20261009115010[.]63B36CDEAD_8548[.]zip

Resubmissions

09/10/2026, 12:39

261009-pvsppaex6j6

09/10/2026, 12:31

261009-pqex2aba477

Sharing

Copy URL Twitter E-mail

General

Target
20261009115010.63B36CDEAD_8548.zip
Size 3.0MB
Sample261009-pqex2aba47
SHA256 9b17134136bf53492c98cedfbfc998693ea8bfb6ce7af08d0bf4176e4d6952d5
MD5 1ad044150511a2407f44a62d2cc76170
SHA1 fa5a81478dd683d887a7ac5107121dd0109c1210
SHA512 15af10a9af8ddf72410c1fb0d63c47037ae249de6109300353e3b817eacf2751fd1a436d782d3555e8827e5af9951b771b80f4910e158d5464f990da47100d7a
SSDEEP 49152:LNuBNbCNRIsc4QMTcgpYsydw8cz1GyrdKob1o/euCw49njoDjpv:LiCNqscXM4gRydwh5bRpO/6w49sDjpv
TLSH
T132E533506FC46565F7CE43330196BB65CECD242998FBF6ECDA17A01470AB0E13366A72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack002/RiMe.dlL
unpack002/odexl32.dll

File Explorer

20261009115010.63B36CDEAD_8548.zip

.zip 3.0MB
20261949114311.63B36C.vhd

.vhd 18.0MB
Q1949114311.exe

.exe 1.9MB
RiMe.dlL

.dll 3.4MB
System Volume Information/WPSettings.dat

12B
d5afc9d7-171f-4ab9-b039-5c7b7d3cce9d.pfx

8KB
odexl32.dll

.dll 9KB

20261009115010.63B36CDEAD_8548.zip

SHA256 9b17134136bf53492c98cedfbfc998693ea8bfb6ce7af08d0bf4176e4d6952d5
MD5 1ad044150511a2407f44a62d2cc76170
SHA1 fa5a81478dd683d887a7ac5107121dd0109c1210
SHA512 15af10a9af8ddf72410c1fb0d63c47037ae249de6109300353e3b817eacf2751fd1a436d782d3555e8827e5af9951b771b80f4910e158d5464f990da47100d7a
SSDEEP 49152:LNuBNbCNRIsc4QMTcgpYsydw8cz1GyrdKob1o/euCw49njoDjpv:LiCNqscXM4gRydwh5bRpO/6w49sDjpv
TLSH
T132E533506FC46565F7CE43330196BB65CECD242998FBF6ECDA17A01470AB0E13366A72
MD5 SHA1 SHA512 SSDEEP TLSH

Q1949114311.exe

IMPHASH 9071e050024b691ff30e815dde620015
SHA256 c74f55247aa2c72001024bd977c869cb5adce6f8604a4d32329f015b73ae2a49
MD5 711cd47d4524145f9c488afecc85ebc7
SHA1 2f9e5368c039db49018ec41bbb20a3b085788b24
SHA512 8bf03abb818d6d11f210e17a7e8c8f3c941774390cf0c5e679cb18331089341d43486cdc7af1203b29eac476f2f802f789f17ec6926d17fdd099d13172a79a15
SSDEEP 24576:DitHbptR5UngkbfXXqO7jiugTdtHxVAuN9AGFwzojqnIXxXi2+QV8epwMGqtc:WtR5UngkzvyPtHxWzojqnIXtl+NeBGqq
TLSH
T105953A203942C13EEA9113718D78EAFA565DAD102F35D1CF63987A6A3B78DC31933627
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

10:33:54:47:94:d3:a5:c7:af:79:f6:54:da:71:62:6e:db:62:86:30:a3:93:30:31:ae:9a:a8:7d:ee:32:d0:01

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91310120MA1HYANY1L,CN=卡饭（上海）信息安全有限公司,O=卡饭（上海）信息安全有限公司,POSTALCODE=201400,STREET=奉贤区金海公路6055号28幢1层,L=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Oct 12, 2021

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 3, 2014 - Dec 2, 2029

Subject

Serial Number

a6:02:b1:29:d0:4f:62:4e:59:28:95:91:74:86:02:95

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 5, 2020 - Nov 5, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

