3b7a836cd7a646cfbfa219f4965928564e6b31db1aeed672550e21d545bab469
- SHA256 3b7a836cd7a646cfbfa219f4965928564e6b31db1aeed672550e21d545bab469
Overview
overview
3Static
static
3Ϻ�...or.dll
windows10-2004-x64
3Ϻ�...or.dll
windows11-ltsc_2024-x64
3Ϻ�...el.dll
windows10-2004-x64
3Ϻ�...el.dll
windows11-ltsc_2024-x64
3Ϻ�...on.dll
windows10-2004-x64
3Ϻ�...on.dll
windows11-ltsc_2024-x64
3Ϻ�...ta.dll
windows10-2004-x64
3Ϻ�...ta.dll
windows11-ltsc_2024-x64
3Ϻ�...le.exe
windows10-2004-x64
3Ϻ�...le.exe
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ϺҽҽԺV5.01__Ű/DataOperator.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ϺҽҽԺV5.01__Ű/DataOperator.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
ϺҽҽԺV5.01__Ű/DataSetModel.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
ϺҽҽԺV5.01__Ű/DataSetModel.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
ϺҽҽԺV5.01__Ű/MedCommon.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
ϺҽҽԺV5.01__Ű/MedCommon.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
ϺҽҽԺV5.01__Ű/Medicalsystem.iMedical.Data.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
ϺҽҽԺV5.01__Ű/Medicalsystem.iMedical.Data.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
ϺҽҽԺV5.01__Ű/OpetationSchedule.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
ϺҽҽԺV5.01__Ű/OpetationSchedule.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 3b7a836cd7a646cfbfa219f4965928564e6b31db1aeed672550e21d545bab469
- Size 1.4MB
- Sample260819-ls5ppatsft
- SHA256 3b7a836cd7a646cfbfa219f4965928564e6b31db1aeed672550e21d545bab469
- MD5 be792a910ea81e32564166a1e9f506e3
- SHA1 e65948f205fde826c2b63c21c0458dde706f1953
- SHA512 d269b4ece1296a95a42f2693ebdb7e8f9ddf9f02f3e8cede58d2b6480d327f0a06b9a67f9e11c2b240735bd7d243279820ab59b293944020e7df4c06d05bb958
- SSDEEP 24576:zJCH/M2ZrdpU6bF+3ozQAHG9ZItx8Txl7ZSCsl+IVWrjhpOtaLO5q1:VcrZxpxSr0G9ZNTxH9sM+mjqtaiQ1
- TLSH T1556533DA94FB6E518FBF1E7F9331A68C55CA08989B8D16B0E6FF8BD4D9CA214D003501
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/ϺҽҽԺV5.01__Ű/DataOperator.dll unpack001/ϺҽҽԺV5.01__Ű/DataSetModel.dll unpack001/ϺҽҽԺV5.01__Ű/MedCommon.dll unpack001/ϺҽҽԺV5.01__Ű/Medicalsystem.iMedical.Data.dll unpack001/ϺҽҽԺV5.01__Ű/OpetationSchedule.exe
File Explorer
-
3b7a836cd7a646cfbfa219f4965928564e6b31db1aeed672550e21d545bab469.zip 1.4MB
-
ϺҽҽԺV5.01__Ű/DataOperator.dll.dll 50KB
-
ϺҽҽԺV5.01__Ű/DataOperator.pdb105KB
-
ϺҽҽԺV5.01__Ű/DataSetModel.dll.dll 906KB
-
ϺҽҽԺV5.01__Ű/DataSetModel.pdb1.9MB
-
ϺҽҽԺV5.01__Ű/MedCommon.dll.dll 20KB
-
ϺҽҽԺV5.01__Ű/MedCommon.pdb63KB
-
ϺҽҽԺV5.01__Ű/Medicalsystem.iMedical.Data.dll.dll 169KB
-
ϺҽҽԺV5.01__Ű/Medicalsystem.iMedical.Data.pdb131KB
-
ϺҽҽԺV5.01__Ű/OpetationSchedule.exe.exe 1.7MB
-
ϺҽҽԺV5.01__Ű/OpetationSchedule.pdb693KB
ϺҽҽԺV5.01__Ű/DataOperator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e24b42defbcb73abae46ba3772da9a35802f5f7e35530468596380cf36a42d4a
- MD5 d50188fa9402b11641d354c8a833f71a
- SHA1 795a624105c8893decaca205d8fd60d4ddb1cec5
- SHA512 b5a4167e35b733e4ad5152c2d6f9782e79a51f2fafa822d7c17844314f7243a695c344fd14917836ccc39179f4c7d07e6329502aa7ca6761ca31f3dd3332e992
- SSDEEP 768:a5h/PLajXOMMSgjI0hVBCCFz/mM6FZv2rUnSN8VoHwOAFeJQkTUde/lVAYC02wu/:aHPqf0fBCCFz1K/mH/OhdiVHFVC
