8cdfe9c78400e042fe6bfabd6bc49f18bb3388c2143a4e65e85596de7fd36a2c
- SHA256 8cdfe9c78400e042fe6bfabd6bc49f18bb3388c2143a4e65e85596de7fd36a2c
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
鼠标屏幕助手.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
鼠标屏幕助手.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 8cdfe9c78400e042fe6bfabd6bc49f18bb3388c2143a4e65e85596de7fd36a2c
- Size 611KB
- Sample260804-s7kfmadb49
- SHA256 8cdfe9c78400e042fe6bfabd6bc49f18bb3388c2143a4e65e85596de7fd36a2c
- MD5 a9666f8fcc58d621efecd2494a02a867
- SHA1 06286f1325bc8bc3b83bc416ae88c95fc87ff2c4
- SHA512 590040eb6a4cbaf800ec3dae516014ecd4f43b88724de4e756587c4e033277c8fcb290c0f69f602813dced894ccada6b1025408c60d3599f85f083bb9b286112
- SSDEEP 12288:SKf6aMIRTDUyzhUCzE+xtCJsHAp6PHRhYAtmE1klwv3CLtdV4dH+Nwv:qeTQyzYGtK6PHRftmxlU3Cl4
- TLSH T178D4239B8B0C9671BD241A1075C8723F583D8B053C9FA94AF5271AB746B0E21C7B73E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/鼠标屏幕助手.exe
File Explorer
-
8cdfe9c78400e042fe6bfabd6bc49f18bb3388c2143a4e65e85596de7fd36a2c.zip 611KB
-
鼠标屏幕助手.exe.exe 2.8MB
鼠标屏幕助手.exe
- IMPHASH ec8c007516b9b42f823cd1e40dea3984
- SHA256 ea438ee8311007930673336654fac2a0698687217b8444c8c00dd0109c4dae64
- MD5 9741ef9a5bf575f2b242d3fb1535f16c
- SHA1 05424cd76587f0a4a0f74f7ff7f642fa795ead9a
- SHA512 5e0672ca9df01c728a6e55f509ad3cb7fe566054cf98d4e2321ecf80d33b8696d4199414720c5afbfbdc6f5f12b449e78dbd292f4fa5e15da9764ce47abf3c2d
- SSDEEP 24576:bdjZVzsOj+dHSyjHb4GcilUbQhAc6PI7t7UDW6i+Ec0xMkl81sU3AofYon7Aq34t:bdjZKOjsHndPUbQhAeVUTTYon7Aq34t
- TLSH T12DD5D64369DB0DE9CED26BB861C75335A778FD71CE291F2BAA04D2212D536C46D2EB00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4144
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
comctl32
InitCommonControlsEx
comdlg32
GetOpenFileNameW
GetSaveFileNameW
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontW
CreatePen
CreateRoundRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
FillRgn
FrameRgn
GetTextMetricsW
SelectObject
SetBkColor
SetBkMode
SetTextColor
kernel32
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetStartupInfoW
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalFree
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
__C_specific_handler
api-ms-win-crt-convert-l1-1-0
_wtoi
mbrtowc
mbsrtowcs
strtoul
wcrtomb
api-ms-win-crt-environment-l1-1-0
__p__wenviron
getenv
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
localeconv
setlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
_fdopen
api-ms-win-crt-private-l1-1-0
__intrinsic_setjmp
longjmp
memchr
memcmp
memcpy
memmove
strchr
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___wargv
__p__wcmdln
_assert
_beginthreadex
_cexit
_configure_wide_argv
_crt_atexit
_endthreadex
_errno
_exit
_set_app_type
_initialize_wide_environment
_initterm
_initterm_e
_set_errno
_set_invalid_parameter_handler
abort
exit
signal
strerror
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vsprintf
_fileno
_get_osfhandle
_lseeki64
_read
_setmode
_wfopen
_write
fclose
fflush
fopen
fputc
fputs
fwrite
setvbuf
api-ms-win-crt-string-l1-1-0
_strdup
iswctype
memset
strcmp
strcoll
strlen
strncmp
strnlen
strxfrm
towlower
towupper
wcscoll
wcslen
wcsnlen
wcsxfrm
wctype
api-ms-win-crt-time-l1-1-0
strftime
wcsftime
api-ms-win-crt-utility-l1-1-0
rand_s
user32
BeginPaint
CallNextHookEx
CallWindowProcW
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
DrawTextW
EndPaint
FillRect
GetClientRect
GetDC
GetDlgCtrlID
GetDlgItem
GetMessageW
GetParent
GetWindowTextLengthW
GetWindowTextW
InvalidateRect
LoadCursorW
LoadIconW
LoadImageW
MessageBoxW
PostQuitMessage
PostThreadMessageW
PtInRect
RegisterClassExW
RegisterHotKey
ReleaseCapture
ReleaseDC
SendInput
SendMessageW
SetCapture
SetCursor
SetCursorPos
SetProcessDPIAware
SetWindowLongPtrW
SetWindowPos
SetWindowTextW
SetWindowsHookExW
ShowWindow
TrackMouseEvent
TranslateMessage
UnhookWindowsHookEx
UnregisterHotKey
UpdateWindow
Name
.text
Size
876KB
Virtual Size
876KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/14
Size
512B
Virtual Size
208B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/80
Size
512B
Virtual Size
219B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/91
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/107
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/123
Size
512B
Virtual Size
249B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