602197

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\gitlab\builds\aCoD4X3k\0\qingyun\qingyuninput\ivan\output\KafanInputService.pdb

imm32

ImmDisableIME

rime

RimeFreeStatus RimeGetStatus rime_get_api RimeConfigNext RimeConfigBeginMap RimeConfigGetString RimeConfigGetBool RimeConfigGetInt RimeGetProperty RimeSchemaOpen RimeConfigSetBool RimeConfigEnd RimeSetOption RimeDeleteCandidate RimeFixAtFirst RimeSetProperty RimeConfigSetInt RimeClearComposition RimeCommitComposition RimeIsKeyEaten RimeProcessKey RimeDestroySession RimeCreateSession RimeFindSession RimeFinalize RimeConfigOpen RimeStartMaintenance RimeInitialize RimeSetNotificationHandler RimeSetup RimeConfigGetCString RimeConfigClose RimeConfigSetString RimeUserConfigOpen RimeGetOption

kernel32

GetProcAddress LoadLibraryExW LoadResource SizeofResource FindResourceW LoadLibraryW LocalAlloc LocalFree lstrcmpiW IsBadWritePtr VerifyVersionInfoW MultiByteToWideChar CreateToolhelp32Snapshot Thread32First Thread32Next HeapAlloc HeapFree GetProcessHeap SetEvent CreateEventA CreateEventW FormatMessageW WideCharToMultiByte WaitForSingleObjectEx CreateMutexW GetModuleFileNameA FindResourceA LockResource InitializeCriticalSectionEx Sleep QueryPerformanceCounter QueryPerformanceFrequency WaitNamedPipeW SetNamedPipeHandleState CreateFileW WriteFile FlushFileBuffers DisconnectNamedPipe ReadFile CreateNamedPipeW ConnectNamedPipe GetModuleHandleExW SleepEx ExpandEnvironmentStringsW HeapSize HeapReAlloc HeapDestroy FileTimeToSystemTime SystemTimeToFileTime GetLocalTime GetTempPathW SetErrorMode GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW GetCurrentProcess GetExitCodeProcess Process32FirstW Process32NextW GetFileAttributesW DeleteFileW FindFirstFileW SetFileAttributesW FindNextFileW FindClose RemoveDirectoryW GetFileSize CopyFileW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceInitialize InitOnceExecuteOnce InitOnceBeginInitialize InitOnceComplete InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetTickCount64 GetModuleHandleA GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetTickCount TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread GetStringTypeW GetStartupInfoW ResetEvent TerminateProcess UnhandledExceptionFilter LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer WriteConsoleW OutputDebugStringW IsDebuggerPresent FreeLibrary UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualQuery GetVersionExW CreateProcessW ResumeThread SuspendThread OpenThread GetCurrentThreadId GetCurrentProcessId WaitForSingleObject LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetLastError SetUnhandledExceptionFilter CloseHandle CreateDirectoryW GetCommandLineW VerSetConditionMask DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException DecodePointer ReleaseSemaphore WaitForMultipleObjectsEx OpenEventA SetWaitableTimer GetSystemInfo GetLogicalProcessorInformation CreateWaitableTimerA RtlUnwind InterlockedFlushSList GetConsoleMode ReadConsoleW GetConsoleCP ExitProcess GetStdHandle CreateThread ExitThread FreeLibraryAndExitThread GetCurrentThread GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleCtrlHandler SetStdHandle SetFilePointerEx HeapQueryInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA SetEnvironmentVariableW GetTimeZoneInformation GetFileSizeEx GetModuleHandleW OpenProcess

user32

WindowFromPoint MoveWindow UpdateLayeredWindow ReleaseDC SystemParametersInfoW IsRectEmpty GetKeyState SendInput GetSystemMetrics UnregisterClassW DefWindowProcW DestroyWindow CharNextW wsprintfW SetWindowTextW PostQuitMessage MonitorFromWindow GetWindowThreadProcessId CloseDesktop OpenDesktopW AllowSetForegroundWindow WaitForInputIdle LoadStringW LoadCursorW GetDC IsWindow PostMessageW DispatchMessageW TranslateMessage GetMessageW SetWindowPos ScreenToClient GetMonitorInfoW EnableWindow ShowWindow GetDlgItem CallWindowProcW CreateWindowExW GetWindowLongW SetWindowLongW GetWindowRect GetClassInfoExW RegisterClassExW PeekMessageW

