f1782b3a179da3c35c6812382d7820aa31dae6aa116a658faaff57f592c00725

Sharing

Copy URL Twitter E-mail

General

Target

f1782b3a179da3c35c6812382d7820aa31dae6aa116a658faaff57f592c00725
Size

496KB
MD5

4c6eb39c0f0cf6ec102d699ffaf6f89c
SHA1

c00d59fc8fee14578b64d6721a56d91c0f41f262
SHA256

f1782b3a179da3c35c6812382d7820aa31dae6aa116a658faaff57f592c00725
SHA512

d4d033522475156bf4132569d57f7bd82caf806d98d8aa67b4500b1ba08fde204deac332aa4c337c2c595dc2537f296e43f6ddec53810e23af5df4c284485c9e
SSDEEP

12288:dgUK9Q0059pGHNu4B2UoZIvzuGsoPp+bDFpPOo1V+:dgUK9Q0jI4roEC/oPGRd3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f1782b3a179da3c35c6812382d7820aa31dae6aa116a658faaff57f592c00725

Files

f1782b3a179da3c35c6812382d7820aa31dae6aa116a658faaff57f592c00725
.exe windows:6 windows x64 arch:x64

7f48027a29e4cb118e0c4d615abe35ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\wani\customer\wangping\Keychron\M3mini\App\firmwareUpdateAppVc4K\x64\Release\M3minifirmwareUpdateApp.pdb

Imports

hid

HidD_GetAttributes
HidD_GetPreparsedData
HidP_GetCaps
HidD_GetHidGuid

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

mfc140

ord6101
ord14208
ord6102
ord14209
ord6100
ord14207
ord7688
ord12160
ord14007
ord11615
ord11614
ord2004
ord7637
ord12571
ord3941
ord4002
ord9049
ord14133
ord7619
ord14135
ord12171
ord12170
ord2437
ord5167
ord7989
ord12490
ord8050
ord8131
ord12913
ord7206
ord4086
ord3157
ord8788
ord6565
ord2182
ord2207
ord3591
ord10117
ord4714
ord8128
ord13784
ord8432
ord10680
ord9016
ord5221
ord13683
ord13689
ord8693
ord6266
ord8863
ord8888
ord11803
ord2695
ord13327
ord5980
ord3066
ord3299
ord3300
ord11037
ord10657
ord11761
ord1487
ord2473
ord6229
ord4710
ord7519
ord4715
ord7364
ord3705
ord9351
ord3501
ord6299
ord3748
ord3723
ord1032
ord4648
ord2264
ord6292
ord1084
ord988
ord8862
ord11869
ord7890
ord5211
ord7420
ord7431
ord7430
ord5896
ord5049
ord5213
ord5067
ord5566
ord5323
ord9001
ord5536
ord5347
ord5064
ord11798
ord3165
ord3270
ord3271
ord3804
ord11754
ord2627
ord5704
ord13284
ord11357
ord6607
ord14134
ord7620
ord14136
ord2962
ord4343
ord9343
ord4351
ord4817
ord4756
ord4741
ord4803
ord4848
ord4771
ord4826
ord4842
ord4783
ord4789
ord4795
ord4777
ord4832
ord4765
ord1750
ord1729
ord1743
ord1717
ord1695
ord11888
ord11892
ord13438
ord3166
ord8909
ord10644
ord6703
ord11850
ord8618
ord14128
ord11575
ord3710
ord11719
ord8779
ord11366
ord316
ord5687
ord11365
ord5435
ord9936
ord9932
ord438
ord9934
ord9935
ord9933
ord14279
ord2696
ord7881
ord3202
ord3205
ord13331
ord4021
ord4490
ord11877
ord4436
ord1507
ord7888
ord10079
ord11881
ord11849
ord12552
ord6143
ord5539
ord9898
ord6590
ord1089
ord1087
ord1367
ord1421
ord3943
ord13469
ord7028
ord13050
ord940
ord2173
ord7685
ord1446
ord981
ord7363
ord10026
ord265
ord266
ord2899
ord1674
ord305
ord5691
ord2917
ord300
ord1504
ord310
ord878
ord1381
ord1485
ord3734
ord6533
ord4020
ord8792
ord13603
ord3138
ord12692
ord2471
ord9903
ord6226
ord1051
ord5982
ord3051
ord3258
ord2368
ord6788
ord450

kernel32

GetLastError
OutputDebugStringW
DeleteCriticalSection
SetLastError
CloseHandle
CreateFileA
WriteFile
CreateEventA
ReadFile
GetOverlappedResult
Sleep
CreateThread
SizeofResource
LockResource
LoadResource
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
FindResourceA
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess

user32

DrawIcon
PostMessageA
RedrawWindow
GetParent
GetSystemMetrics
IsIconic
GetSysColor
SendMessageA
GetClientRect
InvalidateRect
FillRect
CopyRect
EnableWindow
AppendMenuA
GetSystemMenu
MessageBoxW
LoadIconW
DrawFrameControl

gdi32

GetTextExtentPoint32A
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
GetStockObject
CreateSolidBrush

msimg32

TransparentBlt

comctl32

InitCommonControlsEx
_TrackMouseEvent

msvcp140

?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context
memmove
_CxxThrowException
__current_exception
memcmp
memset
__std_exception_destroy
__std_exception_copy
memchr
__C_specific_handler
memcpy

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
terminate
_initialize_onexit_table
_errno
_c_exit
_register_onexit_function
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vsprintf_s

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_setmbcp
_configthreadlocale

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 404KB - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7f48027a29e4cb118e0c4d615abe35ed

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

hid

setupapi

mfc140

kernel32

user32

gdi32

msimg32

comctl32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 59KB - Virtual size: 59KB

.rdata Size: 25KB - Virtual size: 25KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 404KB - Virtual size: 404KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 59KB - Virtual size: 59KB

.rdata
Size: 25KB - Virtual size: 25KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 404KB - Virtual size: 404KB

.reloc
Size: 1KB - Virtual size: 1KB