4b03edb05b95fb63968552e2d2b22b5ca094eb244bd87595e10f7506b556f659
- SHA256 4b03edb05b95fb63968552e2d2b22b5ca094eb244bd87595e10f7506b556f659
Behavioral task
behavioral1
Sample
引导锁/引导锁.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
引导锁/引导锁.exe
Resource
win11-20250610-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
引导锁/引导锁_upx打包.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
引导锁/引导锁_upx打包.exe
Resource
win11-20250610-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 4b03edb05b95fb63968552e2d2b22b5ca094eb244bd87595e10f7506b556f659
- Size 247KB
- Sample260510-eav9zagy4s
- SHA256 4b03edb05b95fb63968552e2d2b22b5ca094eb244bd87595e10f7506b556f659
- MD5 478ead539245bf739ab8b3dc52706594
- SHA1 e65e277361c65e77d2db77e8032f7d06a4ea4eb3
- SHA512 3b3ef94ddcae680339c7b84eb66b67ea532f71648bca239fd6e114a880d19d16b4a31d67860e13c5fa97e3f90501e7e9eff2862998b9e3cfa661851335a1fa0c
- SSDEEP 6144:GjFrsBltioUt3TisqsJQKqvVr9YghfbRu/npgWGAOy8y:GZral3YixCOZPhMPpgTW
- TLSH T1073412018B07B521CEE2B2741CE72D2D4D29966B37D559D29C2A2FC06CFC9D6067BF0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/引导锁/引导锁_upx打包.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/引导锁/引导锁.exe unpack001/引导锁/引导锁_upx打包.exe unpack002/out.upx
File Explorer
-
4b03edb05b95fb63968552e2d2b22b5ca094eb244bd87595e10f7506b556f659.zip 247KB
-
引导锁/引导锁.cpp12KB
-
引导锁/引导锁.exe.exe 210KB
-
引导锁/引导锁.obj212KB
-
引导锁/引导锁_upx打包.exe.exe 91KB
-
out.upx.exe 210KB
引导锁/引导锁.cpp
- SHA256 cb329b46f9a3cf4a239ac64cddeb1ee4636462c964b76d6f18061d504a623551
- MD5 5fff7acc9fdbb22ca27e2a166e3bcba2
- SHA1 51e19c40baba7117172e929cb7f62bfb13737f6a
- SHA512 2e3e2355af7ebd3e6770f56c9b3ef4c354e650ba117d5ececc6546778b5b9c6ff1d3c23a1419ecc1c448637324e1a67b542dccb4a96bbce1a5333ac472d7eef1
- SSDEEP 192:HLdDkDrIr3qzAmgp+JGerqETQGgwQp+ltTFaK18lNR51eOu8VZ4mOIBttoOqF3Gi:rIbGkJFqEn/nTxm+dgNo94YASX
- TLSH T17842C4E578A76F20B0B312AB1F5BCD03642DDA4B9258EA2075CD43D4DF69C839AB13D0
- MD5 SHA1 SHA512 SSDEEP TLSH
引导锁/引导锁.exe
- IMPHASH bd51fc2e90f97694a41094dc65fdc7e5
- SHA256 152c3c9e2dbe6268d6dc6c615fdf9eb9053ae05adb2609c1be7c50e84df94fba
- MD5 eed096d4b630f1cec55ca9b3303c67e2
- SHA1 b93f61965f179c8f90ee6d9d4b514ac875930a71
- SHA512 cdb7b1a30a2803d272f6fbf65833b7252ba6c78bd63602193254d4ecb5c779787d6f9bff49fd777f6c2313f7b67a9d592d7de2afe1a2114661d172ce2893b8bc
- SSDEEP 3072:a7x++DDhKYhmDRgiEH1/BcjoxVp5bNKsgwsv6bf871mF0jmjS9iidAkdmL4gm6ul:mHhogiY1/VVj4sgZAY7qqHFOi1tH1
- TLSH T148247D11B891D032D9B70876CCFADB7D9A2DFC410B6568D763C41EEE8E209D1BB3560A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
44777
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
MessageBoxW
ShowWindow
shell32
ShellExecuteExW
advapi32
CryptReleaseContext
StartServiceW
OpenSCManagerW
CreateServiceW
CloseServiceHandle
OpenProcessToken
AdjustTokenPrivileges
DuplicateTokenEx
ImpersonateLoggedOnUser
LookupPrivilegeValueW
InitiateSystemShutdownExW
CryptAcquireContextW
CryptHashData
CryptDeriveKey
CryptDestroyKey
CryptGetHashParam
CryptEncrypt
CryptCreateHash
CryptDestroyHash
kernel32
SetStdHandle
HeapSize
WriteConsoleW
GetCurrentThreadId
CreateDirectoryW
CreateFileW
DeleteFileW
ReadFile
SetFileAttributesW
SetFilePointer
SetFilePointerEx
WriteFile
CloseHandle
GetLastError
CreateMutexW
GetCurrentProcess
ExitProcess
OpenProcess
