可疑.zip
- SHA256 ccd9fb1b447c2aaf35d1ac28e710f229e82133c97173c58923ca0bc3685a8ee9
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
可疑/样本_guge.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
可疑/样本_tquVt2J103V.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
可疑/样本_tquVt2J103V.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 可疑.zip
- Size 116.8MB
- Sample261023-nc2zzabs61
- SHA256 ccd9fb1b447c2aaf35d1ac28e710f229e82133c97173c58923ca0bc3685a8ee9
- MD5 5857d55ca921bde76597982adc28bc79
- SHA1 a57941bda0865b38712006987211709ab529bc09
- SHA512 f697b03a18646cf535527c8648ba467375b0848c2d8d0b1a0bf7b554ccb7baf1115ce0c37e8c25d7510ae6e7c2adc488635c52f8fb18eab84531976b316c2159
- SSDEEP 3145728:XIO8ovF8gxpykQ5uv35N63D6QGSMW/V3tx4BR:XIxovF8apkuv23OQlMWN3txS
- TLSH T1E94833D3772D66386E56D463F5BD0FCDE68CBC5A3554EE9438926782E822FE280B0811
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/可疑/样本_tquVt2J103V.exe
File Explorer
-
可疑.zip.zip 116.8MB
-
可疑/wc8f服务.reg1KB
-
可疑/服务配置-wc8f.txt512B
-
可疑/样本_guge.exe.exe 116.7MB
-
可疑/样本_tquVt2J103V.exe.exe 98KB
-
可疑/样本_wCMfmj.ico26KB
-
可疑/目录ACL-KHMnx.txt490B
-
可疑/目录ACL-zPAOC9s.txt497B
-
可疑/送检说明.txt2KB
可疑/wc8f服务.reg
- SHA256 2ea03556c86e1914809f42e20067802a7428e0ee3e95a955c59dc0b0d3b374fe
- MD5 b3d42aaabd0d872f879777c7cbee888e
- SHA1 1b3dd9a68cb2f918da12aafed8cb66841dd4c1b9
- SHA512 f9506a769f0e128caeb304e2e5036207561ac44d9a023dbd74359462eb628e574915e6fed9d81c968c5dd33cfde7448670a768539cca738761269802b5f7cc1f
- TLSH T128313E3FD765280A62B38D58CFE34463FA693856322CD88A04D21B4949D2B49B4B13BF
- MD5 SHA1 SHA512 TLSH
可疑/服务配置-wc8f.txt
- SHA256 31f1939a4d63e28578e71c12788bc6734fb63f68ead915b31b75d8ac75d821fd
- MD5 5aa2dad82e96e6ca03980502d1808f82
- SHA1 05f173e4231da0bcbde32013fe216e30e6e863e9
- SHA512 37c75d456dd4eb8db036212ae47125880ebdaaf577c71ea8fc66389e1df56ea61bc429513402ce66d7aa2d9a7d5f3b933476806aea9617c504be07e92f8a02de
- TLSH T1A2F055D201CA428B2FB38050546FD430E5979D2799401E0631DC2E165BBC515634E007
- MD5 SHA1 SHA512 TLSH
可疑/样本_guge.exe
- IMPHASH 865d1a9674197c47ebae84bb5c3fa76e
- SHA256 9012f0f2c76ef18fc1518e0e74321fd2396d459fdea7b6c187e74050aa8689ae
- MD5 c18deab80dd2954c43843391d2e303c4
- SHA1 0008943dd8ce6e8c5ab1a6d88b54f8a0dc6f327c
- SHA512 8bb19baee02d47a2da8e1c19a563d5a9a985206aab0f132007b668b2d02e5dc8dbbbe6b68d46e881687f5caf85e173720b5d8e64b79c901c2b6ad5f295f8ca96
- SSDEEP 3145728:DQoisxLauv7aACjsTrHdw7l6eGUIy5DXFQRe:DQZsxLai7OsT274eZIyhXFQ
- TLSH T1534833C3377D6238EE5AD473F9BD5FCDEA48BC2A3554E99039A17582A472FE28170810
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
21:c2:3f:54:cf:9a:0b:e4:bd:d2:17:ba:1e:3e:22:f9:8d:d3:8f:96:b5:57:f3:c8:35:33:5a:fc:ac:1a:36:42
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jun 9, 2025
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 8, 2024 - Apr 10, 2027
