029630e55b8f8ebec21e51813925b947fd2f3c94b530e90cbf96c084a37e4a9e

Sharing

Copy URL Twitter E-mail

General

Target
029630e55b8f8ebec21e51813925b947fd2f3c94b530e90cbf96c084a37e4a9e
Size 4.8MB
Sample261017-nd9q7sys2p
SHA256 029630e55b8f8ebec21e51813925b947fd2f3c94b530e90cbf96c084a37e4a9e
MD5 79ba9046798a23989d9a702aa929efb5
SHA1 973bfb4b969c3a122f108d550e89e67d782c2036
SHA512 0985e01e1944ca9cf39b797978744cffe6dea0b0b5210840fd61e93a64fd75d72ce2494169447925230a0c4e83ad7ce71c5c50c150da6e155494dd1cf532723e
SSDEEP 98304:zpYUJ/TZS4M4IIXOIVhC8xuDcNZUn41Ag+eqfNo3BbLgRAgeJAwSVhPB4:zKUJ/TZS4M4IIXOIVhC8xuDcNK41Ag+H
TLSH
T181368C22EB56C025E4BF0AF5E4BE63BF89347A30033894E3D7885D599971AD0B93570B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
029630e55b8f8ebec21e51813925b947fd2f3c94b530e90cbf96c084a37e4a9e

File Explorer

029630e55b8f8ebec21e51813925b947fd2f3c94b530e90cbf96c084a37e4a9e

.dll 4.8MB

029630e55b8f8ebec21e51813925b947fd2f3c94b530e90cbf96c084a37e4a9e

IMPHASH 71c31d186b758b6fce322317cf5c7279
SHA256 029630e55b8f8ebec21e51813925b947fd2f3c94b530e90cbf96c084a37e4a9e
MD5 79ba9046798a23989d9a702aa929efb5
SHA1 973bfb4b969c3a122f108d550e89e67d782c2036
SHA512 0985e01e1944ca9cf39b797978744cffe6dea0b0b5210840fd61e93a64fd75d72ce2494169447925230a0c4e83ad7ce71c5c50c150da6e155494dd1cf532723e
SSDEEP 98304:zpYUJ/TZS4M4IIXOIVhC8xuDcNZUn41Ag+eqfNo3BbLgRAgeJAwSVhPB4:zKUJ/TZS4M4IIXOIVhC8xuDcNK41Ag+H
TLSH
T181368C22EB56C025E4BF0AF5E4BE63BF89347A30033894E3D7885D599971AD0B93570B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2611392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\home\mtk14060\AutoScriptBackup\Project\WCP2_CleanRoom\DA\Download_Agent_Main\Raphael-lib\_Output\windows\Release\FlashtoollibEx.pdb

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

kernel32

CancelIo PurgeComm QueryPerformanceFrequency CloseHandle GetModuleFileNameA GetComputerNameExA GetLocalTime GetVersionExA GetTickCount InterlockedIncrement InterlockedDecrement LeaveCriticalSection InterlockedExchange EscapeCommFunction InterlockedExchangeAdd TlsAlloc TlsFree GetProcAddress LoadLibraryA WaitForMultipleObjects GetFileSizeEx WaitForSingleObjectEx GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcess CreateSemaphoreA ReleaseSemaphore DuplicateHandle GetOverlappedResult ReadFile CreateEventA SetCommTimeouts SetCommState WriteFile GetProcessHeap SetEvent HeapFree QueryPerformanceCounter GetCommState ClearCommError HeapAlloc CreateFileA SetupComm lstrcpyA GetModuleHandleA GetLastError SetFilePointerEx ClearCommBreak CreateThread EnterCriticalSection GetEnvironmentVariableW GetStringTypeExW GetStringTypeExA SetWaitableTimer CreateWaitableTimerA GetSystemInfo ResumeThread OpenEventA ResetEvent AreFileApisANSI GetFullPathNameW GetWindowsDirectoryW GetDiskFreeSpaceExW MoveFileExW SetFileAttributesW SetFileTime GetFileTime GetFileAttributesExW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CopyFileW CreateDirectoryExW GetFileAttributesW OutputDebugStringA GetModuleHandleExW InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedCompareExchange SetLastError TlsGetValue TlsSetValue DeleteFiber WideCharToMultiByte MultiByteToWideChar GetModuleHandleW GetVersion GetFileType GetStdHandle ConvertFiberToThread GetCurrentProcessId FreeLibrary LoadLibraryW FindNextFileW FindFirstFileW FindClose GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW ExitThread Sleep InitializeCriticalSection GetLocaleInfoA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW GetCPInfo FileTimeToSystemTime FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe SetConsoleCtrlHandler GetTimeFormatA GetDateFormatA GetCommandLineA RtlUnwind RaiseException WriteConsoleW ExitProcess GetDriveTypeA FindFirstFileA HeapValidate IsBadReadPtr LCMapStringA LCMapStringW GetStringTypeW CompareStringW CompareStringA GetACP GetOEMCP IsValidCodePage DebugBreak OutputDebugStringW GetStringTypeA SetStdHandle SetHandleCount GetStartupInfoA GetTimeZoneInformation FlushFileBuffers GetConsoleCP SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree GetCurrentDirectoryA GetFullPathNameA HeapSize HeapReAlloc VirtualAlloc IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetLocaleInfoW WriteConsoleA GetConsoleOutputCP VirtualQuery SetEnvironmentVariableA CreateFileW SetEndOfFile WaitForMultipleObjectsEx FormatMessageA LocalFree RemoveDirectoryW DeleteFileW DeviceIoControl

