OPPW4_PATCHER.zip
- SHA256 86d33f9bb694f519a38822ee37006cded1c9c5fd3cc82168c6546138cd0382fb
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OPPW4_PATCHER.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
OPPW4_PATCHER.zip
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
OPPW4_PATCHER/OPPW4_PATCHER.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
OPPW4_PATCHER/OPPW4_PATCHER.ini
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
dinput8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
dinput8.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target OPPW4_PATCHER.zip
- Size 2.2MB
- Sample260625-dfwl9ahs4k
- SHA256 86d33f9bb694f519a38822ee37006cded1c9c5fd3cc82168c6546138cd0382fb
- MD5 6ee2f493c3962316d15e69c05e643b86
- SHA1 6ed70b02e5e765cf3048ede8aabb6510c5facc56
- SHA512 555db0046de950d5594934eb515c385fe8846e402c695861dcbd21d498400650399642c711bb883a2476800526ee45204ab13f6d952ac8383e420669832a6fcf
- SSDEEP 49152:tAMBSCK56p4LqyRfX4kbX5Z9K3csiiULZeti:uMBSCAc4L3fX4kbJeYiUVAi
- TLSH T1BDB533C31CD91C87CB229E3539D645A2849FEDCB48D3CC01D6AB7CAFA48A9D2E574C64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/dinput8.dll
File Explorer
-
OPPW4_PATCHER.zip.zip 2.2MB
-
OPPW4_PATCHER/OPPW4_PATCHER.ini232B
-
dinput8.dll.dll 8.9MB
OPPW4_PATCHER/OPPW4_PATCHER.ini
- SHA256 fd90480a6a2741b8c4b97733daa5194044d9e8a875c1069d0aec6b79cbb0689f
- MD5 6627e781d3162d67570da81d067baa2e
- SHA1 2f70a594d0f46c1011e77925c1cde67b0cd74d7f
- SHA512 e42eee4e09806dad8a6918f767580c6a55a74784630ca5f023c1e4185f3be07280300c49661689f8f845f4f4cd6fe1064c6e4b8390150cb1578570608aa70bdf
- TLSH T143D0A79F0F18046F5A9214435F0593B3B12CA10D78EF06206B54D635718F024A49E83D
- MD5 SHA1 SHA512 TLSH
dinput8.dll
- IMPHASH a4e2166584630530105ffd54d65cbe77
- SHA256 187bdbbbea73a49a0bf9069063593b886948618970153259b06c79223f5874b4
- MD5 564d9d94408698b34fe1dc4337272bbc
- SHA1 6e014aceb4c2f9f3c1bee4c4f3dfbc9848254b76
- SHA512 29d8f59e5a5c6c1f9df7a078df5e8bf936b9a3e46b231571c1a91fbe174fd516a638b54e5c60c2c080f7d246e495576e9814cc96f75d72a880341350b4133263
- SSDEEP 49152:QVk8m+5co00yrAxFrXxe3HRqh7f/HMU1QuLk0FnqDNUf3z3IHwRKZK0d4/YETqI:AxtmqoU1fLbF6SfAZK0d4
- TLSH T11696B6D6557AED0D8C737173A76BB8826C8C3C07124797419E358E31A2AFB13687AE4C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateFileA
CreateFileW
CreateMutexA
CreateProcessA
CreateSemaphoreA
CreateToolhelp32Snapshot
DeleteCriticalSection
EnterCriticalSection
FindClose
FindFirstFileExA
FindNextFileA
FlushInstructionCache
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetFileSizeEx
GetFileTime
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleW
GetProcAddress
GetStartupInfoW
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetThreadContext
GetTickCount
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MultiByteToWideChar
OpenThread
OutputDebugStringA
QueryPerformanceCounter
ReadFile
ReleaseMutex
ReleaseSemaphore
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetThreadContext
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
Thread32First
Thread32Next
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
_fdopen
_fileno
_read
_rmdir
_write
__dllonexit
__doserrno
__iob_func
__mb_cur_max
__pioinfo
_amsg_exit
_errno
_exit
_filelengthi64
_fileno
_fstat64
_initterm
_lock
_lseeki64
_mkdir
_onexit
_stat64
_stricmp
_strlwr
_strnicmp
_time64
_unlock
_vsnprintf
_wfopen
_wgetenv
_wmkdir
_write
_wstat64
abort
atof
atoi
calloc
ceil
exit
fclose
ferror
fflush
fgetpos
floor
fopen
fprintf
fputc
fputs
fread
free
fseek
fsetpos
ftell
fwrite
getc
getenv
getwc
isalnum
isalpha
islower
isspace
isupper
iswctype
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putc
putwc
raise
rand
realloc
remove
rename
setlocale
setvbuf
signal
sprintf
srand
sscanf
strchr
strcmp
strcoll
strcpy
strerror
strftime
strlen
strncmp
strstr
strtol
strtoul
strxfrm
system
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcsstr
wcsxfrm
shell32
SHFileOperationA
user32
MessageBoxA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
DirectInput8Create
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7.7MB
Virtual Size
7.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
211B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