PEHIME-v0.2.1-x86.zip
- SHA256 c34f557b1c1dd71e9047043eef2bef85e5277a3e445268263aeaaaa4908bc144
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PEHIME.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
PEHIME.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target PEHIME-v0.2.1-x86.zip
- Size 669KB
- Sample261107-p2cxtab14v
- SHA256 c34f557b1c1dd71e9047043eef2bef85e5277a3e445268263aeaaaa4908bc144
- MD5 745e2e3e82edf63a4995d6d514e3fa37
- SHA1 9ca0597f7669bc40c8c9ca426b53a4fee2284033
- SHA512 7f06998b82e02bcbff4cda3db0930623edca08cc6660035edcc17cdc4ac5f585dd2b545b631041316419dbbc8148673a109140fb3a1626309b5f73b17ac84326
- SSDEEP 12288:lHewUHO5z60k4ATs3FAJGmQgabLm4oNa/AiXo4CrAwLhnCbSRsqumd1uttPCxm2G:wZu9Is3FVxgsmxg/AinCrrhnNRxumd1S
- TLSH T11BE423F3D8FC928D547AD7EC7A1253525799EE25ED2AFE318E50354F282CC89C280768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PEHIME.EXE
File Explorer
-
PEHIME-v0.2.1-x86.zip.zip 669KB
-
LICENSE11KB
-
PEHIME.EXE.exe 78KB
-
SHA256SUMS.txt310B
-
pehime.dict919KB
-
pehime.ini318B
LICENSE
- SHA256 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30
- MD5 3b83ef96387f14655fc854ddc3c6bd57
- SHA1 2b8b815229aa8a61e483fb4ba0588b8b6c491890
- SHA512 98f6b79b778f7b0a15415bd750c3a8a097d650511cb4ec8115188e115c47053fe700f578895c097051c9bc3dfb6197c2b13a15de203273e1a3218884f86e90e8
- SSDEEP 192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
- TLSH T11632623FBA48037706C20162BB9764CBF21E903F3B552568354CC1681F6BA6543FB6EA
- MD5 SHA1 SHA512 SSDEEP TLSH
PEHIME.EXE
- IMPHASH 41bde814c77157aba3a21958c3783d08
- SHA256 7f41d179a379c348d6ef76d772c59f50b6797177aca406d5b2db346c3615b970
- MD5 b891a6bf61c7667e07edd2ddcc626ffb
- SHA1 2f0bcdc247644579197cce4e227ebc2a9e3fd628
- SHA512 a965b00e12e7bc9699b02861a405b624dd4f905417d7b9fe8d24ec2785297e311dbc062a808b3499825047088065ed28e3a01e3299e5e57fa39c0daabd848389
- SSDEEP 1536:+o+gnnujDN8QxmO58xegiALZWe3tOTXzbfAK3C1oakK:R+gnu3N8Q8O58xegiAkRjboK3C1ZkK
- TLSH T1EA731945EA4360F1E94F04F44CC7F7FF5B616661883ACCA0EA8D9942BE1BB5121DA60B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
OpenProcessToken
gdi32
BitBlt
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontW
CreatePen
CreateSolidBrush
DeleteDC
DeleteObject
GetStockObject
GetTextExtentPoint32W
Polygon
Rectangle
SelectObject
SetBkMode
SetTextColor
TextOutW
kernel32
CloseHandle
CreateDirectoryA
CreateFileA
CreateMutexW
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
FileTimeToSystemTime
GetCPInfo
GetCommandLineW
GetCurrentProcess
GetCurrentThreadId
GetFileSize
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTime
InitializeCriticalSection
IsDBCSLeadByte
LeaveCriticalSection
MoveFileA
MultiByteToWideChar
ReadFile
ReleaseMutex
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
lstrcpynA
lstrcpynW
msvcrt
__p__dstbias
__p__daylight
__p__iob
__lc_codepage
__p___initenv
__p___mb_cur_max
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_errno
_initterm
_lock
_snprintf
_stricmp
_tzset
_unlock
localtime
gmtime
atexit
abort
atoi
calloc
exit
fclose
fflush
fgets
fopen
fprintf
fputc
free
fseek
ftell
fwrite
getenv
localeconv
malloc
memcmp
memcpy
memmove
memset
qsort
setvbuf
signal
strchr
strerror
strlen
strncmp
strrchr
vfprintf
wcscat
wcscpy
wcslen
wcsstr
__p__timezone
__getmainargs
shell32
ShellExecuteExW
Shell_NotifyIconW
user32
AppendMenuW
BeginPaint
CallNextHookEx
ClientToScreen
CreateIconIndirect
CreatePopupMenu
CreateWindowExW
DefWindowProcW
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageW
DrawTextW
EndPaint
FillRect
GetAsyncKeyState
GetClientRect
GetCursorPos
GetDC
GetGUIThreadInfo
GetMessageW
GetSystemMetrics
GetWindowRect
InvalidateRect
KillTimer
LoadCursorW
MessageBoxW
PostMessageW
PostQuitMessage
PtInRect
RegisterClassExW
ReleaseDC
SendInput
SetForegroundWindow
SetTimer
SetWindowPos
SetWindowsHookExW
ShowWindow
SystemParametersInfoW
TrackPopupMenu
TranslateMessage
UnhookWindowsHookEx
UpdateWindow
wsprintfW
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
921KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
SHA256SUMS.txt
- SHA256 cc5fc2ce334b5e8555ee57161abdcfdca9fcd81211aa5115b90687bb1d2a32fc
- MD5 3b6255713d6539de06736c0670efa0b2
- SHA1 1e541dc002237542485e4914595acd231aca4c19
- SHA512 8a67af2d27e5b94cbd93654cb7361df3ebe23b4ab5ea963932ea3c540c1203b0d0494310ce06fd96d617f75216a6cfffbe6c039be3c76c0ad1aa92e583d574c8
- TLSH T188E07D193D51AAC5119CE920040AD837A03A0C3280C7B5B596367F52298379C1E5734E
- MD5 SHA1 SHA512 TLSH
pehime.dict
- SHA256 8806258423e974fb1208ac63183bcf30b33900ce6d39d48228da675db7923589
- MD5 8fd5777f46b5c35f11233d5f9356c2fe
- SHA1 ba09395934a58447749dca67a83292c43f50c9d6
- SHA512 5cb261b91880e67fd93b0444213544e82c135bf381c434b7d78cae54838e290d758f11b8a065c610470bdf1ab2b3950ef9fb6430dcb079a8b7c5d0f4c62188aa
- SSDEEP 24576:qUXsU1D1+NjmoZN7zPXpqpC31HTL4z0xsw:p7qckN7zhqpC3R8A/
- TLSH T1CB15E1A0FD4E66148FF8B60FC2ABDBB2D7922D837A2795473D121AD11AD10C15B8734B
- MD5 SHA1 SHA512 SSDEEP TLSH
pehime.ini
- SHA256 6846af4fd59a39d4394e07eb365d0d7df93744fc0fa77127a3e5c4d738bfa9a9
- MD5 26c1a6763d54558d93d9a24c6849e070
- SHA1 bfc514cf391ac6bfdb50f6c637f44bb877360bf0
- SHA512 0e5f47acba8bcf10671a17d675ea06255c362bb95cd445c70abbb0f83918a0521bf737f74ce82a6bc5f7984398a12f41d11492bdc77823d5ec499742cb0c5a80
- TLSH T1AEE07D264B4AF0F4C815C05B60681246EFE1048D50DE2E447C302D300EDD650B30F2BC
- MD5 SHA1 SHA512 TLSH