gdi32

GetObjectW CreateCompatibleDC SelectObject DeleteDC TextOutW

advapi32

BuildExplicitAccessWithNameW GetNamedSecurityInfoW ConvertSidToStringSidW CreateProcessAsUserW SetTokenInformation ConvertStringSidToSidW DuplicateTokenEx GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation OpenProcessToken RegSetKeySecurity AddAccessAllowedAce InitializeAcl GetLengthSid RegRestoreKeyW RegSaveKeyW RegEnumValueW RegQueryValueExW RegOpenKeyW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW ConvertStringSecurityDescriptorToSecurityDescriptorW SetEntriesInAclW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey GetUserNameW SetSecurityDescriptorSacl SetSecurityDescriptorDacl InitializeSecurityDescriptor GetSecurityDescriptorSacl FreeSid AllocateAndInitializeSid LookupAccountSidW GetAclInformation GetSecurityDescriptorDacl AdjustTokenPrivileges LookupPrivilegeValueW AccessCheck SetNamedSecurityInfoW IsValidSid GetSidIdentifierAuthority GetAce GetSidLengthRequired InitializeSid AddAce GetFileSecurityW DuplicateToken MapGenericMask

shell32

ord165 SHGetFolderPathW ShellExecuteW

ole32

CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoUninitialize CoCreateGuid

oleaut32

SysFreeString VarUI4FromStr

shlwapi

PathFileExistsW PathRemoveFileSpecW PathAppendW PathAddBackslashW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

RiMe.dlL

IMPHASH e6b81662ebc0527eb39e4d54d12656a8
SHA256 71774738fd6957b6e9efc344cd89b69918438d00b6d4d73560cb4ea430e9c05e
MD5 fdc82d4ff7e988fb58e185a404231908
SHA1 0dabd90d378eb00ac5a99b7ddf1f8a4d3e9138f3
SHA512 0cc8cda6a81463f5cc2a0486778b5eafa2b5c9cb72ca74b911007afba59c858f53bf12849c5394ed24ca7678e09c2f36a93f3f36cc1cedfb04f56831f0cdcbf5
SSDEEP 98304:+ifW4u9EvlxZ8lj+L569ywUn4XMNi6KsNAh00/vDp:LDyRKRi6KsNcH/vDp
TLSH
T148F5E1233DE580BAC25F02704A6F77AD76FDD1B14D3441A726C86F286DB09A2653CB63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1250858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\vmware-vdiskmanager\Release\vmware-vdiskmanager.pdb

kernel32

SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage SetFilePointerEx GetConsoleMode GetConsoleCP GetTimeZoneInformation GetFileType SetStdHandle QueryPerformanceFrequency VirtualQuery GetSystemInfo HeapQueryInformation GetCommandLineA FreeLibraryAndExitThread ExitThread InterlockedFlushSList RtlUnwind GetCPInfo GetStringTypeW LCMapStringW OutputDebugStringW WriteConsoleW GetACP InitializeSListHead VirtualAlloc HeapAlloc HeapFree DeleteCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection HeapCreate HeapDestroy CreateEventA CloseHandle WaitForSingleObject Sleep SetEvent FormatMessageW GetLastError GetCurrentThreadId SwitchToThread SetLastError CreateEventW CancelIo ResetEvent WideCharToMultiByte lstrlenW CreateWaitableTimerW SetWaitableTimer LoadLibraryW GetProcAddress TryEnterCriticalSection lstrcpyW lstrcatW WriteProcessMemory MultiByteToWideChar InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException DecodePointer GetProcessHeap CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileAttributesW CreateDirectoryW GetCurrentProcess SizeofResource LockResource LoadResource FindResourceW LocalFree LocalAlloc CreateFileW GetTickCount OpenProcess DeviceIoControl ExitProcess GetLocalTime SystemTimeToFileTime CreateMutexW GetModuleFileNameW CreateThread DeleteFileW GetTempPathW SetFileAttributesW CreateThreadpoolTimer SetThreadpoolTimer GetModuleHandleExW GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile WriteFile GetWindowsDirectoryW GetModuleHandleW CreateProcessW GetSystemDirectoryW CopyFileW GetStdHandle ResumeThread lstrlenA OpenMutexW GetCommandLineW GlobalAlloc GlobalSize GlobalLock GlobalUnlock GlobalFree MulDiv SetThreadPriority SuspendThread GetCurrentThread GetVersionExW FreeLibrary LoadLibraryExW GlobalDeleteAtom lstrcmpA lstrcmpW SetErrorMode OutputDebugStringA GetModuleHandleA InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalReAlloc GetCurrentProcessId GlobalGetAtomNameW FileTimeToSystemTime EncodePointer FreeResource LoadLibraryA GlobalAddAtomW GlobalFindAtomW GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW GetCurrentDirectoryW CompareStringW GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalFlags FindClose FindFirstFileW FlushFileBuffers GetFullPathNameW GetVolumeInformationW LockFile ReadFile SetEndOfFile SetFilePointer UnlockFile DuplicateHandle lstrcmpiW VirtualProtect FileTimeToLocalFileTime GetFileAttributesExW GetFileSizeEx GetFileTime SystemTimeToTzSpecificLocalTime FindResourceExW VerSetConditionMask VerifyVersionInfoW GetTempFileNameW GetProfileIntW SearchPathW WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime VirtualFree

