b33955048817dbe062f41f2801c0485357752c396e3cf0d9bc702a7ba225057e

General

Target
b33955048817dbe062f41f2801c0485357752c396e3cf0d9bc702a7ba225057e
Size 752KB
Sample261027-jgem1scs8m
SHA256 b33955048817dbe062f41f2801c0485357752c396e3cf0d9bc702a7ba225057e
MD5 ec857d616fcf2c51ba6a3c88d032dd4b
SHA1 e31f871ec83bbdf21547cd2ffbde3722906143e4
SHA512 d4a732dcebae0ff1940a1e4dc38ff5fe8bc93e41016c4159d26157542e19190076ae5fd65d1a5dca8bc5d3620ddb27fe1cf93fcf9eda24be8b6e3fc8a382afe9
SSDEEP 12288:5Zrxy/3278GiyPvc3ClSixNQbJ7WtX46CoHkuuq/V5r1VLd4BmX+:/NuxyPvcixNltx8q7Lsc+
TLSH
T19EF4D50BB66FC129D08653769E6573B278B6A2B72E349C83F7C89B4C50E12D5CD1A343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b33955048817dbe062f41f2801c0485357752c396e3cf0d9bc702a7ba225057e

File Explorer

b33955048817dbe062f41f2801c0485357752c396e3cf0d9bc702a7ba225057e

.dll 752KB

b33955048817dbe062f41f2801c0485357752c396e3cf0d9bc702a7ba225057e

IMPHASH 13c4f926f4d41f959cf51160b24d5523
SHA256 b33955048817dbe062f41f2801c0485357752c396e3cf0d9bc702a7ba225057e
MD5 ec857d616fcf2c51ba6a3c88d032dd4b
SHA1 e31f871ec83bbdf21547cd2ffbde3722906143e4
SHA512 d4a732dcebae0ff1940a1e4dc38ff5fe8bc93e41016c4159d26157542e19190076ae5fd65d1a5dca8bc5d3620ddb27fe1cf93fcf9eda24be8b6e3fc8a382afe9
SSDEEP 12288:5Zrxy/3278GiyPvc3ClSixNQbJ7WtX46CoHkuuq/V5r1VLd4BmX+:/NuxyPvcixNltx8q7Lsc+
TLSH
T19EF4D50BB66FC129D08653769E6573B278B6A2B72E349C83F7C89B4C50E12D5CD1A343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

kernel32

CloseHandle CreateFileA DeleteCriticalSection DeleteFileA DeviceIoControl EnterCriticalSection EnumCalendarInfoA ExitProcess FileTimeToDosDateTime FileTimeToLocalFileTime FindClose FindFirstFileA FreeEnvironmentStringsA FreeLibrary GetACP GetCPInfo GetCommandLineA GetCurrentThreadId GetDiskFreeSpaceA GetEnvironmentStrings GetFileAttributesA GetFileType GetLastError GetLocalTime GetLocaleInfoA GetModuleFileNameA GetModuleHandleA GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetStringTypeExA GetStringTypeW GetThreadLocale GetTickCount GetTimeZoneInformation GetVersion GetVersionExA GlobalMemoryStatus HeapAlloc HeapFree InitializeCriticalSection InterlockedDecrement InterlockedIncrement LCMapStringA LeaveCriticalSection LoadLibraryA LoadLibraryExA LocalAlloc LocalFree MultiByteToWideChar RaiseException RtlUnwind SetConsoleCtrlHandler SetFilePointer SetHandleCount SetLastError TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualQuery WideCharToMultiByte WriteFile lstrcpynA lstrlenA

user32

CharNextA EnumThreadWindows GetKeyboardType GetSystemMetrics LoadStringA MessageBoxA wsprintfA

