_CSA
Static task
static1
Behavioral task
behavioral1
Sample
2-_.rar
Resource
win11-20240508-en
General
-
Target
2-_.rar
-
Size
36.4MB
-
MD5
0ee8c85e4c5a457a871b2697b809ccd6
-
SHA1
011a0af98acc9e6a9de0b1644182b75c242bfd6a
-
SHA256
eec3a450c88d7aceb20da1ff81630484c81c5ffc025429803f61bcb1ca45a25f
-
SHA512
2092a22894792090a5106b7e3ef047147c82168b415c6f242d29ea4600614bcfd573de7d9d6c59ece1645a58b37d2b29f6fbb1baf58af9be463b92348a34232b
-
SSDEEP
786432:qxSCONH0hb3zSPZ7YWM6FX2xTzhlq9Avef5cUjmNZF0vaVs3JFaw83:qxSHJGb3z07+8IzhNnUjmDU7+wa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/骑士精神2- 整个文件夹解压桌面打开/307.1
Files
-
2-_.rar.rar
-
骑士精神2- 整个文件夹解压桌面打开/307.1.dll windows:4 windows x86 arch:x86
07883b84788c0afa05fe13bbd41defbb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
winmm
waveOutRestart
ws2_32
inet_ntoa
kernel32
SetLastError
user32
UnregisterHotKey
gdi32
LineTo
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
SHGetSpecialFolderPathA
ole32
OleInitialize
oleaut32
SafeArrayUnaccessData
comctl32
ord17
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 911KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 399KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.svmp1 Size: - Virtual size: 4.5MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp2 Size: 13.8MB - Virtual size: 13.8MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp3 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp4 Size: 29.7MB - Virtual size: 29.7MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp5 Size: 4KB - Virtual size: 64B
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
骑士精神2- 整个文件夹解压桌面打开/右键-管理员运行我 (整个文件夹解压桌面后运行 不要在压缩包里单独运行) .bat