2e942e6f7cf8684e789c3f4f0907b274746888d325714be70f398a250139989f

Sharing

Copy URL Twitter E-mail

General

Target

2e942e6f7cf8684e789c3f4f0907b274746888d325714be70f398a250139989f
Size

15.4MB
MD5

c95fa09c8796c725c69e8e26293728c7
SHA1

60eab6879a69a014b22f0c7604d50a693307efb1
SHA256

2e942e6f7cf8684e789c3f4f0907b274746888d325714be70f398a250139989f
SHA512

0e662b93a5e83cadfb8d7543872ce72c1fb5efd7bf5d6df7bc4aa027bc224dbce3967f7db224fb43234c1338e48a4d676c6dad607c3a03781a46ab04afa3500e
SSDEEP

393216:ExEg8PaiNHqKCxgwkCAMp4442IJdiDHyVvdUMz3Gat2Q:ExR8SGqZkCAW22Ibi6RGQP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/Sunny.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Sunny.dll	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Leave Pay 低版本启动器.exe
unpack001/Leave Pay 微信pc挂机.exe
unpack001/Sunny.dll
unpack002/out.upx

Files

2e942e6f7cf8684e789c3f4f0907b274746888d325714be70f398a250139989f
.zip
Leave Pay 低版本启动器.exe
.exe windows:5 windows x86 arch:x86

fb28351013496a67daa27452c55b613c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
GetVersionExA
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

ole32

OleInitialize

user32

GetClassInfoA
SetPropA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

atl

ord47

shell32

DragQueryFileA
SHBrowseForFolderA

gdi32

GetClipBox
GetTextMetricsA

advapi32

DeleteService
RegOpenKeyExA

winspool.drv

DocumentPropertiesA
OpenPrinterA

comctl32

ord17
ImageList_Destroy

oledlg

ord8

oleaut32

SafeArrayUnaccessData
LoadTypeLi

shlwapi

PathFileExistsA

winmm

waveOutUnprepareHeader

ws2_32

inet_ntoa

comdlg32

GetSaveFileNameA

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 969KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 395KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Leave0
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Leave1
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Leave Pay 微信pc挂机.exe
.exe windows:5 windows x86 arch:x86

a0182be6000416f98ccb533c876d5d19

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetMenuItemCount
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

gdi32

CreatePalette

winmm

midiStreamRestart

winspool.drv

ClosePrinter

advapi32

RegCloseKey

shell32

ShellExecuteA

ole32

CLSIDFromProgID

oleaut32

VariantCopy

comctl32

ImageList_SetBkColor

ws2_32

recvfrom

comdlg32

GetFileTitleA

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 953KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

LeavePay
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

LeavePay
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Sunny.dll
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Exports

Exports

AddCertPoolPath
AddCertPoolText
AddClientAuth
AddP12Certificate
AddVerifyUser
BrUnCompress
BytesToInt
Cfree
CreateCA
CreateCertificate
CreateHTTPClient
CreateKeys
CreateQueue
CreateSocketClient
CreateWebsocket
DeflateUnCompress
DelP12Certificate
DelRequestHeader
DelResponseHeader
DelVerifyUser
ExportCA
ExportKEY
ExportP12
ExportPub
GetRequestALLCookie
GetRequestAllHeader
GetRequestBody
GetRequestBodyLen
GetRequestClientIp
GetRequestCookie
GetRequestData
GetRequestHeader
GetResponseAllHeader
GetResponseBody
GetResponseBodyLen
GetResponseData
GetResponseHeader
GetResponseStatus
GetResponseStatusCode
GetServerName
GetWebsocketBody
GetWebsocketBodyLen
Geterr
GoCall
GzipUnCompress
HTTPClientGetErr
HTTPGetBody
HTTPGetBodyLen
HTTPGetCode
HTTPGetHeads
HTTPOpen
HTTPSendBin
HTTPSetHeader
HTTPSetProxyBasicAuth
HTTPSetProxyIP
HTTPSetRedirect
HTTPSetTimeouts
HexDump
KeysDelete
KeysEmpty
KeysGetCount
KeysGetJson
KeysRead
KeysReadFloat
KeysReadInt
KeysReadLong
KeysWrite
KeysWriteFloat
KeysWriteInt
KeysWriteLong
KeysWriteStr
LoadP12Certificate
LoadX509Certificate
LoadX509KeyPair
MustTcp
OpenTcp
PInit
ProcessAddPID
ProcessCancelAll
ProcessDelPID
ProcessStart
QueueIsEmpty
QueueLength
QueuePull
QueuePush
QueueRelease
RemoveCertificate
RemoveHTTPClient
RemoveKeys
RemoveSocketClient
RemoveWebsocket
ScriptCall
SendWebsocketBody
SetCa
SetIeProxy
SetInsecureSkipVerify
SetIpAuth
SetIpProxy
SetProxyTimeout
SetRequestAllCookie
SetRequestCookie
SetRequestData
SetRequestHeader
SetRequestProxy
SetRequestUrl
SetResponseAllHeader
SetResponseData
SetResponseHeader
SetResponseStatus
SetScript
SetScriptLogCallAddress
SetServerName
SetTcpAgent
SetTcpBody
SetTcpConnectionIP
SetWebsocketBody
SocketClientClose
SocketClientDial
SocketClientGetErr
SocketClientReceive
SocketClientSetBufferSize
SocketClientWrite
StartProcess
Stop
TcpCloseClient
TcpSendMsg
TcpSendMsgClient
VerifyUser
WebpToJpeg
WebpToJpegBytes
WebpToPng
WebpToPngBytes
WebsocketClientReceive
WebsocketClose
WebsocketDial
WebsocketGetErr
WebsocketReadWrite
_cgo_dummy_export

