285b569d3dd62efff18213f3fb90528f24d8d5decffd71f1b3fad76ffd10e33d

General

Target
285b569d3dd62efff18213f3fb90528f24d8d5decffd71f1b3fad76ffd10e33d
Size 1.4MB
Sample260722-rjs77aff68
SHA256 285b569d3dd62efff18213f3fb90528f24d8d5decffd71f1b3fad76ffd10e33d
MD5 f972a76e74d7b41b5b0a4b0bd4fc6ade
SHA1 c017b1199b68ef345ed3d8029cadc816435b1fbc
SHA512 5ccbb3fe262162ca197c0ef0ccd5582de4001ba25076e0c3f3540734bf46046d512d2a8fd46f3adc0edbf07bc60a2ac8e0f4f7164ba642d372f8416602c239b6
SSDEEP 12288:82QUbq3TbLqyapYCjQuvFDFF4WP+/abps:JQxQYCv+JSbm
TLSH
T17865C40FB71BC136D09902B19D1663A274B696B76B349887FBC0AB4D98F09D4CD0BB53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
285b569d3dd62efff18213f3fb90528f24d8d5decffd71f1b3fad76ffd10e33d

File Explorer

285b569d3dd62efff18213f3fb90528f24d8d5decffd71f1b3fad76ffd10e33d

.dll 1.4MB

285b569d3dd62efff18213f3fb90528f24d8d5decffd71f1b3fad76ffd10e33d

IMPHASH 13c4f926f4d41f959cf51160b24d5523
SHA256 285b569d3dd62efff18213f3fb90528f24d8d5decffd71f1b3fad76ffd10e33d
MD5 f972a76e74d7b41b5b0a4b0bd4fc6ade
SHA1 c017b1199b68ef345ed3d8029cadc816435b1fbc
SHA512 5ccbb3fe262162ca197c0ef0ccd5582de4001ba25076e0c3f3540734bf46046d512d2a8fd46f3adc0edbf07bc60a2ac8e0f4f7164ba642d372f8416602c239b6
SSDEEP 12288:82QUbq3TbLqyapYCjQuvFDFF4WP+/abps:JQxQYCv+JSbm
TLSH
T17865C40FB71BC136D09902B19D1663A274B696B76B349887FBC0AB4D98F09D4CD0BB53
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

kernel32

CloseHandle CreateFileA DeleteCriticalSection DeleteFileA DeviceIoControl EnterCriticalSection EnumCalendarInfoA ExitProcess FileTimeToDosDateTime FileTimeToLocalFileTime FindClose FindFirstFileA FreeEnvironmentStringsA FreeLibrary GetACP GetCPInfo GetCommandLineA GetCurrentThreadId GetDiskFreeSpaceA GetEnvironmentStrings GetFileAttributesA GetFileType GetLastError GetLocalTime GetLocaleInfoA GetModuleFileNameA GetModuleHandleA GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetStringTypeExA GetStringTypeW GetThreadLocale GetTickCount GetTimeZoneInformation GetVersion GetVersionExA GlobalMemoryStatus HeapAlloc HeapFree InitializeCriticalSection InterlockedDecrement InterlockedIncrement LCMapStringA LeaveCriticalSection LoadLibraryA LoadLibraryExA LocalAlloc LocalFree MultiByteToWideChar RaiseException RtlUnwind SetConsoleCtrlHandler SetFilePointer SetHandleCount SetLastError TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualQuery WideCharToMultiByte WriteFile lstrcpynA lstrlenA

user32

CharNextA EnumThreadWindows GetKeyboardType GetSystemMetrics LoadStringA MessageBoxA wsprintfA

