9fd9ac43d6f91cca34d810d1d9ef73acd0c0b68919d93375d63a303bd57634e1
- SHA256 9fd9ac43d6f91cca34d810d1d9ef73acd0c0b68919d93375d63a303bd57634e1
Overview
overview
3Static
static
3PC游戏�...��.url
windows10-2004-x64
1PC游戏�...��.url
windows11-ltsc_2024-x64
1S.T.A.L.K....er.exe
windows10-2004-x64
3S.T.A.L.K....er.exe
windows11-ltsc_2024-x64
3【当快�...��.url
windows10-2004-x64
1【当快�...��.url
windows11-ltsc_2024-x64
1加入官�...�.html
windows10-2004-x64
3加入官�...�.html
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PC游戏安装与运行常见问题.url
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
PC游戏安装与运行常见问题.url
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
S.T.A.L.K.E.R. 2 Heart of Chornobyl v1.0-v20260820 Plus 32 Trainer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
S.T.A.L.K.E.R. 2 Heart of Chornobyl v1.0-v20260820 Plus 32 Trainer.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
【当快软件园官网】发现好应用、好游戏，做有态度的应用市场.url
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
【当快软件园官网】发现好应用、好游戏，做有态度的应用市场.url
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
加入官方QQ群【答疑丨催更丨交流】.html
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral8
Sample
加入官方QQ群【答疑丨催更丨交流】.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 9fd9ac43d6f91cca34d810d1d9ef73acd0c0b68919d93375d63a303bd57634e1
- Size 889KB
- Sample261017-e4x1nahv6p
- SHA256 9fd9ac43d6f91cca34d810d1d9ef73acd0c0b68919d93375d63a303bd57634e1
- MD5 feec23dc0671777510e7593ad8734e1a
- SHA1 2df46521ad7168b32fc160357c72d247dff1eb61
- SHA512 30adf3466659cfad982787e071da1a7570699fe2646b045b8cd8d6e495e0e5f0f080ccfc831391408141378f88fb89cc50923f8aef4c612d1e15f60acb801e90
- SSDEEP 24576:xKvZ4d1hV/uW8zd4pS9GIN3fDVlCwBwE+QynH:cOXhhuW+SSFDVvGrH
- TLSH T12F15337C2573C5B6BFC319B41785470BA639DA67C103E336935BBD02D4EA43622826EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/S.T.A.L.K.E.R. 2 Heart of Chornobyl v1.0-v20260820 Plus 32 Trainer.exe
File Explorer
-
9fd9ac43d6f91cca34d810d1d9ef73acd0c0b68919d93375d63a303bd57634e1.zip 889KB
-
PC游戏安装与运行常见问题.url125B
-
S.T.A.L.K.E.R. 2 Heart of Chornobyl v1.0-v20260820 Plus 32 Trainer.exe.exe 1.6MB
-
【当快软件园官网】发现好应用、好游戏，做有态度的应用市场.url104B
-
免责声明.txt2KB
-
加入官方QQ群【答疑丨催更丨交流】.html.html 2KB
-
安装必看.txt1KB
PC游戏安装与运行常见问题.url
- SHA256 a254a6160446ade142d8bf853d48b3ac723df1457719157dd804f16cf9a9c35a
- MD5 3015d2b8afff7cc92a2e6eb8cedf507d
- SHA1 2cc6eaada9c99030ed23871e0b53743c09f3e685
- SHA512 ddcdd3185d2a699bed481b8dfb52b2d4b0131eef367f1a4003353abe42ef1eb95de7934b6f2270d5ebe4e184215d4592e6113d7cac16e97eb0302a5fe9d7143d
- TLSH T1DAB09B65451AD4F4D217440948589D7DE403644C659BCDA48154558C78455550D44158
- MD5 SHA1 SHA512 TLSH
S.T.A.L.K.E.R. 2 Heart of Chornobyl v1.0-v20260820 Plus 32 Trainer.exe
- IMPHASH 4b9cd3599ff1d6688f706601a005a443
- SHA256 1ab9c5c9482365c7e2d7f277be72fbafead050487e7f4f7420a0909807196b18
- MD5 2637b16781d83f5bb36f377d4b579bc9
- SHA1 335d5f8f880a37cca1622c067a795fb51f0d9cd2
- SHA512 908ddcb0eace81d810f136c1d1a30123f9dacdc3480dbb54120af2afa22d8d115f0b8e651767cc22e1ab7d9552dd29b6e9e39d4ee6c6e1a86390684a2286ac9d
- SSDEEP 24576:PNQkS1m+oczc5v9QFr31WnwtNrUf3IgEV3RQFE8IgRGdG1/ZoWWJP:u7zc5FQUwtdUffm3RHgsdG3oWWd
- TLSH T14075BF22AAE800FDD0B7D1F88A578557E772B84A43349FEB43D896261F277D44A3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
685536
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WritePrivateProfileStringW
Sleep
GetCurrentProcessId
LoadLibraryW
GetProcAddress
GetModuleHandleA
LoadLibraryA
InitializeCriticalSectionEx
DeleteCriticalSection
GetModuleHandleW
DecodePointer
GetModuleFileNameW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetTempPathW
WaitNamedPipeW
ReadFile
CreateFileW
GetCurrentProcess
FindResourceW
LoadResource
SizeofResource
LockResource
LoadLibraryExW
GetFileAttributesW
FreeLibrary
GetProcessTimes
GetSystemTimeAsFileTime
IsWow64Process