- TLSH T12733B54C37FD8A14D27E997949344B700379B40A8A62F7FF2CE994CBA463708CE57A61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\麻醉\OperationSchedule\华东\上海市中西医结合医院V5.01_From_Date20130625_20140326\Src\DataOperator\obj\x86\Debug\DataOperator.pdb
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ϺҽҽԺV5.01__Ű/DataOperator.pdb
- SHA256 c26073f6e9c457439460dcdd4e69abfb48ad8c9dbda26f06a3c15f2ff306748a
- MD5 3f8eccba6a87477c652f6ad8a436ab6a
- SHA1 ea1b8150ebddc3c783d88aae19c405acae7a69e4
- SHA512 616a6c163713f77e19ec3aed5346900b7f6af2f583baae1239ad62868018de1d72f4f2ca18e4d4f333f48ebabfee8ace674fd3d93cceb9b8f4f3b5843df28263
- SSDEEP 1536:DbzBUFqDdmB/qvNkKP/yECckNIfpuSP5+H+46va6vV/YfwFjx:9dowkM/yBcFxuYz7qfw9x
- TLSH T1C9B342437FD2DA32C452CA3D83970F6D3A38E8D5AF57576B65A9B41C7CA33092A85320
- MD5 SHA1 SHA512 SSDEEP TLSH
ϺҽҽԺV5.01__Ű/DataSetModel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e51686be88577f28247253ecdc5e328867b05dd493d35cadbb176eac7ad4a3a7
- MD5 1932704c8db7786bfaec8b3c26f68024
- SHA1 d08ac32dca07393ecb4c64e270a5521a23beec6c
- SHA512 0050d8acf052495f498f880ccf6bab23fdc7a1520edd052940aa4b0465481d8c74dc45daa8b9f7ca595b97051046c974cdea7f29db07e7ccb05ab0cdafef80ad
- SSDEEP 24576:J2qNkQMvFJrH04IVNb9Jtk/qgtRkcuk8ZXs3l:JBNb7tk/qgtRkcuk8ZXs3l
- TLSH T1DD15B20136D88E19F4BE3BB79B8AC21583FB71C55277D359EEE0A1C319267118F01A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
934110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\麻醉\OperationSchedule\华东\上海市中西医结合医院V5.01_From_Date20130625_20140326\Src\DataSetModel\obj\x86\Debug\DataSetModel.pdb
mscoree
_CorDllMain
Name
.text
Size
904KB
Virtual Size
904KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ϺҽҽԺV5.01__Ű/DataSetModel.pdb
- SHA256 fe54d2ac25c1e87e05fee8f7b5b56a687ee7e045fca1a8e9044c08dd3039a8f1
- MD5 0b2308b3ce00f6504fa4e5d49329cbbe
- SHA1 61ab8ee0bb5761d31ae44840c0f86a83b5c5eba8
- SHA512 68253a4a74eed373386a2429ff3610421d10e88d2bba2aaecf4b7cdc40436bbb9417802d7b74b9d51f67273a2ecf6502f3d15b4bd11b7c29cb842d305d12712d
- SSDEEP 12288:5tYPGzlRThaPT8iWtE1Ws6uE6AvcTzCfo8udmLsWShCHIoj8MLozn:5GPYlRobpnYs6uE6SHZEmAFCHIoj8B
- TLSH T12B9520573B90CA32C442C47C7BEB0F2E5278E1CC47C6ABBF514991ADBE873595C9A290
- MD5 SHA1 SHA512 SSDEEP TLSH
ϺҽҽԺV5.01__Ű/MedCommon.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3321da36e840abb59d38b0e0aac88f438226d32cb5b8756d58d9df6659889316
- MD5 4e3273be7757bca89918834f57d70026
- SHA1 631a09b7d7317bd990c28c22ec3bf7c0284a7cbb
- SHA512 68dcb14dfe0f0c451b9f610ce4ef768f2c96efee69c8eddc62099883e294047b3c459cb08b9e37a8c6a090bf9736904c629475e62246d4f96848151f07ab2797
- SSDEEP 384:pPhg1u7KnZ+3fR6VW/qujjjU1pnT+ceIqGrBjk92m7itKXSZ944V/B:pPhSaKnZKJ9y9qcmQjkstp7N
- TLSH T103922A5AB7E8872FC83E4BBC9CF086642374D6455D53F72F9F98D498286333485113AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26510
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\麻醉\OperationSchedule\华东\上海市中西医结合医院V5.01_From_Date20130625_20140326\Src\MedCommon\obj\x86\Debug\MedCommon.pdb
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ϺҽҽԺV5.01__Ű/MedCommon.pdb
- SHA256 784e3076225f8d1c164b2d99af5b40921e5f2887f6b35c8362f2b890330a7b9b
- MD5 ec25dd82f70b67becc8b1521e2b71c5c
- SHA1 6d7df96f569b7676c16b3406c68b2ecf740fc777