oleaut32

SysFreeString

@SMIGenEraseFail$qppvp9_ADDRINFO17System@AnsiString @SMIGenProgramFail$qppvp9_ADDRINFO17System@AnsiString @SMIGenReadFail$qppvp9_ADDRINFO17System@AnsiString @SMIPrepareEraseFail$qppvucp9_ADDRINFO17System@AnsiString @SMIPrepareProgramFail$qppvucp9_ADDRINFO17System@AnsiString @SMIPrepareReadFail$qppvucp9_ADDRINFO17System@AnsiString @SMIValidateEraseFail$qppvp9_ADDRINFO17System@AnsiString @SMIValidateProgramFail$qppvp9_ADDRINFO17System@AnsiString @SMIValidateReadFail$qppvp9_ADDRINFO17System@AnsiString _SMIChkVarifyMode _SMIDistinguishES _SMIFlushCache _SMIGenEraseFail _SMIGenProgramFail _SMIGenRdUNC _SMIGenReadFail _SMIGetSWPtestDllVersion _SMIGreyBoxLogOpt _SMIHostReadData _SMIHostWriteData _SMIInitSWPtestDLL _SMIPBA2LBA _SMIPreRdUNC _SMIPreUGSDProgFlash _SMIPrepareEraseFail _SMIPrepareProgramFail _SMIPrepareReadFail _SMIPretestClearSystemBlock _SMIPretest_CheckRDT_Report _SMIPretest_CheckRDT_Report_Ex _SMIPretest_CheckSorting_Report _SMIProgFlashPage _SMIPtestAnalysisBadBlock _SMIPtestAnalysisRDTReport _SMIPtestB0kbProgSorting _SMIPtestB0kbProgSortingEx _SMIPtestCalculateInfoBlkBufSize _SMIPtestCheckRDT_BECCTable _SMIPtestCheckRetry _SMIPtestCheckRunMode _SMIPtestChkGPIOSetting _SMIPtestChkProgTime _SMIPtestChkValidWindow _SMIPtestCompareCheckSum _SMIPtestDRAMLoadDgISP _SMIPtestDownloadISP _SMIPtestDownloadMPISP _SMIPtestDriveReset _SMIPtestDumpSysBlock _SMIPtestEraseAll _SMIPtestFlashConnectivityTest _SMIPtestGenBadBlockBitMap _SMIPtestGenDiffAddrTable _SMIPtestGenDummyWorstBlockStatus _SMIPtestGenInfoBlkBuf _SMIPtestGetBadBlkCnt _SMIPtestGetBlockStatus _SMIPtestGetDumpRuntimeBadStatus _SMIPtestGetDumpTotalBlockStatus _SMIPtestGetFlashId _SMIPtestLoadDgISP _SMIPtestN28ProgSorting _SMIPtestProgramDummyAll _SMIPtestRdRetryTab _SMIPtestReadDriveInfo _SMIPtestRebuildSysIndex _SMIPtestSRamTest _SMIPtestSaveInfoBlock _SMIPtestSetBlockStatusbyBECCTable _SMIPtestSetCardMode _SMIPtestSetChCeMap _SMIPtestSetDiskCapacity _SMIPtestSetDriveSerialNumber _SMIPtestSetSystemBlockAndBoundaryBlock _SMIPtestShallowEraseFix _SMIPtestTranAdj _SMIPtestTranDriveSettingTableToParamTable _SMIPtestTranRTC _SMIReadCIDTable _SMIReadFlashID _SMIReadIDTable _SMIReadMPInfo _SMIReadRunBadBlk _SMIReadSmart _SMIReadVndrCmd _SMIResetSmart _SMIScanSMIDrive _SMISetCmdLogPath _SMISetPassThroughType _SMITranLBA2PBA _SMITrigerUGSD _SMITriggerGc _SMITrimCmd _SMIValRdUNCBadInfo _SMIValRdUNCCorrectable _SMIValRdUNCDoReclain _SMIValRdUNCPopClr _SMIValRdUNCTlcChg _SMIValidateEraseFail _SMIValidateProgramFail _SMIValidateReadFail _SMIValidateUGSDProgFlash _SMIWriteMPInfo _SMIWriteMPInfoEx _SMIWriteVndrCmd _SMI_Erase_Phy_block _SMI_Program_Phy_Page _SMI_Read_Phy_Page ___CPPdebugHook

Name

.text

Size

563KB

Virtual Size

564KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

150KB

Virtual Size

940KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b33955048817dbe062f41f2801c0485357752c396e3cf0d9bc702a7ba225057e

advapi32

kernel32

user32

oleaut32

generic