7aa7b3c716cba13ca5c557ddeae7c58edcafc48d55ba3b3c33797163c8d2351d
- SHA256 7aa7b3c716cba13ca5c557ddeae7c58edcafc48d55ba3b3c33797163c8d2351d
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
plugin.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
plugin.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 7aa7b3c716cba13ca5c557ddeae7c58edcafc48d55ba3b3c33797163c8d2351d
- Size 417KB
- Sample260812-sa6ycszbpc
- SHA256 7aa7b3c716cba13ca5c557ddeae7c58edcafc48d55ba3b3c33797163c8d2351d
- MD5 d4e91de0de13ce8191984aaaaaaa2d47
- SHA1 95d26071dd392411017a5003e78873e58bd73d06
- SHA512 2717d625edccfe00f002ae1b72a99ad1b32865c36995a76df8267b82cd5d453646d9076931f369b807158e6149cce99aba8299445908de6d9d2b79dc26357e3b
- SSDEEP 12288:UipNwDdbsQBTZkmJm7KmzlpyNXpXNSjwot:UipNwD6QBNkkpmzAXJNSjd
- TLSH T1FC9423C28FAE090BFC3A5D95B097051F758F52B2258652363CB57F3D0EA332B29908D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/loader.exe unpack001/plugin.dll
File Explorer
-
7aa7b3c716cba13ca5c557ddeae7c58edcafc48d55ba3b3c33797163c8d2351d.zip 417KB
-
loader.exe.exe 614KB
-
loader_config.json284B
-
plugin.dll.dll 182KB
-
plugin_config.json353B
-
使用教程.txt2KB
loader.exe
- IMPHASH 5770eb7476f42382b369c4bfae98705d
- SHA256 5b006af5c55ee1b01f193abd50d137c243bb5dff77f31ea8863802f00dd93f21
- MD5 fc041cf7a29d224a16aad18df3e223d8
- SHA1 3e35fbb80607985850d8cd4bec7b8750c71af5f7
- SHA512 771ac6a91e11c30bae0315963c10784d4a84bf51c7b6dffe979edbdc0a1327fe82201b298ef168f7113d940b691d3f9dc46a64a2b823f5f1e6fdd4d6e04773cb
- SSDEEP 12288:UGjl5xPK5ph0lhSMXlilrQgUePXs6lUFvyNXp:9Zirh0lhSMXl+2UsXyX
- TLSH T127D49EC2F65581FCE529C1B44C26C979F6233CAF8B811AEB12D47D1339AB5D15A3BA03
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
168988
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
GetModuleHandleExW
SetEndOfFile
WaitForSingleObject
CreateFileW
GetCurrentThreadId
ReleaseMutex
ResumeThread
GetModuleHandleA
MultiByteToWideChar
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
ReleaseSemaphore
GetProcAddress
SetFilePointerEx
VirtualAllocEx
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
CreateProcessW
GetModuleHandleW
WideCharToMultiByte
CreateRemoteThread
VirtualFreeEx
DebugBreak
IsDebuggerPresent
FormatMessageA
LocalFree
SetLastError
GetCurrentProcess
HeapFree
CreateSemaphoreExW
WriteProcessMemory
GetFileSizeEx
GetModuleFileNameA
HeapAlloc
ReadFile
FindClose
FindFirstFileW
GetFileAttributesExW
GetFullPathNameW
AreFileApisANSI
GetFileInformationByHandleEx
GetConsoleMode
WriteConsoleW
GetLocaleInfoEx
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
user32
MessageBoxA
comdlg32
GetOpenFileNameW
advapi32
RegCloseKey
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyExW
RegGetValueW
AdjustTokenPrivileges
msvcp140
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
_Mbrtowc
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
_Query_perf_counter
?id@?$numpunct@_W@std@@2V0locale@2@A
?id@?$numpunct@D@std@@2V0locale@2@A
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Id_cnt@id@locale@std@@0HA
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
memset
memcpy
memcmp
__current_exception_context
__std_terminate
__std_exception_copy
__std_exception_destroy
memmove
__current_exception
_CxxThrowException
__RTDynamicCast
api-ms-win-crt-heap-l1-1-0
calloc
free
malloc
_set_new_mode
_callnewh
api-ms-win-crt-runtime-l1-1-0
terminate
_cexit
_crt_atexit
_register_onexit_function
_set_app_type
_initialize_narrow_environment
_configure_narrow_argv
_get_initial_narrow_environment
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_initterm
abort
_initterm_e
_exit
_c_exit
__p___argc
_errno
_invoke_watson
_invalid_parameter_noinfo
__p___argv
exit
_initialize_onexit_table
api-ms-win-crt-math-l1-1-0
_dclass
_dsign
_fdclass
_ldsign
_fdsign
__setusermatherr
_ldclass
api-ms-win-crt-stdio-l1-1-0
__p__commode
_fileno
_get_osfhandle
_set_fmode
__stdio_common_vswprintf
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
Name
.text
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
180KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
254KB
Virtual Size
253KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
520B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=39, id=261, version=35207,
count=6, id=257, version=35207,
