42a12c89198f8613836ecd762296c3738196d0873a310a971b48d76728a32134

General

Target
42a12c89198f8613836ecd762296c3738196d0873a310a971b48d76728a32134
Size 680KB
Sample260722-rmtywswfnc
SHA256 42a12c89198f8613836ecd762296c3738196d0873a310a971b48d76728a32134
MD5 445e86deb58dcfc33aa4802ccab9bdbc
SHA1 c232268ae959faf13de76dda7c1f38248fad012f
SHA512 20432c54e54f9029f5a2d049e53fe019ddf288f3306ac7efa176a1150bbf362997d764991fb9edb7b9a0e0377888e2f66e6741f6ec2ace9b6300a64c39b8e7b7
SSDEEP 12288:d2QUbqkFbLqyapYCjQuvFDFF4WP+/ak999BjvrEH7fDW:wQxrYCv+JSknTrEH7fDW
TLSH
T12DE4F60FB70AC276D09902B1AD1573A274B696772B359887FBC0AB4C98F49D4CD0BB53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42a12c89198f8613836ecd762296c3738196d0873a310a971b48d76728a32134

File Explorer

42a12c89198f8613836ecd762296c3738196d0873a310a971b48d76728a32134

.dll 680KB

42a12c89198f8613836ecd762296c3738196d0873a310a971b48d76728a32134

IMPHASH 13c4f926f4d41f959cf51160b24d5523
SHA256 42a12c89198f8613836ecd762296c3738196d0873a310a971b48d76728a32134
MD5 445e86deb58dcfc33aa4802ccab9bdbc
SHA1 c232268ae959faf13de76dda7c1f38248fad012f
SHA512 20432c54e54f9029f5a2d049e53fe019ddf288f3306ac7efa176a1150bbf362997d764991fb9edb7b9a0e0377888e2f66e6741f6ec2ace9b6300a64c39b8e7b7
SSDEEP 12288:d2QUbqkFbLqyapYCjQuvFDFF4WP+/ak999BjvrEH7fDW:wQxrYCv+JSknTrEH7fDW
TLSH
T12DE4F60FB70AC276D09902B1AD1573A274B696772B359887FBC0AB4C98F49D4CD0BB53
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

kernel32

CloseHandle CreateFileA DeleteCriticalSection DeleteFileA DeviceIoControl EnterCriticalSection EnumCalendarInfoA ExitProcess FileTimeToDosDateTime FileTimeToLocalFileTime FindClose FindFirstFileA FreeEnvironmentStringsA FreeLibrary GetACP GetCPInfo GetCommandLineA GetCurrentThreadId GetDiskFreeSpaceA GetEnvironmentStrings GetFileAttributesA GetFileType GetLastError GetLocalTime GetLocaleInfoA GetModuleFileNameA GetModuleHandleA GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetStringTypeExA GetStringTypeW GetThreadLocale GetTickCount GetTimeZoneInformation GetVersion GetVersionExA GlobalMemoryStatus HeapAlloc HeapFree InitializeCriticalSection InterlockedDecrement InterlockedIncrement LCMapStringA LeaveCriticalSection LoadLibraryA LoadLibraryExA LocalAlloc LocalFree MultiByteToWideChar RaiseException RtlUnwind SetConsoleCtrlHandler SetFilePointer SetHandleCount SetLastError TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualQuery WideCharToMultiByte WriteFile lstrcpynA lstrlenA

user32

CharNextA EnumThreadWindows GetKeyboardType GetSystemMetrics LoadStringA MessageBoxA wsprintfA

