362_sa-streammemfix.rar
- SHA256 77515dd44db30c989e86a0013442894dd5379bf851463e19eed7dcb0f76a888b
Overview
overview
7Static
static
7StreamMemFix1.0.dll
windows10-2004-x64
3StreamMemFix1.0.dll
windows11-ltsc_2024-x64
3StreamMemF...t1.dll
windows10-2004-x64
3StreamMemF...t1.dll
windows11-ltsc_2024-x64
3StreamMemF...t2.dll
windows10-2004-x64
3StreamMemF...t2.dll
windows11-ltsc_2024-x64
3vorbisFile.dll
windows10-2004-x64
3vorbisFile.dll
windows11-ltsc_2024-x64
3vorbisHooked.dll
windows10-2004-x64
3vorbisHooked.dll
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
StreamMemFix1.0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
StreamMemFix1.0.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
StreamMemFix2.2_test1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
StreamMemFix2.2_test1.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
StreamMemFix2.2_test2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
StreamMemFix2.2_test2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
vorbisFile.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
vorbisFile.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
vorbisHooked.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
vorbisHooked.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 362_sa-streammemfix.rar
- Size 67KB
- Sample260723-pkafcsck71
- SHA256 77515dd44db30c989e86a0013442894dd5379bf851463e19eed7dcb0f76a888b
- MD5 0b0368c8b7e471b2a69a4b54c13f11d0
- SHA1 097f921cccbd1849ef0232a41ee6604a005fe05e
- SHA512 638b96476d52cf078f2f5993d6774264e666b8c57952da300391e955c1627de587db0b4ff98878a88aedb9568ae605406f34b95496fb1509d97c726fe27c01d4
- SSDEEP 1536:9cmn4cGtiA/uilLSFkCbzOwgjps2BtPVP8L32LQnEqN0/ZeYqEk6:2mn4RuenCPqCuDPC2Y/N0ZeYqc
- TLSH T1F7630295ABF126191C0DF16558A7897CB1902166BEDCF8873C23934D05032AC76F7FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule static1/unpack001/StreamMemFix1.0.asi aspack_v212_v242 static1/unpack001/StreamMemFix2.2_test1.asi aspack_v212_v242 static1/unpack001/StreamMemFix2.2_test2.asi aspack_v212_v242 -
resource yara_rule static1/unpack001/StreamMemFix1.0.asi upx static1/unpack001/StreamMemFix2.2_test1.asi upx static1/unpack001/StreamMemFix2.2_test2.asi upx - Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/StreamMemFix1.0.asi unpack001/StreamMemFix2.2_test1.asi unpack001/StreamMemFix2.2_test2.asi unpack001/vorbisFile.dll unpack001/vorbisHooked.dll
File Explorer
-
362_sa-streammemfix.rar.rar 67KB
-
ReadMe(eng).txt656B
-
ReadMe(rus).txt865B
-
StreamMemFix1.0.asi.dll 27KB
-
StreamMemFix2.2_test1.asi.dll 27KB
-
StreamMemFix2.2_test2.asi.dll 27KB
-
vorbisFile.dll.dll 3KB
-
vorbisHooked.dll.dll 64KB
ReadMe(eng).txt
- SHA256 a1e445852cf5d75c82023756f9b848a36a4928eac0246c5a8e32d4650146b15a
- MD5 8f6421cf7423856725a48089c3dc9a1b
- SHA1 ff5c6f10a739ac9b06a6ef46362de140155aeb4e
- SHA512 55e75d9be16843f126291152a38cdf6166bd711d98666e2ba19ee6dfd9e0e7e9bc81e7c2c6a422df200304cd9900b711010022531c6254e13d76b0315ef2e2e7
- TLSH T1A6F099921E6F9731A170876C6F326912DB2E82B8FB6A5580B24E80552B450941E78E5E
- MD5 SHA1 SHA512 TLSH
ReadMe(rus).txt
