229e65824f7ab75a310937640a3a30ead2a8e8288cdab0e0788e1f5204bc88d7
- SHA256 229e65824f7ab75a310937640a3a30ead2a8e8288cdab0e0788e1f5204bc88d7
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
hongguo-tv-core.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
hongguo-tv-core.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
红果短剧.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
红果短剧.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 229e65824f7ab75a310937640a3a30ead2a8e8288cdab0e0788e1f5204bc88d7
- Size 8.8MB
- Sample261027-e3lagaav6z
- SHA256 229e65824f7ab75a310937640a3a30ead2a8e8288cdab0e0788e1f5204bc88d7
- MD5 80a0ea41ccb28d02556203c2e9884a62
- SHA1 2058d09b49e0f8b9b7d5836020520e60bc72f087
- SHA512 f20439c954a1f31410b37415ffa7a758ef741e0c57fdf2fadc9dfd5d5090e0b9e2426b4d87b9702bf803b9d21dff6e16b3d320fe98ca70124c1d32bfc8500742
- SSDEEP 196608:IrCnW+sr9cQICahT0X2GqNmYH6pzDPptnTq4gPHWkM65+PW3:yGWN9bkhT0cyTnGH54PW3
- TLSH T191963354937BE8CB2E95EFC8578E7F24F353C0E6BD8401892673762B18B44B2B097598
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/hongguo-tv-core.exe unpack001/红果短剧.exe
File Explorer
-
229e65824f7ab75a310937640a3a30ead2a8e8288cdab0e0788e1f5204bc88d7.zip 8.8MB
-
README.txt865B
-
hongguo-tv-core.exe.exe 11.7MB
-
红果短剧.exe.exe 10.1MB
README.txt
- SHA256 e7d612111ef476fe3fac4071920cf899f748bd40cf921f597ca955cd4b3c434c
- MD5 b04b17b7993072ce5bee564786eeaf80
- SHA1 65638454462900f616d8a70a0792385e17c9ee6e
- SHA512 9583c4478fb4c0a3aa8ade0c6cfdc8b3d8c47ad0ac4eca3505a041cef8db92ddc6a39637e17d7b876b1fdf214def7fccc541da188611ede3e4a1af28c086abf1
- TLSH T1691152D851E3D480132E25963726C4AE5092B533E5B8F7AC426883DD6D8905EF02F448
- MD5 SHA1 SHA512 TLSH
hongguo-tv-core.exe
- IMPHASH d42595b695fc008ef2c56aabd8efd68e
- SHA256 b0e7f246778855bd9ed6b3f5cca61b7f8cf4433d94309753f633b887318e3291
- MD5 d3a89dbb3730f11025f2e7087da9d1b8
- SHA1 28a55eaca08b062844979d81506e64586ce17772
- SHA512 0f5f87b2acf24be317c30b4c4a1f8e0230904a1c745fc2790734769eb604126dd3da1866b0314481c4462128c4a102e1a0507022f87e565160d04c81fab0738b
- SSDEEP 98304:TvBnlVaF2qbrFtmusbXe3rFCtq/pRcH7vUFXKRrYHPlL+YnFES:T/4F2qFtmDbexYqbKxYvz2S
- TLSH T1EAC65B17E8A145E9C4AED1388A369222BF317C454B3163D33B94F7642F76BD0AEB9740
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
528288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
4.7MB
Virtual Size
4.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6.4MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
434KB
Virtual Size
779KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
红果短剧.exe
- IMPHASH d42595b695fc008ef2c56aabd8efd68e
- SHA256 095e7f6083b4eb65fe8e5f78d919a6790893c43ffe6a9de87e6458a8e67e0887
- MD5 b742f3537853a97200eda7b38e622db7
- SHA1 b440ac7f4816986cb71c7f1f11c3ed105c594402
- SHA512 2bc1d80996000ba34b922ead31286bb67184bac06b3487ac29e3bbfaa86775017172fe00fa01b818d72d843b4267db3c2d5fd85a9eee21f7e0e40b908c24d673
- SSDEEP 98304:9cQ4WmcPSr4X9+iYS0obe7fto5vUtDIraEQ8VazrEY:9cWEr4t+iYwkFnKZa8
- TLSH T143B64A47ECA545E9C1E9D13486769263BB71BC485B2127CB2B60F3242FB3BD06EB9350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
530464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
4.3MB
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.8MB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
801KB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
111KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