ebda9b30e03e53f6d48de09bd3550a697555eb0a8db63d97db16ffebaaa15d9e
- SHA256 ebda9b30e03e53f6d48de09bd3550a697555eb0a8db63d97db16ffebaaa15d9e
Behavioral task
behavioral1
Sample
WiseRegCleaner-Pro-v11.3.3.735-x64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
WiseRegCleaner-Pro-v11.3.3.735-x64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
去脚本之家看看.url
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
去脚本之家看看.url
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
服务器软件.url
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
服务器软件.url
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target ebda9b30e03e53f6d48de09bd3550a697555eb0a8db63d97db16ffebaaa15d9e
- Size 4.9MB
- Sample260924-d5x7daycqa
- SHA256 ebda9b30e03e53f6d48de09bd3550a697555eb0a8db63d97db16ffebaaa15d9e
- MD5 6c03fdcbb59d298b6b045e5d643c0f0c
- SHA1 5019252d4f93a8b06670efd57a65d370acca6908
- SHA512 d648dd0832a8857a1e7bb5c09f18641bff598582e326ba88eba3a0a88a2213b56496a66dbe02c6fbd15e29d98e157170e80567261c7ce0d0e9695e408e44adf2
- SSDEEP 98304:+4c8BZzDUmgTgcwef0sfR1cuYFAwn99yyJdUx2xxRvjZyzYNumAzxAwg9:+4c87DOTb0E1Jtwn99y+9xHVyg1Oel9
- TLSH T1AD363315C7896DE0CE1E028B22366FE15A3DCDD5C945A285AEDA21177B2402FB2FF35C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
File Explorer
-
ebda9b30e03e53f6d48de09bd3550a697555eb0a8db63d97db16ffebaaa15d9e.zip 4.9MB
-
WiseRegCleaner-Pro-v11.3.3.735-x64.exe.exe 5.0MB
-
jb51.net.txt4KB
-
关注公众号 获取更多惊喜资源.jpg.jpg 19KB
-
去脚本之家看看.url124B
-
更新使用说明.txt577B
-
服务器软件.url112B
WiseRegCleaner-Pro-v11.3.3.735-x64.exe
- IMPHASH f6baa5eaa8231d4fe8e922a2e6d240ea
- SHA256 50902889a3bf17e8a23f7fcd7009fbf786b5c12ed8efd90e2e9c2e15ce8c96a9
- MD5 8d7186331f27c736161f83c82503a79f
- SHA1 467da6a6a8a2097116afd0659c5d5477677a94a6
- SHA512 98a09706263dd3abfca32f534665a8f9e720ed024b30539abbc65fc7d514ddfe677c8bd811408aac525de802a167999ffab7cc99ea667c939e1463eddfd90eb3
- SSDEEP 98304:CgwRaPuKZTzzUIGT2IYMviazRnuEY38gnHnCkldK1q5NNxn3UxAvgkP3LGhNkg:CgHWKFzcTDsSnPZgnHnCi75fJUKjPyMg
- TLSH T1FE3633117689EAF0DD19017625666FA12B3DDCE94F0486C3BED9360B3F34096F2BE249
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
103471
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
ord17
shell32
SHGetSpecialFolderPathW
ShellExecuteW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteExW
gdi32
CreateCompatibleDC
CreateFontIndirectW
DeleteObject
DeleteDC
GetCurrentObject
StretchBlt
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
GetObjectW
advapi32
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
user32
GetWindowLongW
GetMenu
SetWindowPos
GetWindowDC
ReleaseDC
GetDlgItem
GetParent
GetWindowRect
GetClassNameA
CreateWindowExW
SetTimer
GetMessageW
DispatchMessageW
KillTimer
DestroyWindow
SendMessageW
EndDialog
wsprintfW
GetWindowTextW
GetWindowTextLengthW
GetSysColor
wsprintfA
SetWindowTextW
MessageBoxA
ScreenToClient
GetClientRect
SetWindowLongW
UnhookWindowsHookEx
SetFocus
GetSystemMetrics
SystemParametersInfoW
ShowWindow
DrawTextW
GetDC
ClientToScreen
GetWindow
DialogBoxIndirectParamW
DrawIconEx
CallWindowProcW
DefWindowProcW
CallNextHookEx
PtInRect
SetWindowsHookExW
LoadImageW
LoadIconW
MessageBeep
EnableWindow
IsWindow
EnableMenuItem
GetSystemMenu
CreateWindowExA
wvsprintfW
CharUpperW
GetKeyState
CopyImage
ole32
CreateStreamOnHGlobal
CoCreateInstance
CoInitialize
oleaut32
VariantClear
SysFreeString
OleLoadPicture
SysAllocString
kernel32
GetFileSize
SetFilePointer
ReadFile
WaitForMultipleObjects
GetModuleHandleA
SetFileTime
SetEndOfFile
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FormatMessageW
lstrcpyW
LocalFree
IsBadReadPtr
GetSystemDirectoryW
GetCurrentThreadId
SuspendThread
TerminateThread
InitializeCriticalSection
ResetEvent
SetEvent
CreateEventW
GetVersionExW
GetModuleFileNameW
GetCurrentProcess
SetProcessWorkingSetSize
SetCurrentDirectoryW
GetDriveTypeW