user32

IsRectEmpty DrawFocusRect WindowFromPoint ReleaseCapture SetCapture GetNextDlgGroupItem LoadImageW TrackMouseEvent IntersectRect MapDialogRect GetAsyncKeyState GetNextDlgTabItem EndDialog CreateDialogIndirectParamW OffsetRect SetRectEmpty SendDlgItemMessageA InflateRect GetMenuItemInfoW DestroyMenu CharUpperW DestroyIcon FillRect GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW InvalidateRect KillTimer SetTimer RealChildWindowFromPoint GetDesktopWindow ClientToScreen DeleteMenu SetCursor ShowOwnedPopups SystemParametersInfoW CopyImage IsDialogMessageW SetWindowTextW CheckDlgButton MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo LoadIconW GetWindow GetTopWindow GetClassNameW GetClassLongW SetWindowLongW PtInRect EqualRect DrawIconEx MapWindowPoints ScreenToClient AdjustWindowRectEx GetWindowRect GetClientRect RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow RedrawWindow IsZoomed BeginPaint SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow TrackPopupMenu SetMenu GetMenu GetSystemMenu BringWindowToTop SetCursorPos PeekMessageW TranslateMessage DispatchMessageW MsgWaitForMultipleObjects UnregisterClassW GetCapture SetFocus GetDlgCtrlID GetDlgItem IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement SetWindowPos DestroyWindow IsChild IsMenu IsWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos RegisterWindowMessageW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetFocus GetWindowTextLengthW GetWindowTextW LoadCursorW GetIconInfo MessageBeep EnableScrollBar HideCaret InvertRect NotifyWinEvent CreatePopupMenu GetMenuDefaultItem MapVirtualKeyW GetKeyNameTextW LoadMenuW SetLayeredWindowAttributes EnumDisplayMonitors SetClassLongW SetWindowRgn SetParent OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW DrawEdge CopyRect DrawFrameControl DestroyAcceleratorTable MessageBoxW CharUpperBuffW GetMenuStringW GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu GetMessageW SendMessageW IsWindowVisible GetActiveWindow GetKeyState ValidateRect GetCursorPos SetWindowsHookExW CallNextHookEx PostMessageW PostQuitMessage UnhookWindowsHookEx EnableWindow IsWindowEnabled GetWindowLongW GetParent GetWindowThreadProcessId GetLastActivePopup GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush CopyIcon FrameRect DrawIcon UnionRect UpdateLayeredWindow MonitorFromPoint LoadAcceleratorsW TranslateAcceleratorW InsertMenuItemW UnpackDDElParam ReuseDDElParam GetComboBoxInfo PostThreadMessageW WaitMessage GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyCursor GetWindowRgn CreateMenu SubtractRect TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar GetUpdateRect IsClipboardFormatAvailable RegisterClipboardFormatW ModifyMenuW GetDoubleClickTime SetMenuDefaultItem LockWindowUpdate SetRect CopyAcceleratorTableW EndPaint

