usbdeview-x64.zip
- SHA256 1acfeaac8352313a607d2aa55a8a56e3662054ccf0bb05fc1eb909e1159152db
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
USBDeview.chm
Resource
win11-20260911-en
windows11-21h2-x64
1 signatures
60 seconds
Behavioral task
behavioral2
Sample
USBDeview.exe
Resource
win11-20260911-en
windows11-21h2-x64
5 signatures
60 seconds
General
- Target usbdeview-x64.zip
- Size 124KB
- Sample261024-al4y2aex9v
- SHA256 1acfeaac8352313a607d2aa55a8a56e3662054ccf0bb05fc1eb909e1159152db
- MD5 4757c96bf9d4feb1bc71f16bc37b9a32
- SHA1 8fb836b3d0b2b2d12e6d3d706330ce060bd0c339
- SHA512 d89ffaf26220d471779a263631e0aa6756c1a8cb483ef18b71bdeede060e3cd1c7eb52cf81aad731667cf2126fc5a3b90d623c36802d0f7a67b780e9c8d353be
- SSDEEP 3072:DRgzf7HY9/f75jkNi6ttLEDIFj5aUHdFLja2gOg:I7HWIWqj5/LGcg
- TLSH T18CC312C8247ABCBCE3C80A3154470823139B254F7F75B65AE55FA8B37DAB058079887A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack001/USBDeview.exe Nirsoft
File Explorer
-
usbdeview-x64.zip.zip 124KB
-
USBDeview.chm.chm 24KB
-
USBDeview.exe.exe 192KB
-
readme.txt43KB
USBDeview.chm
- SHA256 bbbc6ca7ac498ffaac06b8b71a4508628d6d21af465bc93e6d1a6c6844a805fa
- MD5 fc776429bb0abc9695c84c48911f3dea
- SHA1 b9ba2cb353443682c0f98632c8a7bdc8460eaf04
- SHA512 4bd409b13b0bd322b918feb0381f3df2da26a1bbd44ec3ba95278c80a36626f1686890fa5cb5f7e331315320a0f6277e74867804a388ecf2a1aa61480d33ab9d
- SSDEEP 384:8zoFWDWtVSnVqXId0fDIrnVg/fQVebJ8t1l/tgN64xWYK:8zfDqVi+IFrK/fjJGl/QC
- TLSH T16BB2D0A1B230853DC417917FAF84A886DB6CF4B1D831178A73A7810DEAAEDCD99C7481
- MD5 SHA1 SHA512 SSDEEP TLSH
USBDeview.exe
- IMPHASH 0ca732aa2f0b1bbb2736fa8cce06852e
- SHA256 57f7cedd6bc0be6adc9a4816a5893bc42fd0c6b05ee993fe24e86d36975e0c20
- MD5 47dcf62390925838511422da7543614f
- SHA1 4c3ba6133c5e17439915b7288d954ab4fb4c448c
- SHA512 327b4fa63aa3216ba436cf74a5224247d2795c35e18197c8f123d37dab2c6b5524ee324657686301775dc0eec482f7127a59e3b6a7c418d2d5812cbeeed30f5a
- SSDEEP 3072:z51/nUN6gFRi8nzOPxzUwKUVpfVgqgxPp/mTwtvIJd6du23sjMZ1PUP7g84oavMj:FsDiWyt97mdT3iy1PU1GK
- TLSH T1E3144915A3F800A9E4ABE675CEB28623EAB17C541B34872F0770DD6A0F27350FD25726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
Digest
ca:b4:ce:0c:1f:59:31:48:89:2f:6e:15:46:47:da:d9:57:17:4a:dc:16:1c:26:48:0a:a1:29:ed:6a:c9:0d:43
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
Chains
Sep 8, 2023
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
Serial Number
f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 9, 2019 - Sep 9, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 12, 2019 - Dec 31, 2028
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 3, 2023 - Aug 2, 2034
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
131504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\Projects\VS2005\USBDeview\x64\Release\USBDeview.pdb
msvcrt
__getmainargs
_acmdln
exit
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
_onexit
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
__dllonexit
_mbsrchr
atol
_strlwr
_mbsicmp
qsort
_mbschr
memmove
_strnicmp
strrchr
strchr
strcmp
strtoul
malloc
free
_strcmpi
modf
_memicmp
memcmp
srand
rand
abs
_strupr
_itoa
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memcpy
strlen
_purecall
_stricmp
_snprintf
atoi
strcpy
memset
strcat
strncat
sprintf
comctl32
ImageList_Add
CreateToolbarEx
ImageList_SetImageCount
ImageList_Create
ImageList_AddMasked
ord6
ws2_32
socket
WSASetLastError
closesocket
send
WSAAsyncSelect
WSAAsyncGetHostByName
connect
inet_addr
htonl
WSAGetLastError
htons
bind
WSAStartup
WSACleanup
kernel32
Process32Next
OpenProcess
SetEnvironmentVariableA
GetCurrentThreadId
DeviceIoControl
GetStartupInfoA
GetProcAddress
CreateToolhelp32Snapshot
Process32First
GetCurrentProcess
ExitProcess
GetCurrentProcessId
ReadProcessMemory
ExpandEnvironmentStringsA
CreateProcessA
Sleep
FreeLibrary
WinExec
GetComputerNameA
GetModuleFileNameA
GetLastError
CompareFileTime
GetPrivateProfileStringA
SystemTimeToFileTime
GetModuleHandleA
FileTimeToSystemTime
LoadLibraryA
GetDiskFreeSpaceExA
GetLogicalDrives
GetWindowsDirectoryA
GetDriveTypeA
ReadFile
FlushFileBuffers
CloseHandle
DeleteFileA
CreateThread
CreateFileA
GetTickCount
WriteFile
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
GetDateFormatA
GetTempPathA
LocalFree
GetSystemDirectoryA
GetTempFileNameA
GetFileSize
LoadLibraryExA
GlobalAlloc
GlobalLock
WideCharToMultiByte
MultiByteToWideChar
GetTimeFormatA
GlobalUnlock
GetFileAttributesA
GetVersionExA
FormatMessageA
GetPrivateProfileIntA
WritePrivateProfileStringA
EnumResourceNamesA
GetStdHandle
SetErrorMode
user32
EnumWindows
GetWindowThreadProcessId
SetForegroundWindow
AttachThreadInput
GetMessageA
GetSysColorBrush
ShowWindow
LoadCursorA
SetTimer
ReleaseDC
GetDC
SetCursor
SetDlgItemInt
BeginPaint
GetWindow
GetClientRect
SetDlgItemTextA
DrawFrameControl
GetDlgItemTextA
SetWindowTextA
GetSystemMetrics
DeferWindowPos
SendDlgItemMessageA
GetWindowRect
GetDlgItemInt
EndDialog
GetDlgItem
CreateWindowExA
EndPaint
InvalidateRect
DefWindowProcA
TranslateAcceleratorA
MessageBoxA
GetWindowPlacement
SendMessageA
RegisterClassA
UpdateWindow
PostMessageA
SetMenu
LoadAcceleratorsA
SetWindowPos
LoadImageA
GetSysColor
GetWindowLongA
SetWindowLongA
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
GetWindowTextA
CheckMenuRadioItem
MoveWindow
OpenClipboard
CheckMenuItem
GetMenu
EmptyClipboard
EnableMenuItem
InsertMenuItemA
GetMenuItemCount
GetParent
SetClipboardData
GetMenuStringA
EnableWindow
MapWindowPoints
GetSubMenu
GetCursorPos
GetClassNameA
CloseClipboard
LoadMenuA
LoadStringA
ModifyMenuA
DialogBoxParamA
GetDlgCtrlID
DestroyMenu
CreateDialogParamA
DestroyWindow
EnumChildWindows
GetMenuItemInfoA
CreatePopupMenu
LoadIconA
SetMenuItemInfoA
GetKeyState
TranslateMessage
IsDialogMessageA
KillTimer
DrawTextExA
InsertMenuA
RegisterWindowMessageA
TrackPopupMenu
DispatchMessageA
PostQuitMessage
RemoveMenu
ChildWindowFromPoint
gdi32
GetTextExtentPoint32A
CreateCompatibleBitmap
SetTextColor
StretchBlt
GetStockObject
SetBkColor
GetPixel
GetObjectA
DeleteObject
SetBkMode
GetDeviceCaps
CreateFontIndirectA
CreateCompatibleDC
SelectObject
SetPixel
SetStretchBltMode
DeleteDC
comdlg32
ChooseFontA
FindTextA
GetSaveFileNameA
advapi32
RegCreateKeyA
OpenSCManagerA
ControlService
QueryServiceStatus
RegCloseKey
StartServiceA
ChangeServiceConfigA
OpenServiceA
CloseServiceHandle
RegLoadKeyA
RegUnLoadKeyA
RegConnectRegistryA
RegEnumKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegDeleteKeyA
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptCreateHash
CryptAcquireContextA
shell32
SHGetFileInfoA
ShellExecuteExA
ShellExecuteA
Shell_NotifyIconA
ole32
CoCreateInstance
Name
.text
Size
126KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=12, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=337, id=1, productName=Unmarked objects,
count=21, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=33, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
readme.txt
- SHA256 9fa6af4c7fcb16067801e7e9a873922f9ebe9bb689b97b026b84f2fb1e54daf7
- MD5 ff67c85ff3adb6325bcc107fe5f38c99
- SHA1 cbf296a87d84cde46366c2839a10e027f84507fe
- SHA512 4a744bb159797db7ca1551f5347ccb05bd01e08560e9f7a0237c873a7cf1ad948b3498aa962d2384c9ff361b6de7f5a15bbfee7a8325d140f5e5930b2b99a66d
- SSDEEP 768:rcWOs4u2DFLa8JIOec08VsZ8F+rj/Wyjrc9JxbjTAz4aNx8i85Hlraz8sq89UHNu:oWOs4NDFLa8JIOec08VsZ8F+rj/WyjAM
- TLSH T13913B80622072730053301E22F0D7697F37A52AE57650AE4B8B9C16C6F36395E7F79EA
- MD5 SHA1 SHA512 SSDEEP TLSH