dharma[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

dharma.exe
Size

677KB
MD5

2d4ec86793fec1e10ac8fb617b2dcdbd
SHA1

078df2b23e7e24f2397532f9ec2694191fd9cc20
SHA256

a6ed8beb599f2aa594298076a2e8312871a2b12feb8e5d072d51335f21f85d7b
SHA512

1e15b4c910532ed36cf3adf605f744784224ceaa815e71588fb521f0e7b76975dc37889e6c8ac2e1c888060eda2380850c8877a801c74e222db043715719c5de
SSDEEP

12288:5IODa1GPYOBsDMOUaIQpGyEV3T5W241YcWEhpEdVe1/4vS1ZoYGIRUafy5LT+0w:5IO+aYxHjpYT5s1YcWEhpEdVe1/4vS1T

Score

N/A

Malware Config

Signatures

Files

dharma.exe
.exe windows x86

4320331bcf9a46674ed5540b0553eb3e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetACP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentThreadId
LoadLibraryExW
SetFilePointerEx
ReadFile
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
CloseHandle
AreFileApisANSI
ExitProcess
EnumSystemLocalesW
GetOEMCP
SetStdHandle
ReadConsoleW
CreateFileW
SetEndOfFile
MultiByteToWideChar
CreateDirectoryW
GetWindowsDirectoryA
LoadLibraryA
CreateEventW
lstrlenA
Sleep
WaitForSingleObject
LocalFree
LocalAlloc
GlobalFree
GlobalAlloc
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetCommandLineW
RtlUnwind
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameW
GetFileType
GetStdHandle
IsProcessorFeaturePresent
GetStringTypeW
WideCharToMultiByte
EncodePointer
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
IsDebuggerPresent
HeapReAlloc
HeapAlloc
DecodePointer

user32

CheckMenuRadioItem
GetParent
GetWindowLongA
PtInRect
UnionRect
SetRect
FillRect
GetCursorPos
SendMessageA
GetClientRect
ScrollWindow
SetFocus
DrawIconEx
GetKeyState
TrackPopupMenu
UpdateWindow
GetDC
ReleaseDC
GetDlgItem
EnumWindowStationsW
DestroyIcon
GetScrollInfo
SetScrollInfo
LoadStringA
GetIconInfo
InvalidateRect

gdi32

GetObjectA
SetTextJustification
SetBkColor
SelectObject
GetDeviceCaps
DeleteObject
DeleteDC
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
CombineRgn

comdlg32

GetOpenFileNameA

advapi32

SetSecurityDescriptorDacl
InitializeAcl
AllocateAndInitializeSid
FreeSid
SetEntriesInAclW
RegOpenKeyExW
GetUserNameW
LookupAccountNameA
MakeSelfRelativeSD
AddAccessAllowedAce
GetSecurityDescriptorLength
InitializeSecurityDescriptor
GetLengthSid

shell32

SHGetSpecialFolderLocation
SHGetSpecialFolderPathA
SHGetMalloc

ole32

MkParseDisplayName
CreateBindCtx
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SafeArrayPutElement
OleTranslateColor
VariantInit
SysFreeString
SysAllocString
VariantClear
SafeArrayUnaccessData

opengl32

wglMakeCurrent
wglCreateContext
wglCopyContext

ws2_32

bind
closesocket
ioctlsocket
WSAStartup
WSAHtonl
WSAHtons
WSARecvFrom
WSASendTo
WSASocketA
WSALookupServiceEnd
WSAGetLastError

setupapi

CM_Get_Device_Interface_ListW
CM_Get_Global_State
CM_Get_Device_Interface_AliasW

msacm32

acmDriverDetailsA

mpr

WNetAddConnection2A

netapi32

NetApiBufferFree
NetUserGetInfo

avifil32

AVIStreamGetFrameOpen

rpcrt4

RpcBindingFree
UuidToStringA
UuidCreate
RpcBindingSetAuthInfoA
RpcMgmtWaitServerListen
RpcServerUseProtseqEpA
RpcStringFreeA
RpcBindingFromStringBindingA
RpcStringBindingComposeA
RpcServerListen

snmpapi

SnmpUtilIdsToA
SnmpUtilOidToA

ntdsapi

DsWriteAccountSpnA

d2d1

ord1

dwrite

DWriteCreateFactory

Sections

.text
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 263KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4320331bcf9a46674ed5540b0553eb3e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

opengl32

ws2_32

setupapi

msacm32

mpr

netapi32

avifil32

rpcrt4

snmpapi

ntdsapi

d2d1

dwrite

Sections

.text Size: 143KB - Virtual size: 143KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 7KB - Virtual size: 18KB

.rsrc Size: 263KB - Virtual size: 263KB

.text
Size: 143KB - Virtual size: 143KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 7KB - Virtual size: 18KB

.rsrc
Size: 263KB - Virtual size: 263KB