Behavioral task
behavioral1
Sample
武逸风云(复古180).exe
Resource
win7-20240708-en
General
-
Target
5f265dac423c5a8eaee9d87fb4c83fc64196d882778faf4dd458f84062c483e1
-
Size
8.6MB
-
MD5
c8d24603f96317d3973a357533fd0eb9
-
SHA1
350f9a9575da9d09196c255604687cc2d0097d73
-
SHA256
5f265dac423c5a8eaee9d87fb4c83fc64196d882778faf4dd458f84062c483e1
-
SHA512
563632bcac7ebc2f2274e89014065839f2942eca36c4c985c685c3960ca84757f0933d3190b0ed30c4e00c4602c4505d3dfb951ebf84ff2b7509997eba639f60
-
SSDEEP
196608:N7ExmZZuPXQbYMc96y2xO6rLFAcyLtIbI0zzqnYrNB4GR1naL2s39s:N7Ex2ZwXaYMc96O6vWcyWE0fy8N1naU
Malware Config
Signatures
-
resource yara_rule static1/unpack001/武逸风云(复古180).exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/武逸风云(复古180).exe
Files
-
5f265dac423c5a8eaee9d87fb4c83fc64196d882778faf4dd458f84062c483e1.zip
-
如果登陆游戏有问题——请看这里.txt
-
武逸风云(复古180).exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 215KB - Virtual size: 216KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE