8d5327bd12ab0c6a1e62ce99976d4fdb2d248d7a235c85edbc3f98b62fbf2f60
- SHA256 8d5327bd12ab0c6a1e62ce99976d4fdb2d248d7a235c85edbc3f98b62fbf2f60
Overview
overview
7Static
static
3玩具设�...��.lnk
windows10-2004-x64
7玩具设�...��.lnk
windows11-ltsc_2024-x64
3玩具设�...��.lnk
windows10-2004-x64
7玩具设�...��.lnk
windows11-ltsc_2024-x64
3玩具设�...��.lnk
windows10-2004-x64
7玩具设�...��.lnk
windows11-ltsc_2024-x64
4玩具设�...in.exe
windows10-2004-x64
1玩具设�...in.exe
windows11-ltsc_2024-x64
1玩具设�...��.pdf
windows10-2004-x64
3玩具设�...��.pdf
windows11-ltsc_2024-x64
3玩具设�...��.pdf
windows10-2004-x64
3玩具设�...��.pdf
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
玩具设计（深圳）/1-华为.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
玩具设计（深圳）/1-华为.lnk
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
玩具设计（深圳）/2-腾讯.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
玩具设计（深圳）/2-腾讯.lnk
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
玩具设计（深圳）/3-大疆创新.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral6
Sample
玩具设计（深圳）/3-大疆创新.lnk
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral7
Sample
玩具设计（深圳）/popmart/weixin.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
玩具设计（深圳）/popmart/weixin.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
玩具设计（深圳）/popmart/华为-玩具设计.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
玩具设计（深圳）/popmart/华为-玩具设计.pdf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
玩具设计（深圳）/popmart/大疆-玩具设计.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 8d5327bd12ab0c6a1e62ce99976d4fdb2d248d7a235c85edbc3f98b62fbf2f60
- Size 714KB
- Sample260722-sss48axfqa
- SHA256 8d5327bd12ab0c6a1e62ce99976d4fdb2d248d7a235c85edbc3f98b62fbf2f60
- MD5 ed91fea98e9483ba81b8e50ef46145af
- SHA1 d9f5dc4bef505cdd4c431b9c634ec51f7293fd7e
- SHA512 31a3bd47a04daff16fb694b1db4c3b0edb76709f20c80c14c1ac14a972364b7e4dd94197a1e1b4b49795f5ecd28da8fa19321512d10d60090fe145587db6f3bb
- SSDEEP 12288:3ujdO7pG2eMdxaX9GtwSUPioim0fJ3419xfbLGEJnUDE0p75Ry2NxmV0hF/H3i3:AdO7pFe9X9Gtp1meJgxO8Ip7/yj0vv3A
- TLSH T1A5F43389F2D7B14CC7E1B9B3C8117325E1350772E1CE9FB2C258492ED09AB469989BC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/玩具设计（深圳）/popmart/weixin.exe
File Explorer
-
8d5327bd12ab0c6a1e62ce99976d4fdb2d248d7a235c85edbc3f98b62fbf2f60.zip 714KB
-
玩具设计（深圳）/1-华为.lnk.lnk 650B
-
玩具设计（深圳）/2-腾讯.lnk.lnk 648B
-
玩具设计（深圳）/3-大疆创新.lnk.lnk 650B
-
玩具设计（深圳）/popmart/config.ini14KB
-
玩具设计（深圳）/popmart/weixin.exe.exe 1.1MB
-
玩具设计（深圳）/popmart/华为-玩具设计.pdf.pdf 148KB
-
玩具设计（深圳）/popmart/大疆-玩具设计.pdf.pdf 153KB
玩具设计（深圳）/1-华为.lnk
- SHA256 4f082f9062eceb2fed1b3423042ccceb95311aaca20bfe42744d183bd9d54447
- MD5 2b713aece1cad4e03fd4bd594cfce2ac
- SHA1 86cb60682ed1a46ae738e99e986b88fd76822258