- SHA256 508b1fa6eb22ef04e3dc614f87ab2e1479c27a822d5ae1fa78960e66d873ae87
- MD5 a3bb4f3f9777551d4e3d4e81bef4334a
- SHA1 dc2a256cb3f527001e55f2043fa6d8b3d90da42f
- SHA512 98af2d748f2700ef5e0d13c7bad52b6c0c562d2b7ab70e6827a66dd4d67e7f33f6f7fbde69d7dfc788cbc1652b8865212f5d0753f24322f9d8faff31396ad234
- TLSH T1E511EBCA0DAA15B4E5B29A3885A79A8388B0065DEC52E144F56FC61C6B714B02CBCF0E
- MD5 SHA1 SHA512 TLSH
StreamMemFix1.0.asi
- SHA256 ef4b0fa41f332799d656c2c0c2143de5199840811da32b12e690e24e02c044b2
- MD5 f786108b7accebf37dc8c8fd25b563ff
- SHA1 c9b31bee2e2b9377e319bcad247bff03db68a49a
- SHA512 9149b46cc9280246b405c952b31a8140ec63a7cd094ee63e038ce3a168393538094138a5d78358b4d3269ecce570ea994d8a0448d0b23164ceeb940544708a6b
- SSDEEP 384:OhvLkR7KUxJhBgxzCpFdVsYdNKhENFp7wj/TTRXMsW0vl3n1gV/gAj/hRQASAxhl:OxkpK2JhjXLsYTKhEF8R8q1sFNxsdeV
- TLSH T104C2E071BF1045FBD4C500BA358D54E86106E9FB94292AFB03A052793E6F1ECD8D9AF2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57345
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
16KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DATA
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
StreamMemFix2.2_test1.asi
- SHA256 3c2ed3be9864638fed76ad0f8bb49ee50330f0929eec98c81d087ead8e80843d
- MD5 a917a25fe7776edb2108babde2b2ed06
- SHA1 60775769b710219e2fe8e547fbbdbfcb3ed3149b
- SHA512 006a68d3cd5f3416f315c9dfe4fa4f845bd157aa4deda6b4d9bbf676ae2d1b1227f027364a7d26d79d4682b9c64ea08fbe73a8ea3e6d50c78c2e6e073b56ed25
- SSDEEP 768:IxkpK2JhjXLsY4oh7rUyGWKdK5bNxqdeV:Ts2vjXgY4oqyG7K5b2
- TLSH T1FFC2E1767F40C4B6C4C934F579C4848C2268EEB2967345E643B002BD3C5A25EDEA1DF2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57345
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
16KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DATA
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
StreamMemFix2.2_test2.asi
- SHA256 9197acee833019a8831875dd5e4876883e312921b00a37815d6777c5be481e67
- MD5 2872feff1a2452bb311c6be71bc455e2
- SHA1 a72614207db166f122a14d0bac66974c859c51b4
- SHA512 49c415c6543d3251f6642de005c5a812a5515510a3682c0dc56f6b5fbfa13d9a8aba8d351e9c265c909a2789742762342b7ca6c3d4a5ba8839290066389c2d0a
- SSDEEP 768:IxkpK2JhjXLsYGe0kbwHvgdK5fNxqdeV:Ts2vjXgYEkkHvmK5f2
- TLSH T153C2D0767A4184BBC8C438B5A7D844D4B268E976953B0AE302B146BE3E6E158DD08DF2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57345
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
16KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DATA
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
vorbisFile.dll
- IMPHASH 43f206c7235be665fafb28cd2be8e9d2
- SHA256 9430580cdebdc5d87bfaba3c02a078a8a5ebce2d95672662cc5c285ca87e9c4e
- MD5 7d4d29c853202c99cb083ed9e96300c9
- SHA1 1893e8f6b01c671ba68e513399d70702ce744893
- SHA512 d112ac1b7ab723ffc60e6e6c3339612abc6678832c48d5f65abbe8ff647a67776a743dcbdf06c334189b9bb95ca5bd91ded1e2817f4106fe594d1d1d38687adf
- TLSH T19251779B3F55EC72C38C03B71C8326F9236B81144B6200C70B16EB54686ABD2D67B643
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4480
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadLibraryA
FreeLibrary
FindClose
FindNextFileA
FindFirstFileA
GetProcAddress
ov_clear
ov_info
ov_open_callbacks
ov_read
ov_time_seek
ov_time_tell
ov_time_total
Name
.text
Size
512B
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
416B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
280B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
122B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=1, productName=Unmarked objects,
count=3, id=19, version=8034,
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
vorbisHooked.dll
- IMPHASH 8ec5f91b35a203372803c35e3faa6597
- SHA256 a08923479000cec366967fb8259e0920b7aa18859722c7dda1415726bed4774f
- MD5 2b7b803311d2b228f065c45d13e1aeb2
- SHA1 905d33aa70ad00d513c701cce22ad6fdb9d7d463
- SHA512 7468757cca02c948b1d1d838b3f9f64fc8b52b6f6b5c1458dc1c915f9194403af8cb3ab94f3d5089bafaae77bdd0be3dba86e07894a832b25bf0247ccd412a9f
- SSDEEP 768:RG9mqQnM6D5cmIc33qTRP8XV/+EVFnnU/iB9Zfe4MtoZAo4CsRTJ0v:Rum/Xd7qTRkX0E7J1CtoK
- TLSH T18853AE22A8E2C1F3D189023508A55B3BDB3D5D1617D2A9E38F58DE851F705A3E63B30B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19608
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ogg
ogg_sync_clear
ogg_stream_init
ogg_sync_wrote
ogg_sync_buffer
ogg_sync_init
ogg_stream_packetout
ogg_stream_pagein
ogg_stream_reset_serialno
ogg_page_serialno
ogg_sync_pageseek
ogg_sync_reset
ogg_page_granulepos
ogg_page_eos
ogg_stream_reset
ogg_page_continued
ogg_stream_packetpeek
ogg_stream_clear
vorbis
vorbis_synthesis_headerin
vorbis_block_clear
vorbis_comment_init
vorbis_info_clear
vorbis_comment_clear
vorbis_info_init
vorbis_packet_blocksize
vorbis_synthesis_halfrate
vorbis_synthesis_halfrate_p
vorbis_synthesis_restart
vorbis_synthesis_read
vorbis_synthesis_pcmout
vorbis_synthesis_blockin
vorbis_synthesis_trackonly
vorbis_info_blocksize
vorbis_block_init
vorbis_synthesis_init
vorbis_synthesis
_analysis_output_always
vorbis_synthesis_lapout
vorbis_window
vorbis_dsp_clear
kernel32
RtlUnwind
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
InterlockedIncrement
InterlockedDecrement
FlushFileBuffers
SetStdHandle
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
GetCurrentProcess
TerminateProcess
GetModuleHandleA
GetProcAddress
RaiseException
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
VirtualAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
CloseHandle
ReadFile
ov_bitrate
ov_bitrate_instant
ov_clear
ov_comment
ov_crosslap
ov_halfrate
ov_halfrate_p
ov_info
ov_open
ov_open_callbacks
ov_pcm_seek
ov_pcm_seek_lap
ov_pcm_seek_page
ov_pcm_seek_page_lap
ov_pcm_tell
ov_pcm_total
ov_raw_seek
ov_raw_seek_lap
ov_raw_tell
ov_raw_total
ov_read
ov_read_float
ov_seekable
ov_serialnumber
ov_streams
ov_test
ov_test_callbacks
ov_test_open
ov_time_seek
ov_time_seek_lap
ov_time_seek_page
ov_time_seek_page_lap
ov_time_tell
ov_time_total
Name
.text
Size
40KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=21, id=14, version=7299,
count=110, id=1, productName=Unmarked objects,
count=2, id=19, version=8034,
count=94, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=6, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,