uberlogger-v1.3.3.zip
- SHA256 b77b1b3659be9339707515235f8a61fcd88d61fbfa24b5f854b6ed88e65311f7
Overview
overview
7Static
static
3Converter-...aw.exe
windows10-2004-x64
7Converter-...aw.exe
windows11-ltsc_2024-x64
7Converter-...raw.py
windows10-2004-x64
3Converter-...raw.py
windows11-ltsc_2024-x64
3Wired/esptool.exe
windows10-2004-x64
4Wired/esptool.exe
windows11-ltsc_2024-x64
4Wired/upda...re.bat
windows10-2004-x64
1Wired/upda...re.bat
windows11-ltsc_2024-x64
1Wired/upda...are.sh
ubuntu-18.04-amd64
1Wired/upda...are.sh
debian-9-armhf
1Wired/upda...are.sh
debian-9-mips
Wired/upda...are.sh
debian-9-mipsel
calib_uber.py
windows10-2004-x64
3calib_uber.py
windows11-ltsc_2024-x64
3esptool.exe
windows10-2004-x64
4esptool.exe
windows11-ltsc_2024-x64
4uberlogger-prog.bat
windows10-2004-x64
1uberlogger-prog.bat
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
Converter-tool/convert_raw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Converter-tool/convert_raw.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Converter-tool/convert_raw.py
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Converter-tool/convert_raw.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
Wired/esptool.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
Wired/esptool.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
Wired/update_firmware.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Wired/update_firmware.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Wired/update_firmware.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Wired/update_firmware.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Wired/update_firmware.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Wired/update_firmware.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
calib_uber.py
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
calib_uber.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
esptool.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
esptool.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
uberlogger-prog.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
uberlogger-prog.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target uberlogger-v1.3.3.zip
- Size 23.4MB
- Sample260710-pcmeysa19k
- SHA256 b77b1b3659be9339707515235f8a61fcd88d61fbfa24b5f854b6ed88e65311f7
- MD5 bf14d138045dc10a9e8bf171e4fbbc9f
- SHA1 888f62a8d62682b1a899fd451ed61a7e554a9329
- SHA512 ea65a51effd84d7055892ed3eabef32dda17c857fa859931991637731215379a288db9f3ebdd1ecb13ca490aac21e19016f9e5ac1a68ae067f7c911d5587d56a
- SSDEEP 393216:kWmI0pDO6+2waGCmwSoNZABAj8cLyMLPfuJGmqNopPVH+3MLPfuJGmqNopP0H+H:nmI0pDOX24CmwSo0Kj8dgP0ZFP2gP0Zb
- TLSH T1A03733C418406321E848F93FE7359BE759472D2DF692AD1A205C9513EEF21FB872DA83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Converter-tool/convert_raw.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Converter-tool/convert_raw.exe
File Explorer
-
uberlogger-v1.3.3.zip.zip 23.4MB
-
Changelog_and_flash_instruction.txt7KB
-