- SHA512 5fc59309e5c1a68361238df47f2b95f22d3e5f93e8b65677780f5d10e6231540b1e10dc7ddf2de5631f408f015b18279cdab1f8dd2d46bf6619bbd71d747d90d
- TLSH T1B2F0A01C6EC72F26CB18C236E8AB5324DA3B3C92F5A50F1E00945A95646A10025A9E2F
- MD5 SHA1 SHA512 TLSH
玩具设计（深圳）/2-腾讯.lnk
- SHA256 3aaf0ed1468464c3d77f3284f380d6fa9437fba5ff5ba40861b2be7d895a4523
- MD5 ae3e9788cd89b42af321d1bf799925c7
- SHA1 a38e12ab2782137904020b3d7fe099d5879a610d
- SHA512 06685ef9190eb4ef29633b8f4d9d0a0a8737eae4b213a5aa385d99a7d1ab6371d810cd9b323808e08c1b64a3c5b936a3c4b3474f0fe44967dcca7066b2568076
- TLSH T15BF0A01C6EC72B26DB98C235E8B76325E93B3C92F5A50F5E00940A84646A1012598E3F
- MD5 SHA1 SHA512 TLSH
玩具设计（深圳）/3-大疆创新.lnk
- SHA256 c7b1c471df45d10d60468cd61a7ed1f2de1b7a407c9f775ca312d7b5b7cd006c
- MD5 0906611c2c58a28883e7247c9adb32f5
- SHA1 f7d8889be28bf505d8a280ae9eb0208b60034101
- SHA512 7f540179df687553a49bff5afbf79d9a3a6b529e1e846a09907cc25a57a61b8606037d2276d313145943eae561ae4dd57d9b94bcd6ecc169944940081cc6f907
- TLSH T1F8F0A01C6EC72F26CB18C236E8AB5324DA3F3C92F5A51F1E00945A94646A10025A8E2F
- MD5 SHA1 SHA512 TLSH
玩具设计（深圳）/popmart/config.ini
- SHA256 28a505c850fccee5f69a1f718f5c59caeebcc65260fb2a21e5bc5af17eb480ca
- MD5 403dc51442cc42a2d52d780b6ac5abff
- SHA1 010d7b419f2d91b5c3031ecd4ed0b93cdbad55dc
- SHA512 cf771501462415e03107dba0ed926aba0a1d2e43f7ca5c0b9ebc76b07dc98883241d1951e47fa7da80719336c82f2e5464ed8ff0d14d23778fbd5029491aa567
- SSDEEP 384:Bi2Tph9G7ZjNVPJaUB+k/0ABHCltvTWHD1s+:BPlG7ZJSUIKpBHCltQDq+
- TLSH T1C662E1CFD0692688076A30D855D6EAEB709173F4DE7683CA9083254D8190F1EF6C52CB
- MD5 SHA1 SHA512 SSDEEP TLSH
玩具设计（深圳）/popmart/weixin.exe
- IMPHASH 4a9d8fca37b1a5c0bfd9c36968d5986c
- SHA256 b43ab12932d93f08f0ad7c6722f842e394ecf5d2b9e54b9fe93a83029765e1dd
- MD5 99e73a842b27dc0951342b87e0a13fae
- SHA1 39284e41a83b13f54321fe82f35027d7a467f43e
- SHA512 6088dc0d7ba49ee778fb40e864435dcafbfabbb8b9e6c09ec16cec2d62b45a0cdb365d211add051c610410538295c34dc4aca4c3fa5b685845191345204d538c
- SSDEEP 24576:swdIfMAlBaoSgWtMARLwZKTvP4z5XTsih5X/jQsAaq:swdIfMAioktMLZKTvP4z5Dsih5X/jQs
- TLSH T18D455B0762E815E4E973AA3C8B7607C9E775BD053B20D6CF06E092951F2F6E13A7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
399192
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\AppModelSamples\Samples\ChatAppShare\x64\Release\ShareApp.pdb
kernel32
GetFileSizeEx
TerminateProcess
GetModuleFileNameW
WaitForSingleObject
CreateFileW
GetFileAttributesW
Sleep
GetLastError
OutputDebugStringW
CloseHandle
GetProcAddress
GetCurrentPackageFullName
CreateProcessW
GetModuleHandleW
GetExitCodeProcess
GetTickCount
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
InterlockedFlushSList
CreateEventW