SetLastError
QueryFullProcessImageNameW
GetFileSizeEx
ResumeThread
WaitForSingleObject
LocalFree
CreateDirectoryW
SetEndOfFile
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetLastError
CloseHandle
MultiByteToWideChar
GetPrivateProfileStringW
WideCharToMultiByte
GetCommandLineA
FindNextFileW
FindFirstFileExW
FindClose
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
VirtualProtect
ReadConsoleW
GetConsoleMode
GetStringTypeW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetCurrentThreadId
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
GetExitCodeThread
EnterCriticalSection
LeaveCriticalSection
EncodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
WakeAllConditionVariable
SleepConditionVariableSRW
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
IsDebuggerPresent
OutputDebugStringW
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
TerminateProcess
IsProcessorFeaturePresent
GetStdHandle
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
GetFileType
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
RtlUnwind
user32
SetProcessDPIAware
MessageBoxA
MessageBoxW
advapi32
SetEntriesInAclW
ConvertStringSidToSidW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
shell32
SHGetFolderPathW
SHCreateDirectoryExW
ole32
CoUninitialize
CoInitializeEx
oleaut32
SysFreeString
SysAllocString
VariantInit
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
mscoree
CLRCreateInstance
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
PlaySoundW
Name
.text
Size
871KB
Virtual Size
870KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
300KB
Virtual Size
300KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
408KB
Virtual Size
408KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=179, id=261, version=33145,
count=18, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=99, id=261, version=35721,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=17, id=257, version=33145,
count=162, id=1, productName=Unmarked objects,
count=30, id=261, version=35723,
count=18, id=265, version=36256,
count=1, id=255, version=36256,
count=1, id=151,
count=1, id=258, version=36256,
【当快软件园官网】发现好应用、好游戏，做有态度的应用市场.url
- SHA256 eede0518c55f4cfb86e2e92228f94e596f5642aa0111832237901a38641fbd2f
- MD5 6a34d0783b852d08d668e5e3fbbb6d39
- SHA1 2ce947830c0b66fb5349a3cf53c88a27f091ff09
- SHA512 5ddeda0247e3af94c80df6480f0d689e48a01867f67552c24934668a866b5f95e428b40ce32107a0037b6147e52c262c05494df9ddfa8cc526135d7b779859a9
- TLSH T148B012B1461ED4B4C257880D4428CD7CE803305CA9EBCCB44298A689BC424260E88159
- MD5 SHA1 SHA512 TLSH
免责声明.txt
- SHA256 7df2e60858029e89056f6ba0510e0f8e18d0188914136bde85f438bba22b8368
- MD5 0db575c0364d9aa44af027c6d0a307a6
- SHA1 6048639bbd706e4a8d4711e278c8db17d146b1ce
- SHA512 cf250bd4789efd9a5fbe2bf0a35a81ca630a7a1a6486e901c1b9c675bab984aa2b9f194cdd2e8435458a739058ce618981d997d8485f0a443c9300c5871a0b76
- TLSH T16951C65AD3AD23782693220A7B0E47E2D316547AB37A8506BCB2D04C3741D26C531E9E
- MD5 SHA1 SHA512 TLSH
加入官方QQ群【答疑丨催更丨交流】.html
- SHA256 76a009737129361b8f0ca298c34c05f323f93496260993c41958c3079628f67e
- MD5 178885bc0b5d3e28e103c643e2e505b1
- SHA1 f7c21c53659128c521d1daf87846f8b27a4c760b
- SHA512 6c388c190884982131d89bb5b069802e6ea6fe7478c8cba1e85055f40144de016b60dfcf1a8a75084aa357911f6d8bc556c507fe09650669888d2746fa5a0294
- TLSH T13051556182801C463133A6B497E28745FBD20443DA42C7387FDDA3578FB9965CA93B5D
- MD5 SHA1 SHA512 TLSH
安装必看.txt
- SHA256 a998af04ca11d56836af95d3870434fe1c107a02f96bb1236f4eb8a04593e260
- MD5 0f80b49e9365ec7005c81a33ed4b99cb
- SHA1 cb06967187fa02ab02502d22cbaaa4596c1d5b6e
- SHA512 a24507a4ad3f6f89a7f6f70ac959fce6812d9483dde9c8e396a7fb64f47961348009d100526c598f2a88f899fd982f25bbf8ba389dd806d3e895056048eb9888
- TLSH T16B11DC8E968B614AC324C09A33330202D8D652CFA883B4DA333C40671F516B21C742EC
- MD5 SHA1 SHA512 TLSH