i:\私服版本\登录器\udpjxw\Release\jxw.pdb
Behavioral task
behavioral1
Sample
c613cf9f24afb0b328f6a6eecc7ec88a905f4f2916720cd4d00ff8bc6bcc86e6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c613cf9f24afb0b328f6a6eecc7ec88a905f4f2916720cd4d00ff8bc6bcc86e6.exe
Resource
win10v2004-20240508-en
General
-
Target
c613cf9f24afb0b328f6a6eecc7ec88a905f4f2916720cd4d00ff8bc6bcc86e6
-
Size
2.7MB
-
MD5
07f903ccce5bbf07270d4bfa1e22feff
-
SHA1
9d331b5c7e210b865f616db3689a80d9c188adc0
-
SHA256
c613cf9f24afb0b328f6a6eecc7ec88a905f4f2916720cd4d00ff8bc6bcc86e6
-
SHA512
084d226e313c57add77dbb6a10a7178405ea42ea98fc101a3ce93971b3f2d75abd96d3137ebf7d08fa5619a1124e61a08a7c83ffea0ee5b799c169a82ac77fdf
-
SSDEEP
49152:SkXTpyRRdU53lVJDujsYNg4gqBa/fgWRNLfryT/4EHPoyeB6fhSo+:SktyM2Qs3hB6fgWTLr8BeyhH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c613cf9f24afb0b328f6a6eecc7ec88a905f4f2916720cd4d00ff8bc6bcc86e6
Files
-
c613cf9f24afb0b328f6a6eecc7ec88a905f4f2916720cd4d00ff8bc6bcc86e6.exe windows:5 windows x86 arch:x86
9001fc15a8b9d4159774f50f5cc737b5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetVersionExA
GetVersion
CloseHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
gdi32
CreateSolidBrush
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
ShellExecuteA
comctl32
ImageList_GetIconSize
shlwapi
PathRemoveFileSpecW
oledlg
ord8
ole32
CoUninitialize
oleaut32
VariantClear
luaedit
OpenLuaWindows
version
GetFileVersionInfoA
ws2_32
gethostbyname
wininet
InternetGetLastResponseInfoA
msvfw32
DrawDibDraw
msimg32
TransparentBlt
Exports
Exports
���d��{�W܇����%r��ۜF e�41�5d�Drv� �7�����on,>*:EK Ł��=�|��)T���}rD�6SL�f������b˕�~s�![�}��u$-��|����'� c�f�C�2md�9N��r�j��}Q�t����3��M\�)���<'c����1k-E�9/�c8,�w��|���>�[��ԋ�ı���W���Mֲ���N(aj_x��'�-�G��?s>zU�/�qxי��B(����N�b��k���T����}��3��Bf�����=A?�s^���B���)[k❳�&���o�u 3��. $Ʒ��-"*��Ɔi"�J�U:���+t�[:%\В+�QSj�����;��n�w!�hJ��(���c˧Aj�R�Q:�yV��� �Ѡ�h$9��Q�/�0����+>�Q�eX�`���k�����G"� ��͔ ��mF��w��J3IG>�Ү�.����oUCڬ�Y2`pV�{�Fb�#'�]QѴsJ��z\�5%GQ'f ��J�R!�9ԁ�%��Q||zy���#����ks ���*��~�o�ݤ�'=��g9xg��BN�;Xd�Q��x��s����G��ƿTOj5���H��x�-�lbC�e�G�i����vj�x�c�f�3��GST��b�L$���ăX�I�% �3]w"u��&���#~�6�n�]6��!�������ϡ�X<�^���1��f��0���0�^dg�i6!