FunctionProtectStart
GetTickcount
_SetServiceCode
_ismoreopen
tydy
Behavioral task
behavioral1
Sample
H1Z1_透视免费版/H1Z1.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
H1Z1_透视免费版/H1Z1.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
H1Z1_透视免费版/H1Z1_hack.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
H1Z1_透视免费版/H1Z1_hack.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
H1Z1_透视免费版/H1Z1_透视免费版.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
H1Z1_透视免费版/H1Z1_透视免费版.exe
Resource
win10v2004-20240508-en
Target
7d255043dbf4114da04b2fbc97af4b2e_JaffaCakes118
Size
7.6MB
MD5
7d255043dbf4114da04b2fbc97af4b2e
SHA1
da4d7ff8a9c2a7a4125f780d5a5566983f8c0f0b
SHA256
74bd39c586d9d7672a21c57d634a2fa8285e8f853585162e6936bde4495e8be7
SHA512
1f4aeab743bd048d3a62a155ab842017ed856abe40e654464efa32b068730ad095c5d936fd6cbce535c7c4d415e4e9521d25973f55016bf281cf200b24a302dc
SSDEEP
196608:BAJLK4B9z7jI6pytQhw3SxrV+tyyKNoMhFLalILwB:BANK437jIjA5TVWlxB
resource | yara_rule |
---|---|
static1/unpack001/H1Z1_透视免费版/H1Z1.qy | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
unpack001/H1Z1_透视免费版/H1Z1.qy |
unpack001/H1Z1_透视免费版/H1Z1_hack.qy |
unpack001/H1Z1_透视免费版/H1Z1_透视免费版.exe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetAdaptersInfo
waveOutPrepareHeader
accept
RasGetConnectStatusA
GetVersionExA
GetVersion
MultiByteToWideChar
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
SetWindowsHookExA
BeginPath
DocumentPropertiesA
RegQueryValueA
Shell_NotifyIconA
CLSIDFromString
VariantCopyInd
ImageList_Destroy
HttpQueryInfoA
ChooseColorA
FunctionProtectStart
GetTickcount
_SetServiceCode
_ismoreopen
tydy
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
DeleteFileA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetClipboardData
CharUpperBuffW
AllocateAndInitializeSid
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
CoCreateGuid
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
Direct3DCreate9Ex
D3DXCreateFontA
DwmIsCompositionEnabled
WSAStartup
ImmGetContext
memcpy
_time64
exit
_strdup
_set_new_mode
_set_fmode
_lock_file
rand
__setusermatherr
_configthreadlocale
WTSSendMessageW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
GetVersionExA
GetVersion
IsBadWritePtr
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
SetCursorPos
Escape
midiOutUnprepareHeader
ClosePrinter
RegCloseKey
Shell_NotifyIconA
CLSIDFromString
RegisterTypeLi
ImageList_Destroy
closesocket
GetFileTitleA
