƛ�P�����[lN�'��&Ț���%^wY�a��.yї�̠И$U��l�,~ :M��1��?�b��K`b�画 �C�<T?��Z~�-�D;O:�P��NFc-K��#�i����O��{�����p��Jr��f@�u�����Y%<\�Q�(��O]P&=?=">�m5c��vE���}�#���䏖&܋�t�E���/B%��i _: ~�4X� �S�o_������x�DkF�GA���ol���x�!}�vJ�Wy��)�Ɯ��D'������K��P&j�O�X)a.F��{Åh>DV��o;X1�j�0�!yin��������J4�s5����U.�D?�_�w^��V-Jw�8o>�D7����b㡦�Yň<�D. x�X�<S�zQh���Y�pG�<f[{]¥���l���M�r7�Q���a���7�=����y��)n�&<ٝ�*�ζi@���+<�ܳ��]��ũ@v�Q�`!c��� � ��Y���嫰���v~C;ӑ߄F�o ��+ �W�������&��U����%M;;m����pwһX&O���)U$�x_ �#5��5k�1=42kY��E�ב:`����TM���vQح-:,��Ȕ=�D�"FET�&�};���-��s7`cߗ��I6�O�+-YP*B�zW�*D|.�#qXr��&�"�����@�����Gz��_�yUS,��8ȴ�T)K�v�����-��4-�X-��P/^��>����V ��p�Q�>�([z�Itƞ�+�>� ��4�I���u�U��cYj��&�|��Ar+�G��Y1�}���e�q�#�L���|�Ղ��"�v�c,�}�����p3X:��(�N���s���LS��3[�Z�A��EW��@�I@���y �\�E�A����L���6����|�w9�_�H�}*�g1�-��4��E������h6Bӯ�$���A��k^a��Lg-}��v�%IJ��7(H���)�hÈ)��VWC��oh�s�v�9�q�[�5�X���P��J�!D�e����ߕ��'��q����ۅ�=�n��y�G�Kʎ,x���FS�}��h�+�z9���߽�(UT��מwT�����8��ip��\��1���`�&Z�@�~k���D,��(�FJ�.בQ=ܮ. kK�6���R>��T�I%"��$������/�?��յ:�Yt.? ��K^� �i�d'z~�|>#c.^H�z�I��~F2�a="^!φ����fM���ɱ��yNGz�U\�j�u��i���#W;k�:�a��w�.�ݕ�=�:�X4�;X�ɷg�٦����>�aǕj���k�b?U��G�j-�i���Xp�n?�'ђO�!n�����(O��d�6�U���8��S�DvA�ƔE�=·��@�Z}Ϳ�Q�� m���A��H����mB��#����,5��YU��z1�x{ �X.��@d�߰��p.�����z��Q7?��y��0�\�n���y���h�;��ݑ�j���v���ih��q-Tԧy'By�요��|�h�H��G��iK��*L� {����S�*�9fQ�2�r�w�I�tMܘ]M����q���e���lY>��\/S�1V�]lp��8>F��<�#��y��n|aa�țu�1] PF5���3�fw��=�Qd�X��6�r/�3E�b���2;�}����ӿ=��2W�1UɴOe��*�'�/5L������If�� -k�<:1f���ٺ��!�om���l]�<��|��sf-&z�J��zm���u�>6�k�mBA�X�~rӧYg����?�=��[�6 ���� 0%ߣ�;�]y"©���"�o����2)(B�~[���z��\�Ra�(R�F�����p��w}khS��O�v�9�к3�^��O Q�����V�ӓ�7#�>8����m���}8[� ��<N9Y�^��Գ�L9v�I�;/����F"�kv=�F��0�RT
Sections
.text Size: - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 575KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 270KB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