PEIM-v0.1.zip
- SHA256 21e329c30837fc762e092e53dccbf0bf8ba7bccaa15dedd969dfa2a388d7dd9d
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PEIMH.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
PEIMH.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target PEIM-v0.1.zip
- Size 705KB
- Sample261107-p18cbsfa35
- SHA256 21e329c30837fc762e092e53dccbf0bf8ba7bccaa15dedd969dfa2a388d7dd9d
- MD5 53b3a30192534bbf6f9a65326a201c61
- SHA1 f2a6242d5299ba05dd89c140a168de6f32abd0da
- SHA512 2df3addafa6a5509bc6fe93cc9252dd3f92c5ed6187b77099eedb9fe4a2786688c1ab7348ee1ca403535871b59b8201e926106005f0573e63e9d109101ca290f
- SSDEEP 12288:hVKJ1Di2BuWBlSJ32X4pU/JXuM6tamOh1/7Lo8LyYaaLb2WYNw38ofb:WGkBkVqjZmObD88+YaaH2WYe3hfb
- TLSH T104F423361C2C15CFA1C389B22E7F8525B1537E979131A0E42BAC9B4BC408EEBEB71457
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PEIMH.EXE
File Explorer
-
PEIM-v0.1.zip.zip 705KB
-
PEIMH.EXE.exe 79KB
-
SHA256SUMS.txt313B
-
peim.ini357B
-
peim_cn.dict919KB
-
peim_en.dict132KB
PEIMH.EXE
- IMPHASH 05246d107dfdb378a1a26e66f886842e
- SHA256 dbcc405bcbe7e29755820d28a5cfdc0db7b743643cf28ef48c4ad416959edc6e
- MD5 d36d4969cc3512065fa3f05eb1f2cd01
- SHA1 8d74a34ae4ca480f7a2aaba78fe88d0b6e69fe2c
- SHA512 a405e27e237e943c9b0dd37208c42f8b17772c2da28df816193b12afcf2919bbec4229cec09c0f1bb8e97e7a061b80e5a8b95d522ce451a7692ff07f7f798b03
- SSDEEP 1536:Ht0+TGeYt+WJhRcjtjxYJm57KPLwixXAId9o4Gs1YF:Ht0+TGzwgcoJOaLwixXAOoBs1Y
- TLSH T1BB835B4BE39360FCC6EBC17846D39771BC31BC648524BE3E96D0D6351E60F10AA6DA26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
OpenProcessToken
gdi32
BitBlt
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontW
CreatePen
CreateSolidBrush
DeleteDC
DeleteObject
GetStockObject
GetTextExtentPoint32W
Polygon
Rectangle
SelectObject
SetBkMode
SetTextColor
TextOutW
kernel32
CloseHandle
CreateDirectoryA
CreateFileA
CreateMutexW
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
GetCPInfo
GetCommandLineW
GetCurrentProcess
GetCurrentThreadId
GetFileSize
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetStartupInfoA
InitializeCriticalSection
IsDBCSLeadByte
LeaveCriticalSection
MoveFileA
MultiByteToWideChar
ReadFile
ReleaseMutex
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
lstrcpynA
lstrcpynW
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_localtime64
_lock
_snprintf
_stricmp
_time64
_unlock
abort
atexit
atoi
calloc
exit
fclose
fflush
fgets
fopen
fprintf
fputc
free
fseek
ftell
fwrite
getenv
localeconv
malloc
memcmp
memcpy
memmove
memset
qsort
setvbuf
signal
strchr
strerror
strlen
strncmp
strrchr
vfprintf
wcscat
