抢课小软件.zip
- SHA256 c95122d33ccb6f619f8b4e3a57b4727c2cf5cea2cafbc910efaff880edcf3bc4
Behavioral task
behavioral1
Sample
抢课小软件/qiangke12.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
抢课小软件/qiangke12.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
抢课小软件/教程.docx
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
抢课小软件/教程.docx
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 抢课小软件.zip
- Size 21.5MB
- Sample261102-dbz4wagy4k
- SHA256 c95122d33ccb6f619f8b4e3a57b4727c2cf5cea2cafbc910efaff880edcf3bc4
- MD5 58e2a3e7ec59088ff30346fc491974f1
- SHA1 698fcb13828b9db02a7ff241fe7d59d10067a0a4
- SHA512 060a46c0dbedc240512f20a3f41ed09038c0af8a006731900502997989586b2cd04501359d77dc5701f8ff18a5a2270e421225a7cc0b8429037cca2f0bcd4427
- SSDEEP 393216:T0RzYq5M1OjGL809vKhDPhX4gwAUcALLE16kmA5EYLxhG68:Tx1oGA4KhDPBjM7vUm2pT8
- TLSH T110373359462B1F6095C79DB2C5E287F2CC82FD9B27EF092590C978E90BCB08C7792587
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/抢课小软件/qiangke12.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/抢课小软件/qiangke12.exe
File Explorer
-
抢课小软件.zip.zip 21.5MB
-
抢课小软件/qiangke12.exe.exe 20.7MB
-
qiangke12.pyc19KB
-
抢课小软件/教程.docx.docx 1.2MB
抢课小软件/qiangke12.exe
- IMPHASH 72c4e339b7af8ab1ed2eb3821c98713a
- SHA256 e2291706c3ed11ade575143515b2c4f94f82d891f1a2624c4d1fa6a5a389c212
- MD5 93e5aa4fcf44c672d41504b447363b79
- SHA1 af98f13f4e3cd9cb1a6870f97e51557e1bbecc35
- SHA512 21a5acfd0734d68bb15ffad8752d5d2e75e2996bcda51afe26de4a1860bab127c22e2cdc697dd64a3c76653d39b9c9fb124f5dd46d83e1f7b99c3e81562546b0
- SSDEEP 393216:yW8O4AatW+cIsWpib48Mq2gXk3+eWcGfd0aC2jxuFsh:yW83TcFWME8MqzXaY5F82jp
- TLSH T1D3273366371A1CB0DCBA19B98AF14353DB937CA603AECA4637D168820FC76DCBD54643
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
52768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
LCMapStringW
CompareStringW
FlsFree
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
FormatMessageW
GetLastError
GetModuleFileNameW
LoadLibraryExW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
GetEnvironmentStringsW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsSetValue
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
168KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=180, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=33808,
count=9, id=259, version=33808,
count=17, id=260, version=33808,
count=40, id=261, version=33808,
count=11, id=257, version=30795,
count=155, id=1, productName=Unmarked objects,
count=25, id=260, version=34123,
count=1, id=258, version=34123,
qiangke12.pyc
- SHA256 103ad86e0156b6e8eaf0318fea633d70c2e3167673348c1acd51e3223c03e41e
- MD5 b5ce7a86778f4085b8ff707e0a25c73a
- SHA1 a54517f9352961fadc530e8209afb773ee805729
- SHA512 534b6e1c10d2acc2ec7fabc5fde909828d190f00620e3d2eb998765ea9acee0d5f4bfdf7cbb89a4c0daaf640fb52aae9610f22f60d427f212f2394256979fad9
- SSDEEP 192:eQnq06BT4mbeERVllIO62R3mPQ+iWdSLAyHzA9Ej4maEoXyXEYa3zSzohG:eQq0EbeEBlR6nPUWSdx4J5X2M2UhG
- TLSH T1509281846782F6BBF85AF3760D171727B7B5EAF0F3529207321090729E85B26AC065DC
- MD5 SHA1 SHA512 SSDEEP TLSH
抢课小软件/教程.docx
- SHA256 2c990d9ec9597142c3297344382d1537d59d1a86037afd8b39289721442fbdc3
- MD5 61f8730c6a5effd38435ce1b24fac92e
- SHA1 707d543e287560b0a1bcc12f5119fb8841c898ce
- SHA512 21b83e2402defa473a3580045518037d93a17abbe5f8e0ac8898a2334a6d580f18af61bcabce74edb26e8fb1850afcbae9225c8be1779862f4e43cd2b057ab9b
- SSDEEP 24576:wOW+wGVGz2sUKj9kQoIKpjp/7tSBmzVvob6L6Epu3NI3PmZWRV:wle82WjqeKpjp/wmpvobZEpui3Pk6
- TLSH T1B9452349D87FE87CCD4F05B40AD20F97B7F35A0160F80B7252719A1DDC8FE2A4A46AA5
- MD5 SHA1 SHA512 SSDEEP TLSH