Converter-tool/convert_raw.exe.exe 8.0MB
-
convert_raw.pyc21KB
-
Converter-tool/convert_raw.py21KB
-
Wired/esptool.exe.exe 6.3MB
-
esptool.pyc456B
-
Wired/firmware.bin3.4MB
-
Wired/update_firmware.bat2KB
-
Wired/update_firmware.sh.sh 1KB
-
calib_uber.py4KB
-
esptool.exe.exe 6.3MB
-
esptool.pyc456B
-
firmware.bin3.4MB
-
ota_filesystem.bin900KB
-
ota_main.bin1013KB
-
ota_support.bin22KB
-
uberlogger-prog.bat.bat 1KB
Changelog_and_flash_instruction.txt
- SHA256 8cb685d212ad183a6af8dee5104b0d60a2f7a046913ef9bfa687cc60fffc3ae7
- MD5 7fc36ef31f66ccf75ae5a0a166dfa3d1
- SHA1 00b8f5dab65f07dd32ad2e9e26b77bb4e9875827
- SHA512 869909d8764c69eda47a7923baf59d59632fdce71b0205ddc9d78eaa4dff4c254a4c5099a5249e4f2be51c65ed34fc830ff3ec5f2b7f07a85e02031b6d691eba
- SSDEEP 96:InFQs4TPVRz6sGIfoWSu724WBvWPI6PH22zC0DnD1GwHR4h8YSHCkIG1G3aIK30J:SrlIA2724WoIG21w4hFSassvso/1Bp+W
- TLSH T132F1B657B718333201120112970F13E2AF5294AA7357621894EDA24C7B997BAC6BF7ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Converter-tool/convert_raw.exe
- IMPHASH ba5546933531fafa869b1f86a4e2a959
- SHA256 970e32daa1ce3a2bb8deb7dc1779df58391031c12ee5ddcfcf9b5908fa51c1c6
- MD5 09699886fef6cd2fdf284b8023b12550
- SHA1 39ee0444c83c2f4baa07e0f4ef4c375ebcb317b8
- SHA512 66c1e158afac0ce4c14d5cccbf97325ff5bb40b4c79091f20de4f06055b1e8576c2b0a1788b6a645c4082edaf19741cbe7ee13fb68f88ad685c8c1b70b6bc537
- SSDEEP 196608:c2Vq9x1dy5XOSxIJEO2tpkQmJueAWNFaNx/RhETSEGhcWNje5SPMR:S9x1dVSSJEVwbsWNF4xYOdhe59
- TLSH T166863395626009E0FCBCC43F8105C92AD6B67C7BA364D98B13E8C6571F635F6293EE81
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
42672
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
FreeLibrary
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
SetEndOfFile
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=190, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=32420,
count=40, id=261, version=32420,
count=17, id=260, version=32420,
count=9, id=259, version=32420,
count=5, id=257, version=30795,
count=117, id=1, productName=Unmarked objects,
count=20, id=260, version=32538,
count=1, id=258, version=32538,
convert_raw.pyc
- SHA256 08f94afe8f8999644fe9ac33df6a810c309e7c50aedc06bf3cffeb1e589fa118
- MD5 217c6993c5145987f321b9b7088a4ec7
- SHA1 f8cd374547a54aa748fe673dbea968b3bab0f881
- SHA512 637c3e508d894f56a0ca22f0517f9c233319f9212cf494a54e6986dd532e215ab6092952bb7a541f44341941844046acadd3b01ea3b20cfed71e8af6e3fdbf9f
- SSDEEP 384:QMSKbZfT3ZTA/ewzzI+L2L+GDq5u5zYUIKUHUGbTPc9Q91Nx54GLyqIIIY:QpwZbJA/ewzk+qL+yWBHUWc98NxX2qNv
- TLSH T15CA2814276B5DA7BFB51B3B9B42B0215B361DEA1EF00C6533158B01ABF453A9AC409FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Converter-tool/convert_raw.py
- SHA256 c8505516d1787bcbd52a8c20294c0226cefee10d04d1af3e2ecadbe7ee2a727e
- MD5 2971ede5e1931f78db7fcb3955811c3c
- SHA1 436967e0f5f9b720a8a2d81329fffb39f4a3967b
- SHA512 67d847e945ae2f9c82b777393f4f7be7948c78ebd287acf1746b461c80383482810f5edbf71784de2eaa9fa4b6025a7a1aa9c8287e593a50acc3c42e30fd610e
