7638e69e55a53c26a001801a76d46d95

Sharing

Copy URL Twitter E-mail

General

Target

7638e69e55a53c26a001801a76d46d95
Size

4.0MB
MD5

7638e69e55a53c26a001801a76d46d95
SHA1

54bd12c0ef27c8c1b72f56d99259e9b72df9808c
SHA256

c20871265305c6f4793a9b5b6112d49fbf7846e4622e9cae613eb0d5d700d4ef
SHA512

5c59902cddf603e9a2ee478a40783de3254742f5c4940c4678c641b1cd41bb14f856cec628f99677cd6dede5fd7df83e5f910f81717e3c759698382eb23c7017
SSDEEP

98304:rhFAW1DKjzNGnTNLBMM5cpqlcWvhp1mkTO6j8TUQiWwI465nY:rhFDgNGTNL7cpqlxhp1PTOsWX4L

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/eDigest/EDFTools.exe	aspack_v212_v242
static1/unpack001/eDigest/EdfView.exe	aspack_v212_v242
static1/unpack001/eDigest/GetText.exe	aspack_v212_v242

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/eDigest/EDFTools.exe
unpack001/eDigest/EdfView.exe
unpack001/eDigest/GetText.exe
unpack001/eDigest/eDigest.exe
unpack001/eDigest/hha.dll

Files

7638e69e55a53c26a001801a76d46d95
.rar
eDigest/EDFTools.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 143KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
eDigest/EdfView.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 431KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
eDigest/GetText.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 221KB - Virtual size: 556KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
eDigest/GetText.txt
eDigest/License.txt
eDigest/Readme.txt
eDigest/eDigest.edf
eDigest/eDigest.exe
.exe windows:4 windows x86 arch:x86

07d2d9479c771188e3c0b59d7a3a02ec

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

mpr

WNetGetUserA

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

IsEqualGUID

comctl32

ImageList_SetIconSize

imm32

ImmGetVirtualKey

winspool.drv

OpenPrinterA

shell32

Shell_NotifyIconA

wininet

GetUrlCacheEntryInfoA

urlmon

URLDownloadToFileA

comdlg32

PrintDlgA

oledlg

OleUIObjectPropertiesA

winmm

PlaySoundA

Sections

CODE
Size: 1.1MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
eDigest/hha.dll
.dll windows:4 windows x86 arch:x86

969d3807d966bc686a2e4719c377ca96

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
HeapFree
HeapDestroy
HeapReAlloc
HeapSize
RtlUnwind
ExitProcess
RaiseException
GetCurrentThreadId
GetCurrentProcess
GetLocalTime
GetCommandLineA
HeapCreate
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
SetUnhandledExceptionFilter
GetModuleHandleA
SetHandleCount
GetFileType
GetStdHandle
GetTimeZoneInformation
GetSystemTime
TlsSetValue
GetACP
GetOEMCP
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsBadWritePtr
IsBadCodePtr
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
GetLocaleInfoW
CompareStringW
SetEnvironmentVariableA
GetPrivateProfileStringA
_lread
GlobalHandle
GlobalLock
GlobalFree
FreeLibrary
GlobalMemoryStatus
GetCurrentProcessId
SetEndOfFile
GetWindowsDirectoryA
GetCurrentDirectoryA
GetFullPathNameA
lstrcmpiA
LCMapStringA
VirtualAlloc
VirtualFree
ExitThread
WaitForSingleObject
Sleep
SetFilePointer
CreateSemaphoreA
CreateThread
ReleaseSemaphore
WriteFile
LocalAlloc
CreateDirectoryA
GetFileAttributesA
GetModuleFileNameA
GetSystemDefaultLangID
SetCurrentDirectoryA
lstrlenA
MulDiv
GetLastError
FormatMessageA
LocalFree
GetVolumeInformationA
OpenFile
_lwrite
_lclose
GetUserDefaultLCID
FatalAppExitA
GetVersion
IsDBCSLeadByte
CompareStringA
ReadFile
CloseHandle
CreateFileA
LoadLibraryA
GetProcAddress
GetLocaleInfoA
WritePrivateProfileStringA
IsBadReadPtr
lstrcatA
lstrcpyA
GetFileSize
GetTempPathA
GetTempFileNameA
DeleteFileA
GetSystemTimeAsFileTime
LocalReAlloc
FindNextFileA
FindFirstFileA
FindClose
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
GetVersionExA
SearchPathA
SetLastError
_llseek
_lopen
MultiByteToWideChar
WideCharToMultiByte
lstrcpynA
lstrlenW
CreateFileMappingA
MapViewOfFile
GetTickCount
DebugBreak
GetSystemDirectoryA
GlobalAlloc
GetStartupInfoA
FlushFileBuffers
GetCPInfo

user32

BeginPaint
DeleteMenu
GetMenuItemID
InsertMenuA
DefWindowProcA
IsIconic
RegisterClassA
SetRect
CharUpperA
FillRect
WinHelpA
EnableWindow
CreateWindowExA
OffsetRect
CharPrevA
SetWindowPos
LoadCursorA
SetCursor
LoadStringA
MessageBoxA
CharLowerA
CharNextA
GetSysColor
EndPaint
GetDlgItemInt
LoadBitmapA
GetClientRect
GetParent
SetDlgItemInt
UnhookWindowsHookEx
ClientToScreen
SetTimer
GetCursorPos
ScreenToClient
CallWindowProcA
GetClassNameA
CreateDialogParamA
ShowWindow
SendDlgItemMessageA
wsprintfA
SetFocus
SetWindowTextA
GetWindowTextLengthA
GetWindowTextA
GetWindowLongA
PostMessageA
EndDialog
SetWindowLongA
GetDC
ReleaseDC
GetDlgItem
GetSystemMetrics
InvalidateRect
CallNextHookEx
GetDesktopWindow
GetWindowRect
SystemParametersInfoA
MoveWindow
DialogBoxParamA
IsWindow
DestroyWindow
SendMessageA
EnumChildWindows
SetWindowsHookExA
FindWindowA
wvsprintfA
GetWindowPlacement
KillTimer
ReleaseCapture
SetCapture
PtInRect

gdi32

SelectClipRgn
PatBlt
GetTextMetricsA
GetDeviceCaps
CreateFontA
DeleteObject
GetObjectA
GetTextExtentPointA
ExtTextOutA
SetBkColor
SetTextColor
BitBlt
CreateFontIndirectA
SetMapMode
CreateCompatibleDC
CreateDCA
CreateICA
DeleteDC
SelectPalette
RealizePalette
CreatePen
CreateSolidBrush
CreateCompatibleBitmap
CreatePalette
GetDIBits
StretchDIBits
CreateDIBSection
GetPaletteEntries
CreateHalftonePalette
RestoreDC
PlayMetaFile
SetBkMode
SetViewportExtEx
SetViewportOrgEx
SaveDC
DeleteMetaFile
SetMetaFileBitsEx
CreateRectRgnIndirect
SelectObject
CreateBitmap
CreatePatternBrush

advapi32

RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation

comdlg32

GetOpenFileNameA

comctl32

ord15
ord14
CreatePropertySheetPageA
PropertySheetA

version

VerQueryValueA
GetFileVersionInfoA

ole32

CoGetClassObject
CoCreateInstance

Exports

Exports

?LoadJpeg@@YG?AW4FSERR@@PBDPAUIMAGE@@@Z
EditHhCtrlObject
EditHhCtrlScript
FreeFilterDIB
HHA_CompileHHP
LoadFilterImage

