22ca053ce238019bedddbc3706b2ccb2a214d7b943d97b372e8dd226c9c49b53

resource	yara_rule
static1/unpack001/phototool.exe	upx

resource
22ca053ce238019bedddbc3706b2ccb2a214d7b943d97b372e8dd226c9c49b53
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/phototool.exe
unpack002/out.upx

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 22ca053ce238019bedddbc3706b2ccb2a214d7b943d97b372e8dd226c9c49b53
MD5 29ad78a29d69a4bf5f65dc718f6c9970
SHA1 8e69dcfe63e57386e6d2ea503e9448f5919f4aa1
SHA512 2467ab2613c90fc17c3cdbb7951ba47c54bd6e30b227133b160a34c737f541eb7fa732cb659a5aa68fb92653a2eb713cee24671f19012695741b8e9e2f6c1d91
SSDEEP 49152:oLWYFh8zepWnftTeheOgmE2FqhEwaAeEyLsXNiTBJ9l:oiYFQSWnftTWeZiFiEAaxJX
TLSH
T15B7512216798985DDC2B76BB48A794BC31627D4CD470063B31C2BA6DB3BB31610DBA4B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/LangDLL.dll

IMPHASH fe3375e7e4529b73ba45ab2246b9269b
SHA256 760df89c2341f9c39c0250c283cb9caad185244fd6b76e8157cdf49928dc1d8e
MD5 5e2fd68a1ce97cc2866becb699fdb4c0
SHA1 55469bdaea8e9660f69f15107affda81de2787ae
SHA512 de94531b4f0d85bfb8de5a30390631dca84064e48f1984b7521d54382ddd26e3d886738455a4ed7fcba3f7ee8b092cf01cadcb8c3326b9fa5721e6d952db871e
SSDEEP 48:S46+/DTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mW2ofjLl:zpuPbO5tCZBVEAWyMEFv2CmuL
TLSH
T14BC19370B3D248B9D591413778AB33D36612EE746784504FDB6315AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 4c9e804ce1a391f8e603b7b9c732a6529c1e81be4d12f125c8562ea9d49095c2
MD5 583c38fb0f5af5fe584d9a9b01d6a3e7
SHA1 84dedf7064bb740614f8661793f429f5ee950d86
SHA512 298dac48f75b5d597474fe22e9d69782629c02ebc855f4df91d470edac47ccfb8fe407a1a504fa4a5c94c523c6f03b7b755105b852f25a12d778f2a42313143b
SSDEEP 192:Tg1E8f7JvEeXUUZn7ZkZ85leVlN0sfCm8:Tg1E87ZEYn7Zl4zNhO
TLSH
T174122FA93BAD043022284CFF48D594FADF31F3995F28316D0E74865AE58E3909F09CA7
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
MD5 cf0351a2ab9128838be6b54cea8238d3
SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
TLSH
T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

WaterTemplate/01_右下角原创署名.xml

SHA256 001671c4b3e97c99394e80a0ee4b3b4f8de4d3c1580bd007aff6b14596054027
MD5 3bd00cd950010833d95e6a7d943c01b7
SHA1 1237d63bc93f8227593ab37c6223c846a7efb138
SHA512 34414b66f905d8cec4ce71d80a2f5e728045653112c79fd69fc9e79b48db92c3e27625daf553b0f0290835976b3d9d1f126fd804fddc5df503e440c475ddf479
TLSH
T152215C425BED2148F0BBAA46EAF5155347B23E5B2A3CD85C50BB1F4C00B39816863FE7
MD5 SHA1 SHA512 TLSH

WaterTemplate/02_底部版权声明.xml

SHA256 08821030c7412c09dcb8eb8398b364fad727fb5b1096129218bff9ebd4e18fbd
MD5 559849816fe279099b8735a962fe5b00
SHA1 59d192da581412cc7743fc5909e4a75d5229ffbd
SHA512 586a83a34da0b116c95744c38f63ca0523863ca441e5621cd5ca6e85b4ab00d8c6c1204d333a9aad2a659db8064ca9cb9a40fe146f2dfb5bea97c660d180a7bc
TLSH
T1D23171525BED2144B0B7AA86EAF5155307B23D5B2A3CD81C50FA1F4D00B3581A863FE7
MD5 SHA1 SHA512 TLSH