���.L�i���Bv�_��n�!��tgK�Y�Gp�η,�C����c0lȁHQ�*Q�Huo_a5;��\o�PC�����Ui'.��{�a~\�d@�G�ҡ�o�gF��6u|���P*A3���K�`D˕��U�9/���V4�� uJwC�ۙ��+�^`�z���Б�d$���WwN�� z/�D2�R7�=b�F?ۢ�j]�wR@+`Q���K4�&�}�'|�x���x��<!��Kj���=ީ�:�[S�A��ο��zva�|��55u8��a l�3ZM� ۦaQ��X tZ�.�=Ī��Y����X8��u��W�������'����.�.������}��8CH��1����!>=w��^��5��٦2������0��� r�%x�h�b�b�a�T�}�ԇ�2�[Seƚ��~{��1�j\s��Q����6H�x,��Ȓ%(@Wq'���8`f�+�l���)<J� [k�^��/7�_̎�� ����ۺcx�8@of@��Cަ��\��g�G��;��Bf�yT&��yv�1F_�6c��`�ҥ��1X��9�����Ŀ�x���0��#�|��W�o�"�b3�Y=��C�z�[��- i���Z���-�I�^�AR��dg�äh��Q^��5Nl��7u���^�Q],�dj����# �X:%�y�*�2�?��� pk�)=�F��#�+��D�4I�cC+4���Y�C�I��xa�H �,�K&e�r\)��{R�}s�5A�j,\�BP/'9�zN�ۿ������A����rH�mZ�၄j�R����\('�mE>�����Pe�w�qm��~��X�_@�ٸPI�� ����:�шL_��y �Oh&��#4r��ӣSL]�9TjB�ͩ]kD��T���=��d�q����������W�p��l�0���y�ش���ƒ���V���QYSj���H9�l�P�����>d[-Y��g,<�\f�#B�U���Mr�366��1G�WU�;˘��#e��5j�u�t��I��j���ǎaƭ>����{��u�������^zQg�H!+sM^d�X#�s[ș�2B���O�����,�ΩLݩ�@��{�~����ta��`��@���?�,���;�5�L/d~�Ҳ�$@>��U��T4]��IRL2��� a�P,�]D�W��n`Y��/+�}�1�BB��4b�@w4 c�+K�,��F^{�t�V��C����n�0�h���ݣ:����6 /ʬ�S����Pe�\6S�cs�v` �1=�����"�a���2����9�4�nD�d_7������T�i#�l���JA���h�X�ov.P�Or^�K�ѧ��vMO^R�#b��o>KfD� �'��3e�b��E}��r�<oF��&�Ν����C��n�FO|�v��s�V:�� ��{We���V��QZ�69,<n��A��Vg+��~'��u!:�t��[��A�i��>��N��ì�$u- Sʮvs1���_r.�n@�[�ϒ��"0�5&:��?a���z�?9�����r�:ˤ�e��䬃"�8��SN;�(����њO1�<G�_�~��'���oo��]��.�o�����^Y�B����4�-�srK�td��&����,�&`w�L[�^#7W��u��ҭI? 2�/��8�*�h81I}2���./p!�7*��q��_�n֤$���#R6G�r�4 ��՟��4/O�eLv�T���!'�����8 D�ô�Q����<�J��Z���".��оF~s�rLK�]�0�÷���#u��%�<U���s��ź�䒷��Z[�p�r3k�M$���8��}/�xK�����aX4����mU��ɏ�?Sv��Q+Sz��G9�7���H��;=��e[�o�ɓ�4e��� m�YN��w���G}�'�UAK�ҵT�Fg�x6�n� 70 b�\f�2U�~u�Ua�a��s�0�7��N��%LZ�ET��|E����$��u��� =_������y�5-�['�r=)��{)X1�0Ֆnl���19�ď�����������^�H��h��z��3�A9���TĖ�����F-�r����T���qY��%P2M�.��iP������:�g�P)[�y��� oj��g���@z��m~�}8:jٞ+d)�+�$ή�l(���`B5�8�(��)��m��+��(n��؏#���L4��1���~�)�$,��M�����ʿv�-�y����3>�, х�9�X����g� <c/8�؎!����&���Ο�w �v�brH��T'H1�:�����>�_����k���W��t\��O+kG6=8��Ց�%�J;���_;��m�Ϯ�����=�4��{·}�ǒ��� ���O���B�I_���:h��nL�[� ӿ��x���Ȳ1���i$�:ٮ������_,�ʙ7X��>.{L�G�������U9��� *�������'�f���X�ȸ�Q�Xq���s�9�@2�7�=�[ ����&�P�����N���q�Jox_)^ztYGJ���鹀������2��%�ቐA���J��Uke��� J��`��E����� �2*c���~��t�j��#��EJ�>���i��^ERHjl�t+�H]��f��m�tT�'A[�m�!��#����_�vO�>���k��n5I����Bȅ+������)t1������.����L�\�'�vaK���>���z�W�d��/���]<�B����X�@��둄mPT��n ���� �$�R _1����cY>��700b@��ms�}���F�Mʸ���+�C[6�Y��jq0�?�����\Բ ������ -Md (���K�}ߢ\� Tアѧ����^I�A.��Z1⼎�n��=���I�$��Ma�9wGrEt]�Y��S_���C�j�h�!��-h&~7r�q%O�x3X�I��vH����]�D�@h���B�5�����<�:.��mx�V���Ɍ[���d�œ#z��z�:��ȉ����6F��kr�!�=�@�!"�zu�!�ҧ2�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