ps5-dump-forge-0[.]3[.]1-windows-x86-64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
ps5-dump-forge-0.3.1-windows-x86-64.zip
Size 8.4MB
Sample261027-3va2jaws7p
SHA256 40febc9e121facee34d518638300a4989b1c9d6860c37915efe005619f03e62d
MD5 d7747edb9baf8e8b655208623bee3ee3
SHA1 ff1fadb0fa269e95c1e388c6aa3358b1f874e4f8
SHA512 2446a0ac467fdfef81c2690695537d6b13630227f870d9fca3856e8bbe1b7ea442a84fe14c02322d300c4b7a24ddf811d0697d71ce211eeea41e042a14d3d068
SSDEEP 196608:3fk3Z18JjRs9Mln8hbamIZGU7DU0tdKzAfbx2VJBs8bHbi9r+mbavXMkC:3yHotxN8hW97DU0taNh97b+MX5C
TLSH
T1FC96331EC33226BAD2A365012517F4B2ACF8A079ECCC64F5274065AAFF4749B48BD5D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ps5-dump-forge-0.3.1-windows-x86-64/PS5 Dump Forge.exe
unpack001/ps5-dump-forge-0.3.1-windows-x86-64/ps5-dump-forge.exe

File Explorer

ps5-dump-forge-0.3.1-windows-x86-64.zip

.zip 8.4MB
ps5-dump-forge-0.3.1-windows-x86-64/PS5 Dump Forge.exe

.exe 15.4MB
ps5-dump-forge-0.3.1-windows-x86-64/ps5-dump-forge.exe

.exe 7.3MB

ps5-dump-forge-0.3.1-windows-x86-64.zip

SHA256 40febc9e121facee34d518638300a4989b1c9d6860c37915efe005619f03e62d
MD5 d7747edb9baf8e8b655208623bee3ee3
SHA1 ff1fadb0fa269e95c1e388c6aa3358b1f874e4f8
SHA512 2446a0ac467fdfef81c2690695537d6b13630227f870d9fca3856e8bbe1b7ea442a84fe14c02322d300c4b7a24ddf811d0697d71ce211eeea41e042a14d3d068
SSDEEP 196608:3fk3Z18JjRs9Mln8hbamIZGU7DU0tdKzAfbx2VJBs8bHbi9r+mbavXMkC:3yHotxN8hW97DU0taNh97b+MX5C
TLSH
T1FC96331EC33226BAD2A365012517F4B2ACF8A079ECCC64F5274065AAFF4749B48BD5D3
MD5 SHA1 SHA512 SSDEEP TLSH

ps5-dump-forge-0.3.1-windows-x86-64/PS5 Dump Forge.exe

IMPHASH 1a001cb84de7dc9e9acc367c56b0a684
SHA256 b105e48925c37e9dec7994f91b79c516edbec08c5c95c84e4765f13184a684da
MD5 32dc7e19ba7ba71069e4acf2d9169870
SHA1 63d87597d1020252cecf6f48c17c60b022006854
SHA512 e9bf45ab8f4ef8bfbd8631d97b5a09269f700d57a55a93de6f9b25b875350affe5955b95d4066bd8236f7120ac14617623815a7680da9c024c9f613cf0f2df25
SSDEEP 196608:t+YZG78PtfgyLP2hGDFZNNlsPJFCie3yG9KCSmP:tBG78tL+hGDFZNNlsPJFCie3yGU7
TLSH
T148F629117A5B98ACD587C87083468A734E2138DB1A36B9BF45C4A63D3F7DBF05B29318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10819632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Forge.pdb

user32

FindWindowExW GetParent SetWindowRgn SetPropW SetFocus SetParent GetMenu ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState ClipCursor GetClipCursor ShowCursor SetWindowTextW SetWindowLongW GetSystemMenu GetWindowTextW GetWindowTextLengthW RegisterWindowMessageA IsProcessDPIAware TrackPopupMenu AppendMenuW InsertMenuW CreatePopupMenu CreateMenu DrawIconEx GetDC SetMenuItemInfoW EnableMenuItem VkKeyScanW CheckMenuItem DrawTextW ReleaseDC GetWindowDC OffsetRect MapWindowPoints GetMenuBarInfo ShowWindow PostQuitMessage CreateAcceleratorTableW SystemParametersInfoA DestroyMenu RemoveMenu DestroyAcceleratorTable MessageBoxW GetForegroundWindow FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos GetWindowRect DrawMenuBar SetMenu GetMenuItemInfoW TranslateAcceleratorW InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW DestroyIcon GetIconInfo LoadImageW GetMonitorInfoW SystemParametersInfoW SetCursor LoadCursorW MonitorFromRect CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SetCapture ReleaseCapture FillRect ClientToScreen GetWindowLongW ScreenToClient SendInput SetForegroundWindow AdjustWindowRectEx GetUpdateRect MapVirtualKeyW ValidateRect GetRawInputData SetWindowLongPtrW RegisterTouchWindow GetSystemMetrics SetWindowDisplayAffinity DefWindowProcW MsgWaitForMultipleObjectsEx PeekMessageW PostThreadMessageW DestroyWindow PostMessageW DispatchMessageW GetMessageW IsWindowEnabled EnableWindow MonitorFromWindow IsIconic IsWindowVisible RegisterRawInputDevices SendMessageW GetCursorPos EnumChildWindows DispatchMessageA TranslateMessage GetMessageA SetWindowPos CreateWindowExW RegisterClassExW GetWindowLongPtrW GetClientRect MonitorFromPoint RedrawWindow CreateIcon AdjustWindowRect EnumDisplayMonitors GetWindow CharLowerW CharToOemA OemToCharBuffA OemToCharA CharToOemBuffW CharUpperW