WaterTemplate/03_左上角拍摄日期.xml

SHA256 d3cc6f9e9d886efdf8509b6512139343cad942a85d476b0d87770f8c3f7d1b07
MD5 70ab9059f4b7e4c1130a497b0a2dec3f
SHA1 be2d20b39ac8439a5e84e064b798bb46be6bb661
SHA512 5d4fef6dd57a21af280f0973fd79b54df6e994b38015148c85c4c8fe24d8c001131501f9926d50dca2b97722bb5909bc6cff4a5608c12b6a30455d7c2b73821d
TLSH
T185313B525BED2148B0BBAA46EAF5154307B23D5B2A3CD85C50FB1F4D00B2981A863FE7
MD5 SHA1 SHA512 TLSH

WaterTemplate/04_右下角相机参数.xml

SHA256 63b319f757748db4b8b290588120f571fe3771605957eece4ce071317eed21ee
MD5 5b20425ddd3bf7ba6ed8979805ae6c1d
SHA1 f2d8fb1d7886768b87c37be71f2342a54bc7657c
SHA512 b0d2d3afd5ebdb526ab952e02a155a624142b11c238ee12c05fe8bee887161390bafdcd6b5b1fefc6c7ccaef6bd426d7f91da518e3d20b82c436d979511af229
TLSH
T1FA315E5617ED2148F0B7AA46EEF2164307A17D5B2A3CD85C54FE2E4C00B3581A863FE7
MD5 SHA1 SHA512 TLSH

WaterTemplate/05_底部文件归档信息.xml

SHA256 603146e11ca95cc2cd29f2fce574aec7513a9558284343518c9eddcaa6201f2e
MD5 6f61e4a6c2467d4842f2a69bf429e004
SHA1 a77ad297bc5bf3803a831898f626d168b15aa378
SHA512 e6a9ce57822c10faa0c4b92e871d3269fb0a02c640b4f1e2e008f9a1e558d8ece59d51676b1c49eb2cce78bccb4892735069616ed3ab37e337a9e21e71a41306
TLSH
T1CE314B466BED2148F1BB6A46EAF6154347B27D572A3CD80C50FB2F4D00B25816863FEB
MD5 SHA1 SHA512 TLSH

WaterTemplate/06_电商品牌角标.xml

SHA256 255b03ce24d595db9ecd3cf1a303fed98ba325e29fe3aa80934d253254a84de3
MD5 5ccbf9f8f7d073aa63f0fd42983b3464
SHA1 6f16f8c28842f948f172f3401e2fbea1361360ad
SHA512 81ac9f712e766c6d7c0fc53b10ddfad9634112734d6dc8a31f7b0d8db128c495124f92616e60bd0ddb96f7bb6592644f63a9c8363d553aa6e39f30360e6c5231
TLSH
T19E218C525BED1148B0B7AA46EAF5154347B27D5B2A3CD84C50FA1F4C00B3A81A863FE7
MD5 SHA1 SHA512 TLSH

WaterTemplate/07_电商卖点横条.xml

SHA256 fdead945383fe4a8c90b2813edca42f3f8a9dd3dc6565afa6c01211425f892bd
MD5 f228048e05900b75147bbad4647c24e7
SHA1 7bd72e35a00a80c7204d4e4019797b6b0990c468
SHA512 5ae760921539c511fb8ae86fc16a283a6d2717cb6ab312b8e2dd09a621eb54a334e3988701fe31d9fea65d256e2a27ce59551b41cf97e13448610c1a36785b13
TLSH
T1C4316D521BED1248B1BB6A46EAF5154347B23D572A3CDC5C50BB1F4D00B2981A863FE6
MD5 SHA1 SHA512 TLSH

WaterTemplate/08_全图防盗水印.xml

SHA256 64e79df82060ee7327d67ded2b84cc4dc2de3358664357e484a644e50f157b8c
MD5 77f1871be435ef974f61392a1f620a90
SHA1 0f54ae87bffda0b9a6efc186d8f480602ff53e08
SHA512 170c673a00d894cef7e037ab93f4c279b693e20d3fbb96dfd7f9b7424286b55102e8b80547e89becd6ff4da85d4e71d2ec04adee82bd58c268468b0dd5681ed2
TLSH
T1405157425BED1154F0B6AA56EEF515434BA23D5F2A3CEC1C50BA1F4D00B3A81A863FE6
MD5 SHA1 SHA512 TLSH

