�/?>%���jK���P�bJ�R츓�R'$��M~�'�F┉��.S̳R!S�(x�DL^�A���Ź��lJy5�xɒi��<�&�7��w�: ��/�U�^^�ȓb�Ɨb��%��QH_�A��AO������V�i����|V���M�'��[�}Og|�L��-�h$���-��R#AI;���By�&���j��p��_O�Y;���N|~�s�L%�V|�!�\�E�/^B��6�e��r��HT~Qm���Mp�ql���C�D������r7��L:���GX�:��8=xL� "��5�u�!�1�T�8��(���n�p���������� @+b`�� W�Xo���U�όuL�,����G�������� � �gwŨ 7� :�������3��g`� 0ߪ"��#��4�>T��B�W2� ����bv���x��r\b��˨F�k��OR _�/��;����^'�O�?�@�֤EH$�)�5�]g�D�c����*B�:��V!��iA�`c�:b�*Mx��sb%A�����Q��<j���DY-]<�9�_�~a*���n��Y�d�t�\;c���s���ܡ�b��%.��j!�k8'ݐ��C���������� ::qiU_�S=�W�%=��_���<�6H���(y���f`ʛɚ�9 �J,{��bY����4[��\�oj����V�g�k�!�?���tq�B:G�����(� � i�LX������h-L�qZ%]�4�ܟ�����J����pBh�R-��j��|��u`�,�@�}�b��OR��f��ݕD���P�m�J��Dj�YÔ��f�y����1��v���Y��ӟ�C��z��镲��V������w}��8->�X��pp� �G: <���|WM!\��HH�75E�����1���&��`��G�{��f�Y)Ԅ.����[�!y�x��z�y�&=��}l��.'��0=c�TN*�t��M��4���9t�GltM\:��Q�mTK4i֊q�����Uy��N�u���A'��⸛�h�]d�����ç���&MOݭ�^e�q�i~�S���(��ƼE�yH�t����$�~r��|��\����� 5a�L�1��0�v=`l�R�a�WK�N��o�u���<����D;탵D-_j2�\��C <Ԍ������M?���B ��8?�0~�'W/���T����z%���B�{3gޭy�d��FMJ��5;�"�������!vQ%i������o;��e��" 3�T�T�NN_ww�n� �j��L���u���;\��t4����q"�z[`+�y*a���̄�F�ʜ���@��|*�T��Q�� 5v����0����X�����[æEr�s���,r(�?��&ҤP3��B��!��q�S���Ͱ����73ɦ��aH�!Bی17CUxy���YW��asrMG�,*;��i���-�������[`�� (c�r/^b�4 Ud��y!�eZU?l`���PJ�ˏ[�� ��C]�H���6�k���u>�z�!���3��A�?�*)*Wk���l*�G4��H�6����ٌ�䗜(�t�=� ��FĔ�������V��X����L�+!)�E�g��7�b���(�݁W�~�H=�H��a��|<\5�� '~�]�9�ӻ�`}��[���)��Nǡ��'�Dt�!2B<�Q:�K �!X�*��1�("��+Q�F�&��q~�2;BFpp%�����&����L�ʩ�j�!�@��g�ES�c���䁏�| �Z��R�n�UĢOz�T��c�m�b�����76�C�ft�)d)�A�Ẫ��D���<e�rϒ��������V�0yXu6��튈�W�3 �Po��}D�T��Ij�����6�z��*��c�_1e����fh��&�v ��۵x����z��̡��������eᆾ}���^����I(�hmn��g��d�ߣ��ga�~#ϯvM@^��bu{m��,�X�(�T���/���\-�N�6ޫ>�s��O�C&M�Vz#��{��B����U@5���O��d�W"�զ���� ӵ�fE��,�ԁ��=�@u�<9�/���s��������F3/,>�Ń֬��AM���&Vs��z[�bm$�!���d}�P~9�Du����� ��v�ڑ)1u�=����_�|���FN� ��g|��V������a�� �G��?0�͝�p)�ˈ:|�̵{��L�F�&G69�`����D�>6�d0O��V�B�xz��E��Zfx���%u�1I$C6p�x6������b�2V���"��Z~ڃ��m��b�_r2\ �� ������V�k��U�i���P�7?�2'��]�i�a bm2��~��b�uFR=��.49ؚ�:��e?v�-��*?X���y�7#eiȌX%v2]ۜ6�rWV�ȟ�.'s�OB轠F_o�e��J_Kut�%]9w9Y���v+��9n�����M�<����7���2#�{��V� �T��Z�N�ҋi����j4o����/�cJ�O�tk>e�_ɭGK�����֭͗i�+DB�ze=<��\fDrR5;G�/y7�6�#x��1�)�Ez5❦+A{�D$���d>��|)��P���8�� �hy2��f}��� 9��zⶶ��0�C�����f�����\��)7R*�l^~k�+'"#=N\W�Y��S$ c�IB�77p Ke:��f��Md�OgI�?e������+VfƖ=`P $�>mA��m-�9�%Yo1?~w�.5�W�+l3ݞV`8I��Ur�p�ևb-�81�أ� o�`���Kg����V�5�Z� �%P�!�3 ������E��������^z3�s٧N�t������2�|u���κ��mv�����;�ɬD�`(�;�N����F Y������ٍ}��o��^��s��>c�r#�=�Ñ�Z�6:}��~�����W��J4���9�%g�8��dM�8�oo�W��N-`-�Y�tZ$��j��Q�]����.{
Behavioral task
behavioral1
Sample
家庭版增加管理策略(右键管理员运行).bat
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
家庭版增加管理策略(右键管理员运行).bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
情缘(11-27).exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
情缘(11-27).exe
Resource
win10v2004-20240508-en
General
-
Target
d8c58b9b4e5e035ba9a2b265520cbc9d6d81af0dc9c342713320b79c2d0436fb
-
Size
3.7MB
-
MD5
0c41e697ebbc20ab0d1f6b6a8d944385
-
SHA1
b27151424755e50d8d248e4b217c1915922cd9c9
-
SHA256
d8c58b9b4e5e035ba9a2b265520cbc9d6d81af0dc9c342713320b79c2d0436fb
-
SHA512
f1ca633cbaf4ae873be61af49ff12bc9698102cf89cd94c7b9102d0de7e1b225bc359b475d1eaf4c66833510995fee4081a8f992b0b1d5b777cdaad368242924
-
SSDEEP
98304:NG8KSj0uPdL5o+EnwHvnAo5M9ta2DmmsOgTQN3H8MSSQvs:NTPj5PdLS+E+PjM9ta2Dmms43H2m
Malware Config
Signatures
-
resource yara_rule static1/unpack001/情缘(11-27).exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/情缘(11-27).exe
Files
-
d8c58b9b4e5e035ba9a2b265520cbc9d6d81af0dc9c342713320b79c2d0436fb.zip
-
使用指南(win10-11).zip.zip
-
使用指南(win10-11).txt
-
家庭版增加管理策略(右键管理员运行).bat
-
获取权限.reg
-
情缘(11-27).exe.exe windows:5 windows x86 arch:x86
728ca1d00dfa385ca10ff7804f8aab25
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutUnprepareHeader
ws2_32
ntohs
kernel32
GetEnvironmentVariableA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ChildWindowFromPointEx
gdi32
GetStockObject
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
OleRun
oleaut32
VariantClear
comctl32
ord17
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 775KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 957KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