xred | d8d6626208a81cecad87d65c39bff34b1dbbb84a59998fa904827ad31be8b2e7

resource
unpack001/WinHex20Pro/WinHex_v20.5_x86_x64.exe

d8d6626208a81cecad87d65c39bff34b1dbbb84a59998fa904827ad31be8b2e7

SHA256 d8d6626208a81cecad87d65c39bff34b1dbbb84a59998fa904827ad31be8b2e7
MD5 679c36fac2bbb0821f92ba83bede5b83
SHA1 e70b5b1bb5ea5126d957cf2e699319adee77b14f
SHA512 cffaf362c7ed7ea92a1f4a298519d3a5262190ca704a4ba5953ef606b4c53ad87cc164529e7299c45884b568029bd718cb6508fbe3d140c2ddde2ba9e11fe968
SSDEEP 49152:Cp16z+9HVk0Sy1kdPmHxkHVnqt9tpWHMos2lInbGdZ7qoOMAjpb+SagztSIq:B6FSyOk6HVw9VGH7HOMA4
TLSH
T189D53374879E3095C38E937F47868A49F4F41D2B0A875B504CA1ABFEC687843E0F6E65
MD5 SHA1 SHA512 SSDEEP TLSH

WinHex20Pro/WinHex_v20.5_x86_x64.exe

SHA256 02c8fa008710affd57be5c6d79f68ee66ee43e742243679d7af3dbba1d4c95f8
MD5 c2d6190998103692a506a80e2aec9ccb
SHA1 7f1858fafbb913deab4764f4d1b8b8badb9359b9
SHA512 ed7ad952820ea67fd907bdc3fa710e398f147cc5e88fd4e2e9cf00df6eeade9e8828fff8fe1eae059e35ceff0232cafc6b53e3c18f7d2b16034d4939aabad0d1
SSDEEP 49152:XnsHyjtk2MYC5GDeOiSfk/hmT3ifRjgRXNTAlQoseRc3bg7hLSYaQ6f/lgWag7yl:Xnsmtk2aZOiScUOfRKXdg1LzaQ6Tu
TLSH
T1CEE50232F2D29437D1321B3D9C5B93A598297E512E38794A3BF41E4D8F3E68238652D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

633728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

615KB

Virtual Size

614KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

57B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

WinHex20Pro/jb51.net.txt

SHA256 6bf5483d638a740c2459ff46d1befed91edd651b778a7392b2eb958ad8e585cd
MD5 1a84430e677616c4c4af9d8c52a70e8a
SHA1 6df224c651a26b55bf89cdc4acc46a998d36d4a2
SHA512 55f41f08fe53679e094d755a952ec40c3462ecc4e6781edaeb6d76329697fd7c5b970a9df5347a748833c121202ddc09a6b90e6f0064173e97c547dfe9c88e24
SSDEEP 48:S3bZU+SvGKdXy2TYtrzXW8Wxa1yBTxGbQGXaJA57hrnWDlr7dfjC+5t6cAPv+f+e:Lldd6HBEQbQoj1qLfxA5PvAKtNodF
TLSH
T170A1DB5C9D47980627BBC9D1E0B16A35E861CD83D689AA9FF06C14C6EF603ED70DC1B8
MD5 SHA1 SHA512 SSDEEP TLSH

WinHex20Pro/使用声明.txt

SHA256 31641fb58639bd7a4a0a69f62994c178e06781b50e2028846dc493ce9f422ad4
MD5 30e87f71223d1fbc4b6537eaf7e4f2bb
SHA1 8acfba39474ecec413d564752e9672883744aace
SHA512 d004087f6075f7eea092d808cefe217165b58c9db75d10c9d487985cd5198ddf9b30940587cfd1b05a675d5b47f7bee8cc6a5ada7bd78195637302a262d45059
TLSH
T14ED09700DFCF81BA2B8FA52B41472A08D1740CCEAB005B0433AF20130EC702AA2FCB9C
MD5 SHA1 SHA512 TLSH