�zQ��{��w�;6�n��/�ma��S˾�Az��8�3�g�@5�V(����:Ouv�0��i����7�WD��L��߆;(jF' 2R0L�xY�bQ��0ʦ��8���s��KM�~/�n�t�b��-2�#�z�����[�Y͟2{�L�|��=�۩O���l��G.N �����#U o�5��W�"c�����u'e���Gd��4P:���n]��6�� K��P�cƦ����o} �3�t�����Ռ�C�O�����-i����zu�� Еb�?��G�F�J�k"�E����\m�" �aL12#f�� O 2�^m��7-j�ZN�O���[J�k:�z��p藾��������^g8m;��'��cXm��Fۀ��¦��K"���v[�Xy1�`�{Ub���!�3B2lZ�N�@7F��\���� `�h���M�tq��jqEB!��Ɂ{og���ն��`�H?�z�S�������F;�UrAw��#�ـq���){D�fur�Q[CN*eDs�G�3�N3�"G�g3�� ���57G#���9�"�`�}��ь���#䆯=+0��*t��)c�� ���SlY� ,4]�et*�8��~Ymҫ,��]�����e���4�T'ç3�Z�4KI���7���� E,�b:F��jm.�=#ଯr��W�N��[ >�������0�9Qk�Z+�B�tW����qx~p��*����R����@��@����4#q!{�ck��3mC��J�҇r�]j���J�-a��� ��e>U���!W[��Kz�}*�Tnӻ��B� ����k����O����V�r��'�'�NRŞ���Nm'�;�%��P��� D���E�a��ENn�v(���+�������?�g�-R�_;`��#f���u�����n��I����[y��m��fJ��3W�[>c!GqS� ��F�k�n����;ֹ��zX�cO���˶�4�2�i�F�\JA{h�<^��4)Q��~ҤkHU�&9P#���Ѝ�k^r��k綾c[�o[Q�݃qy�M*���G�5��PK��,K�(���r���� �jɮ{,6�7���.���q���n� (�{=��_�Mq����i�F��X�o��P�lX�n3nS��^��˒1�\2-L�e�Ds�Z0q���|veЂ�FW�t,������� ��~|:��R���kI��d=)JBx�Ẫ�M~F����[5��1ϣ���\�]k�e ��˒���6�j� +�֚�(�P�5?��Ig���AZ╴�]��&�N ���J���,:�:�\ ����l>1������>�>y�qVr��\P��?m��d�>_����0 ��z�頌��J���V���"_�-���5�!8�鋶5BF�y<Z����%��7� ��rS�Ҥx�Z8;�a]� k>�vf���H��^x�'W��������/P�Z� � �+|�xVo%A�Q��d|埥R�$�3�W�͟�Z�p�&��6��� �u��]X�'u>4�����H���8�����Ф5$��;+��ȩ��,�����G:��S�U����H�KU�#Ӵh�?�Jyr���w�K�'2!DE�;5������T��TtI�iC����/�Y .��L���A���Cq���-�|��ԍ��O=E��vh4FI�,?�!J� =�����2D������=�4wױ������~K �S��υ:<w2WgN9�.�� ��*7�ǃ�4�b4<�z�P`�I=C����'��5��dG�k�6Fˑ?�� ѷ����ř��T�=Q�7�4!3>n?/�i&���?���H��&���)�˦A^�:#Tu���yx��:����QC|����~�q���Ɂ\>Y��2�,R����`����+���z0\�\�]�����e�b��k�^|�(1�gs��E��g�$O����7�^>�A�92�v���?j�D@�/Sw����G�w�,���^ŋh��3��3�b]bO!bi��0� ���2-�Q�HH/��ݥ�����|���Gd��X�0�O��y2���~�S���[�Qώ�����C��7��1�UF�'�"�F��ݸ�ص��Tb�f02kX�3HW������� ۬���+�`+�ζ�Ȣp�˥ػJZ�:��LB}T-�2f�JP���m�%r:':�r��X�P7u~��mT�����_��ꂗL��2�n~H�8o���t��s����Zc2��v�cb��%�Z��_��z�����% �e?sU������P���F+A��� �(q�_���g�sl;e$#2
Sections
.text Size: - Virtual size: 548KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 524B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 131KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