Subject
CN=Dummy certificate
Serial Number
01
Issuer
CN=Unknown issuer
Key Usages
KeyUsageCertSign
Ext Key Usages
Timespan
Jan 1, 2013 - Apr 1, 2013
Minor OS version
0
Major OS version
10
Entry point
15744
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mini_installer.exe.pdb
advapi32
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
OpenProcessToken
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
SystemFunction036
shell32
CommandLineToArgvW
kernel32
CloseHandle
CreateDirectoryW
CreateFileW
CreateProcessW
DosDateTimeToFileTime
DuplicateHandle
EnumResourceNamesW
ExitProcess
ExpandEnvironmentStringsW
FindResourceW
FlushFileBuffers
FreeLibrary
GetCommandLineW
GetCurrentProcess
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandleEx
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemInfo
GetVolumeInformationW
GetVolumePathNameW
HeapAlloc
HeapFree
LoadLibraryExA
LoadLibraryExW
LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
LockResource
MultiByteToWideChar
RaiseException
ReadFile
SetFileInformationByHandle
SetFilePointer
SetLastError
SetProcessWorkingSetSize
SizeofResource
Sleep
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcmpW
lstrcmpiW
lstrlenW
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
116.7MB
Virtual Size
116.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
可疑/样本_tquVt2J103V.exe
- IMPHASH 21ef8aad9932fba2dd6135c6ad01c23f
- SHA256 ae959b918e771c341115c894f61d041da216da112676a2693c0c5878443c8acd
- MD5 159fa501881e59068457d3fb267ce529
- SHA1 f8f890ea91c3f7e888ae0038b9c580efb71ec091
- SHA512 f95fe1da394737f66b46952cacf14e55c5925f46340a03d1c34b4667165ae1ff4c9e6481a3853f481f2c206bce8a55f9454bf5e00f123379323a61c975990837
- SSDEEP 1536:z44M2RXToVlT9zWPAELvB6MPP9LUZSrqxr2aML7L/nFUtKFcosLCQKo1xMFsSr:z4ImTRfov/9LUC+9MLHFUtvCJGDS
- TLSH T1D0A36B1633A520F9D8638238C9E25921F7B2785A5375C7CF562443A66F273D1AE3E323
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
6756
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\liuting\gitlab-source\nemu-vbox6-source\out\win.amd64\release\obj\NetAdpInstall\NetAdpInstall.pdb
rdl
UDKWkouLIqmnkSYfMjIvKrbCQFJ
PxdeGMUKjKUUFIRTV
LWWXzsoDthVXcwwS
SxAhQnKTGDmqVrkKnRMOzs
xekxtMTrYACJxFssm
hIywCmTpyPFBX
tFFzJXLqaIozIZwV
nstkzIyKbvPubMAXB
QiKHLqWVBgeHeW
IQgHMoNkCgnoPIzd
EPBcPbdcpsg
kdzNkwpnN
gOKkbNUFsAGj
eZaWWTrDwYUKTPbCuR
vwgHEDBPliMOlxXNUPShqgm
TXuZziCpgiOuQDRXgwP
BZASwJxAmIWtzbRmgCKHrD
KXKXuJkshcZleS
noHStDTRPnJFcPiffUjduKGluSmsWosVkIKdu
cwiMiXwnals
OuwHztyVfbhDDFv
TMTnVtzTWOnsWjSqfPvzv
qFUyUkzJAiB
iEFvUBXqCjV
BnLqNDH
iJDYsHKmwpWv
brTjgxTRdqhBaCAytH
cywtDhmT
SHmxwJVJjEzoDbqYAO
GzZWtJDfsw
rgSMBPzQph
bkFLCIUlFPSurYiHPgRrSZk
yzcsSVNeVTod
NRGhkmMFNBGWkwoJPBv
kjXbqNpzXOBDnrJwQSTyZqA
cwfXRybDKtZnikKlsncJsnpR
UJoGEGpI
LtQibZLTb
jrkZGX
yVpEDIvm