count=9, id=257, version=33145,
count=208, id=1, productName=Unmarked objects,
count=3, id=265, version=35221,
count=1, id=255, version=35221,
count=1, id=151,
count=1, id=258, version=35221,
loader_config.json
- SHA256 62af303a77a900e05f3608006f157a98ccae35c68f4bbebb3e4817cb8428a7b6
- MD5 ab2e9711209d2e64f36a552a9396cf3e
- SHA1 9d2fd330d46423c0cf0b3233e3422ce4aaaeddf4
- SHA512 a174b9e33833aae81492536b7dc5b9d47e069befb0210f88ae83c923296486a4090fc309c8fd173631969d5eec2f6295c5cdb8a46782b20b81cb44e49e27832b
- TLSH T17ED05B29C0251D7B9094286B8CD45757571941634C267C05B31C15DD3F1FA3D61B1EB6
- MD5 SHA1 SHA512 TLSH
plugin.dll
- IMPHASH 5aa54d2559d36566a7b8fb166737e73c
- SHA256 f52bcab57d28d2de20245261a5ee36982f62bb7b867af8d84b5e7c691895d08b
- MD5 3574ae1172e4d6bbb9c1ba378eb4b221
- SHA1 47e098cb11ca1102798b5f392b590d4d68ead817
- SHA512 82a2d6c3b7e467935d1cb66f79d734ab88d588f5c397b27d6f8756a11160fa256ac02727720904ac40cc3320031efaddb3efa293a09d5762184cc465b4c16002
- SSDEEP 3072:wODEoD+1wF/XD3HxBWEUP3Q5Rs+G3JqnAl7VqKuZEfTBtqh5464y5:wODK1wF/XDhBWEUP7+GAcIh547y
- TLSH T1E3045B2AF51440AAE2664078CD9F4A16FBB27C5643D056DF23516EBE1F27FE85B3A300
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
103836
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapFree
SetLastError
ReleaseSemaphore
WriteFile
GetModuleHandleExW
SetEndOfFile
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
DisableThreadLibraryCalls
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
SetFilePointerEx
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
DebugBreak
IsDebuggerPresent
CreateFileW
StartThreadpoolIo
CreateThreadpoolIo
TryAcquireSRWLockShared
WaitForThreadpoolIoCallbacks
CancelThreadpoolIo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
CreateSemaphoreExW
GetOverlappedResult
CloseThreadpoolIo
ReadDirectoryChangesW
SetPriorityClass
GetCurrentProcess
GetModuleFileNameW
GetModuleHandleExA
HeapCreate
VirtualProtect
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
HeapDestroy
GetThreadContext
FlushInstructionCache
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
FormatMessageA
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetFileSizeEx
GetModuleFileNameA
CancelIoEx
ReadFile
GetLocaleInfoEx
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WakeAllConditionVariable
InitializeSListHead
SleepConditionVariableSRW
MultiByteToWideChar
AreFileApisANSI
LocalFree
user32
GetWindowThreadProcessId
GetForegroundWindow
GetAsyncKeyState
GetCursorInfo
msvcp140
_Thrd_detach
_Query_perf_counter
_Cnd_do_broadcast_at_thread_exit
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_frequency
_Mtx_unlock
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
memmove
__std_type_info_destroy_list
__C_specific_handler
__std_exception_destroy
__std_exception_copy
__std_terminate
memset
memcpy
memcmp
__std_type_info_name
memchr
_purecall
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
_beginthreadex
_invalid_parameter_noinfo
terminate
_initterm
_errno
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm_e
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
expf
Name
.text
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=28, id=261, version=35207,
count=6, id=257, version=35207,
count=7, id=257, version=33145,
count=177, id=1, productName=Unmarked objects,
count=18, id=265, version=35221,
count=1, id=255, version=35221,
count=1, id=151,
count=1, id=258, version=35221,
plugin_config.json
- SHA256 c05147e6466fdf22a17a0f08c520b09b1f68eed84604ffdc96327ba58578f8f8
- MD5 195a1760d4e89c7582c520070a3ce3d1
- SHA1 1bd3598e715f28900cc0427c8744c3882155824e
- SHA512 0ba0a03ce980fb3ae11e08aca942426b06c2e2b4d8e4638b42ca1db1499eaf12a9835287b6a3c21f30bdebf9bd9506aeac3f8fc03562d51485ada670dff0be45
- TLSH T157E08613C9255C7710DC5D2444148247471402977E42BD9E389D76CC1F4F26F51BECA6
- MD5 SHA1 SHA512 TLSH
使用教程.txt
- SHA256 339a50c23d4e8e25dceaaebd15fca78563658dfb3d7f50a02457f8f39cc695df
- MD5 6ad6a9bead8cc39ebfdb20705e58a54b
- SHA1 9694a05e42d894eb8a26e3bf2628ea27accccb6e
- SHA512 1aa82cd0c86424b1093b9a4d7f26363fa3b8f63c5f789f31482c9c6c6460825697e9fff6fcd00bf97e507ca828177f6006cbeb44acdef9b3c06a95079e1c377d
- TLSH T1FA41B66802CDDE691B2161A899BCD5CE354DCB13AF25DB7379EEA0582BC8326404E4C1
- MD5 SHA1 SHA512 TLSH