user32

RegisterClassExA GetMessageA PostQuitMessage SendMessageA CreateWindowExA DefWindowProcA DispatchMessageA UnregisterDeviceNotification RegisterDeviceNotificationA LoadStringA MessageBoxW GetUserObjectInformationW GetProcessWindowStation LoadStringW

setupapi

SetupDiGetClassDescriptionA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailA SetupDiGetDeviceRegistryPropertyA SetupDiGetDeviceInstanceIdA SetupDiEnumDeviceInfo SetupDiGetClassDevsA

secur32

GetUserNameExA

ws2_32

WSACleanup ntohs htons htonl ntohl WSAStartup WSAGetLastError closesocket recv WSASetLastError send

advapi32

CryptEnumProvidersW CryptDestroyKey CryptGetProvParam CryptAcquireContextW CryptGetUserKey CryptExportKey CryptDestroyHash CryptSignHashW CryptSetHashParam CryptCreateHash CryptDecrypt DeregisterEventSource ReportEventW RegisterEventSourceW CryptGenRandom CryptReleaseContext

crypt32

CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertDuplicateCertificateContext

_flashtool_clear_last_errmsg@4 _flashtool_connect_brom_with_handle@20 _flashtool_customize_impl@8 _flashtool_efuse_read_all@8 _flashtool_efuse_write_all@8 _flashtool_generate_gpx@12 _flashtool_is_chiptype_match@20 _flashtool_set_last_errmsg@8 _flashtool_trans_modem_type@12 _meta_start_boot_mode@28 flashtool_cleanup flashtool_connect_brom flashtool_connect_da flashtool_create_session flashtool_create_session_with_handle flashtool_destroy_session flashtool_device_control flashtool_download flashtool_download_cert flashtool_enable_dram flashtool_firmware_update flashtool_format flashtool_format_partition flashtool_generate_checksum flashtool_get_com_handle flashtool_get_device_info flashtool_get_hrid flashtool_get_last_errmsg flashtool_get_lib_info flashtool_get_rpmb_status flashtool_get_rsc_cnt flashtool_get_rsc_info flashtool_get_scatter_info flashtool_if_lib_da_match flashtool_image_checksum flashtool_memory_test flashtool_otp_zone_operation flashtool_pl_chanllenge flashtool_query_tracking_status flashtool_read_partition_table flashtool_readback flashtool_reconnect_com flashtool_set_boot_flag flashtool_set_log_folder flashtool_set_log_level flashtool_set_rsc_info flashtool_set_scatter_path flashtool_set_ufs_config flashtool_shutdown_device flashtool_startup flashtool_switch_com flashtool_tell_device_change_com flashtool_test flashtool_upgrade flashtool_upload flashtool_waitfor_com flashtool_write_data get_revised_scatter_partitions

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

941KB

Virtual Size

940KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

60KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

229KB

Virtual Size

229KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

029630e55b8f8ebec21e51813925b947fd2f3c94b530e90cbf96c084a37e4a9e

version

kernel32

user32

setupapi

secur32

ws2_32

advapi32

crypt32

generic