PEIM-v0.2.zip
- SHA256 8c3e12666c7823138cebd66f11a91ffb58e93c7cc705d5f7938d12045efda93d
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PEIMH.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
PEIMH.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target PEIM-v0.2.zip
- Size 664KB
- Sample261107-p17e2ab131
- SHA256 8c3e12666c7823138cebd66f11a91ffb58e93c7cc705d5f7938d12045efda93d
- MD5 0ee8690444fb3f796effbbd659bafe60
- SHA1 40371af3fd49fce1005989af7ef7e8d3fcd0f91a
- SHA512 dd87cb3e983557c2dcc003f7734d224b74f287dd9ada07de8fb2d44683ede1e9699520f8133ba143d62d79a22b9b8788f4f68a15e8d1e7db5cd2ace208b10a8e
- SSDEEP 12288:q5A7HewUHO5z60k4ATs3FAJGmQgabLm4oNa/AiXo4CrAwLhnCbSRsqumd1uttPC8:q5A7+Zu9Is3FVxgsmxg/AinCrrhnNRx0
- TLSH T154E433B3FCFC128D68BBD7DD9B1283425685EE54EA5ABE324E54361F0C28C85C18076A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PEIMH.EXE
File Explorer
-
PEIM-v0.2.zip.zip 664KB
-
PEIMH.EXE.exe 78KB
-
SHA256SUMS.txt230B
-
peim.dict919KB
-
peim.ini318B
PEIMH.EXE
- IMPHASH b0ce40f2a6640148451dca29b53eb881
- SHA256 7cb948d80b87550d1631a2d72f387cde91e2f9941c4ec7696057367c465f5fb5
- MD5 4b4926f0f7e4b7c33aa7f67e1f3ef78f
- SHA1 a8f422e45ff1c9c55981d601d02a761d8e89d33b
- SHA512 bdffa2bb55e19d120f29242f97d50db983af6e2fd78898871fa431148322e789e92646746abd77c391cbed04775f827964aecb99b265995674e85bdd561922e8
- SSDEEP 1536:8my/kPAOaU6HivixfIGHmX7KvLwixriYu7oBFX/cwksB/EO:8my/kPAFzCvENHUCLwixriToP/cwXR
- TLSH T103736C46E393D0FCC6CBC1B482E2577DBA317C750524BF3B5298EA701E15C506AAD93A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
OpenProcessToken
gdi32
BitBlt
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontW
CreatePen
CreateSolidBrush
DeleteDC
DeleteObject
GetStockObject
GetTextExtentPoint32W
Polygon
Rectangle
SelectObject
SetBkMode
SetTextColor
TextOutW
kernel32
CloseHandle
CreateDirectoryA
CreateFileA
CreateMutexW
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
GetCPInfo
GetCommandLineW
GetCurrentProcess
GetCurrentThreadId
GetFileSize
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetStartupInfoA
InitializeCriticalSection
IsDBCSLeadByte
LeaveCriticalSection
MoveFileA
MultiByteToWideChar
ReadFile
ReleaseMutex
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
lstrcpynA
lstrcpynW
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_localtime64
_lock
_snprintf
_stricmp
_time64
_unlock
abort
atexit
atoi
calloc
exit
fclose
fflush
fgets
fopen
fprintf
fputc
free
fseek
ftell
fwrite
getenv
localeconv
malloc
memcmp
memcpy
memmove
memset
qsort
setvbuf
signal
strchr
strerror
strlen
strncmp
strrchr
vfprintf
wcscat
wcscpy
wcslen
wcsstr
shell32
ShellExecuteExW
Shell_NotifyIconW
user32
AppendMenuW
BeginPaint
CallNextHookEx
ClientToScreen
CreateIconIndirect
CreatePopupMenu
CreateWindowExW
DefWindowProcW
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageW
DrawTextW
EndPaint
FillRect
GetAsyncKeyState
GetClientRect
GetCursorPos
GetDC
GetGUIThreadInfo
GetMessageW
GetSystemMetrics
GetWindowRect
InvalidateRect
KillTimer
LoadCursorW
MessageBoxW
PostMessageW
PostQuitMessage
PtInRect
RegisterClassExW
ReleaseDC
SendInput
SetForegroundWindow
SetTimer
SetWindowPos
SetWindowsHookExW
ShowWindow
SystemParametersInfoW
TrackPopupMenu
TranslateMessage
UnhookWindowsHookEx
UpdateWindow
wsprintfW
Name
.text
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
SHA256SUMS.txt
- SHA256 52474bbdb2ae8f30abb3aae0fe29a461b81bd6f2806e1921beecd6d1c38870e7
- MD5 1f8cc40a964b38332c08f0354e989882
- SHA1 a2523db0b5e552d77b707931deba0a80a6558391
- SHA512 827d3dc7545bdca2bb9c4ef1bac4cc26e8246e6d8133645540babd677173548b24ae50e1c6246be02fe5cd18d6d733ce486c08c7386c1cf6571367cf06aa83f1
- TLSH T1F4D0A70DB50B67D926E9F612154E8436B0B01501608965E904B6991A16813DD5E3331E
- MD5 SHA1 SHA512 TLSH
peim.dict
- SHA256 8806258423e974fb1208ac63183bcf30b33900ce6d39d48228da675db7923589
- MD5 8fd5777f46b5c35f11233d5f9356c2fe
- SHA1 ba09395934a58447749dca67a83292c43f50c9d6
- SHA512 5cb261b91880e67fd93b0444213544e82c135bf381c434b7d78cae54838e290d758f11b8a065c610470bdf1ab2b3950ef9fb6430dcb079a8b7c5d0f4c62188aa
- SSDEEP 24576:qUXsU1D1+NjmoZN7zPXpqpC31HTL4z0xsw:p7qckN7zhqpC3R8A/
- TLSH T1CB15E1A0FD4E66148FF8B60FC2ABDBB2D7922D837A2795473D121AD11AD10C15B8734B
- MD5 SHA1 SHA512 SSDEEP TLSH
peim.ini
- SHA256 6846af4fd59a39d4394e07eb365d0d7df93744fc0fa77127a3e5c4d738bfa9a9
- MD5 26c1a6763d54558d93d9a24c6849e070
- SHA1 bfc514cf391ac6bfdb50f6c637f44bb877360bf0
- SHA512 0e5f47acba8bcf10671a17d675ea06255c362bb95cd445c70abbb0f83918a0521bf737f74ce82a6bc5f7984398a12f41d11492bdc77823d5ec499742cb0c5a80
- TLSH T1AEE07D264B4AF0F4C815C05B60681246EFE1048D50DE2E447C302D300EDD650B30F2BC
- MD5 SHA1 SHA512 TLSH