kernel32

LocalFree GetProcessHeap HeapFree ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx RtlPcToFileHeader RaiseException FlsGetValue EncodePointer GetLastError LoadLibraryExA GetCommandLineW FindNextFileW GetFileSizeEx SetEnvironmentVariableW GetFinalPathNameByHandleW DeleteFileW GetTempPathW GetExitCodeProcess WaitForMultipleObjects GetModuleFileNameW GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW CompareStringOrdinal ReadFile GetOverlappedResult CancelIo CreateEventW ExitProcess CreateDirectoryW SetFileTime CreateFileW FindFirstFileExW SetFileInformationByHandle QueryPerformanceFrequency WriteFileEx ReadFileEx SleepEx GetEnvironmentVariableW HeapAlloc FlsFree FlsSetValue IsThreadAFiber GetModuleHandleExW FlsAlloc WriteConsoleW MultiByteToWideChar GetConsoleOutputCP GetConsoleMode GetStdHandle FormatMessageW ReleaseMutex WideCharToMultiByte CreateMutexA WaitForSingleObjectEx GetCurrentDirectoryW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetFullPathNameW MoveFileExW CreateHardLinkW FlushFileBuffers GetDiskFreeSpaceExW GetSystemInfo DuplicateHandle GetCurrentProcess GetCurrentProcessId GetFileInformationByHandleEx GetFileInformationByHandle SetFilePointerEx GetModuleHandleA LoadLibraryW Sleep WaitForSingleObject SetWaitableTimer CreateWaitableTimerExW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetVolumeInformationW GetVolumePathNameW HeapReAlloc CloseHandle CreateThread GetSystemTimePreciseAsFileTime FindClose QueryPerformanceCounter GetProcAddress LoadLibraryA SetLastError GetCurrentThreadId lstrlenW LCIDToLocaleName GetUserDefaultUILanguage SwitchToThread GetModuleHandleW InitializeCriticalSectionEx RemoveDirectoryW SetThreadExecutionState SetThreadPriority SetFileAttributesW DeviceIoControl MoveFileW FindFirstFileW GetVersionExW GetProcessAffinityMask FoldStringW CreateSemaphoreW SystemTimeToFileTime FileTimeToSystemTime TzSpecificLocalTimeToSystemTime SystemTimeToTzSpecificLocalTime DeleteCriticalSection LocalFileTimeToFileTime FileTimeToLocalFileTime IsDBCSLeadByte GetCPInfo CompareStringW LeaveCriticalSection ReleaseSemaphore GetFileType AreFileApisANSI ResetEvent EnterCriticalSection SetEvent InitializeCriticalSection SetEndOfFile GetShortPathNameW SetFilePointer GetLongPathNameW WriteFile FreeLibrary LoadLibraryExW OutputDebugStringW OutputDebugStringA GetSystemTime

ntdll

RtlNtStatusToDosError RtlGetVersion NtReadFile NtWriteFile NtOpenFile NtCreateNamedPipeFile

bcryptprimitives

ProcessPrng

comctl32

DefSubclassProc TaskDialogIndirect SetWindowSubclass RemoveWindowSubclass

oleaut32

VariantClear GetErrorInfo SetErrorInfo SysFreeString SysStringLen SysAllocString

ole32

RevokeDragDrop RegisterDragDrop CoCreateInstance CoUninitialize CoSetProxyBlanket OleInitialize CoInitializeEx

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

shell32

SHAppBarMessage DragQueryFileW SHCreateItemFromParsingName ShellExecuteW SHGetStockIconInfo SHGetKnownFolderPath DragFinish

combase

CoTaskMemFree CoCreateFreeThreadedMarshaler CoTaskMemAlloc

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

gdi32

CreateCompatibleDC CombineRgn BitBlt GetDeviceCaps CreateDIBSection DeleteDC SetTextColor CreateRectRgn SetBkMode SelectObject CreateSolidBrush GetDIBits DeleteObject

imm32

ImmReleaseContext ImmGetCompositionStringW ImmGetContext

shlwapi

SHCreateMemStream

userenv

GetUserProfileDirectoryW

advapi32

SetFileSecurityW LookupPrivilegeValueW FreeSid CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken EventUnregister EventWriteTransfer EventSetInformation EventRegister RegCloseKey RegQueryValueExW RegOpenKeyExW RegGetValueW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

api-ms-win-crt-math-l1-1-0

log2 ceil roundf round log2f pow __setusermatherr trunc floor

api-ms-win-crt-string-l1-1-0

wcscmp _wcsicmp wcslen strcpy_s wcsncmp wcscpy strlen wcspbrk

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initterm _initterm_e _seh_filter_exe _cexit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initialize_onexit_table _initialize_narrow_environment _c_exit _register_onexit_function _crt_atexit __p___argc __p___argv _set_app_type terminate abort _exit exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-heap-l1-1-0

malloc free calloc _callnewh realloc _set_new_mode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ps5-dump-forge-0.3.1-windows-x86-64/ps5-dump-forge.exe

