Static task
static1
Behavioral task
behavioral1
Sample
DiscImageCreator_20240101.zip
Resource
win10v2004-20231215-en
General
-
Target
DiscImageCreator_20240101.zip
-
Size
458KB
-
MD5
7ee8330041dd1ee32b8a6b25eabb1db4
-
SHA1
9cdcc9faa0c1203dbb1c2b1ed4936fd563234225
-
SHA256
94b791c22a07ee6d4cb0891e5520b0dc0bd8acb89155f3e297f0ea448c678da2
-
SHA512
f62dbd2b80fad52820e37689236c58c61672cef0c944e999b4053a1ded79c351587467dbf7aea97212caa9637754e34f2dcace797d47f6b92ec02cc74d2b4050
-
SSDEEP
12288:HCX8kn9E00E/HhM7+o8apI0ToAzzGUHOOr2DA3fFF0h5TMy:HCXzOzcM7+o8avToAzzbZx39FaB
Malware Config
Signatures
-
Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release_ANSI/DVDAuth.exe unpack001/Release_ANSI/DiscImageCreator.exe unpack001/Release_ANSI/E_WISE_W.EXE unpack001/Release_ANSI/EccEdc.exe unpack001/Release_ANSI/i6comp.exe unpack001/Release_ANSI/unscrambler.exe
Files
-
DiscImageCreator_20240101.zip.zip
-
LICENSE
-
README.md
-
Release_ANSI/C2ErrorProtect.txt
-
Release_ANSI/DVDAuth.exe.exe windows:5 windows x86 arch:x86
0dc03b60cc06dcfdabf337b212f382a9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
GetLastError
CloseHandle
FormatMessageA
CreateFileA
SetLastError
DeviceIoControl
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
vcruntime140
strstr
__CxxFrameHandler3
_except_handler4_common
memcpy
_CxxThrowException
memset
api-ms-win-crt-string-l1-1-0
isprint
strncpy
_strnicmp
strncmp
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
malloc
calloc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__stdio_common_vsprintf
__stdio_common_vfprintf
fopen
fread
_set_fmode
fclose
api-ms-win-crt-runtime-l1-1-0
_exit
_get_initial_narrow_environment
__p___argc
_initterm
_cexit
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
__p___argv
_initterm_e
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_set_app_type
_seh_filter_exe
_c_exit
exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Release_ANSI/DiscImageCreator.exe.exe windows:5 windows x86 arch:x86
6a8ac9684a49d4ed7605e7777ae48b50
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathRemoveFileSpecW
SHCreateStreamOnFileW
PathRenameExtensionA
PathRemoveExtensionA
PathRemoveFileSpecA
PathAppendA
PathAppendW
PathFileExistsA
imagehlp
MakeSureDirectoryPathExists
setupapi
SetupIterateCabinetA
kernel32
InitializeSListHead
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
CreateEventW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
GetDiskFreeSpaceExA
WideCharToMultiByte
GetLastError
SetLastError
CloseHandle
Beep
GetCurrentDirectoryA
Sleep
ReadFile
DeviceIoControl
SetFilePointer
SetFilePointerEx
CopyFileA
MoveFileExA
FindClose
lstrcpyA
lstrcatA
GetTempPathA
RemoveDirectoryA
SetFileAttributesA
GetFileAttributesA
DeleteFileA
FindFirstFileA
FindNextFileA
SetTapePosition
PrepareTape
GetTapeStatus
GetTapeParameters
CreateFileA
GetModuleFileNameA
GetProcAddress
LocalFree
GetCurrentProcess
FormatMessageA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetModuleFileNameW
MultiByteToWideChar
IsDebuggerPresent
OutputDebugStringW
QueryPerformanceCounter
UnhandledExceptionFilter
xmllite
CreateXmlWriter
CreateXmlReader
vcruntime140
__CxxFrameHandler3
_CxxThrowException
memset
strstr
wcsrchr
_except_handler4_common
memcpy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
fread
fclose
fgets
fseek
__stdio_common_vsprintf
fflush
__stdio_common_vfscanf
__stdio_common_vsscanf
fwrite
feof
_set_fmode
_ftelli64
_fseeki64
ferror
rewind
ftell
__acrt_iob_func
__p__commode
fopen
__stdio_common_vfprintf
getchar
setvbuf
api-ms-win-crt-string-l1-1-0
isupper
tolower
wcsncmp
strncat
isdigit
wcsncpy
isprint
strncmp
strtok
_strnicmp
islower
isalpha
strncpy
api-ms-win-crt-heap-l1-1-0
malloc
realloc
_set_new_mode
free
calloc
api-ms-win-crt-multibyte-l1-1-0
_mbsrchr
_mbstok
_mbsnbcat
_mbscmp
_mbsnbcmp
_mbsnbcpy
api-ms-win-crt-convert-l1-1-0
atoi
strtoul
strtol
api-ms-win-crt-filesystem-l1-1-0
_makepath
remove
_splitpath
api-ms-win-crt-runtime-l1-1-0
exit
_initterm_e
_exit
_initterm
system
_get_initial_narrow_environment
__p___argc
__p___argv
_set_app_type
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