oleaut32

SysFreeString

@SMIGenEraseFail$qppvp9_ADDRINFO17System@AnsiString @SMIGenProgramFail$qppvp9_ADDRINFO17System@AnsiString @SMIGenReadFail$qppvp9_ADDRINFO17System@AnsiString @SMIPrepareEraseFail$qppvucp9_ADDRINFO17System@AnsiString @SMIPrepareProgramFail$qppvucp9_ADDRINFO17System@AnsiString @SMIPrepareReadFail$qppvucp9_ADDRINFO17System@AnsiString @SMIValidateEraseFail$qppvp9_ADDRINFO17System@AnsiString @SMIValidateProgramFail$qppvp9_ADDRINFO17System@AnsiString @SMIValidateReadFail$qppvp9_ADDRINFO17System@AnsiString _SMIChkVarifyMode _SMIDistinguishES _SMIFlushCache _SMIGenEraseFail _SMIGenProgramFail _SMIGenRdUNC _SMIGenReadFail _SMIGetSWPtestDllVersion _SMIGreyBoxLogOpt _SMIHostReadData _SMIHostWriteData _SMIInitSWPtestDLL _SMIPBA2LBA _SMIPreRdUNC _SMIPreUGSDProgFlash _SMIPrepareEraseFail _SMIPrepareProgramFail _SMIPrepareReadFail _SMIPretestClearSystemBlock _SMIPretest_CheckRDT_Report _SMIPretest_CheckSorting_Report _SMIProgFlashPage _SMIPtestAnalysisBadBlock _SMIPtestAnalysisRDTReport _SMIPtestB0kbProgSorting _SMIPtestB0kbProgSortingEx _SMIPtestCalculateInfoBlkBufSize _SMIPtestCheckRetry _SMIPtestCheckRunMode _SMIPtestChkGPIOSetting _SMIPtestChkProgTime _SMIPtestCompareCheckSum _SMIPtestDRAMLoadDgISP _SMIPtestDownloadISP _SMIPtestDownloadMPISP _SMIPtestDriveReset _SMIPtestDumpSysBlock _SMIPtestEraseAll _SMIPtestFlashConnectivityTest _SMIPtestGenBadBlockBitMap _SMIPtestGenDiffAddrTable _SMIPtestGenDummyWorstBlockStatus _SMIPtestGenInfoBlkBuf _SMIPtestGetBadBlkCnt _SMIPtestGetBlockStatus _SMIPtestGetDumpRuntimeBadStatus _SMIPtestGetDumpTotalBlockStatus _SMIPtestGetFlashId _SMIPtestLoadDgISP _SMIPtestProgramDummyAll _SMIPtestRdRetryTab _SMIPtestReadDriveInfo _SMIPtestRebuildSysIndex _SMIPtestSRamTest _SMIPtestSaveInfoBlock _SMIPtestSetCardMode _SMIPtestSetChCeMap _SMIPtestSetDiskCapacity _SMIPtestSetDriveSerialNumber _SMIPtestSetSystemBlockAndBoundaryBlock _SMIPtestShallowEraseFix _SMIPtestTranAdj _SMIPtestTranDriveSettingTableToParamTable _SMIPtestTranRTC _SMIReadCIDTable _SMIReadFlashID _SMIReadIDTable _SMIReadMPInfo _SMIReadRunBadBlk _SMIReadSmart _SMIReadVndrCmd _SMIResetSmart _SMIScanSMIDrive _SMISetCmdLogPath _SMISetPassThroughType _SMITranLBA2PBA _SMITrigerUGSD _SMITriggerGc _SMITrimCmd _SMIValRdUNCBadInfo _SMIValRdUNCCorrectable _SMIValRdUNCDoReclain _SMIValRdUNCPopClr _SMIValRdUNCTlcChg _SMIValidateEraseFail _SMIValidateProgramFail _SMIValidateReadFail _SMIValidateUGSDProgFlash _SMIWriteMPInfo _SMIWriteMPInfoEx _SMIWriteVndrCmd _SMI_Erase_Phy_block _SMI_Program_Phy_Page _SMI_Read_Phy_Page ___CPPdebugHook

Name

.text

Size

448KB

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

121KB

Virtual Size

912KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

42a12c89198f8613836ecd762296c3738196d0873a310a971b48d76728a32134

advapi32

kernel32

user32

oleaut32

generic