经典登录器V2.rar
- SHA256 886937f9210da88c5d6e5bb6f19a1fc7164a1adb5340c14214217dbdf44685eb
Static task
static1
Behavioral task
behavioral1
Sample
经典·战神.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
经典·战神.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 经典登录器V2.rar
- Size 25.2MB
- Sample260916-w3prbssvcs
- SHA256 886937f9210da88c5d6e5bb6f19a1fc7164a1adb5340c14214217dbdf44685eb
- MD5 db64e311ce095fcaba1850b46af00835
- SHA1 55c4e65ff0a91a7f3311c1406eaca6780cf7bdd3
- SHA512 a6b949e48dd4bdf9c028777358398d6aeb64a668f9482e0c734fcbf652121057938ec55b83b5ade40f46c0e75201f08ad4a6895ec9dafbf65035e3b72d1b83f0
- SSDEEP 786432:teXt+2jG7ijGSIG6cjVMxl/OVyBpLUWQzjJl8b:UXt+QG6G6jCxFOVARUJzjJl8b
- TLSH T1C44733DB311EEF08C2EE9A2FC5EABE5059A0FC0714DFB57051EB8B8556CA00E25DE116
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
经典登录器V2.rar.rar 25.2MB
-
经典·战神.dat25.1MB
-
经典·战神.exe.exe 1.2MB
经典·战神.dat
- SHA256 b6a15128350f4ad6cc4df078d2da50a5239da4ee9383313796ec4385945b4af1
- MD5 5edd94fdceed2082b2f0acdd5406f78b
- SHA1 a92205e744c2f7f6c3dda29c242c5f522ed1c165
- SHA512 538d4502895c23b7fc356e1783ea6abb84215a6268c4d49df6cd34a3607a8df80107195feead66eaf5c94e49e0d194f9ed97225d240605a94209d2e955c02b48
- SSDEEP 393216:nytPo33mBH8VKJKRTgLHVXBi83m4mkTfFnyvNqcUpkxLgJ/Mpc1RleSeKeXgDKtb:vQiKJYcHVXZO23pILpm1FeXgDKtBl
- TLSH T1E147333823076679D52110373BDD3EFEB72BE1098F96E85C002926569F8C60697BDF26
- MD5 SHA1 SHA512 SSDEEP TLSH
经典·战神.exe
- IMPHASH b4f78474edfef30df1432a65dab0a0bd
- SHA256 ba9923de60e31b49b658d48489b84e6c6498381efbd4e714726a5c40516b4a8f
- MD5 5325c6c79405f80c3d243c9f35f3e4b9
- SHA1 59d877b303343777524b750792b4db46b90ea7c3
- SHA512 192656635b1e1aabe07ab30d5ec08f9553094a97f8ed0aa5e8861e7288c317159999a8c3b5d442e7eda88858a29164ed60be0ddb01ee041f74db68cdb384fb71
- SSDEEP 24576:qcw7UtrlugWvwWyj9l1cRYAQ7lg35P9CTnCW7NIS5q92ojeltPmL1GEPww8XKccE:xwIh7mR8P7NIqq9TjeltPm5GEPw7X3cE
- TLSH T11145BF3238C28073D6A24170557BEB39CABD6674173285D7A3D45838AD726C1AB3E37B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d0:2c:73:74:56:70:02:f8:7a:be:18:bd:16:55:c5:b0:64:79:8b:04:80:1e:42:50:5b:02:cc:d7:17:f0:1a:fa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91330105MA2GL2DK14,CN=杭州慧跃网络科技有限公司,O=杭州慧跃网络科技有限公司,L=杭州市,ST=浙江省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e4b88ae59f8ee58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Jan 23, 2025
SERIALNUMBER=91330105MA2GL2DK14,CN=杭州慧跃网络科技有限公司,O=杭州慧跃网络科技有限公司,L=杭州市,ST=浙江省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e4b88ae59f8ee58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=91330105MA2GL2DK14,CN=杭州慧跃网络科技有限公司,O=杭州慧跃网络科技有限公司,L=杭州市,ST=浙江省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e4b88ae59f8ee58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=91330105MA2GL2DK14,CN=杭州慧跃网络科技有限公司,O=杭州慧跃网络科技有限公司,L=杭州市,ST=浙江省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e4b88ae59f8ee58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2013 - Jan 15, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 13, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=91330105MA2GL2DK14,CN=杭州慧跃网络科技有限公司,O=杭州慧跃网络科技有限公司,L=杭州市,ST=浙江省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e4b88ae59f8ee58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Serial Number
08:32:5f:dd:91:a6:39:ad:ef:ee:f1:38:04:7f:01:9a
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 8, 2022 - Apr 9, 2025
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
758409
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\996Workspace\996Launcher\AutoUpdate\AutoUpdateWizard\Release\AutoUpdateWizard.pdb
kernel32
SystemTimeToFileTime
GetLocalTime
InitializeCriticalSectionAndSpinCount
GlobalAlloc
GlobalUnlock
GlobalLock
HeapSize
DeleteFileW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
GetFullPathNameW
SetEndOfFile
SetStdHandle
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlushFileBuffers
HeapAlloc
HeapFree
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
ExitProcess
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentProcess
RaiseException
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
CreateEventW
ResetEvent
SetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
CompareStringEx
GetSystemTimeAsFileTime
DuplicateHandle
WriteFile
SetFileTime
SetFilePointer
CreateDirectoryW
MulDiv
GetFileSize
CreateFileW
GetACP
FreeResource
LoadLibraryW
GetCurrentDirectoryW
VerifyVersionInfoW
VerSetConditionMask
GetEnvironmentVariableA
GetCurrentProcessId
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
WaitForSingleObjectEx
MoveFileExA
FormatMessageW
SetLastError
GetLastError
WideCharToMultiByte
MultiByteToWideChar
Sleep
GetTickCount
QueryPerformanceCounter
SleepEx
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetModuleHandleW
CreateProcessW
FindResourceW
LoadResource
CloseHandle
LockResource
WriteConsoleW
GetStringTypeW
GetLocaleInfoEx
LCMapStringEx
DecodePointer
EncodePointer
GetCurrentThreadId
WaitForSingleObject
DosDateTimeToFileTime
GetModuleFileNameW
SizeofResource
user32
IsWindow
DestroyWindow
SetWindowPos
IsWindowVisible
IsIconic
CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
LoadIconW
SetTimer
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
GetWindowRect
GetCursorPos
ScreenToClient
MapWindowPoints
IntersectRect
UnionRect
IsRectEmpty
PtInRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
wvsprintfW
SetCursor
OffsetRect
LoadCursorW
DefWindowProcW
PostQuitMessage
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
ShowWindow
EnableWindow
SetPropW
GetPropW
MonitorFromWindow
GetMonitorInfoW
CharPrevW
DrawTextW
FillRect
SetRect
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
GetSysColor
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
MoveWindow
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
PostMessageW
MessageBoxW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
gdi32
CreateCompatibleBitmap
SetBkMode
CreateCompatibleDC
CreateFontIndirectW
CreatePatternBrush
GetObjectA
GetDeviceCaps
GdiFlush
ExtTextOutW
TextOutW
MoveToEx
CreateDIBSection
SetTextColor
SetStretchBltMode
StretchBlt
BitBlt
SetBkColor
ExtSelectClipRgn
SelectClipRgn
RoundRect
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRoundRectRgn
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
SelectObject
SaveDC
RestoreDC
Rectangle
GetStockObject
DeleteObject
DeleteDC
CreatePen
advapi32
CryptImportKey
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptAcquireContextA
ole32
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CreateStreamOnHGlobal
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
gdiplus
GdipDeleteFont
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipCreateLineBrushI
GdipDeleteBrush
GdipCloneBrush
GdiplusShutdown
GdiplusStartup
GdipSetSmoothingMode
GdipAlloc
GdipCreateStringFormat
GdipDrawString
GdipGetFamily
GdipCreateFontFromLogfontA
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipGraphicsClear
GdipDrawImage
GdipDrawImageRectI
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipSetCompositingQuality
GdipFree
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
bcrypt
BCryptGenRandom
imm32
ImmSetCompositionFontW
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
comctl32
_TrackMouseEvent
ord17
ws2_32
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
getsockopt
bind
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
ntohs
WSASetLastError
inet_ntop
WSAStartup
WSACleanup
inet_pton
connect
getpeername
getsockname
gethostname
ioctlsocket
sendto
recvfrom
freeaddrinfo
getaddrinfo
listen
htonl
accept
select
__WSAFDIsSet
WSAIoctl
socket
setsockopt
recv
htons
Name
.text
Size
930KB
Virtual Size
929KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
179KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=259, version=29395,
count=203, id=261, version=29395,
count=7, id=253, version=28518,
count=19, id=260, version=30034,
count=24, id=259, version=30034,
count=1, id=263, version=29395,
count=88, id=261, version=30034,
count=35, id=260, version=29395,
count=33, id=261, version=30154,
count=114, id=260, version=30154,
count=404, id=1, productName=Unmarked objects,
count=23, id=257, version=29395,
count=2, id=265, version=30154,
count=1, id=255, version=30154,
count=2, id=151,
count=1, id=258, version=30154,