rdifLCowgIrKvkt
AmMPoEWHvalZhQPFSPp
ZqCWQFeuPuX
MtnezwOrnkON
IunFOMTsl
BcdMZTIvdpf
OosXinBOmJOI
IraXpuFIiBzrUI
lnFvakJauFAqwcjC
dwIExtjxmXuo
PJjcXkAahNyVns
WPCQTEyzwLUiPL
dKKlFSjG
ldZMEZczmHY
amZxxKJgyFVsQ
hgtNKWKYQaEX
ZxypMhkhjVj
CHRzsArlMyiY
ROpjcGyhqeTMpBQzePy
smJohzRYz
UhpcxqVowIccA
lTlUklniFSwnKgZYC
pXKZRrZjKDqFuOxKWLaQdPVDea
xFXUukzGl
HFKykDfoYksINpviRyLB
vESkgrzbntDfZ
SRxVFdXcRPQogbWnpNBz
DYOffbHDRTs
CaDLSeXiKlGMHDc
NFYmPNnSpibn
hhmtIXfcotuQFZVI
TOOxeKFMNiuAjYPLLz
wzaxuswHBuDflrIP
alqYfncYHGrZsNiyVJ
DygTWdpFsRrUTC
XKMdk
rxRjFLDqNtUsbK
Name
.text
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=135, version=30729,
count=5, id=171, productName=VS2010 build 30319, version=30319,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=158, id=1, productName=Unmarked objects,
count=2, id=152, version=20115,
count=108, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=10, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=50, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
可疑/样本_wCMfmj.ico
- SHA256 ba98f9906f4339539e3f8ad3d652af103eace1dd897d9791ec2e8fa40c62d6c4
- MD5 ce3873fb93800fa02621bfe026f548b3
- SHA1 f42ef37deafe8802c170ed24a32d9ba01630c036
- SHA512 a715b0d305fbdf8213b4f5c969538febc5b73a24e68a9f5c5e5ccb342a4fead7c898da4ab6d11cc3c8698d0bb87ab952deeecbaa7bc7ed76e9a223352a62a3cd
- SSDEEP 384:qdFXr0C+xfqNeM6EugSWjhtHkHz+XAEivOd5EPiGvae5J8+y4oeMpSuxVEJip:qdR0XfqgM6ENlZXOWfzGSOJJM58ip
- TLSH T18EC2E1662B62F9D4C009083A8930BD81DFFFE47EC69104054A41AD7B77A4B56EDF1378
- MD5 SHA1 SHA512 SSDEEP TLSH
可疑/目录ACL-KHMnx.txt
- SHA256 3e7a0c26b35bfbab46cf6174dd6fd7f61f83f24fff203b26de6896c77a8a14a7
- MD5 b4126f9b23dc01fd1a345abe780bab23
- SHA1 40d74f937739a7a41b0078459dd7914e40f2cde4
- SHA512 ffc41b20448a3fa4f68596ff068c8906c24c0e00b64800d4b4123158ba1966efd5f5ab30d59758fe1ecf497cd72f422a5086be24911982c20b2e4ea30c8024fa
- TLSH T18CF08C8F6D45525929B33A6037270509CCE98146AAB467B2B8CFDD3A6F61B0430F381E
- MD5 SHA1 SHA512 TLSH
可疑/目录ACL-zPAOC9s.txt
- SHA256 8a1f523d342470ec33fb5e1887987a60e0a028042eec02785b3d387fd5c23007
- MD5 aebb05195f5c2712a3e9017f49b7352f
- SHA1 cb8b09170f85ba91c62ab9e7550e54f78597abf1
- SHA512 1764c56b1a866d516d2797822f8b3e0d56498387c0567e0f1d5e25de8c73862ba075cc1c2bc66647ef2c53c14eb15a850a74a39d16274097ee4eab0e513e0d4e
- TLSH T1C5F08C4E6D41525929B3376037270509CCA88146EAB463B2B8DFDD3D6FB1B0420F382E
- MD5 SHA1 SHA512 TLSH
可疑/送检说明.txt
- SHA256 1bd584b25241006385671c3c257a346930ad1482d9fa0dc7685cf7e2162a3015
- MD5 88e7920082951b4ee1fb2f525815ec69
- SHA1 8a72ac36c024e72fec9c2e5485c6271c234ec513
- SHA512 e1819860c398a28b377a4e434d9f0ce1ec90f8446e54499b441fd417ec27a421ab037148b4842ef53a7e28845df20434d04a47ac4f769a654fea905fbfa636cf
- TLSH T18651C8C5812D4AD6094002C1172D8601ED25F707FABAAEAEFFDD89148340801EADFF4D
- MD5 SHA1 SHA512 TLSH