{"id":"e88344ccd7ce6dc2b5b2e6b61f2bb4ef","title":"unknown — unknown · packed-stub · PE","md5":"e88344ccd7ce6dc2b5b2e6b61f2bb4ef","sha256":"bbb3c83e13e0f849cb23a51e41d67d51f3a7fc07a3cf5084d5b7f1cb05c4e6c5","family":null,"apt":null,"verdict":"suspicious","sample_type":"packed-stub","lang":"C++","file_format":"PE","compiler":"MSVC","published_at":"2026-07-26T08:12:39.126Z","summary":"该样本为 32 位 Windows PE 可执行文件（24KB），编译时间戳为 2017-10-22，采用 MSVC 编译器生成，Rich header 可验证其工具链来源。样本具有显著加壳特征：导入表完全为空，.rdata 节区熵值高达 7.444，且嵌入了完整的 zlib inflate 解压存根——包含 Chris Anderson 快速解码实现的全套错误诊断字符串（共 18 条），被识别为 zlib-stub 定制加壳器，置信度 72。入口点反汇编显示通过函数指针 [0x404004] 与 [0x404050] 进行动态 API 解析的典型模式——先调用函数指针获取模块基址，再通过另一指针解析具体 API，这与 LoadLibrary/GetProcAddress 运行时绑定模式一致。静态解压尝试使用 zlib raw inflate（wbits=-15）在 .text 和 .rdata 节区中成功提取了 3 个原始数据块（大小分别为 380、427、133 字节），但均未形成有效的 PE 或 ELF 载荷，表明主载荷需运行时解密至内存并通过 VirtualAlloc 执行。多引擎情报与社区沙箱查询均显示该哈希无任何先验记录，系首次出现的未知样本。综合加壳特征、空导入表、高熵节区及社区无先验状态，研判为可疑恶意样本——具有典型恶意软件打包行为，但因缺乏动态行为确认与情报交叉验证，暂不判为确定恶意。","url":"https://zseceye.com/report/e88344ccd7ce6dc2b5b2e6b61f2bb4ef","json_url":"https://zseceye.com/report/e88344ccd7ce6dc2b5b2e6b61f2bb4ef.json","html_url":"https://zseceye.com/report/e88344ccd7ce6dc2b5b2e6b61f2bb4ef","hash_urls":{"md5":"https://zseceye.com/hash/e88344ccd7ce6dc2b5b2e6b61f2bb4ef","sha256":"https://zseceye.com/hash/bbb3c83e13e0f849cb23a51e41d67d51f3a7fc07a3cf5084d5b7f1cb05c4e6c5"},"search_urls":{"md5":"https://zseceye.com/?q=e88344ccd7ce6dc2b5b2e6b61f2bb4ef","sha256":"https://zseceye.com/?q=bbb3c83e13e0f849cb23a51e41d67d51f3a7fc07a3cf5084d5b7f1cb05c4e6c5"},"sample_download_url":"https://zseceye.com/report/e88344ccd7ce6dc2b5b2e6b61f2bb4ef/sample","sample_filename":"sample.zip","iocs":[{"type":"filename","value":"630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da.exe","description":"原始文件名（疑似 SHA256 哈希命名）"},{"type":"md5","value":"e88344ccd7ce6dc2b5b2e6b61f2bb4ef","description":"样本 MD5"},{"type":"sha256","value":"21fd8d817a57c8d0519e1d78449aa7365bf040bcee27823700ebe634fcee9080","description":"静态解压产物 payload_2（133B，.text+0xa39，非 PE）"},{"type":"sha256","value":"743943588aa01dcf70b33ed9a13bd20d743dd1b413336d3045722df29df016fe","description":"静态解压产物 payload_1（427B，.rdata+0x1bd4，非 PE）"},{"type":"sha256","value":"bbb3c83e13e0f849cb23a51e41d67d51f3a7fc07a3cf5084d5b7f1cb05c4e6c5","description":"样本 SHA256"},{"type":"sha256","value":"c52e9997eb6f8153ff0496f252560b0f50bf5d82ec2fb5046ed11eac07f55f19","description":"静态解压产物 payload_0（380B，.text+0x1d39，非 PE）"}],"ips":[]}