Sections

UPX0
Size: - Virtual size: 11.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Sections

.text
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7.1MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 233KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 231KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
使用说明.txt
微信收款单.lnk
.lnk

Sharing

General

Malware Config

Signatures

Files

fb28351013496a67daa27452c55b613c

Headers

File Characteristics

Imports

kernel32

ole32

user32

atl

shell32

gdi32

advapi32

winspool.drv

comctl32

oledlg

oleaut32

shlwapi

winmm

ws2_32

comdlg32

wtsapi32

Sections

.text Size: - Virtual size: 969KB

.rdata Size: - Virtual size: 139KB

.data Size: - Virtual size: 395KB

.Leave0 Size: - Virtual size: 2.5MB

.Leave1 Size: 4.4MB - Virtual size: 4.4MB

.rsrc Size: 20KB - Virtual size: 19KB

a0182be6000416f98ccb533c876d5d19

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

wtsapi32

Sections

.text Size: - Virtual size: 953KB

.rdata Size: - Virtual size: 152KB

.data Size: - Virtual size: 320KB

LeavePay Size: - Virtual size: 3.2MB

LeavePay Size: 5.6MB - Virtual size: 5.6MB

.rsrc Size: 20KB - Virtual size: 19KB

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 11.5MB

UPX1 Size: 5.7MB - Virtual size: 5.7MB

UPX2 Size: 4KB - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 5.1MB - Virtual size: 5.1MB

.data Size: 7.1MB - Virtual size: 7.1MB

.rdata Size: 4.4MB - Virtual size: 4.4MB

.bss Size: - Virtual size: 233KB

.edata Size: 3KB - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 231KB - Virtual size: 230KB

.text
Size: - Virtual size: 969KB

.rdata
Size: - Virtual size: 139KB

.data
Size: - Virtual size: 395KB

.Leave0
Size: - Virtual size: 2.5MB

.Leave1
Size: 4.4MB - Virtual size: 4.4MB

.rsrc
Size: 20KB - Virtual size: 19KB

.text
Size: - Virtual size: 953KB

.rdata
Size: - Virtual size: 152KB

.data
Size: - Virtual size: 320KB

LeavePay
Size: - Virtual size: 3.2MB

LeavePay
Size: 5.6MB - Virtual size: 5.6MB

.rsrc
Size: 20KB - Virtual size: 19KB

UPX0
Size: - Virtual size: 11.5MB

UPX1
Size: 5.7MB - Virtual size: 5.7MB

UPX2
Size: 4KB - Virtual size: 4KB

.text
Size: 5.1MB - Virtual size: 5.1MB

.data
Size: 7.1MB - Virtual size: 7.1MB

.rdata
Size: 4.4MB - Virtual size: 4.4MB

.bss
Size: - Virtual size: 233KB

.edata
Size: 3KB - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 231KB - Virtual size: 230KB