yyjsq[.]rar | Triage™

General

Target
yyjsq.rar
Size 8.5MB
Sample260809-wvcrsstarf
SHA256 628d7b9be268c08c9dc267b7d4d3376b6ea9f1614e43a58853aa7a217b084275
MD5 e6305e9d0e95d6d647c2c3d18b63162d
SHA1 f4fa5cbf7461519f7a41b33e2d97978328e4d81a
SHA512 e9e4d8c85f6d575a397febdcdc96f8c5a0fc88f0db8aac7f2ffffc75b64b3e2af49deaeeef970dc0172513b63e86973e0ef5e66bf812db5432f66091f9678b6e
SSDEEP 196608:+CJKxaQVC5PVsMVeAgShCLYlqVcNeZLVBt:+yKxaQ5M/gSGYlnN4VBt
TLSH
T1A29633648C528AF73536D84B27D6C8207C99A2CBD13F32FBA1037C5B56CA9B7111A3D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/优游网游加速.exe

File Explorer

yyjsq.rar

.rar 8.5MB
优游网游加速.exe

.exe 8.8MB

yyjsq.rar

SHA256 628d7b9be268c08c9dc267b7d4d3376b6ea9f1614e43a58853aa7a217b084275
MD5 e6305e9d0e95d6d647c2c3d18b63162d
SHA1 f4fa5cbf7461519f7a41b33e2d97978328e4d81a
SHA512 e9e4d8c85f6d575a397febdcdc96f8c5a0fc88f0db8aac7f2ffffc75b64b3e2af49deaeeef970dc0172513b63e86973e0ef5e66bf812db5432f66091f9678b6e
SSDEEP 196608:+CJKxaQVC5PVsMVeAgShCLYlqVcNeZLVBt:+yKxaQ5M/gSGYlnN4VBt
TLSH
T1A29633648C528AF73536D84B27D6C8207C99A2CBD13F32FBA1037C5B56CA9B7111A3D9
MD5 SHA1 SHA512 SSDEEP TLSH

优游网游加速.exe

IMPHASH 2414e3d3f51afc2ac50d0e15f1382248
SHA256 ea3a23f2a1a7d35e78b1d919cf827d60f6b779ebc42134d0f376ca112bac172a
MD5 050a8e5f2e75ec11485332731768a38d
SHA1 4dd17f8df774ca126e1dfda47308f2ab392963f4
SHA512 214f92dd4588674462b131dd43e7e1cf97622d54d8a11559200c6af3fb29f514307ac43264c72b4e782de9bd9c6172f3c96b8daa61bcaf34d4c02b65d3cb7ba5
SSDEEP 196608:FrDNgP9Sl8Me5h1lPzAO1m0VqZdOtOtXJYtAXZFdOvV9XWu4t9XaOsLegrw:FnGVD5h7zAO1vVqDOt8JlFdoWtYOv
TLSH
T1859623E372620546F091D8F6493BAD9074FA5E6A5ED2BDF045AEF8C13531CD8B232A13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14069018

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

475KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.upx10

Size

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.upx11

Size

8.7MB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

yyjsq.rar

优游网游加速.exe

iphlpapi

winmm

ws2_32

version

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

comdlg32

wtsapi32

generic

Sharing

General

Malware Config

Signatures

File Explorer

yyjsq.rar

优游网游加速.exe

iphlpapi

winmm

ws2_32

version

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

comdlg32

wtsapi32

generic