WaterTemplate/09_自媒体账号签名.xml

SHA256 940bff9b49f7627d6712f241848fb01d2022cef0abc072300ab937da27727b80
MD5 317e52872c83302e38fb58205b2b96e4
SHA1 51f800057f9756d2743456e914f2046ab4aaf7c1
SHA512 f4a0d7b87a01ab203fb94c207308977f3c41155b5c061b63c919c0ef599c95761491c7c5538a548de59c060c1b8791e154915fd6bc0ba9f507083c92b405c37f
TLSH
T13C3139465BED2158B0B76A86EAF5154307F23E5B2A3CD85C50FB1F4C00B2A816863FE7
MD5 SHA1 SHA512 TLSH

WaterTemplate/10_自媒体封面标题.xml

SHA256 211f0f7c76cdd1db6fb659d441111379cb0fdd548e1f64e744745e79ff2d49aa
MD5 d19b9dab6d0f22a7ff92c8f38aebd509
SHA1 df563fb89f61a4f86c40401177d4a5fdd91fa97c
SHA512 1eaced47401ff3a4704f159c1dacd6fbab1247032d825bbd36f54089e0e823e4f5bfe1cb9fb71e8420c44de7a8746016a719e20be8498535cfd1f68b9cc59268
TLSH
T1353169421BED1158F0BA6A46EAF115430BF23E5B2A3CD84C50FB1F4D00B29816863FE7
MD5 SHA1 SHA512 TLSH

WaterTemplate/11_百变防搬运水印.xml

SHA256 b553156870c4c22c918a5d55b9efba7fb61b9883bcf62f19c8687c4cfcff8ad9
MD5 493221c3621eb765f81da144e6db8941
SHA1 03e04c003b9c2e9ae80f8a20b44b02a99334a0be
SHA512 a9cb95f59151ecde2e0cffd7b44f66ea5d5108e4f953a65012ee39a30862ac6407ab71d7d0408b6ae8d181b1ecc04bfe5de99a99885e7c2119dc19b2d337cadf
TLSH
T1DA319C561BED2148F0B76A46EAF1154307B23D5B2A3CD84D50FA1F4C00B29816863FEB
MD5 SHA1 SHA512 TLSH

WaterTemplate/12_百变种草文案.xml

SHA256 ca637c2fb23ed2db83c1b2863188e74ceb68dbe9631e46b6d473f5606132e5d7
MD5 ac942c25c078ce3c56772dd51b75223e
SHA1 e351c5337fef152cf26ca42d3dd9af356235fae5
SHA512 2fc6b73afbf5ea3cec31021f80b245585e12ca801fba7ff9def660c14925d57a3b9cb7f76da5d5adf393a478229dd1d5f9e6bf3300e2e2ec9e00f38c94636a61
TLSH
T14331A4525BED1288F0B72A46EAB1154317B67E172A3CDC4D50FA1E4D00B69C16863FE7
MD5 SHA1 SHA512 TLSH

WaterTemplate/13_证件材料用途声明.xml

SHA256 ca72a9c552489cea1f9ca617f8a86a13c52fc23e1e3c1581f75476a0b1d84e5c
MD5 29c5de83a892c37c775bbf06805ec15d
SHA1 2218a43bc395c45dd80c0851ae8540c61f99719b
SHA512 6cdf3efef3e3a0ced5d5f2e92cdb1bc9dbebf1b29fb9f1c21febd57682e69e45ab31c15b99f1a59edf3b39c7c06990ab3fb6e80ada13e4f6dc118e8634406d3b
TLSH
T1C431AB465BED2144B0B7AA46EAF515530BB23E5B2A3CD80C50FA1F4D00B3A817863FE7
MD5 SHA1 SHA512 TLSH

WaterTemplate/14_内部资料保密标记.xml

SHA256 65ce0239c60da38adf35acd4ea9ae54f7f1726f20092e1eb99d86ff36379f43b
MD5 815c89782dba0c4fbafbc2e4ff799eae
SHA1 4f420e0ad6e44e695b33006166686409173d97ed
SHA512 488dee8ce19bfeea79181932b30c2cc6450102940dd9a514c37b37e3a5cd9408d2d110d5be6fb6e182547ebd7b6e50bb8d463a82921aaa2f48101dc9e15de198
TLSH
T1873190425BED1248B1B7AA47EAF5155347F23D5B2A3CE80C50FA1F4C00B39816963FE6
MD5 SHA1 SHA512 TLSH