- SSDEEP 384:k5pyoPlmd6SaLxYFirYvhWG5891fy5oeP89LkghyGlGiJ3pHPDyA86aBrGBZeekb:k5F9G+F9rYvhWG5891fyLP89LkghyGl2
- TLSH T1ABA27381395B19EDC3437D4889DB4803F738720F4A0CA5A9B6AC69957F08E75F1FAAC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Wired/esptool.exe
- IMPHASH 69eb46a9f63edcc604b0bdaaa8e0f2f5
- SHA256 62185730ea23a0fcf9d550692ae8203d8f130e7605507d20c45309e6904aa7df
- MD5 c47aac98ae3cfff1c3d825a44cf18576
- SHA1 a4736a0b13aa698f76fe7fb8c274141ec7d65811
- SHA512 6aca87cc3005b9958a83aa2e7876ccf1b5d5b0ce31e1ad7443ab82b4180ad2a26c1dbd2ca5017ff52db922c7d88fe8a7b5f48de9de358468fe06d9b450ba627b
- SSDEEP 196608:U9zjOCsXDjDyf/dJolpPgToa10/IUFOnJSi5IoWf:WzjOCEDCJ83a10QUs0gN+
- TLSH T1E7663347A58119E9E9F3653E88518702F6A67C37C712874F06A45237EE2B2B19F3B703
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4b:26:77:21:21:0b:3f:ef:fc:d6:4e:cd:5c:31:2e:05:82:68:5d:4e:26:fb:07:d0:7b:f3:13:34:0d:e6:95:5d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Espressif Systems (Shanghai) Co.\, Ltd.,O=Espressif Systems (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN
Chains
Sep 14, 2022
CN=Espressif Systems (Shanghai) Co.\, Ltd.,O=Espressif Systems (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Espressif Systems (Shanghai) Co.\, Ltd.,O=Espressif Systems (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN
Serial Number
0e:e8:0f:34:9a:92:8e:38:f2:12:7c:fd:14:08:78:91
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 23, 2019 - Oct 14, 2022
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
2
Major OS version
5
Entry point
41792
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
FreeLibrary
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
117KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=190, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=31328,
count=40, id=261, version=31328,
count=17, id=260, version=31328,
count=9, id=259, version=31328,
count=5, id=257, version=30795,
count=117, id=1, productName=Unmarked objects,
count=20, id=260, version=31332,
count=1, id=258, version=31332,
esptool.pyc
- SHA256 a74a2f61c10a0bdd7654ffb798b4526e75ec5840f3868971d2db90b5402362e9
- MD5 a6657e4537b54f6bebabfcf6340aa0a3
- SHA1 6cc1224faca3c6b82df39569061e38309650b488
- SHA512 cd53875fb0172760cb4f958eb2c40ce9ab83afdb1ef7be48a4c1e67208b8f529eb20bdfad4936cc1d725b0ccce5689c7ae4814f42368b43c25c73cafa8fb47aa
- TLSH T16BF0DC53412200F8F8D2BAB0B1220B529FD3B23C8704479F5A08AA3F8C281908C1470C
- MD5 SHA1 SHA512 TLSH
Wired/firmware.bin
- SHA256 b466c7d59e4d22a00b7df70e67883e32fc5408aec0f2628e3a46e3a05d1a106f
- MD5 bc6ca2ecdbd6d8a6d4d3394b00f01e11
- SHA1 8159edd89e20ed83205904a835a93c20140ccc36
- SHA512 58f96c006142be2953025100df7cb19096945b6c92737daef9b9b1d9d61caba866bd4568a57ae4e48f19d6ac1c1825bd88f91ea293300b191c9802302dfa8a57
- SSDEEP 49152:Kr0IlsyNgZK/FYO29gEvH6Uq7dkny1R6jRQ6bBO:pggg/h7dknyPmRvO
- TLSH T1B7F5F1063061585AE19748346AF15A113BB0DE0F924D4186B68C73BB4FB5FBCCEA76F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Wired/update_firmware.bat