- SHA512 8cb9d58a97e919fb85028dcee4ca2202264ba49bc0d334661cff6c9709e174ea0540236322a2fd3dbf0fdb5b8480097d80bb8db72dff0ad2dc4c1f4059c81baf
- SSDEEP 768:pj8NpIxMFlHHKK+euOd9oIsJnjL4KpgpC5/MMchKsl0QtQEwmxCwB0lMqOIe9nNj:u0nf2MchKMxCw
- TLSH T149532E577B80D233C4168639AAEB4B1E2379EDC94B82975F1799B42C3DF23642F86350
- MD5 SHA1 SHA512 SSDEEP TLSH
ϺҽҽԺV5.01__Ű/Medicalsystem.iMedical.Data.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 13bc1c501673cb2b08ffef07c5443266411fbf28d756a49b9e6fdd9bb239093c
- MD5 79049db1a9bc106ea80498ed2d171117
- SHA1 b04c68100d6a0ab6a403d60115bc1a2a49207b2a
- SHA512 75953d62a8609ecbdf57590c6411384b724903070d34a42d311510c694781ea8c764f6f364e0af432921a065fa0f316c36b4ae1abef14ebd626129d512e2cb43
- SSDEEP 1536:Neg25AlO2FWawV9vrRyCxGWawV9vrRy8mtaz5WawV9vrRy8mtBazMWawV9vrRytx:N525AlHTNB1K
- TLSH T1BC040720B4ECA35DF926B9E59FCEC5ACC627B7D8D737832B11A9510762A5C045F02BB0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
179646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\麻醉\OperationSchedule\华东\上海市中西医结合医院V5.01_From_Date20130625_20140326\Src\iMedical.Data\iMedical.Data\obj\x86\Debug\Medicalsystem.iMedical.Data.pdb
mscoree
_CorDllMain
Name
.text
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ϺҽҽԺV5.01__Ű/Medicalsystem.iMedical.Data.pdb
- SHA256 5c5f1df72f46861f7c32dff6afeb1fa062a2ce91657a13cc9aaa141f4f6b1c7e
- MD5 57ee0505710af83849857b92284946df
- SHA1 90423a27f86ae442fb49942b31bce419c12e3509
- SHA512 258e6b8fe4aa34a67ba5ffe0bd0361790098d3a672eb5e3af81607877f4c0c203a55cd048267abac14041014b2220a62999e78c267e7c10879220aee25a8c19e
- SSDEEP 1536:kHThpRTnjdzZW0SiAevoWEQwJLTWldBQ4C5r/d03nupqrUX87eSBKowc8kM/ta4:WSiAevoTQT/I/npZX87e
- TLSH T1EDD3125B7BA0D233C426C63CD5EB4B7F2278EDC84B825B6B165DB06C7DA33851E86244
- MD5 SHA1 SHA512 SSDEEP TLSH
ϺҽҽԺV5.01__Ű/OpetationSchedule.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 08de1e040dcc6f54b4da5b1ab9986c0fc25ff17df1f5ed08db26208726209a9d
- MD5 3f7dbfcfecec8042b200cf04503a6b15
- SHA1 30454d485b160c2c067caf42e59fcd8f0a7326a7
- SHA512 cfe34daabc757881f78163d730a1f64471bdc4c7fafd2ce908325c9c2290b46b505cfc18e3ef4fdbaf4db58629782d603b4468bbfa0330898daaf7c04507451c
- SSDEEP 12288:ePDwG0Mc0+I817pISUSYgZvnoUYUrRsmJcLW/nqTH9OuuLDUhggkuAtiElHiWMo8:eWMctIGKSUSYgZvRY1mJ7qcu28
- TLSH T144854A5211E84B21F03A83F5D141E011EFF2226B65ADE698BDCDA3E70F75B502247B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1620910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\麻醉\OperationSchedule\华东\上海市中西医结合医院V5.01_From_Date20130625_20140326\Src\OperationScheduel\obj\x86\Debug\OpetationSchedule.pdb
mscoree
_CorExeMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
135KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ϺҽҽԺV5.01__Ű/OpetationSchedule.pdb
- SHA256 bf09e883e9fd32cb7e48499a8bd1217c3bcc579e7daad999e69c1b3eab30833b
- MD5 0de3c930fd63a4967a8cf4199f3f1fb5
- SHA1 a7890d2f801bfd8aaf88bed42f061482b859b6e0
- SHA512 1d128b8d0893f2b111f036d132db280ee5815838470d3130a076244862ea61148b5b4760077ddbe81094dfa181af54a589dddfeeb596f2d8d6eea97cb2f3bfbc
- SSDEEP 6144:Uc4DKgKAnBB8J2+t/jP7Hh/9V1BHBg+wVF17WO/OihpnMy/O4YunSBbrbgwv:Ujz+v9HIVSGO4YuSBb
- TLSH T152E483A3BA90DA33C426C6F996A74F3D6238D5C44F8297DF2B99A42C7DC27055F86310
- MD5 SHA1 SHA512 SSDEEP TLSH