terminate
_cexit
_crt_atexit
_register_onexit_function
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_controlfp_s
api-ms-win-crt-time-l1-1-0
strftime
_localtime64
_gmtime64
_time64
api-ms-win-crt-locale-l1-1-0
setlocale
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 437KB - Virtual size: 436KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 226KB - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Release_ANSI/Doc/ChangeLog.txt
-
Release_ANSI/Doc/Firmware&Tool.md
-
Release_ANSI/Doc/KnownIssue.txt
-
Release_ANSI/Doc/Reference.md
-
Release_ANSI/Doc/TestedDrive.txt
-
Release_ANSI/Doc/Todo.txt
-
Release_ANSI/E_WISE.INI
-
Release_ANSI/E_WISE_W.EXE.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
CODE32 Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CONST32 Size: 3KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 980B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Release_ANSI/EccEdc.exe.exe windows:5 windows x86 arch:x86
1bcf8e097254d93d23bca784f46f372e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
GetLastError
FormatMessageA
GetFileSize
CloseHandle
CreateFileA
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
msvcp140
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
??Bios_base@std@@QBE_NXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
shlwapi
StrCmpNIA
vcruntime140
__std_terminate
memset
memcpy
__CxxFrameHandler3
_CxxThrowException
strstr
_except_handler4_common
__std_exception_destroy
memmove
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
system
_seh_filter_exe
_set_app_type
terminate
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_register_onexit_function
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_controlfp_s
_initialize_onexit_table
_c_exit
api-ms-win-crt-string-l1-1-0
strncpy
strncmp
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
calloc
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_splitpath
_lock_file
_makepath
api-ms-win-crt-stdio-l1-1-0
ungetc
setvbuf
_fseeki64
fsetpos
_set_fmode
fseek
fgetpos
fgetc
fflush
_get_stream_buffer_pointers
__stdio_common_vsprintf
__stdio_common_vfprintf
fwrite
fputc
fopen
fclose
__acrt_iob_func
fread
__p__commode
ftell
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Release_ANSI/ReadErrorProtect.txt
-
Release_ANSI/default.dat
-
Release_ANSI/driveOffset.txt
-
Release_ANSI/i6comp.exe.exe windows:4 windows x86 arch:x86
c864d080fcaf84514f5d269dff0ec965
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetStdHandle
HeapFree
RtlUnwind
ExitProcess
TerminateProcess
GetCurrentProcess
GetLastError
SetFilePointer
DeleteFileA
HeapSize
FindFirstFileA
FindNextFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
HeapReAlloc
GetCommandLineA
GetVersion
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapAlloc
GetProcAddress
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
FlushFileBuffers
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
CloseHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
ReadFile
CreateDirectoryA
SetEndOfFile
GetDriveTypeA
SetFileAttributesA
GetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
CreateFileA
GetFullPathNameA
GetCurrentDirectoryA
GetSystemTime
GetLocalTime
Sections
.text Size: 84KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Release_ANSI/unscrambler.exe.exe windows:5 windows x86 arch:x86
0d4bdfe9e1ff3a959d93e0e6c1da36d8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
vcruntime140
memset
_except_handler4_common
api-ms-win-crt-stdio-l1-1-0
fclose
__p__commode
feof
fread
_fseeki64
ferror
__stdio_common_vfprintf
rewind
fwrite
_ftelli64
_set_fmode
__acrt_iob_func
fopen
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-time-l1-1-0
_time64
_difftime64
api-ms-win-crt-runtime-l1-1-0
_controlfp_s
terminate
_register_onexit_function
_initialize_onexit_table
_seh_filter_exe
_crt_atexit
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argv
__p___argc
_set_app_type
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 231KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 452B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