PlayPcSpeaker101.zip
- SHA256 6a64094788e70896a3076b81eef17414337b2472c755b08b92e26561c2e693cf
Behavioral task
behavioral1
Sample
InstallDriver.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
InstallDriver.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
PlayPcSpeaker.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
PlayPcSpeaker.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
inpout32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
inpout32.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target PlayPcSpeaker101.zip
- Size 1.5MB
- Sample260723-erwbaswsgs
- SHA256 6a64094788e70896a3076b81eef17414337b2472c755b08b92e26561c2e693cf
- MD5 6aefabfc7a823cb10388512eb933c303
- SHA1 8954beb7be15fb9ceccda2254f5e03575cb374b7
- SHA512 980bdba0da9775a749249f1761985af4326536ef071d87e606a909b28ea15a6eedcb93e61dd268d56aa3ac1162e5fd3a90047f96437b4ad34aac8bc963888189
- SSDEEP 24576:DSNuqGiAXJhExj/M7wzg2tZbVcbPf6EFFKUYaVv221HVIlaLxww5tlc/9DXIzN4O:DMfkJSBEog2trcb6EFFK3yva0Cw5byA
- TLSH T1D47533F804C75752DE8AE41C03FE23699BB15BDC04B14AFE576A877E312A066D6CD8C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/PlayPcSpeaker.exe upx - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/InstallDriver.exe unpack001/PlayPcSpeaker.exe unpack002/out.upx unpack001/inpout32.dll
File Explorer
-
PlayPcSpeaker101.zip.zip 1.5MB
-
Beatles - Girl.wav2.3MB
-
InstallDriver.exe.exe 48KB
-
PlayPcSpeaker.exe.exe 210KB
-
out.upx.exe 429KB
-
inpout32.dll.dll 96KB
Beatles - Girl.wav
- SHA256 ce73d23f0604d80d04b58c00c6e0a4ff6cafe7785e2a4d7ce76224a1512a705e
- MD5 7a1dfa330159a383777e74b2e45e5297
- SHA1 722e46aac1c547fdb4471b77674e55bc889b6160
- SHA512 099b0b0fad376b0231640b477c087185ffab84eca769408cfd37e4bcaa2e221f125190ffe099249c14adafed158e63ed922fca1e63d41d44f57af8b4970b6692
- SSDEEP 49152:RbzUlPHX7+9+nmO+l+WU63QyOODS68xCcLFBEanKREBKXTqsq:m+YOfu
- TLSH T1B0B5E8E7504CC19D539FE8A1AE1E99D2EE05A071E788F07F91483CA754A63CA5C8CBC7
- MD5 SHA1 SHA512 SSDEEP TLSH
InstallDriver.exe
- IMPHASH 87cea554f9cb4b282bb296a63949bda0
- SHA256 2f6cef951a937f898ff24bc6adcdffb321b55fd3d21769ca9580e0233bbeed5a
- MD5 f25a0a82ad1eefd4becd6f034c078dbc
- SHA1 75c1063c318bd528b90e8a29bfc419beb1d35654
- SHA512 5d16a06664a22d95b4a9c553608456e1e9499c72db3fa76e429e3e3da83c9af589fa76f0b66c867976d71b26c4c6d5cc67afb1d0861af3751852368e5d7c7e3b
- SSDEEP 768:zsfqbtPnPlt0RBNxamrr1A081ZadarUq3XEOgbtwg:FbFP/0D3DriT18w1etwg
- TLSH T13523180A3893C033E41649B586E58AC15FFF7C133AF3A06FEF84454E1AA129899797F5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4811
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
e:\My Documents\Visual Studio 2005\Projects\inpout32_source_and_bins\Inpout32_dll_source\Win32\Release\InstallDriver.pdb
inpout32
ord10
ord3
user32
MessageBoxW
kernel32
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
Name
.text
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=16, id=125, productName=VS2005 build 50727, version=50727,
count=25, id=110, productName=VS2005 build 50727, version=50727,
count=75, id=109, productName=VS2005 build 50727, version=50727,
count=4, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=81, id=1, productName=Unmarked objects,
count=2, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
PlayPcSpeaker.exe
- SHA256 d19d7f55100996253d83928277a5a4fc6cc4782096c72fbe9af1e1c0266bf1e6
- MD5 8b6573379e7728822ae5b3b0ddd93f35
- SHA1 c943d523f5cc3a78c04dd566bda850d43cd30908
- SHA512 a5c94f196a9a7b1ed05351afe64802a9b9a2008b8c3e9dd1e3576b2bb3df37aa77a0ea57c49ce372d1cfe2dd2f88d68e8e8f1300711218faef7eff54a0206077
- SSDEEP 3072:JlWsZ13gbrWEoorwVKd9we/rj18fl4GKy6yTM2UgDlCqMw7cD7:ysngbCEHrw0Aew2GKaMAD/c
- TLSH T14724F857B2CA3E50C2B415FD710FBFB99451C923AC25E280E7BF5B43D5B8F0022A656A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
100470992
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
95.6MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
205KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 983aa9ef4f8cd2f016e436e112c610f33f25562f0c856a18dec2d8c0f6063fc7
- MD5 3f81d1cf40224d4207ef88fc56a8a2a4
- SHA1 7607d3a625c69b9e4ee3549d2fd6951c5680e72c
- SHA512 db8cc23bf3565d43e31e223c9f962f2a21c37dbd987d371cff547c2a59c44caf401fc9d741e8d95aecb3da0876958319655776111f0d218d6dd26473ff69557b
- SSDEEP 6144:H5zd0U2lHeHxv7BQbg2QoaU5XP88L3EbvZe+wKLZHqdgA9uYP4ZCAZy2l:Bd0U2VeHxjyDJ88csYLZAPMCAZl
- TLSH T1D8945C66B2E18537D1732A39DC0B46A4AC36BE913E246C473BF91D4CDF39781352A293
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
375244
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
363KB
Virtual Size
362KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
95.4MB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
inpout32.dll
- IMPHASH c7b2fa58ffd099e5f335c337d3bb6689
- SHA256 01bcec6ddb4964e1f5b69ba1bd3876221d8de7ae17cacfac66f095013434a78f
- MD5 c1ccde650bf91a3b1d07dc5494d4276f
- SHA1 8062e3a853769d4c8235d30b30ca97cb200b1479
- SHA512 83c3ad41ab7b35e7116208dbda9fc65ad6203f5922c3ec5e840b0c54c5d2c47127564c0ec88b3445d5563fa39cca0ac62a6ca5603118e317523ae822d06e897c
- SSDEEP 1536:o/Y+Lhxv0hDuC0+5/CH8KM3xtGQI0jqSG0jVf:ozL7E/fhtGQwSR
- TLSH T11BA37D527650C0B6E896463650AAC713AA7BFD402FE9C0C73BA6068D5E513F17B3E30B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8649
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileA
LockResource
LoadResource
FindResourceA
SizeofResource
GetCurrentProcess
GetVersionExA
GetProcAddress
GetModuleHandleA
WriteFile
GetLastError
DeviceIoControl
OutputDebugStringA
GetSystemDirectoryA
CloseHandle
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
FlushFileBuffers
advapi32
StartServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
OpenServiceA
DlPortReadPortUchar
DlPortReadPortUlong
DlPortReadPortUshort
DlPortWritePortUchar
DlPortWritePortUlong
DlPortWritePortUshort
GetPhysLong
Inp32
IsInpOutDriverOpen
IsXP64Bit
MapPhysToLin
Out32
SetPhysLong
UnmapPhysicalMemory
Name
.text
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=125, productName=VS2005 build 50727, version=50727,
count=94, id=109, productName=VS2005 build 50727, version=50727,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=97, id=1, productName=Unmarked objects,
count=33, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,