=�w%5������2��j�?>(�Et�㻑�Q��[�y���PU�l���^)�h��I��܋��tJ�z �M��W4W��=�#��\*�*��PI�,n�g-0��78�`�"F���E��p:��B5:�ԯ�&eL��V~̇�&�W"�W���D}BPP� ��(��~�(�J��?w�a8jO�4cP�չ��TȊK���lV��0���q�){o����|���F���͜u/BbT�Kx��W�k@����t還�(��/��_&BZZ�^��"����<h�{ϟ,I��k�[��݉�m|Pь������0�Or��3�[z\�f�]��љJ�>{��u�e�|^3)��_�G{�+-ō�$M�m�������_B� �%} �۴�(G�C�*�3��t��OE%���0�؇Z��BBK�V~&ZCd!%N�*�-bl��?֨��}�5P�DC�������@<ê�|��ī�.��%ᖅMU�~�)��r� J�G����8xp���-�'�/��s�X��!�ޭ��YeMd {�$ K�!"WR�O`g�:��8�?O1��j^n�2�@!Z���q +�� C�Bt�hD������~�k�lT�)F9ӎ��E�QT���!1�@���AtA툃f\|Mp~�C��7|d�����u`���Pt�#��-e\�&6�]�°��m>��]����-Ka�Df�A9#fk2R�_[�NU�h�V�A+����"��ƿ�%���%�������4v\*kCX���.KSU��� Av�G�i�}z���,���dP~� �Vt���������s�{�6\�>)Q�3m=^�E>U\93a5�E?��n1Ps�K�e�`��]Qy�Нw<���Ƴ����1&�%��n�G=��͡v���D�c%U�GՌz��3���I��5�Ogu^���UX�7���T��<'<2��}��*�9U����%�X�>��ա������'qg�-���H�'���=�-6�'6�liv�P�͢n��I���J�*���� �q�mcEX�X�M���|��ƆM��0���:;�J xh��� ����(R,���Ӭ��8Hk$ y)\{Ԑ�Gx2�ɯ�HR��~ �E+������<����U��lŨ��'��u�<Ⱦs@8�w�[&��j“�9�)n�=����o���A�2����~��X"6Jeg�s����eND��M�OV��%m�J�'�.��]��ϧF�I���{}Jy>�3J�V7K�7�N=!߳_���R_���Z��8Z������H�*�>����Uҙ��!��c'����̀��Nb.���Q��l�V,Bb�q�l��P~k���~)���K�X���{=���5�'_�URN�9<B�����l"�b3ϫ���C���-�<�h��M\|�)- ˒))�8�'-�<�����2fN~�ht;9�ݽ��\{��i8l�A&�q���ǜ��k+ľ�p�"�z?J�i ��TG�)�ӾF�kR������\|���N� �a��rNTd�@>�������̠P1��m�p�߆Eh��f����I�Δȴ����{���Ơ� ��h����c��w�@?R��|��]EFl�p:e#f�>�6�:���D���EC��?u�y��Bq�1�"�7����T/G�Ŝs�:H�[y �����*=E�\�oca&$�ӟINk3�7��B�Fx��h7���ٶ�F�*5� ���k_�~� :�]<x����&ץ�ύ/�� �:^�fZ5�`3�42�RY�}��1}�i���C��3$�C�Q�!�p)�,}�4ku��7O���-�:ڙ5�-���͟:v�`{�Ǝ]�]tظ�l�B�LL��p$#�����m�� `qIS�n~B�E��2j��9�W��"�W��S�K��C�,��*�6��"T��]�-��.P!���?5����p|-����P�� ̾������ G����z�M�-�d�����)���Y�oӦH��Z��ἢ��2*p�U����0�ω����)���g#��)����qLG��D��y���+�����{=�s��6;�2(�j��B�*�(R�*�(*����{��̗�y�k#{+�\#7]��"R��m�P� ��8��PW���Vx������>��|��R�oܪ�>U5����|��m+g�IOal-��>��v$�� jC#� � �Q���=�'R���R*�z�ӻ�[����w�a�霶hDқ�M\���M����w�a͊s0���Fbz*�~f��3/���?ɘ,DSz9�p���� ��#5v���:؟���L}��y���P����G��6ԎO�_�B}���E���a�$ʡ���(���Ξ�G��V�\���g�7n�o�Yv��:����2�g J�9��t��8qЍ��� ��5�4�Rpt�Ǿ�^pKz��������f5N�Q�d O��H�Xł�p'C��j�[y?�6�: /�^/�vK�����������"�rS��Mfᮈ����J�C��A�����re7�r(��ǝ�fR"ܧ'�|�Vő'����b����^)4[��]��!g���FA%�p�4�1�{U��:�5��d��E{#4��y����Q�|�c�S~i���C�yP��Y\�oE�;�ȵ���ۋ�Y1&�@4������ڏ�z��4�c�)���P�n��6���ba�!��m����k����U�Y}yHba�\��X������Y��2�yJ���n�Ӓ����=�l�^��\5�dz�[�K��:�����ܲ(Զ��`8AM��TbA8��L3�+�-��ű.�]�!hq�(C�-�6�'���y�s]վ�D����NT�7����흘=�J���J���B�Fl\f|"(gL,C�F)�Uܝ���"f�Za�c��7\E�/!D�HMg\ʓ�ެ��'��� ����!OD�؇��:�J��^�bS8'm�:�M"� n� H�o�q���ĔG���tp���dE��Dx�X:�E�t�� �M�[�5��w ����u��)��_S�,̌����&b7h��q-R���9<��=�
Static task
static1
Behavioral task
behavioral1
Sample
FS辅助更新器.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
FS辅助更新器.exe
Resource
win10v2004-20240709-en
General
-
Target
fa0f1601f4152abd5a087164de116c64fb727c211cf7bd1a03fb4dfe067778a8
-
Size
15.3MB
-
MD5
977b458ebcfd48e9b04e1a2a8a177d94
-
SHA1
d34eedddcd5454d906556f161daa337bb4d8c4cc
-
SHA256
fa0f1601f4152abd5a087164de116c64fb727c211cf7bd1a03fb4dfe067778a8
-
SHA512
8508e0b01077a533236a607505e6a202cd96e57dd8f566f47798cfd060ba5884ca409591f2ac25a5bd60716fc9464147cd76466684b3cc734d6652cc1f3971c8
-
SSDEEP
393216:w1W0M42zwYFR0D5/scpcGwCQFasg7xlwG8zpNWRRqWCdAtP6anF:m7MBcYFR0qcaHdasSlw/zw8NdAD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/FS辅助更新器.exe
Files
-
fa0f1601f4152abd5a087164de116c64fb727c211cf7bd1a03fb4dfe067778a8.zip
-
FS辅助更新器.exe.exe windows:5 windows x86 arch:x86
11329558e04c7c5ea43b3cd962db6af9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsWindowEnabled
CharUpperBuffW
psapi
GetProcessImageFileNameW
comdlg32
GetFileTitleA
shlwapi
PathFindExtensionA
gdi32
Escape
winspool.drv
ClosePrinter
comctl32
ord17
oleaut32
VariantTimeToSystemTime
shell32
SHGetSpecialFolderPathA
Exports
Exports
Sections
.text Size: - Virtual size: 447KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fshjgxq Size: - Virtual size: 12.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fshjgxq Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fshjgxq Size: 15.4MB - Virtual size: 15.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
使用说明.txt
-
躲大力大梦设置.bmp