- SHA256 9018d9dd9cbceebf989ca4c496fc039390b5ff63d4136ce613fdb7bdf239451d
- MD5 1ce782f513ca857dac4dd090eadf3c71
- SHA1 6876ecdf6fcfd65dd95e773574849a9308e5f3d7
- SHA512 342d1f8c7ef1ac88f28f428134ce0e789d7bcbfd11144f0ce19f7bd0d8890a0d6c6fd95e05702eb6a81e55b5ce3d6e5cb64dbb024a6da1cf01aae53de8d8a89f
- TLSH T196417562B105AA3543764441A8364BB4B33850D7D3229D4CA0DB703C39597E6B7BD0EE
- MD5 SHA1 SHA512 TLSH
Wired/update_firmware.sh
- SHA256 c5f0c3aa1eb5db4de07d4027989f3c66bfa6509efb3ee20b7bf1c47ea8c90d5b
- MD5 be9c0ec6c1f0584c2cbf1ddaf227d283
- SHA1 28d4981fa2dfa89fdebe75d14c24a246ae76bdf8
- SHA512 b027dce59bb5a91306dbe288f04259369ef88003b3ffe345348c414bbb5c4e01a02a4defe5effb2dbcf8b60a574a721836661d86d25a2aa8fc591a3203869d9a
- TLSH T1DE211EDBB268AB3517270030EC2717B47119448796A40E2C64CBB0BA36293D5FADD0FE
- MD5 SHA1 SHA512 TLSH
calib_uber.py
- SHA256 595b0a13d7a78b23caaa6a8012b686434ff2b634f9d920a7b4df86a9fb8786b1
- MD5 2ad1ece51e69bf8104d89771eb82f118
- SHA1 bc88d1d9d60d8790afdc1fb501a77826e5746dbe
- SHA512 c41f6ab2366a0c992d725e59b4abd7fcfdce84753e3606ce018f25d88dc2482fd2b2116dce540c6978f539dc89c3a9386ebc49a38a54dea79a11c378892b0260
- SSDEEP 96:lVIBJmydjkZGa/NBUdBlt43yWQUdlmQgWQU8X2ZTfmAy:auACfny
- TLSH T19A812F03DD58281593331818AA02E260FAA60217176365BEB5EC837D2F791A1D1EF9EF
- MD5 SHA1 SHA512 SSDEEP TLSH
esptool.exe
- IMPHASH 69eb46a9f63edcc604b0bdaaa8e0f2f5
- SHA256 62185730ea23a0fcf9d550692ae8203d8f130e7605507d20c45309e6904aa7df
- MD5 c47aac98ae3cfff1c3d825a44cf18576
- SHA1 a4736a0b13aa698f76fe7fb8c274141ec7d65811
- SHA512 6aca87cc3005b9958a83aa2e7876ccf1b5d5b0ce31e1ad7443ab82b4180ad2a26c1dbd2ca5017ff52db922c7d88fe8a7b5f48de9de358468fe06d9b450ba627b
- SSDEEP 196608:U9zjOCsXDjDyf/dJolpPgToa10/IUFOnJSi5IoWf:WzjOCEDCJ83a10QUs0gN+
- TLSH T1E7663347A58119E9E9F3653E88518702F6A67C37C712874F06A45237EE2B2B19F3B703
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4b:26:77:21:21:0b:3f:ef:fc:d6:4e:cd:5c:31:2e:05:82:68:5d:4e:26:fb:07:d0:7b:f3:13:34:0d:e6:95:5d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Espressif Systems (Shanghai) Co.\, Ltd.,O=Espressif Systems (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN
Chains
Sep 14, 2022
CN=Espressif Systems (Shanghai) Co.\, Ltd.,O=Espressif Systems (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Espressif Systems (Shanghai) Co.\, Ltd.,O=Espressif Systems (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN
Serial Number
0e:e8:0f:34:9a:92:8e:38:f2:12:7c:fd:14:08:78:91
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 23, 2019 - Oct 14, 2022
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
2
Major OS version
5
Entry point
41792
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
FreeLibrary
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
117KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=190, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=31328,
count=40, id=261, version=31328,
count=17, id=260, version=31328,
count=9, id=259, version=31328,
count=5, id=257, version=30795,
