Static task
static1
Behavioral task
behavioral1
Sample
HP ScanJet Pro 2600 f1 UpdateFirmware_0707y23(FW1.55).exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
HP ScanJet Pro 2600 f1 UpdateFirmware_0707y23(FW1.55).exe
Resource
win10v2004-20231023-en
General
-
Target
HP ScanJet Pro 2600 f1 UpdateFirmware_0707y23(FW1.55).exe
-
Size
13.1MB
-
MD5
e43cb9effa6b9d6cbfce3b2dc5e3cfee
-
SHA1
f340714ed0e87692552e37a57461d7515fe88a8a
-
SHA256
8058b3ac125002add1c008568c46d7cffec656df63eeb7a30f4377b0f63b5c62
-
SHA512
0da2754cb1ebdfddbcc707549c9077163815dd9aa7ca1c07f653a2ffabf887f3c3fad14b1b1b62e6d12ef86801322aac9a5b096faf55b4098dcada06fe64f230
-
SSDEEP
196608:l2shsYsfM6c+KvjJsPGPJpw8gCuTiQhGdT5SvS:l2s7aM6c+KvjNJpw8FHnq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HP ScanJet Pro 2600 f1 UpdateFirmware_0707y23(FW1.55).exe
Files
-
HP ScanJet Pro 2600 f1 UpdateFirmware_0707y23(FW1.55).exe.exe windows:6 windows x86 arch:x86
Password: infected
9f02d9e4e1c0de72140ae497f877473f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventA
WriteFile
WaitForSingleObject
GetOverlappedResult
ReadFile
FindResourceA
LoadResource
LockResource
SizeofResource
GetTickCount
CreateMutexA
DeviceIoControl
FindResourceW
FindResourceExW
WideCharToMultiByte
LocalAlloc
LocalFree
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
WriteConsoleW
SetStdHandle
CreateFileA
GetUserDefaultLangID
Sleep
CloseHandle
DeleteCriticalSection
DecodePointer
HeapSize
GetLastError
RaiseException
InitializeCriticalSectionEx
HeapDestroy
GetProcessHeap
HeapFree
HeapAlloc
ReleaseMutex
HeapReAlloc
EncodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetCommandLineA
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetStdHandle
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlUnwind
LCMapStringW
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
CreateFileW
advapi32
OpenSCManagerA
ControlService
ChangeServiceConfigA
QueryServiceConfigA
QueryServiceStatus
StartServiceA
CloseServiceHandle
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
OpenServiceA
Sections
.text Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13.0MB - Virtual size: 13.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