TestMem5[.]7z | Triage

Sharing

Copy URL Twitter E-mail

General

Target

TestMem5.7z
Size

37KB
MD5

33b12c4e826bb552b0cfd71278960f42
SHA1

bb10622f460e4c57a3f0c9c459f8bc0f5b1f4903
SHA256

05ffb5bbaa0c2243bf25664049c7aa3615a77bd5036497ef845fc8ed50128c12
SHA512

d543e9e7cfb55996b31f6ec2262b77b5380fcbdb5f1c27908908b9bcfa5c0f43c2dd40ce6bafe0f9a31a7b5d9c817ee74bad464923bef630ba4022f67297346a
SSDEEP

768:QLqHXSn899nWCmaOHQktlL6MRAKX9UJgPkYaLmRihF6gq:QG3S8z7QBFAmUJgPLaLmH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/TM5.dll
unpack001/TM5.exe
unpack001/bin/MT0.dll

Files

TestMem5.7z
.7z
TM5.dll
.dll windows:6 windows x86 arch:x86

22970e47b6e6193d2f5c7668bb451be2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

LsaOpenPolicy
RegCloseKey
RegQueryValueExW
LsaClose

comctl32

ord380
ord381
ord344

gdi32

ExtTextOutW
SetBkColor
SetBkMode
SetTextColor
CreateSolidBrush

kernel32

AllocateUserPhysicalPages
CloseHandle
CreateEventW
CreateFileA
CreateProcessW
CreateThread
DeleteFileA
ExitProcess
ExitThread
FindClose
FindFirstFileExA
FindNextFileA
FindResourceW
FreeUserPhysicalPages
GetCommandLineA
GetCurrentProcessId
GetDurationFormatEx
GetLocalTime
GetLocaleInfoEx
GetModuleFileNameW
GetModuleHandleW
GetNumberFormatEx
GetPrivateProfileStringA
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetSystemDefaultLangID
GetUserDefaultLangID
GetUserDefaultUILanguage
GlobalMemoryStatusEx
HeapAlloc
HeapFree
HeapSetInformation
LoadLibraryA
LoadLibraryExW
LoadResource
LockResource
MapUserPhysicalPages
OpenProcess
QueryUnbiasedInterruptTime
ReadFile
SetCurrentDirectoryA
SetEndOfFile
SetEvent
SetFilePointerEx
SetProcessWorkingSetSize
SetThreadExecutionState
SetThreadPriority
Sleep
TerminateThread
VirtualAlloc
VirtualFree
VirtualLock
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileStringA

ntdll

strcpy
RtlGetVersion
_stricmp
_ultow
memcmp
strcat
wcslen
strtol
wcscat
wcscmp
wcscpy

user32

GetWindow
wsprintfW
wsprintfA
TranslateMessage
TranslateAcceleratorW
ShowWindow
SetWindowTextW
SetWindowPlacement
SetWindowLongW
SetUserObjectInformationW
SetTimer
SetParent
AdjustWindowRectEx
AllowSetForegroundWindow
CallWindowProcW
CheckDlgButton
CheckRadioButton
CreateDialogParamW
DestroyWindow
DialogBoxParamW
DispatchMessageW
DrawTextW
EnableWindow
EndDialog
EnumChildWindows
FlashWindowEx
FrameRect
GetActiveWindow
GetDlgCtrlID
GetDlgItem
GetDlgItemTextW
GetFocus
GetMessageW
GetNextDlgTabItem
GetSysColorBrush
GetSystemMetrics
SetDlgItemTextW
GetWindowContextHelpId
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowThreadProcessId
InvalidateRect
IsChild
IsDialogMessageW
IsDlgButtonChecked
KillTimer
LoadAcceleratorsW
MessageBeep
PostMessageW
PostQuitMessage
ReplyMessage
ScreenToClient
SendDlgItemMessageA
SendDlgItemMessageW
SendInput
SendMessageW
SetDlgItemInt
SetForegroundWindow

