USBDeview.zip
- SHA256 24083d85facf4e01f4c44527030d94ce0d4169a9fdb5c50708a1351bc56768df
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
USBDeview.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral2
Sample
USBDeview.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
General
- Target USBDeview.zip
- Size 7.4MB
- Sample261024-qcmldsfa43
- SHA256 24083d85facf4e01f4c44527030d94ce0d4169a9fdb5c50708a1351bc56768df
- MD5 f4f3d77ee968ab67d2d7466a9294ed1f
- SHA1 6d84c7debbd1520e7a207be51fa29025b074952c
- SHA512 0fe197c1fe3181e01ada503e0ac6e3e202b2188f144c669b99870c18dd790c2761298446621b68df83e038bc50b027e6c85836dd357ac51db01459f31ec71a56
- SSDEEP 196608:FD7C4YBauTxkctHBqq9pWqzKYr7qfMKkBCWGmeLP6rzfA/nN92:lOXjtntHBqq9pWwKYnq0KkgW3a6rzqNQ
- TLSH T14676339940BAD9688D23103292E7EB83089C4B44E6956DD3B7618CE8F7F33D12D6719F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/USBDeview.exe
File Explorer
-
USBDeview.zip.zip 7.4MB
-
USBDeview.exe.exe 18.9MB
USBDeview.exe
- IMPHASH 452107fcaf9fb28ffdc35f708ad996cf
- SHA256 fd59bf7746f6f93c2279e9dd6d971ea9f9f42608b3f41ee25672a4c20f4a83aa
- MD5 bd77e6282cf7e9294f9e4ec587bdb96c
- SHA1 2dc14ee7e4350d6096d8950a0cb607dbdaafc808
- SHA512 c197dbe507f2e4398e03b691c2747d9272489ed39a42dbd5bc72b390dbda431cdf399f5c25a849ebb19d349044d539eb6a3ec510058e72e06d54b3173355019e
- SSDEEP 196608:eGLu6pRMBt1iH/3ueCrd2H7FoX1OMc8cAg4D:v+DoHfMrdCWlc8cAt
- TLSH T167177BB6AA4D6F5DF06A7076C0E38247A3F17C0D2775CF9B9AC05E63281F584B60960E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
371096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
kernel32
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
ReadFile
SizeofResource
FindFirstFileW
SetHandleInformation
FindNextFileW
GetCurrentProcess
WriteFile
VirtualAlloc
TerminateProcess
GetModuleFileNameW
CreatePipe
GetTempPathW
FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
OpenProcess
CreateToolhelp32Snapshot
Sleep
GlobalLock
OpenMutexA
Process32NextW
GetCurrentThread
LockResource
DeleteFileW
Process32FirstW
CloseHandle
GetActiveProcessorCount
LoadResource
FindResourceW
GetThreadContext
ExitProcess
GlobalMemoryStatusEx
CreateProcessW
GetConsoleWindow
SetThreadContext
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
GetCurrentThreadId
SleepConditionVariableSRW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSListHead
WideCharToMultiByte
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetSystemTimeAsFileTime
WakeAllConditionVariable
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
GetLastError
user32
DestroyWindow
GetWindowRect
EnumDisplayDevicesA
PostMessageW
DefWindowProcW
GetWindowLongW
ScreenToClient
UnregisterClassW
ClientToScreen
TrackMouseEvent
GetForegroundWindow
SetWindowRgn
SetCapture
CreateWindowExW
GetSystemMetrics
RegisterClassExW
GetKeyState
ShowWindow
DispatchMessageW
SetWindowLongA
PeekMessageW
MessageBoxA
MoveWindow
SetLayeredWindowAttributes
TranslateMessage
LoadIconW
PostQuitMessage
UpdateWindow
LoadCursorW
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
GetCapture
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
gdi32
CreateRoundRectRgn
advapi32
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
shell32
ShellExecuteW
msvcp140
_Thrd_detach
_Query_perf_counter
_Cnd_do_broadcast_at_thread_exit
?_Random_device@std@@YAIXZ
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
bcrypt
BCryptGetProperty
BCryptGenRandom
BCryptEncrypt
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptOpenAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptSetProperty
BCryptCreateHash
BCryptGenerateSymmetricKey
BCryptDestroyKey
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
winhttp
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpSendRequest
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpOpen
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
_CxxThrowException
__C_specific_handler
memmove
memcpy
memcmp
memchr
__current_exception_context
__current_exception
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
fflush
__stdio_common_vsprintf
__stdio_common_vsscanf
fseek
fread
__stdio_common_vfprintf
__p__commode
ftell
__acrt_iob_func
fwrite
_set_fmode
fclose
__stdio_common_vswprintf_s
_wfopen
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_register_thread_local_exe_atexit_callback
_c_exit
_invoke_watson
_exit
exit
_beginthreadex
_initterm_e
terminate
_initterm
_errno
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_initialize_onexit_table
_register_onexit_function
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-string-l1-1-0
strncmp
_wcsnicmp
strncpy
strncat_s
_wcsicmp
strcmp
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
free
api-ms-win-crt-convert-l1-1-0
atoi
strtoull
strtoll
strtod
api-ms-win-crt-time-l1-1-0
_time64
_mkgmtime64
api-ms-win-crt-math-l1-1-0
sqrtf
_dsign
powf
fmodf
__setusermatherr
sinf
cosf
ceilf
acosf
_dclass
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
Name
.text
Size
369KB
Virtual Size
369KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17.4MB
Virtual Size
17.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
612B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=31, id=261, version=35207,
count=6, id=257, version=35207,
count=20, id=257, version=33145,
count=7, id=156, version=21202,
count=261, id=1, productName=Unmarked objects,
count=8, id=265, version=35229,
count=1, id=255, version=35229,
count=1, id=151,
count=1, id=258, version=35229,