Sections

.text
Size: 391KB - Virtual size: 391KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 294KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
eDigest/skins/mxp05.jpg
.jpg
eDigest/skins/mxp05.skn
.ps1
eDigest/skins/mxp1.jpg
.jpg
eDigest/skins/mxp1.skn
eDigest/skins/mxp2.jpg
.jpg
eDigest/skins/mxp2.skn
eDigest/skins/mxp3.jpg
.jpg
eDigest/skins/mxp3.skn
eDigest/skins/mxp4.skn
eDigest/skins/mxskin15.jpg
.jpg
eDigest/skins/mxskin15.skn
eDigest/skins/mxskin18.jpg
.jpg
eDigest/skins/mxskin18.skn
eDigest/skins/mxskin24.jpg
.jpg
eDigest/skins/mxskin24.skn
eDigest/skins/mxskin28.jpg
.jpg
eDigest/skins/mxskin28.skn
eDigest/skins/mxskin34.jpg
.jpg
eDigest/skins/mxskin34.skn
eDigest/skins/mxskin49.jpg
.jpg
eDigest/skins/mxskin49.skn
eDigest/skins/mxskin56.jpg
.jpg
eDigest/skins/mxskin56.skn
eDigest/skins/mxskin60.jpg
.jpg
eDigest/skins/mxskin60.skn
eDigest/skins/skin0000.skn
eDigest/skins/skin0050.skn
eDigest/skins/skin0103.skn
eDigest/skins/skin0225.skn
eDigest/skins/skin0256.skn
eDigest/skins/skin0273.skn
eDigest/skins/skin0357.skn
eDigest/安装说明.url
.url

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

CODE Size: 143KB - Virtual size: 344KB

DATA Size: 2KB - Virtual size: 8KB

BSS Size: - Virtual size: 8KB

.idata Size: 3KB - Virtual size: 8KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size: 24KB

.rsrc Size: 9KB - Virtual size: 24KB

.aspack Size: 5KB - Virtual size: 8KB

.adata Size: - Virtual size: 4KB

Headers

File Characteristics

Sections

CODE Size: 431KB - Virtual size: 1.1MB

DATA Size: 6KB - Virtual size: 16KB

BSS Size: - Virtual size: 24KB

.idata Size: 4KB - Virtual size: 12KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size: 72KB

.rsrc Size: 31KB - Virtual size: 152KB

.aspack Size: 8KB - Virtual size: 8KB

.adata Size: - Virtual size: 4KB

Headers

File Characteristics

Sections

CODE Size: 221KB - Virtual size: 556KB

DATA Size: 2KB - Virtual size: 8KB

BSS Size: - Virtual size: 8KB

.idata Size: 4KB - Virtual size: 12KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size: 40KB

.rsrc Size: 12KB - Virtual size: 40KB

.aspack Size: 7KB - Virtual size: 8KB

.adata Size: - Virtual size: 4KB

07d2d9479c771188e3c0b59d7a3a02ec

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

mpr

version

gdi32

ole32

comctl32

imm32

winspool.drv

shell32

wininet

urlmon

comdlg32

oledlg

winmm

Sections

CODE Size: 1.1MB - Virtual size: 3.9MB

.rsrc Size: 20KB - Virtual size: 20KB

969d3807d966bc686a2e4719c377ca96

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

comdlg32

comctl32

version

CODE
Size: 143KB - Virtual size: 344KB

DATA
Size: 2KB - Virtual size: 8KB

BSS
Size: - Virtual size: 8KB

.idata
Size: 3KB - Virtual size: 8KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size: 24KB

.rsrc
Size: 9KB - Virtual size: 24KB

.aspack
Size: 5KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB

CODE
Size: 431KB - Virtual size: 1.1MB

DATA
Size: 6KB - Virtual size: 16KB

BSS
Size: - Virtual size: 24KB

.idata
Size: 4KB - Virtual size: 12KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size: 72KB

.rsrc
Size: 31KB - Virtual size: 152KB

.aspack
Size: 8KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB

CODE
Size: 221KB - Virtual size: 556KB

DATA
Size: 2KB - Virtual size: 8KB

BSS
Size: - Virtual size: 8KB

.idata
Size: 4KB - Virtual size: 12KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size: 40KB

.rsrc
Size: 12KB - Virtual size: 40KB

.aspack
Size: 7KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB

CODE
Size: 1.1MB - Virtual size: 3.9MB

.rsrc
Size: 20KB - Virtual size: 20KB

.text
Size: 391KB - Virtual size: 391KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 68KB - Virtual size: 81KB

.rsrc
Size: 294KB - Virtual size: 294KB

.reloc
Size: 18KB - Virtual size: 18KB