audiodg[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

audiodg.exe
Size

617KB
MD5

627dea21175691fde4495877c53b4c87
SHA1

44df3f0131abead2bc61f2fbd8d0f14b1c3408ed
SHA256

4eaffbc39de50e320a284298241e885820e8125b25da7cf453d35eeb4250b99d
SHA512

34096567496688e8072fb5f64cd241c4ef7b489c11c0f782be011c50bf6a87a21ddde6949006b9b8c022364d7fb8dd3574743cbcbd3600fbdd9c553e08c19bb9
SSDEEP

6144:sLP5+tDE3t6mOF9A8Hju8eaC+oSWEzqdMlHmyZzPIyacwYFD6NpZbVLvWyCr:sLP5Ik6mOzHC8++oSWLGk/S6Z9+yC

Score

1^/10

Malware Config

Signatures

Files

audiodg.exe
.exe windows x64

06aa7dd53682ee476dc4f7d3ba0b0085

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:e2:9a:9c:66:17:dd:a3:5b:29:fc:40:a1:72:64:17:fc:86:0d:d6:30:f8:e8:62:78:be:fc:62:6d:6f:8b:93
Signer

Actual PE Digest

16:e2:9a:9c:66:17:dd:a3:5b:29:fc:40:a1:72:64:17:fc:86:0d:d6:30:f8:e8:62:78:be:fc:62:6d:6f:8b:93

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__cexit
memmove
_o__wcsicmp
_o__wcstoui64
_o_exit
_o_free
_o_malloc
_o_powf
_o_realloc
_o_sqrt
_o_terminate
_o_wcsncpy_s
_o_wmemcpy_s
__CxxFrameHandler3
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o__exit
_o__errno
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o__crt_atexit
_o__configure_wide_argv
__std_terminate
_o__configthreadlocale
__C_specific_handler
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
SizeofResource
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW
GetModuleHandleExW
FindResourceExW
LockResource
LoadResource
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
EnterCriticalSection
ReleaseMutex
InitializeSRWLock
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
ResetEvent
CreateEventW
ReleaseSRWLockShared
CreateEventExW
ReleaseSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockShared
AcquireSRWLockExclusive
TryEnterCriticalSection
WaitForMultipleObjectsEx

api-ms-win-core-heap-l1-1-0

HeapReAlloc
GetProcessHeap
HeapFree
HeapSetInformation
HeapDestroy
HeapAlloc
HeapSize

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetProcessId
GetThreadId
TlsSetValue
GetCurrentProcessId
TlsAlloc
TlsGetValue
TlsFree
GetStartupInfoW
GetCurrentProcess
OpenProcessToken
GetCurrentThreadId
CreateThread
SetThreadPriority
GetCurrentThread

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

GetHandleInformation
CloseHandle
DuplicateHandle

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceBeginInitialize
InitOnceExecuteOnce
InitOnceComplete

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64
GetLogicalProcessorInformationEx

api-ms-win-core-fibers-l1-1-0

FlsSetValue
FlsFree
FlsAlloc

api-ms-win-devices-config-l1-1-1

CM_Unregister_Notification
CM_Register_Notification
CM_Locate_DevNodeW
CM_MapCrToWin32Err
CM_Open_DevNode_Key

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

ntdll

RtlCreateMemoryBlockLookaside
RtlDestroyMemoryZone
RtlAllocateMemoryBlockLookaside
RtlAllocateMemoryZone
RtlUnlockMemoryZone
RtlLockMemoryZone
NtAlpcCreatePort
RtlFreeMemoryBlockLookaside
EtwEventActivityIdControl
EtwLogTraceEvent
NtSetInformationProcess
NtSetInformationThread
NtSetSystemInformation
RtlPublishWnfStateData
NtQuerySystemInformation
EtwEventRegister
EtwEventUnregister
EtwEventWriteTransfer
EtwUnregisterTraceGuids
RtlNtStatusToDosError
EtwEventSetInformation
EtwGetTraceEnableFlags
EtwTraceMessage
NtCreateWnfStateName
NtDeleteWnfStateName
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
RtlCreateMemoryZone
EtwRegisterTraceGuidsW
RtlDestroyMemoryBlockLookaside
RtlExtendMemoryBlockLookaside
RtlRandomEx
NtAlpcConnectPort
NtAlpcOpenSenderProcess
RtlReportException
NtClose
RtlInitUnicodeStringEx
NtQueryInformationProcess
ShipAssert
NtAlpcAcceptConnectPort
AlpcInitializeMessageAttribute
NtAlpcSendWaitReceivePort
AlpcGetMessageAttribute
RtlSetLastWin32ErrorAndNtStatusFromNtStatus

mmdevapi

ord7
ord2
ord29
ord8
ord9

api-ms-win-core-memory-l1-1-1

SetProcessWorkingSetSizeEx
GetProcessWorkingSetSizeEx

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
SetRestrictedErrorInfo
RoOriginateErrorW
RoOriginateError

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsDeleteString
WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDuplicateString

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CloseThreadpoolWait

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

api-ms-win-eventing-classicprovider-l1-1-0

TraceEvent

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 435KB - Virtual size: 434KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 512B - Virtual size: 286B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_CONST
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

RT_DATA
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

06aa7dd53682ee476dc4f7d3ba0b0085

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

16:e2:9a:9c:66:17:dd:a3:5b:29:fc:40:a1:72:64:17:fc:86:0d:d6:30:f8:e8:62:78:be:fc:62:6d:6f:8b:93Signer

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

ntdll

mmdevapi

api-ms-win-core-memory-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 435KB - Virtual size: 434KB

RT_CODE Size: 512B - Virtual size: 286B

RT_BSS Size: - Virtual size: 40B

.rdata Size: 122KB - Virtual size: 122KB

.data Size: 2KB - Virtual size: 5KB

.pdata Size: 28KB - Virtual size: 28KB

.didat Size: 512B - Virtual size: 408B

RT_CONST Size: 2KB - Virtual size: 2KB

RT_DATA Size: 512B - Virtual size: 48B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 7KB - Virtual size: 7KB

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

16:e2:9a:9c:66:17:dd:a3:5b:29:fc:40:a1:72:64:17:fc:86:0d:d6:30:f8:e8:62:78:be:fc:62:6d:6f:8b:93
Signer

.text
Size: 435KB - Virtual size: 434KB

RT_CODE
Size: 512B - Virtual size: 286B

RT_BSS
Size: - Virtual size: 40B

.rdata
Size: 122KB - Virtual size: 122KB

.data
Size: 2KB - Virtual size: 5KB

.pdata
Size: 28KB - Virtual size: 28KB

.didat
Size: 512B - Virtual size: 408B

RT_CONST
Size: 2KB - Virtual size: 2KB

RT_DATA
Size: 512B - Virtual size: 48B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 7KB - Virtual size: 7KB