CreateFileW
GetCommandLineW
GetStartupInfoW
CreateProcessW
CreateJobObjectW
ResumeThread
AssignProcessToJobObject
CreateIoCompletionPort
SetInformationJobObject
GetQueuedCompletionStatus
GetExitCodeProcess
CloseHandle
SetEnvironmentVariableW
GetTempPathW
GetSystemTimeAsFileTime
lstrlenW
CompareFileTime
SetThreadLocale
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
ExpandEnvironmentStringsW
WideCharToMultiByte
VirtualAlloc
GlobalMemoryStatusEx
lstrcmpW
GetEnvironmentVariableW
lstrcmpiW
lstrlenA
GetLocaleInfoW
MultiByteToWideChar
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetSystemDefaultLCID
lstrcmpiA
GlobalAlloc
GlobalFree
MulDiv
FindResourceExA
SizeofResource
LoadResource
LockResource
LoadLibraryA
GetProcAddress
GetModuleHandleW
ExitProcess
lstrcatW
GetDiskFreeSpaceExW
SetFileAttributesW
SetLastError
Sleep
GetExitCodeThread
WaitForSingleObject
CreateThread
GetLastError
SystemTimeToFileTime
GetLocalTime
GetFileAttributesW
CreateDirectoryW
WriteFile
GetStdHandle
VirtualFree
GetStartupInfoA
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
memcmp
free
memcpy
_wtol
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CxxThrowException
_beginthreadex
_EH_prolog
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
memset
_wcsnicmp
strncmp
wcsncmp
malloc
memmove
_purecall
Name
.text
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
241KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
jb51.net.txt
- SHA256 6bf5483d638a740c2459ff46d1befed91edd651b778a7392b2eb958ad8e585cd
- MD5 1a84430e677616c4c4af9d8c52a70e8a
- SHA1 6df224c651a26b55bf89cdc4acc46a998d36d4a2
- SHA512 55f41f08fe53679e094d755a952ec40c3462ecc4e6781edaeb6d76329697fd7c5b970a9df5347a748833c121202ddc09a6b90e6f0064173e97c547dfe9c88e24
- SSDEEP 48:S3bZU+SvGKdXy2TYtrzXW8Wxa1yBTxGbQGXaJA57hrnWDlr7dfjC+5t6cAPv+f+e:Lldd6HBEQbQoj1qLfxA5PvAKtNodF
- TLSH T170A1DB5C9D47980627BBC9D1E0B16A35E861CD83D689AA9FF06C14C6EF603ED70DC1B8
- MD5 SHA1 SHA512 SSDEEP TLSH
关注公众号 获取更多惊喜资源.jpg
- SHA256 39c270df621c70af032beb2575432b2b07b854a14bace978ccf7312771a17b96
- MD5 f04875e13cd5fdda0c78c366b514b126
- SHA1 212cb5489266db0f910d2d98101250c179b9098e
- SHA512 f73fe5e52ea23222b6b2ff6095c7728f2d2b93093c748c9001f45861ef09c3099f7925d1a4a226ec333b37fe05dc6ae862f35d7eeefd0d6306dcf89692f9bdcf
- SSDEEP 384:GN7OpUQ0R0q7q9IIvjkeJEdqD48FqgkKCuBvxR3A2YRh3s4vtPOaIE1PyOkxh+Fv:GhOiQ5q7pIuqD48YgkKfBvxRFYD3ntdh
- TLSH T196926E615C8C2640F799D5354EAE2921B390691DD80C87777F8A3318AC4FA363BFB986
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
qr http://weixin.qq.com/r/gh0DG8LEJp9ZrYZ490iQ
去脚本之家看看.url
- SHA256 c4965fa0cf71f391518797b3cc3b7ffef0ec991c5266f5f9cc90298a7da7e1da
- MD5 9d9c794d654383c012286b258556fe46
- SHA1 8266c2159f57859ff102df419a94157a2ccef61f
- SHA512 28b9a9519a0fb7e826adaf43e76dfd11df323f20ab3089ec53c6263a51c06635c9d0b0a325cb7d20f7db42734dc257666e77d63be620aca34cdb13b766da9bbe
- TLSH T126B012EC6A45C29BD372D80B71F0FD14A80F7DE088C2D5DC6680DD8A6C850C0D48AF66
- MD5 SHA1 SHA512 TLSH
更新使用说明.txt
- SHA256 a4a37bf7993744812b189f52c444e9baee241e25e8cb3e995572e09de774a25b
- MD5 0f7f09ab2c3086f6587d21f9569b5c92
- SHA1 f0c17cdbb37e549a0ba21f3598953eec13c6d378
- SHA512 49d01948036a52c96496c3bb7a3a340e0d57133ff441b8669869b2e1e145029c64d905a8855a13b4ddd37bded9c07b354811b358bfb9d8d6b3abe8f60d49d30b
- TLSH T134F0E13AD7DF43429A5DD82102973E54D89108DEFE202A0073DBA4425F792C975EC69C
- MD5 SHA1 SHA512 TLSH
服务器软件.url
- SHA256 c85359e7af5e102716e42f659fd5c1931b553761898714ccbb261883a03f40e1
- MD5 db4aa2c6c4e0555b3968690756e24836
- SHA1 96933b815ecdcf2fd43bd2ef036260029a633801
- SHA512 6ca491f92f9990d706b75e7ff091f8c025de7d9dc438aa25cf6e8baa87e750f6f0490e9923d82aa00ac074b572468349ed52c2765ec1fd3183a9ea146a2ff5c3
- TLSH T133B012AC6D44C29ED152C80B70B0F844A80F7DE048C2D48CE590DD8A2C05080D487F56
- MD5 SHA1 SHA512 TLSH