wcscpy
wcslen
wcsstr
shell32
ShellExecuteExW
Shell_NotifyIconW
user32
AppendMenuW
BeginPaint
CallNextHookEx
ClientToScreen
CreateIconIndirect
CreatePopupMenu
CreateWindowExW
DefWindowProcW
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageW
DrawTextW
EndPaint
FillRect
GetAsyncKeyState
GetClientRect
GetCursorPos
GetDC
GetForegroundWindow
GetGUIThreadInfo
GetMessageW
GetSystemMetrics
GetWindowRect
InvalidateRect
KillTimer
LoadCursorW
MessageBoxW
PostMessageW
PostQuitMessage
PtInRect
RegisterClassExW
ReleaseDC
SendInput
SetForegroundWindow
SetTimer
SetWindowPos
SetWindowsHookExW
ShowWindow
SystemParametersInfoW
TrackPopupMenu
TranslateMessage
UnhookWindowsHookEx
UpdateWindow
wsprintfW
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
SHA256SUMS.txt
- SHA256 894287cda7a81941cbd68581dfa76c18494ac7cc30df7f8b5e08276a7e20cbf2
- MD5 33f16214d404eda7bf560f0d95bd1f06
- SHA1 29e548917bcf1344660d8bd57faee6a698d7aa0b
- SHA512 9d98f09c5bae10cbe1cd5b999239c971c4fbe4f9d97e1be4cc84a3b752999728031158a58cf1e3814e06cad9933ed8cb78296ddf6825a65cad4427fee253ed12
- TLSH T1EDE07D5DBE01FEC7309EA93E0C4C012D63A93106BB86A208248057F465832BF0F3348D
- MD5 SHA1 SHA512 TLSH
peim.ini
- SHA256 2d4e52bf449b8bcad56b469308424d12429de5c61fbea4a72c57611d9e409f77
- MD5 b1adcc2edcff8609829364ac0f1d6dfa
- SHA1 592bb0377f245d193c3f74ad7b38cd47ffe22d67
- SHA512 901c567315e1a9259df749f388fb107f51062b1321ccfb0daa0ac6c18a0d261a1cdcbde4e14673b13365041472d4901134aa2cd4315d3d1c4ebc133779653c12
- TLSH T19EE0C04C8DE5C5A9174DD80B6410424B92D0E15874386981BA6C5C7417C79220A4F7B4
- MD5 SHA1 SHA512 TLSH
peim_cn.dict
- SHA256 8806258423e974fb1208ac63183bcf30b33900ce6d39d48228da675db7923589
- MD5 8fd5777f46b5c35f11233d5f9356c2fe
- SHA1 ba09395934a58447749dca67a83292c43f50c9d6
- SHA512 5cb261b91880e67fd93b0444213544e82c135bf381c434b7d78cae54838e290d758f11b8a065c610470bdf1ab2b3950ef9fb6430dcb079a8b7c5d0f4c62188aa
- SSDEEP 24576:qUXsU1D1+NjmoZN7zPXpqpC31HTL4z0xsw:p7qckN7zhqpC3R8A/
- TLSH T1CB15E1A0FD4E66148FF8B60FC2ABDBB2D7922D837A2795473D121AD11AD10C15B8734B
- MD5 SHA1 SHA512 SSDEEP TLSH
peim_en.dict
- SHA256 37c3a00ed54c2daa0f54cd571e349a4f69b4a3ecc27111e455b04efc8bad543a
- MD5 062d08ba774abe01aa4320b787b89af1
- SHA1 b033c09560823b289cca9e0b10c24f620b034e7b
- SHA512 1e22dfd710a442318225038e9cfbddc74c94c04eaa1de013ab4d7a1b5fcb24436f2b2d0892130c69cc92737c8c68077e4f2cbe9fe40a24c18e05d9b1f417e446
- SSDEEP 3072:ubvFvuB/L93oTMiQFY8lEgpM2vAmpsrlrftvdnOGzq4Z4+Frd6yXW:uL4eVQvGgM2YmpWjO8sO+
- TLSH T1FED3D0A1F5541A33AADF53BFBCA3424B67758181840500ECE6ED4B48C5CB95E83BF72A
- MD5 SHA1 SHA512 SSDEEP TLSH