b1b6db1a1868a2fe6cd0dfd279fb816cee404bc0ddf289143102bb0a84f6e42c
- SHA256 b1b6db1a1868a2fe6cd0dfd279fb816cee404bc0ddf289143102bb0a84f6e42c
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
登录成功后点击首页不知道为什么会退出.MP4.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
登录成功后点击首页不知道为什么会退出.MP4.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target b1b6db1a1868a2fe6cd0dfd279fb816cee404bc0ddf289143102bb0a84f6e42c
- Size 2.1MB
- Sample260724-lbtabswtgt
- SHA256 b1b6db1a1868a2fe6cd0dfd279fb816cee404bc0ddf289143102bb0a84f6e42c
- MD5 e7bd70a741d2f61b0a67bf4c7c13560a
- SHA1 d6e2415bd03eb67d90404cd8e81ba0ac02a82db1
- SHA512 4c9b5b70be5aa22e559343a51686b048cbaf454914ce4389c68b9de94eb82385f3bc5c24dbd863d0c9b2c1a5a7cb1ed0878188c25ef82c3cfeb3fe95562b3317
- SSDEEP 49152:T3vM9FUbFISEpSwVRK9QOHR9sVU+dzKO0iUNwAzh06Uf/G:DMgZTEnq9QYIpdzL0iSUW
- TLSH T1CDA533825FD34E9373C1CAB7CD0CAB5D5B458758E0ACDE20726950336BE2267582FB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/登录成功后点击首页不知道为什么会退出.MP4.exe
File Explorer
-
b1b6db1a1868a2fe6cd0dfd279fb816cee404bc0ddf289143102bb0a84f6e42c.zip 2.1MB
-
登录成功后点击首页不知道为什么会退出.MP4.exe.exe 3.3MB
登录成功后点击首页不知道为什么会退出.MP4.exe
- IMPHASH d42595b695fc008ef2c56aabd8efd68e
- SHA256 40035c20a806cafa02a373da58b7f2cc13ff9d71d546258c879a487fa28091d4
- MD5 4d50e2e72aac5e2c5167da0b49f899d8
- SHA1 95058d68ea1055a2d40c7660906ffd666a4d7b4c
- SHA512 67d9a3709a4a6e8d986d0157253347d74825f8afed4c21ed9c2540ddcfab0b5833bc79107e1fa68e235d66d23c89559220ecaeebc1e7b893de158fa963d4d141
- SSDEEP 49152:XjZsWPyT+bEjcI2JQXXUv0ppORBKTQAHHzsVUFB/mQ86Vumg1XchaWMGpwGt:XNTqc3QnUEoyTQeHQ8W1QN5
- TLSH T1ACF5AF177CD118BAC06B933289A652B27B31FC490B3263DB2A50F73C2FB26D46A75754
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
463616
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
671KB
Virtual Size
671KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
331B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
155KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/32
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/46
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/65
Size
301KB
Virtual Size
300KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
159KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/90
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