Exports

Exports

InitCommonControls
InitCommonControlsEx

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TM5.exe
.exe windows:6 windows x86 arch:x86

281b24d631f8fd82296159f0d6e07fcf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetPriorityClass
SetThreadPriority
Sleep
TerminateProcess
TerminateThread
VirtualAlloc
ReadFile
WriteFile
WritePrivateProfileStringA
lstrcatA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
QueryPerformanceFrequency
QueryPerformanceCounter
SetFilePointer
MapViewOfFile
LoadLibraryA
HeapFree
HeapAlloc
GlobalMemoryStatusEx
GlobalFree
GlobalAlloc
GetVersion
GetUserDefaultLangID
GetTickCount
GetSystemInfo
GetStartupInfoA
GetProcessHeap
GetProcAddress
GetPrivateProfileStringA
GetModuleHandleA
GetModuleFileNameA
GetLocalTime
RtlZeroMemory
MultiByteToWideChar
GetLastError
GetFileSize
GetCurrentThread
GetCurrentProcess
GetCompressedFileSizeA
GetCommandLineA
ExitThread
ExitProcess
CreateThread
CreateProcessA
CreateFileMappingA
CreateFileA
VirtualFree
CloseHandle

user32

wsprintfA
SendMessageA
SetWindowTextA
SetWindowPos
SetWindowLongA
SetTimer
SetForegroundWindow
SetDlgItemTextA
GetWindowPlacement
MessageBoxA
LoadIconA
GetWindowRect
GetWindowLongA
GetSysColor
GetDlgItem
GetDlgCtrlID
DialogBoxParamA

tm5

InitCommonControls
InitCommonControlsEx

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TestMem5.url
bin/1usmus v3 @ 1usmus.cfg
bin/Absolut @ anta777.cfg
bin/DDR5 Intel @ anta777.cfg
bin/DDR5 Ryzen3D @ anta777.cfg
bin/Default @ serj.cfg
bin/Extreme @ anta777.cfg
bin/Heavy @ anta777.cfg
bin/MT0.dll
.dll windows:6 windows x86 arch:x86

ae8a137c96f649fd71db0dfece668c29

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
HeapFree
MapUserPhysicalPages
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcessWorkingSetSize
SetProcessWorkingSetSize
VirtualAlloc
VirtualFree
VirtualLock
VirtualUnlock
WriteFile
GetProcessHeap
GetLastError
GetCurrentProcess
FreeUserPhysicalPages
CreateFileA
CloseHandle
RtlZeroMemory
AllocateUserPhysicalPages

user32

MessageBoxA
wsprintfA

advapi32

LsaClose
LookupPrivilegeValueA
GetTokenInformation
AdjustTokenPrivileges
LsaOpenPolicy
OpenProcessToken
LsaAddAccountRights

Exports

Exports

BlockMove
MemManager
MirrorMove
MirrorMove128
RefreshStable
SimpleTest

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/Super Light 2 @ anta777.cfg
bin/Universal 2 @ LMhz.cfg

Sharing

General

Malware Config

Signatures

Files

22970e47b6e6193d2f5c7668bb451be2

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

comctl32

gdi32

kernel32

ntdll

user32

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 1024B - Virtual size: 5KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 1KB - Virtual size: 1KB

281b24d631f8fd82296159f0d6e07fcf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

tm5

Sections

.text Size: 18KB - Virtual size: 18KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 276KB

.rsrc Size: 4KB - Virtual size: 3KB

ae8a137c96f649fd71db0dfece668c29

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 9KB

.rsrc Size: 1024B - Virtual size: 728B

.reloc Size: 512B - Virtual size: 352B

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 1024B - Virtual size: 5KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 18KB - Virtual size: 18KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 276KB

.rsrc
Size: 4KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 9KB

.rsrc
Size: 1024B - Virtual size: 728B

.reloc
Size: 512B - Virtual size: 352B