IMPHASH 8ed9b68646780e1273c61fd129946fc4
SHA256 5a49b5dc2ddeb82c988bf47607cc2f9ad24d43151d9375d91ac64a95205d8fac
MD5 b1122a440da8b319974ed45a8dcf994d
SHA1 103c6ff1ecf731056dd86b2773be5266f2e2f777
SHA512 7aa007d022e6b0e81794516f4fd642c5feeca6152bfd05c722458e50d07d6c5865ac6edee3ca7b88d9dda76f0a4e88800db0336a2b222ad50f145672d7e2f837
SSDEEP 98304:HRVOBGV+s5L+QISTAWK2FR7Q+iUmlsPJFN+6Tdi7ie3yG2aHjVmMQj:pQsLElsPJFCie3yG
TLSH
T1BE763A12765B98ACD09AC470870A8A735E217CDB1B26B9FF01C4B6393F79BA05B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4882128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ps5_dump_forge.pdb

kernel32

GetCurrentThread HeapReAlloc CreateThread SetFilePointerEx FindClose GetFileInformationByHandle GetSystemTimePreciseAsFileTime GetFileInformationByHandleEx GetCurrentProcessId GetCurrentProcess DuplicateHandle GetSystemInfo GetDiskFreeSpaceExW GetVolumePathNameW GetVolumeInformationW FlushFileBuffers CreateHardLinkW MoveFileExW GetFullPathNameW GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW CreateMutexA ReleaseMutex GetModuleHandleW FormatMessageW GetConsoleOutputCP SetThreadStackGuarantee MultiByteToWideChar WriteConsoleW FlsAlloc GetModuleHandleExW IsThreadAFiber FlsSetValue FlsFree HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter SetHandleInformation GetModuleHandleA SetFileInformationByHandle FindFirstFileExW CreateFileW SetFileTime ReadConsoleW CreateDirectoryW ExitProcess DeleteFileW GetFinalPathNameByHandleW CreateWaitableTimerExW SetWaitableTimer Sleep GetFileSizeEx FindNextFileW HeapSize GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP AddVectoredExceptionHandler SetConsoleCtrlHandler GetModuleFileNameW SetLastError GetCommandLineW CloseHandle WideCharToMultiByte GetConsoleMode GetStdHandle GetLastError SwitchToThread HeapFree WaitForSingleObject GetProcessHeap GetACP IsValidCodePage SetStdHandle LCMapStringW LoadLibraryExW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA TerminateProcess InitializeCriticalSectionEx EncodePointer FlsGetValue RaiseException RtlPcToFileHeader RtlUnwindEx LocalFree InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetProcessAffinityMask CreateSemaphoreW ReleaseSemaphore ResetEvent SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetShortPathNameW GetLongPathNameW WriteFile SetFilePointer SetEndOfFile ReadFile AreFileApisANSI CompareStringW GetCPInfo IsDBCSLeadByte FreeLibrary FileTimeToLocalFileTime LocalFileTimeToFileTime GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime FoldStringW CreateEventW SetThreadPriority GetSystemDirectoryW LoadLibraryW SetThreadExecutionState GetVersionExW GetFileAttributesW RemoveDirectoryW SetFileAttributesW DeviceIoControl MoveFileW FindFirstFileW GetFileType

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

advapi32

SetFileSecurityW LookupPrivilegeValueW FreeSid CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken

ntdll

NtWriteFile NtOpenFile NtReadFile RtlNtStatusToDosError

userenv

GetUserProfileDirectoryW

ws2_32

select connect listen getsockname getsockopt closesocket recv setsockopt WSAGetLastError shutdown WSASocketW send accept WSAStartup bind ioctlsocket

user32

OemToCharBuffA CharLowerW CharUpperW CharToOemA CharToOemBuffW OemToCharA

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantClear

Name

.text

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

150KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ps5-dump-forge-0.3.1-windows-x86-64.zip

ps5-dump-forge-0.3.1-windows-x86-64/PS5 Dump Forge.exe

user32

kernel32

ntdll

bcryptprimitives

comctl32

oleaut32

ole32

api-ms-win-core-synch-l1-2-0

shell32

combase

dwmapi

gdi32

imm32

shlwapi

userenv

advapi32

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

ps5-dump-forge-0.3.1-windows-x86-64/ps5-dump-forge.exe

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

advapi32

ntdll

userenv

ws2_32

user32

ole32

oleaut32

generic