Static task
static1
Behavioral task
behavioral1
Sample
ReiHook.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ReiHook.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
SharpMonoInjector.dll
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
SharpMonoInjector.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
smi.exe
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
smi.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
smi_gui.exe
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
smi_gui.exe
Resource
win10v2004-20230703-en
General
-
Target
af5e0e06f42abe4a0f0d261e0ba55c013833836956da7b9a5e5448f27413588e
-
Size
401KB
-
MD5
61ea1257faffd8075e94d4e86b2afbf7
-
SHA1
f922b359f1a049d3c19debd96f9f48bb81655dd5
-
SHA256
af5e0e06f42abe4a0f0d261e0ba55c013833836956da7b9a5e5448f27413588e
-
SHA512
12d5414dd900d4cb3bdd2b68295fa21abeaeb510f11a692bc121088b0593678b6c54b983fdd5480bc5dee4d3dbfc3d0a11ca9dbed1ec25aaa951d9bd34619da5
-
SSDEEP
6144:Eg2JvC9zr0WC7QBTgThuDptCi4Kxrk+Xk0gZ9I2OuaoPHRRqnd2+GEKH7:aJsrnGkzsKW+U0gZ9HVBPHRgdA9
Malware Config
Signatures
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/ReiHook.dll unpack001/SharpMonoInjector.dll unpack001/smi.exe unpack001/smi_gui.exe
Files
-
af5e0e06f42abe4a0f0d261e0ba55c013833836956da7b9a5e5448f27413588e.zip
-
ReiHook.dll.dll windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 941KB - Virtual size: 941KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 948B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
SharpMonoInjector.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
smi.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
smi_gui.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 226KB - Virtual size: 225KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
新增 文字文件.txt