WaterTemplate/变异配置1.xml

SHA256 2aaebd11e3fa0ede23b40b1fb62a2511bffd08b78524e7847cdc5faafdc6f895
MD5 6906cc140f1b03caeec6189372342aa1
SHA1 4cb28acbe53da1644c6eee0d1e4160f18f0dff48
SHA512 ca81c1a74112ba8b15b73092543e7de045bd69bf60a600cee70eb5d7b3624b5d9201f73867a0cd0a83607d3c578a4a006ff28a6b9e1102fda74b10f848000bca
TLSH
T1D851C8031FFB4060E591A61EA9B705725F763915253DC03800EE6E8EEAE7D634863BE7
MD5 SHA1 SHA512 TLSH

WaterTemplate/未命名1.xml

SHA256 da3213d2bc49c02790346eee1c0e02d20311a39f5e8831f1102b8b085af06b91
MD5 7332e617f755099650ccb9da71e19ac8
SHA1 d4a5453bdb45eee2fa9171108e74a8b79b6d319e
SHA512 a9267278ea7ac4445ec3d5c9907863e8e716296078e8a0f3fb6f8864063901080c6364e3c8c3e09ffd3611d9bd343611578f2821583e449ff7b0bc5cf75add05
TLSH
T17A31B65357EE1258B1B65A09E8F215630AB33D026A3CC45C51BE1E0D86F3DC28863FEB
MD5 SHA1 SHA512 TLSH

WaterTemplate/未命名2.xml

SHA256 ab7cc90d22b36a0900fdd9973a109e80f67ff4e83965639c5df29255c2edf2c4
MD5 5cd4e37da41f83206ca1894b8b3f4075
SHA1 eb4b2e0c3696aa94b36d9e5042648d86ba2f3553
SHA512 024f5518843f5fc8b8239d27b79ab55e098d2b2d6ca016b4114e300187fb252895889eb0cd012d1f26c5a3c41575291f20be291402fd978ee98a1f50873d0ae3
TLSH
T1BBF03A8213DD220872BB2B82E5B150831AF27D036B3CEC8E91A71F0C04B59C06463FEB
MD5 SHA1 SHA512 TLSH

WaterTemplate/未命名3.xml

SHA256 8f44a90d68c93e8224fc10001014ec40a2df7d602399c735e27923ea9b05c1e3
MD5 6c39436f63a7d675de7477d86ba5adbf
SHA1 5b5d7682677bb65a7e98678962d6a43710e50522
SHA512 9d5b900ab5b36971d72e1ed969e0073583036c1b829bfcc03a7e9cd21461f43049c9bab07931d69555a57d9417f658a28b98e6aab88910c5c45a1c5efce95c38
TLSH
T1AEF01D4653DD2248B1BB2B42E5B1108316F27D036B3CDC8D91A71F0C04B55C16463FEB
MD5 SHA1 SHA512 TLSH

WaterTemplate/百变规则_种草文案.xml

SHA256 3af1adaa35a0fe16d82e3471de8e6f624bd5870ee915bb4e8e0382ce2fe48e04
MD5 ca06350c7e3d1e785026e47a3f8c5e32
SHA1 96293b5a690e77bdaf432c9e07a8dc02e6654a59
SHA512 8ed45591e1d86a41d9d7516f60fac4bcf66f70f11644a46514d9d76fbc04e4c900c50f33e94efe444a620a716c016f3a4d93cbd165bfd071b93056ad4eaf64f5
TLSH
T1DE8172171BEE1196E0F28909FCB616625AA73D52193D841C10ED3E0DD6E3D82A863FE7
MD5 SHA1 SHA512 TLSH