GetModuleFileNameW
GetConsoleWindow
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
SetEndOfFile
GetSystemTimeAsFileTime
InitializeSListHead
GetProcessHeap
RaiseException
RtlUnwind
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetStdHandle
GetCommandLineA
GetCommandLineW
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
ReadConsoleW
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
Name
.text
Size
145KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=33145,
count=182, id=261, version=33145,
count=22, id=260, version=33145,
count=21, id=259, version=35403,
count=18, id=260, version=35403,
count=76, id=261, version=35403,
count=9, id=257, version=33145,
count=126, id=1, productName=Unmarked objects,
count=1, id=261, version=35723,
count=1, id=258, version=35723,
引导锁/引导锁.obj
- SHA256 a8025bea1816fea34765897d01ac423edc19da9cbacee9cbc5cc99e75df37bad
- MD5 d002872b4e00c0eb1080b905064a82b8
- SHA1 aa63757b3fa7e22dc96703adb37d5717da27f07e
- SHA512 51afcccd96191d3823d5999e0f6e3c908083e9fb5cd0a52493d55440fda464812a2371cadfc12e8a7cb3f674d615b1f17b0047f0ada0889235305f3978e647ac
- SSDEEP 3072:9TWI7gKWG2J/aNzq9PdnmgV0uN0QK9UV3Hu/i+L9/n5M6X:oI7g1MqFN0QK9UV3Hu/i+L9/n5M6X
- TLSH T1D8245126B74E8483C67683B598D74277E375BE402B32A35B738AF0311FA3344AD97925
- MD5 SHA1 SHA512 SSDEEP TLSH
引导锁/引导锁_upx打包.exe
- SHA256 6263705fa2ad84d689afe23e92ebe14f5113a93f50b07b48669e12f2ac21dc6f
- MD5 d5e5fe41649ed677897f22f09488fbc7
- SHA1 51fcbddae23f3e596f00091048cbac4e51759b78
- SHA512 401b8b7ab63f874a0f759ec133e2d68a574fbcf0c731d7ed6574509b92b7d83dfc8f3ce5b752b988aed2941d6eae2950635001e5ce6598cad16d1c5e22415096
- SSDEEP 1536:/ly30Ch56ViMz0kuvOelvvEjCeQcLHqZhDQ7c4IS0JzgyObtDo76H:/I0igowuvOelsq742zh2CI
- TLSH T1E99302B3B826D81FFC9252B7055C9F59900DC8AF47F90D06645838CFEE53E59A589382
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
238496
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
90KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=13, id=259, version=33145,
count=182, id=261, version=33145,
count=22, id=260, version=33145,
count=21, id=259, version=35403,
count=18, id=260, version=35403,
count=76, id=261, version=35403,
count=9, id=257, version=33145,
count=126, id=1, productName=Unmarked objects,
count=1, id=261, version=35723,
count=1, id=258, version=35723,
out.upx
- SHA256 06f7c21cdaf430d3b5119d671ab7e4d5d71a18f3f5bed4c71886fd16a3f7a87c
- MD5 28f4e2eb8a6fdc07aca6160b7105f4b2
- SHA1 a1667189fec21d1052efc5b7e634c26ce056a4cc
- SHA512 d09e2de29b50c803ddab3cbd303b17ef780bb97d2cfeede7e154763c0b459c1b665333908a041961efc3f3d7165e3ff4803cf0bb501e4797d70610190c046e63
- SSDEEP 3072:07x++DDhKYhmDRgiEH1/BcjoxVp5bNKsgwsv6bf871mF0jmjS9iidAkdmL4gm6uJ:oHhogiY1/VVj4sgZAY7qqHFOU
- TLSH T157246D11B991D032D9770876CCFACF799A2DFC410B6568D763C81EAE8E209D1BB3161E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
44777
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
145KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=33145,
count=182, id=261, version=33145,
count=22, id=260, version=33145,
count=21, id=259, version=35403,
count=18, id=260, version=35403,
count=76, id=261, version=35403,
count=9, id=257, version=33145,
count=126, id=1, productName=Unmarked objects,
count=1, id=261, version=35723,
count=1, id=258, version=35723,