gdi32

GetTextFaceW GetViewportOrgEx GetWindowOrgEx SetPixelV SetPaletteEntries ExtFloodFill PtInRegion GetBoundsRect FrameRgn FillRgn RoundRect OffsetRgn GetRgnBox Rectangle LPtoDP CreateRoundRectRgn Polyline Polygon CreatePolygonRgn GetTextColor Ellipse CreateEllipticRgn SetDIBColorTable CreateDIBSection StretchBlt SetPixel GetTextCharsetInfo EnumFontFamiliesW CreateDIBitmap CreateCompatibleBitmap GetBkColor RealizePalette GetSystemPaletteEntries GetPaletteEntries GetNearestPaletteIndex CreatePalette EnumFontFamiliesExW GetTextMetricsW DPtoLP SetRectRgn PatBlt CreateRectRgnIndirect CombineRgn GetTextExtentPoint32W CreateFontIndirectW ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW MoveToEx SetTextAlign SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetStockObject GetPixel GetObjectType GetClipBox ExcludeClipRect Escape DeleteDC CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateCompatibleDC BitBlt DeleteObject GetObjectW SetTextColor SetBkColor CreateBitmap GetDeviceCaps CreateDCW CopyMetaFileW

msimg32

TransparentBlt AlphaBlend

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

SystemFunction036 RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegDeleteTreeW RegCreateKeyExW DeleteService ControlService QueryServiceStatusEx StartServiceW OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW CheckTokenMembership FreeSid EqualSid AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation OpenProcessToken RegCreateKeyW RegQueryValueExW RegCloseKey RegSetValueExW RegDeleteValueW RegOpenKeyExW

shell32

ShellExecuteExW SHGetFileInfoW ShellExecuteW SHGetPathFromIDListW SHGetSpecialFolderLocation SHAppBarMessage SHBrowseForFolderW SHGetFolderPathW DragFinish DragQueryFileW SHGetDesktopFolder

shlwapi

PathFindExtensionW PathFindFileNameW PathIsUNCW PathStripToRootW PathRemoveFileSpecW PathFileExistsW StrFormatKBSizeW

uxtheme

DrawThemeText GetThemePartSize GetThemeSysColor IsThemeBackgroundPartiallyTransparent IsAppThemed DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName GetWindowTheme

ole32

CreateStreamOnHGlobal CoInitializeEx IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor DoDragDrop OleGetClipboard CoLockObjectExternal RegisterDragDrop RevokeDragDrop OleLockRunning CoCreateInstance CoDisconnectObject CoCreateGuid ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CoUninitialize CoGetObject CoInitialize

oleaut32

SysStringLen SystemTimeToVariantTime VariantTimeToSystemTime SysAllocStringLen VariantClear VariantCopy VariantChangeType VarBstrFromDate VariantInit SysAllocString LoadTypeLi SysFreeString

ws2_32

WSASetLastError shutdown WSACloseEvent WSAResetEvent WSAEnumNetworkEvents WSAWaitForMultipleEvents WSAEventSelect WSACreateEvent WSAGetLastError send recv select WSAIoctl connect htons gethostbyname socket closesocket setsockopt WSACleanup WSAStartup

winmm

PlaySoundW timeGetTime

ntdll

RtlInitUnicodeString

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

gdiplus

GdipGetImagePalette GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown

imm32

ImmGetContext ImmGetOpenStatus ImmReleaseContext

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

335KB

Virtual Size

334KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.用户�

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

odexl32.dll

IMPHASH 2c3b0cac134b40a3a4df70bc93f96cdf
SHA256 74d8dfb194538138159fa1b00f2df8b4c4fdc30f1cd54598053fdc3a2db40473
MD5 089c7b11c735aad9f9a9a14f4fe78729
SHA1 a09615267e274a9650ef600d68b073a6632b68e5
SHA512 f65c177d84cf26337de14fde5e1e134f3185559e4fbd79b9b0e2237712aa92cefa29a143886d7e398afafd322a49a68bfa94c7428173d873f6b4dbdfde0bf313
SSDEEP 96:3ZKGVqxbUERHAi1e4owcbswog++2TpsmzoNwStpl/CtEWqqWwxWj7W:JKGVqjjo4PmsddXxSLl/7WqqWhj
TLSH
T17912B746B76449A6F7DE1BB534BEAB27223D7D340FB151D35992220D3868DC2ACB1322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

odexl32.pdb

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

20261009115010.63B36CDEAD_8548.zip

20261949114311.63B36C.vhd

Q1949114311.exe

imm32

rime

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

generic

RiMe.dlL

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

ws2_32

winmm

ntdll

oleacc

gdiplus

imm32

generic

System Volume Information/WPSettings.dat

d5afc9d7-171f-4ab9-b039-5c7b7d3cce9d.pfx

odexl32.dll

msvcrt

kernel32

odbcjt32

generic