WaterTemplate/百变规则_防搬运.xml

SHA256 ab153a6e26fc3cc9e16d194926267dfe3cdcd97bea21aca32e4c32cca852c1c6
MD5 7b05ef7aac647893c6dc972f40ceb1ba
SHA1 06d727691c1dd136c27dc814a9a78b946580acd2
SHA512 dd2e42f644d9b6e0780832162fe60618ce0122e6e01af5635225944fce654bede040456fec4cb15fb0bc76c2c61a36597190375837357d66553f355672ad0e0b
TLSH
T10A61801B1FEE1166E0F28909ECB616629AA73D15193DC01C10ED3E0D96E3D82A863FD7
MD5 SHA1 SHA512 TLSH

lang/lang_en_us.ini

SHA256 b2b7d9fb0ba5b0b7696fd4eb4264885ed239b61fca9ff8f7de34da9a7cb54356
MD5 3bcde495a3d507fb13e0ca25ac5dfc52
SHA1 50b98de86800b186f73bbf62dcf75f205e3de2bb
SHA512 65aca0221ad3a5d5401622aed9fd146d39c85b3bdf82d66941832bafcfecee19a783fdbc8a0d561ca9a99c9dfc9da749d788ea141b28512c951fe22dd48c4586
SSDEEP 384:AZVqNum/sEYa9R97BK+jHlpLxILMZkBCXfBgmdsx34GjgXD:AZgN72aL3RnxxkA5siGjgXD
TLSH
T1B0A2F86BA325AE58C60F015FF60648E6EC2DC628F5476202F99C45DCE79748F03AAF71
MD5 SHA1 SHA512 SSDEEP TLSH

lang/lang_zh_cn.ini

SHA256 312f6357312ce85998c36fdaf88cfee02131df3f75a457ba0a7884d9c6cf014b
MD5 fe6a5a106a004886086ec7a1c9782ac7
SHA1 458f751670b81815102714cde8c217b94163d6d7
SHA512 d47b8ea5974b0491d8f80d9b66f7a2e1aaf1015f82a0f0711ccec41e1f263d6751c669f62b0711e26949e00d2ef8223ada7aa23ec756623b5bd757d7746bd80c
TLSH
T176412F9F0E61559F8883049A9E8D7F236833E65A0D272416AF3DD3E859AB04D42DFED0
MD5 SHA1 SHA512 TLSH

phototool.exe

SHA256 0a393b84a6d9c4bb98ddbaef87e4fc77f34cfa49801655f523d970a33d568a62
MD5 65382b069a79a181c58c4e87faf6e3fd
SHA1 ad581dfde8c61c317d0fddd9d5981b0e1a7fc980
SHA512 57669e7f5cc9afc324af8773ee1bb44b0c883fbd782def057ad692faeec031f7b33a04d7ada7ad1b1f90a53ad4ac82cca6a577bc0d05cbbd4a0f37aeac36338d
SSDEEP 24576:7hZDqH2zDRR0I6TkhbFJocswXAu37+PByzzKeOvnmBqXoVrR+tD:S4wI6TkhbFJzswXLuGfO/ql+p
TLSH
T134553372CB74D390C5BEB6F19093ADA42C0C632244C75F9F4F684B85983E2794E7692A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

3677344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 700edb6f93cf18393f8e87a9989edf38e2113c2eb12cd72a90d9d2bcb4f4756f
MD5 19dad6a14d1376ed02d84104a2d9c4c7
SHA1 c44908bda90a447409592e0a2978059eb1c97b55
SHA512 50f0204b42af79e68e63ae2f8e3578d601e738b11fcfbc0a386013430265d657f1f2edb36d0bc48f910485c32e5cec2e4d9132db755ffc7d274af29c30a44c78
SSDEEP 49152:4o0dqifr+aOnCMEtuqUGAWtFcpYrgsv3MB2hgo7ouLgwh7Bf6boXc:4o0djrj+Cf7FaYrnv3e2hz7LLgwh7Bf
TLSH
T138F58D217A444066D1A31370C94DF5BEA26CADB407F582CF53F4AA2A3A375C2DB27B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2171792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

667KB

Virtual Size

667KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

184KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

使用帮助.txt

SHA256 3c6194696c6cf1ef7408683b549bd28b225bad0b5e92e5f81c59844af52abb57
MD5 899e83ff9259489e046a8b779d623568
SHA1 c4309cf8c35f3d32d4f18e4c577a3e9752f8f653
SHA512 578879fd185cf1d51830da1f81f691be3724794a6f7361c49276b5c644414a638c784ed249c227d70a3ef704ee4b88c284ce95b61f96b9d9330dba7ce8a29d65
TLSH
T1D9715FEABC8643F56F8250EA33708463995DB509B231FDA8A8924EF47CD845183B5E33
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer