dfaf1c7294ddcb2210638f900c8666a301ba18b5c0028071e747b134cc56c121
- SHA256 dfaf1c7294ddcb2210638f900c8666a301ba18b5c0028071e747b134cc56c121
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
单文件制作工具 7.0.2.3865_x86_x64/单文件制作工具 7.0.2.3865_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
单文件制作工具 7.0.2.3865_x86_x64/单文件制作工具 7.0.2.3865_x64.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
单文件制作工具 7.0.2.3865_x86_x64/单文件制作工具 7.0.2.3865_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
单文件制作工具 7.0.2.3865_x86_x64/单文件制作工具 7.0.2.3865_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target dfaf1c7294ddcb2210638f900c8666a301ba18b5c0028071e747b134cc56c121
- Size 8.9MB
- Sample260728-q63jpsywhy
- SHA256 dfaf1c7294ddcb2210638f900c8666a301ba18b5c0028071e747b134cc56c121
- MD5 05076c52a594ec16ea4d40a8e566132a
- SHA1 05940f3106f229311ffab637cad9c8533ac8ec19
- SHA512 36ba3e96f78cf45f457e57c845a86e32895c2d8d58a1cbb7b44f97971f14564e267ac75570a1745f71a332abe95f5f8c1092b21da9ab994bf67be9d9d129a693
- SSDEEP 196608:D42YwfmG8/evyO0GLMk1T4N4SAiZFv0hfZS0VaxbqLnMdBqm9y8r/XU2j889L:D42RRyOuk1MN4FyFv0nS0VLLnMF5pTL
- TLSH T1DB9633E5D298AA26CE740ADE3C7593CC6DD9E1173F17267E83D7B298B340023B592583
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/单文件制作工具 7.0.2.3865_x86_x64/单文件制作工具 7.0.2.3865_x64.exe unpack001/单文件制作工具 7.0.2.3865_x86_x64/单文件制作工具 7.0.2.3865_x86.exe
File Explorer
-
dfaf1c7294ddcb2210638f900c8666a301ba18b5c0028071e747b134cc56c121.zip 8.9MB
-
单文件制作工具 7.0.2.3865_x86_x64/单文件制作工具 7.0.2.3865_x64.exe.exe 4.5MB
-
单文件制作工具 7.0.2.3865_x86_x64/单文件制作工具 7.0.2.3865_x86.exe.exe 4.5MB
单文件制作工具 7.0.2.3865_x86_x64/单文件制作工具 7.0.2.3865_x64.exe
- IMPHASH c57e4f526395288c8406444b38b1e657
- SHA256 73e1cb95238fb28f6f7bb3064310f7a0ec801ea141dc138c83b5e122242e5927
- MD5 5de69643f62d562f999952d805c68d86
- SHA1 361a2baabaa4960747f463461951c2186a0a7276
- SHA512 3a0acb93d891e29477e842dacd57362158d9468da19a88a2c3957e3f94632ad131c21d1bfd9019592ee8db570c2ecfae1447c7b07049bf136b6da9f04dd3016c
- SSDEEP 98304:UIHyG6Xr3rWktYM846LJnM1b+DsBw0B9oMzTSP1PE9T3cFIU9dyUWKYRs7zbuhtX:UsyG2DYM8Xcb+ASm9oMzTSdgUIUdpdYF
- TLSH T1B52633D0D6643DE6CE72857D68F222489682EDA31E963D5FC2877ECD3170203B693297
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
13542368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
shlwapi
StrStrA
user32
GetDC
gdi32
BitBlt
advapi32
FreeSid
shell32
SHChangeNotify
oleaut32
OleLoadPicture
version
VerQueryValueW
setupapi
CM_Get_Parent
LoadEnvi
MemoryCompare
MemoryCopy
MemorySet
WndProc1
WndProc1_
WndProc2
WndProc2_
WndProc3
WndProc3_
dllMain_Name
main
main1
main5
mainB
mainB_
mainW
main_
Name
.MPRESS1
Size
4.4MB
Virtual Size
12.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.MPRESS2
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
单文件制作工具 7.0.2.3865_x86_x64/单文件制作工具 7.0.2.3865_x86.exe
- IMPHASH c57e4f526395288c8406444b38b1e657
- SHA256 6491c644a730e029db4f4caba581708cbdffec8ecff346669b3255ab193638f9
- MD5 9bd0ffc6c332b11ffcc20de2b87a63bd
- SHA1 d903076631b3a55d4b5e93cc641e76e3e4eff536
- SHA512 5d47cda6f7d45c56650a5d3df500d3ed9dffe0f2a2661395a37cd8ff130e8235d4b255cad0b65a912d337c0e15f454f045b4a6c9f18ff2a638dd2eb910aa1d89
- SSDEEP 98304:oSlo7XinXmz33pn1+lV7T+mdmyAMtia6635R6yeu8W:oS+XinXiHBsr7imdmyvJR6yV8W
- TLSH T1592633E9E50CCEA6F83419BA287A56842DB77DB25722055C9FC3BEAA3571013245FE03
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13095832
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
shlwapi
StrStrA
user32
GetDC
gdi32
BitBlt
advapi32
FreeSid
shell32
SHChangeNotify
oleaut32
OleLoadPicture
version
VerQueryValueW
setupapi
CM_Get_Parent
LoadEnvi
MemoryCompare
MemoryCopy
MemorySet
WndProc1
WndProc1_
WndProc2
WndProc2_
WndProc3
WndProc3_
_dllMain_Name@12
_mainB_@8
_mainW@16
_main_@4
main
main1
main5
mainB
Name
.MPRESS1
Size
4.4MB
Virtual Size
12.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.MPRESS2
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE