ardamax | DWG[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

DWG.exe
Size

5.2MB
MD5

5dc466d6ba46705d8c2ad4d89e7048a2
SHA1

3229dd9325c55504862e8de81509f897e7e9c122
SHA256

06fd96d0b85854700dee20821c69d9b49af8d1b45c067012627e5972cc3f8718
SHA512

f2303ca5fe881916cbe5aa56f97eb47292378f674dc06c79fff92d4ff19e3635d3fe4212ecdd4e3d3a9259b56a3d8745d879c5c36428808e567dc93df960f799
SSDEEP

98304:b0hQnKaOipzbaSM9D0CpQ+JMBaRXmQhyDO/cYB/Wtq9NK:b0hQVRb9MJ0Cq+JSaRXmXDQnW49NK

Score

10^/10

ardamax

Malware Config

Signatures

Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
sample	family_ardamax

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DWG.exe

Files

DWG.exe
.exe windows x64

15d0e600e6b46421c5da41bb27bd4af0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

winmm

mixerGetLineInfoW
waveInStart
waveInAddBuffer
waveInUnprepareHeader
waveInPrepareHeader
waveInClose
waveInOpen
waveInGetDevCapsW
mixerSetControlDetails
waveInStop
mixerGetLineControlsW
waveInGetNumDevs

wininet

InternetCloseHandle
FtpSetCurrentDirectoryW
InternetGetLastResponseInfoW
InternetOpenW
FtpCreateDirectoryW
InternetConnectW
FtpPutFileW
FtpDeleteFileW
FtpRemoveDirectoryW

psapi

GetModuleFileNameExW
EnumProcesses
EnumProcessModules

oleacc

AccessibleChildren
AccessibleObjectFromWindow
ObjectFromLresult

mpr

WNetAddConnection2W
WNetCancelConnection2W

kernel32

EnterCriticalSection
LeaveCriticalSection
lstrcmpW
lstrcmpiW
CreateMutexW
GetModuleFileNameW
CreateDirectoryW
DeleteFileW
GetVersionExW
CompareStringW
GetShortPathNameW
GetCurrentProcess
ExitProcess
GetCurrentThread
SetProcessPriorityBoost
SetThreadPriority
GetEnvironmentVariableW
SetPriorityClass
GetCurrentProcessId
RemoveDirectoryW
SetFileAttributesW
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
VirtualAllocEx
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
GlobalSize
MoveFileW
TerminateThread
WaitForSingleObject
GetTickCount
VirtualQuery
GlobalAlloc
GetSystemTime
SystemTimeToFileTime
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
GlobalUnlock
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
LoadLibraryExA
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
GlobalLock
GetVersion
GetVolumeInformationW
QueryDosDeviceW
OpenProcess
lstrcpynW
MoveFileExW
GetWindowsDirectoryW
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetACP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetFileType
GetTimeZoneInformation
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
FlushFileBuffers
SetConsoleCtrlHandler
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
CreateFileMappingW
lstrcatW
lstrcpyW
UnmapViewOfFile
MapViewOfFile
FormatMessageW
SetEndOfFile
WriteFile
SystemTimeToTzSpecificLocalTime
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GlobalMemoryStatus
ReadConsoleA
SetConsoleMode
FindFirstFileW
GetFullPathNameW
GetModuleHandleW
lstrlenW
FindClose
GetFileSize
SetLastError
GetUserDefaultLangID
GetLocaleInfoW
EnumResourceLanguagesW
WideCharToMultiByte
FreeResource
CreateFileW
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
EnumResourceNamesW
LoadLibraryExW
CloseHandle
SetFilePointer
GetCurrentThreadId
CreateThread
ReadFile
LocalFree
LocalReAlloc
LocalAlloc
LoadLibraryW
GetProcAddress
FreeLibrary
OutputDebugStringA
MultiByteToWideChar
FindResourceExW
FindResourceW
SizeofResource
LoadResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
LockResource
DecodePointer
QueryPerformanceCounter
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
GetStringTypeW
GetCPInfo
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
RtlUnwind
GetDriveTypeW
PeekNamedPipe
SetCurrentDirectoryW
GetCurrentDirectoryW
SetUnhandledExceptionFilter
GetFullPathNameA

user32

DestroyIcon
LoadCursorW
GetWindow
FindWindowW
GetParent
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
OffsetRect
InflateRect
CopyRect
SetRectEmpty
FrameRect
FillRect
DrawFocusRect
GetSysColorBrush
GetSysColor
MapWindowPoints
ScreenToClient
GetCursorPos
SetCursor
LoadImageW
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
BroadcastSystemMessageW
RegisterWindowMessageW
EnumWindows
GetAncestor
LookupIconIdFromDirectory
DdeUninitialize
DdeConnect
MessageBeep
MessageBoxW
AdjustWindowRectEx
GetWindowRect
GetClientRect
SetWindowTextW
ShowScrollBar
ScrollWindow
DdeDisconnect
DdeClientTransaction
DdeAccessData
DdeGetLastError
DdeCreateStringHandleW
DdeFreeStringHandle
SendMessageTimeoutW
GetDesktopWindow
EnumChildWindows
SetClipboardViewer
UnhookWindowsHookEx
ChangeClipboardChain
GetDoubleClickTime
GetLastInputInfo
DrawEdge
GetMessagePos
IsMenu
CharLowerW
GetKeyState
SetMenu
CreatePopupMenu
GetMenuItemID
DdeInitializeW
RedrawWindow
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
GetDC
SetForegroundWindow
UpdateWindow
DrawTextW
TrackPopupMenu
ModifyMenuW
GetSubMenu
DestroyMenu
GetMenu
LoadMenuW
GetSystemMetrics
IsWindowEnabled
EnableWindow
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetCapture
GetFocus
GetActiveWindow
SetFocus
CharNextW
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
OpenClipboard
GetDlgCtrlID
GetDlgItemTextW
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
GetDlgItem
EndDialog
DialogBoxParamW
IsWindowVisible
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
PostQuitMessage
DefWindowProcW
PostMessageW
SendMessageW
UnregisterHotKey
RegisterHotKey
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
DrawFrameControl
TrackMouseEvent
SystemParametersInfoW
GetWindowThreadProcessId
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
IsWindow
wsprintfW
CharUpperW
MapVirtualKeyW
GetKeyNameTextW
UnregisterClassW
GetMenuItemCount
TrackPopupMenuEx
InsertMenuItemW
GetMenuItemInfoW
SetMenuItemInfoW
WindowFromPoint
SetWindowsHookExW
GetProcessWindowStation
GetIconInfo
LoadIconW
CallNextHookEx
CreateIconFromResource
GetUserObjectInformationW
GetClassNameW

gdi32

SetStretchBltMode
StretchDIBits
StretchBlt
SetDIBitsToDevice
ExtSelectClipRgn
RealizePalette
RectVisible
GetDIBits
SetBrushOrgEx
CreatePatternBrush
Polygon
ExtTextOutW
TextOutW
MoveToEx
GetObjectW
CreateDIBSection
GetTextMetricsW
SetTextColor
SetPolyFillMode
SetBkMode
SetBkColor
SelectObject
RoundRect
PatBlt
LineTo
GetTextExtentPoint32W
GetStockObject
GetDeviceCaps
GetCurrentObject
ExcludeClipRect
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgnIndirect
CreatePen
CreateFontW
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
GetClipBox
BitBlt
CombineRgn

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

SetSecurityInfo
GetUserNameW
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
SetEntriesInAclW
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
GetSecurityInfo
RegCloseKey
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW

shell32

SHGetSpecialFolderLocation
Shell_NotifyIconW
ShellExecuteExW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
ExtractIconW
ShellExecuteW
SHChangeNotify
DoEnvironmentSubstW

ole32

CoTaskMemFree
CoUninitialize
CoTaskMemRealloc
CoCreateInstance
CoInitialize
CoTaskMemAlloc
CoInitializeEx

oleaut32

VarCmp
SysAllocStringLen
VarUI4FromStr
SysFreeString
VariantInit
VariantClear

shlwapi

PathFindExtensionW
PathStripPathW
StrCmpIW
StrDupW
StrFormatByteSizeW
PathAddBackslashW
PathFileExistsW
PathFindFileNameW
PathMatchSpecW
PathRemoveExtensionW
PathRemoveFileSpecW
PathRenameExtensionW
UrlIsW
StrCpyW
StrCatW

comctl32

PropertySheetW
DestroyPropertySheetPage
CreatePropertySheetPageW
InitCommonControlsEx
ImageList_Create
ImageList_Draw
ImageList_DrawIndirect
ImageList_GetIconSize
_TrackMouseEvent
ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_AddMasked

uxtheme

IsAppThemed
IsThemeActive
GetThemeInt
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeBackgroundContentRect

ws2_32

WSACleanup
WSAStartup
getservbyname
setsockopt
listen
bind
__WSAFDIsSet
closesocket
connect
ioctlsocket
getpeername
htons
inet_addr
inet_ntoa
socket
recv
select
send
accept
gethostbyname
gethostname
WSASetLastError
ntohs
getaddrinfo
freeaddrinfo
getnameinfo
getsockname
getsockopt
WSAGetLastError

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenStore
CertGetCertificateContextProperty

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 946KB - Virtual size: 946KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 131KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15d0e600e6b46421c5da41bb27bd4af0

Headers

DLL Characteristics

File Characteristics

Imports

winmm

wininet

psapi

oleacc

mpr

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

uxtheme

ws2_32

version

crypt32

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 946KB - Virtual size: 946KB

.data Size: 131KB - Virtual size: 347KB

.pdata Size: 173KB - Virtual size: 172KB

_RDATA Size: 12KB - Virtual size: 11KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 28KB - Virtual size: 27KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 946KB - Virtual size: 946KB

.data
Size: 131KB - Virtual size: 347KB

.pdata
Size: 173KB - Virtual size: 172KB

_RDATA
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 28KB - Virtual size: 27KB