SetEvent
LoadLibraryW
FormatMessageW
RtlUnwind
WriteConsoleW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
SetFilePointerEx
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTempPathW
SetConsoleCtrlHandler
GetFileType
GetCurrentThread
HeapAlloc
HeapFree
GetModuleHandleExW
ExitProcess
WriteFile
InterlockedPushEntrySList
GetStdHandle
LoadLibraryExW
FreeLibrary
RtlUnwindEx
RtlPcToFileHeader
RaiseException
TlsFree
user32
PostQuitMessage
FindWindowExW
ShowWindow
CreateWindowExW
KillTimer
SendMessageW
TranslateMessage
SetTimer
GetMessageW
DispatchMessageW
GetWindowThreadProcessId
GetWindowTextW
RegisterClassExW
DefWindowProcW
shell32
ShellExecuteW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
CompareStringEx
api-ms-win-core-localization-l1-2-0
LCMapStringEx
GetLocaleInfoEx
FormatMessageA
GetCPInfo
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
ole32
CoInitializeEx
CoCreateFreeThreadedMarshaler
oleaut32
SysStringLen
SysAllocString
SysFreeString
GetErrorInfo
SetErrorInfo
Name
.text
Size
826KB
Virtual Size
825KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
161KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
119KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=160, id=261, version=30795,
count=16, id=260, version=30795,
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=259, version=34321,
count=16, id=260, version=34321,
count=81, id=261, version=34321,
count=11, id=257, version=30795,
count=133, id=1, productName=Unmarked objects,
count=3, id=265, version=34440,
count=1, id=255, version=34440,
count=1, id=151,
count=1, id=258, version=34440,
玩具设计（深圳）/popmart/华为-玩具设计.pdf
- SHA256 c6e730b301d8415ebb74d6c29e2eafb5fe154ef326379723fc3295f47a990a4f
- MD5 5ff273786295394bc7544a828355c4f9
- SHA1 7e5056be55b0154b11fbb025465740d518c2bef2
- SHA512 fb8138314161d64d04176e6595b0d27f8618961f13b5de60b51c056516d49b863020363744a0352aa17d57667e33178567cf6127152deccd8406122f01448237
- SSDEEP 3072:6mvVbrmYew/9sEmu5b3BItk1IYZ5tkI1t14AwqgwSfU:tvmYejEmu5DBIt+IwHJrqU
- TLSH T16DE3029CFAF79945EB80A23F585202979330467358BC8335F92DB80A4D6DE77639488F
- MD5 SHA1 SHA512 SSDEEP TLSH
玩具设计（深圳）/popmart/大疆-玩具设计.pdf
- SHA256 918d328904f569e9ea28c196822224fa712ec40d16d742359d14b6ccc8744019
- MD5 394e09fdcb91918a7c219d33a045b76f
- SHA1 1a9b4c0e379121fc84537309220db27f1c26b4ad
- SHA512 118fb2e9b7882697cb2928c0467051bd6efa13ef49066e607a057dba06c47c7f1161a42dceecf1683c1b5b3df95e70eeb60256cb3e59cf0080534d5f1a6b7bf9
- SSDEEP 3072:NYNvHYcYEJuhMD2Brj7w0klpIPMgqJu3Xrij6CHE/RNTSIjgfQu6va4N:NYOHEoAqg0kyJqNj6iELTJE4xva4N
- TLSH T124F3123CD179128DCEAB14736E76521AC37985A3968D6127CA383006AD3FD7E6B014EF
- MD5 SHA1 SHA512 SSDEEP TLSH