WinHex20Pro/关注公众号获取更多惊喜资源.jpg

SHA256 5c88ec79fc105b818832eed726855e0c411e6abbc45b33c424d42eac07c72cc5
MD5 7df72df51161136736134f2811af05d2
SHA1 598f1070447437ce8552710bd28eb9d7097e3bf1
SHA512 399231b0317968601f45487778711cd8b925f6a53a4942cfedbcd438c9f6908f2f30a7097c6f0017e07458fca2f52adab943f69129d36ee54a12e91795ba11d1
SSDEEP 384:oraEkPvXlo2NgDoSv5uJNXqHM4ssE0dFv8fNF09jUWB+0p3oyqrjHcEvkFcv1woY:ora/lQoW5++M0vLAejUy+M3opkxoxy
TLSH
T11EC29F01D9311FA1FC1F57B169421ECCBDAC9F80EAC1199D86D1CEA9B2C4143809DAEF
MD5 SHA1 SHA512 SSDEEP TLSH

Extracted URLs

qr http://weixin.qq.com/r/gh0DG8LEJp9ZrYZ490iQ

WinHex20Pro/去脚本之家看看.url

SHA256 c4965fa0cf71f391518797b3cc3b7ffef0ec991c5266f5f9cc90298a7da7e1da
MD5 9d9c794d654383c012286b258556fe46
SHA1 8266c2159f57859ff102df419a94157a2ccef61f
SHA512 28b9a9519a0fb7e826adaf43e76dfd11df323f20ab3089ec53c6263a51c06635c9d0b0a325cb7d20f7db42734dc257666e77d63be620aca34cdb13b766da9bbe
TLSH
T126B012EC6A45C29BD372D80B71F0FD14A80F7DE088C2D5DC6680DD8A6C850C0D48AF66
MD5 SHA1 SHA512 TLSH

WinHex20Pro/更新使用说明.txt

SHA256 a4a37bf7993744812b189f52c444e9baee241e25e8cb3e995572e09de774a25b
MD5 0f7f09ab2c3086f6587d21f9569b5c92
SHA1 f0c17cdbb37e549a0ba21f3598953eec13c6d378
SHA512 49d01948036a52c96496c3bb7a3a340e0d57133ff441b8669869b2e1e145029c64d905a8855a13b4ddd37bded9c07b354811b358bfb9d8d6b3abe8f60d49d30b
TLSH
T134F0E13AD7DF43429A5DD82102973E54D89108DEFE202A0073DBA4425F792C975EC69C
MD5 SHA1 SHA512 TLSH

WinHex20Pro/服务器软件.url

SHA256 c85359e7af5e102716e42f659fd5c1931b553761898714ccbb261883a03f40e1
MD5 db4aa2c6c4e0555b3968690756e24836
SHA1 96933b815ecdcf2fd43bd2ef036260029a633801
SHA512 6ca491f92f9990d706b75e7ff091f8c025de7d9dc438aa25cf6e8baa87e750f6f0490e9923d82aa00ac074b572468349ed52c2765ec1fd3183a9ea146a2ff5c3
TLSH
T133B012AC6D44C29ED152C80B70B0F844A80F7DE048C2D48CE590DD8A2C05080D487F56
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

d8d6626208a81cecad87d65c39bff34b1dbbb84a59998fa904827ad31be8b2e7

WinHex20Pro/WinHex_v20.5_x86_x64.exe

generic

WinHex20Pro/jb51.net.txt

WinHex20Pro/使用声明.txt

WinHex20Pro/关注公众号 获取更多惊喜资源.jpg

Extracted URLs

WinHex20Pro/去脚本之家看看.url

WinHex20Pro/更新使用说明.txt

WinHex20Pro/服务器软件.url

WinHex20Pro/关注公众号获取更多惊喜资源.jpg