count=117, id=1, productName=Unmarked objects,
count=20, id=260, version=31332,
count=1, id=258, version=31332,
esptool.pyc
- SHA256 a74a2f61c10a0bdd7654ffb798b4526e75ec5840f3868971d2db90b5402362e9
- MD5 a6657e4537b54f6bebabfcf6340aa0a3
- SHA1 6cc1224faca3c6b82df39569061e38309650b488
- SHA512 cd53875fb0172760cb4f958eb2c40ce9ab83afdb1ef7be48a4c1e67208b8f529eb20bdfad4936cc1d725b0ccce5689c7ae4814f42368b43c25c73cafa8fb47aa
- TLSH T16BF0DC53412200F8F8D2BAB0B1220B529FD3B23C8704479F5A08AA3F8C281908C1470C
- MD5 SHA1 SHA512 TLSH
firmware.bin
- SHA256 b466c7d59e4d22a00b7df70e67883e32fc5408aec0f2628e3a46e3a05d1a106f
- MD5 bc6ca2ecdbd6d8a6d4d3394b00f01e11
- SHA1 8159edd89e20ed83205904a835a93c20140ccc36
- SHA512 58f96c006142be2953025100df7cb19096945b6c92737daef9b9b1d9d61caba866bd4568a57ae4e48f19d6ac1c1825bd88f91ea293300b191c9802302dfa8a57
- SSDEEP 49152:Kr0IlsyNgZK/FYO29gEvH6Uq7dkny1R6jRQ6bBO:pggg/h7dknyPmRvO
- TLSH T1B7F5F1063061585AE19748346AF15A113BB0DE0F924D4186B68C73BB4FB5FBCCEA76F2
- MD5 SHA1 SHA512 SSDEEP TLSH
ota_filesystem.bin
- SHA256 5ef735496f99f6623979486a8c867e61435af902c37dbd8874149aec8cd9b067
- MD5 41dce6b6b8f440b04813b8679a56691a
- SHA1 72ec35e4b1de66da0e5a0f1acc3ceb359155f3df
- SHA512 c274e2e5dab9b719b1d96895d2cdb5709b2bbc4f3c2c2dd3b4041e10cc43069bb1b387a1fd08f5cf83c2d4e280ad1624939bddfe92b8a369fa8172717f3961a8
- SSDEEP 12288:3pz780nmvdknyRbPxoFQRoYkj4eVe7Ohbg41BnNiEByGJH6Os1zmtoTR:Svdkny1R6jR7M6ie6Os1amTR
- TLSH T1C215D01375E10532E21798785ABB7E023B246E03E60A9444F49C72DA6FBCD24C97B7F9
- MD5 SHA1 SHA512 SSDEEP TLSH
ota_main.bin
- SHA256 25fc05df29c8bb822f7853cac4ae1c219112d3f6de7fb5b756b0fc8ecf47dbd5
- MD5 3419fd10b38db3e6f8d3d9512aa338cc
- SHA1 11d7d7d1feb773997a7e99d25576d7c6844ee7ff
- SHA512 055d47a2721aec00542a8858706059d7f9a9e5a66dd4398d75ef349a2111b8c26a5b5895c1e6bd50334890a067d88732b693d5eca785f00750ee178a331fc635
- SSDEEP 24576:Pr0md1c18/r5FEy+K9XQwhYzK/FYO/+9gE2Ugs6Uqlg:Pr0IlsyNgZK/FYO29gEvH6UqO
- TLSH T1CA25D0195011EC9EF5E75930AAD0426976B0DA8E928D4187B68C733B4F42BBC0F976F3
- MD5 SHA1 SHA512 SSDEEP TLSH
ota_support.bin
- SHA256 1e4ddb7946deb6b4958ed755afd7d8542bd494943f6c84cafc271c623021c35d
- MD5 e38feba9a8689ea7d33a7c0450831312
- SHA1 27654ff92504dbbd6e8a3435eeea6bf095ce8187
- SHA512 9347bd064e78f11cc020b30ba42adb14c852e17aa97cb8b5c07e57c34810d8662d472f06a8119d333e1d8e69132aae5e6068db258f0ec2fb1f79ed57c301974c
- SSDEEP 384:O3o/JbSv6OpUheR7Y3pJM71Osk07YQvkQ/npUhAd1gWOGj0H0LY6SBf:OYgi1hU7Y3p3sk07YEkQRkAd9OMFrSt
- TLSH T139B2AE2E141B27C6E62752B952F8C2404EEA060B73319C1503E8FD763B711AA7E196CF
- MD5 SHA1 SHA512 SSDEEP TLSH
uberlogger-prog.bat
- SHA256 fb63aec649c519fdf04c631fc5bcbb2d8811ad7d1af233d37efd2cbf1df0e26e
- MD5 f438136ab97cc18112437c9c42b246d6
- SHA1 857660a36febb9805ea1d1c313636a2055f19c4a
- SHA512 8d2b44b1978ea540baaf61303b7c3f819e6fef4afef0fb3bae2f7426030fab53ccfdd6f7f0e72c48d43193d4963036f89f40e2b46d77e7e427d5b0a41d9b2278
- TLSH T1C5214581E105C5B9B34602027D192DEDF259A15FCB81580E24CB67AC63A5FB0E97F1E5
- MD5 SHA1 SHA512 TLSH