oleaut32

SysFreeString

@SMIGenEraseFail$qppvp9_ADDRINFO17System@AnsiString @SMIGenProgramFail$qppvp9_ADDRINFO17System@AnsiString @SMIGenReadFail$qppvp9_ADDRINFO17System@AnsiString @SMIPrepareEraseFail$qppvucp9_ADDRINFO17System@AnsiString @SMIPrepareProgramFail$qppvucp9_ADDRINFO17System@AnsiString @SMIPrepareReadFail$qppvucp9_ADDRINFO17System@AnsiString @SMIValidateEraseFail$qppvp9_ADDRINFO17System@AnsiString @SMIValidateProgramFail$qppvp9_ADDRINFO17System@AnsiString @SMIValidateReadFail$qppvp9_ADDRINFO17System@AnsiString _SMIChkVarifyMode _SMIDistinguishES _SMIFlushCache _SMIGenEraseFail _SMIGenProgramFail _SMIGenRdUNC _SMIGenReadFail _SMIGetSWPtestDllVersion _SMIGreyBoxLogOpt _SMIHostReadData _SMIHostWriteData _SMIInitSWPtestDLL _SMIPBA2LBA _SMIPreRdUNC _SMIPreUGSDProgFlash _SMIPrepareEraseFail _SMIPrepareProgramFail _SMIPrepareReadFail _SMIPretestClearSystemBlock _SMIPretest_CheckRDT_Report _SMIPretest_CheckSorting_Report _SMIProgFlashPage _SMIPtestAnalysisBadBlock _SMIPtestAnalysisRDTReport _SMIPtestB0kbProgSorting _SMIPtestB0kbProgSortingEx _SMIPtestCalculateInfoBlkBufSize _SMIPtestCheckRetry _SMIPtestCheckRunMode _SMIPtestChkGPIOSetting _SMIPtestChkProgTime _SMIPtestCompareCheckSum _SMIPtestDRAMLoadDgISP _SMIPtestDownloadISP _SMIPtestDownloadMPISP _SMIPtestDriveReset _SMIPtestDumpSysBlock _SMIPtestEraseAll _SMIPtestFlashConnectivityTest _SMIPtestGenBadBlockBitMap _SMIPtestGenDiffAddrTable _SMIPtestGenDummyWorstBlockStatus _SMIPtestGenInfoBlkBuf _SMIPtestGetBadBlkCnt _SMIPtestGetBlockStatus _SMIPtestGetDumpRuntimeBadStatus _SMIPtestGetDumpTotalBlockStatus _SMIPtestGetFlashId _SMIPtestLoadDgISP _SMIPtestProgramDummyAll _SMIPtestRdRetryTab _SMIPtestReadDriveInfo _SMIPtestRebuildSysIndex _SMIPtestSRamTest _SMIPtestSaveInfoBlock _SMIPtestSetCardMode _SMIPtestSetChCeMap _SMIPtestSetDiskCapacity _SMIPtestSetDriveSerialNumber _SMIPtestSetSystemBlockAndBoundaryBlock _SMIPtestShallowEraseFix _SMIPtestTranAdj _SMIPtestTranDriveSettingTableToParamTable _SMIPtestTranRTC _SMIReadCIDTable _SMIReadFlashID _SMIReadIDTable _SMIReadMPInfo _SMIReadRunBadBlk _SMIReadSmart _SMIReadVndrCmd _SMIResetSmart _SMIScanSMIDrive _SMISetCmdLogPath _SMISetPassThroughType _SMITranLBA2PBA _SMITrigerUGSD _SMITriggerGc _SMITrimCmd _SMIValRdUNCBadInfo _SMIValRdUNCCorrectable _SMIValRdUNCDoReclain _SMIValRdUNCPopClr _SMIValRdUNCTlcChg _SMIValidateEraseFail _SMIValidateProgramFail _SMIValidateReadFail _SMIValidateUGSDProgFlash _SMIWriteMPInfo _SMIWriteMPInfoEx _SMIWriteVndrCmd _SMI_Erase_Phy_block _SMI_Program_Phy_Page _SMI_Read_Phy_Page ___CPPdebugHook

Name

.text

Size

448KB

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

910KB

Virtual Size

912KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

285b569d3dd62efff18213f3fb90528f24d8d5decffd71f1b3fad76ffd10e33d

advapi32

kernel32

user32

oleaut32

generic