SndVol[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SndVol.exe
Size

218KB
MD5

d2419d7c3b7888b400487e91f531a2d8
SHA1

e2ecc88d27557b1f61748dd19a63e908b145fc6e
SHA256

ec65bd894b9dd7abc4953b16d9ee6fd5918e2ae1d94efdf56fb3e4ed7834566b
SHA512

19f4aa6f3b95f0b70bd607d06783d4c8319a18b5009af0098cabdefb3ea3a93227593f5a047358133ec233f153f48c02c42c6a3add05d882ab64c558684607b3
SSDEEP

3072:kmtYgpfZy7TkLjeohh0H9v6rZ9rw+wU/JfN2jbEyB7HbIScIQ:kB4fZjLjeoMH9gM/U/1zy10d

Score

1^/10

Malware Config

Signatures

Files

SndVol.exe
.exe windows x86

5f3f3778a963e0c44dcfb0f587f80b8a

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:30

Not After

03/03/2021, 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4b:40:aa:b7:ce:cb:6a:27:c4:ec:17:05:a9:1e:35:80:94:3b:00:79:71:57:f3:47:8d:c5:71:20:02:ff:64:20
Signer

Actual PE Digest

4b:40:aa:b7:ce:cb:6a:27:c4:ec:17:05:a9:1e:35:80:94:3b:00:79:71:57:f3:47:8d:c5:71:20:02:ff:64:20

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

CreateFontIndirectW
CreateDIBSection
ScriptStringFree
ScriptString_pLogAttr
ScriptStringAnalyse
CreateCompatibleDC
GetDeviceCaps
Rectangle
DeleteDC
PathToRegion
EndPath
SetBkMode
CreatePen
BeginPath
GetStockObject
Polygon
BitBlt
SetBkColor
SetTextColor
DeleteObject
SelectObject
CreateSolidBrush
GetObjectW

user32

DestroyMenu
SetWindowRgn
BeginPaint
EndPaint
IntersectRect
CreateDialogParamW
PostQuitMessage
GetDlgCtrlID
SubtractRect
PtInRect
SendMessageTimeoutW
SendNotifyMessageW
LoadIconW
SetTimer
NotifyWinEvent
GetForegroundWindow
GetWindowThreadProcessId
GetDoubleClickTime
KillTimer
CalculatePopupWindowPosition
DestroyIcon
EnumChildWindows
EnableWindow
EndDialog
SetRect
IsDlgButtonChecked
CheckDlgButton
CopyRect
GetParent
GetWindowTextW
GetScrollPos
SetScrollInfo
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsImmersiveProcess
GetIconInfoExW
SendDlgItemMessageW
InternalGetWindowText
GetWindow
IsWindowVisible
EnumWindows
GetClassLongW
TrackPopupMenuEx
SetClassLongW
DrawEdge
GetWindowRect
GetDC
MapWindowPoints
SetWindowLongW
GetWindowLongW
GetMenuItemCount
CheckMenuRadioItem
InsertMenuItemW
CreatePopupMenu
UnregisterClassA
GhostWindowFromHungWindow
GetSysColorBrush
FillRect
GetSysColor
InvalidateRect
CreateWindowExW
LoadCursorW
PrivateExtractIconsW
ValidateRect
FrameRect
MonitorFromRect
AdjustWindowRectEx
SetRectEmpty
SetCursor
ReleaseCapture
SetCapture
DrawFocusRect
GetFocus
OffsetRect
IsWindowEnabled
LoadImageW
ClientToScreen
EqualRect
GetClassInfoExW
RegisterClassExW
DestroyWindow
DialogBoxParamW
GetActiveWindow
GetWindowBand
ord2575
GetMenuItemInfoW
GetSystemMetrics
InflateRect
ReleaseDC
GetWindowTextLengthW
DrawTextW
SetDlgItemTextW
SetWindowTextW
SetProcessDefaultLayout
SetProcessDPIAware
BringWindowToTop
PostMessageW
SetForegroundWindow
FindWindowW
SendMessageW
CallWindowProcW
DefWindowProcW
LoadStringW
SetWindowPos
SetFocus
GetClientRect
ShowWindow
GetDlgItem
IsWindow

msvcrt

malloc
swprintf_s
wcstol
free
memmove_s
_wtoi
_controlfp
_except_handler4_common
realloc
_errno
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_wcsicmp
_wcmdln
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
_isnan
iswspace
wcsstr
calloc
_purecall
_resetstkoflw
vswprintf_s
_vscwprintf
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
__CxxFrameHandler3
_ftol2
_ftol2_sse
memcpy
?terminate@@YAXXZ
memset

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCloseKey
RegSetValueExW
RegCreateKeyExW

comctl32

ImageList_Remove
ord17
ord381
ImageList_Draw
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create
ImageList_SetBkColor
ImageList_CoCreateInstance

ole32

CoTaskMemFree
CoWaitForMultipleObjects
PropVariantClear
CoCreateGuid
CoAllowSetForegroundWindow
CoCreateInstance
CoTaskMemAlloc
CoUninitialize
CoInitialize

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString

shell32

Shell_NotifyIconGetRect
ShellExecuteExW
SHGetFileInfoW
CommandLineToArgvW

gdiplus

GdipDeleteBrush
GdipCreateSolidFill
GdipDrawLine
GdipSetSmoothingMode
GdipDeletePen
GdipCreatePen1
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreatePath
GdipDeletePath
GdiplusShutdown
GdiplusStartup
GdipAddPathLine
GdipFillPath
GdipCreateLineBrush
GdipFillRectangle

ntdll

EtwGetTraceLoggerHandle
EtwEventActivityIdControl
EtwEventSetInformation
EtwEventWriteTransfer
EtwTraceMessage
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwEventRegister
EtwEventUnregister

uxtheme

DrawThemeParentBackgroundEx
BufferedPaintUnInit
BufferedPaintSetAlpha
OpenThemeData
DrawThemeBackground
DrawThemeText
CloseThemeData
DrawThemeParentBackground
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
BufferedPaintInit
GetThemeTextExtent
SetWindowTheme
IsThemeActive

dwmapi

DwmUpdateThumbnailProperties
DwmQueryThumbnailSourceSize
DwmUnregisterThumbnail
DwmRegisterThumbnail
DwmSetWindowAttribute
DwmIsCompositionEnabled

shlwapi

ord348
PathFindFileNameW
ord487
StrTrimW
PathFindExtensionW
PathParseIconLocationW

imm32

ImmDisableIME

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
SizeofResource
FreeResource
LockResource
LoadResource
GetProcAddress
GetModuleHandleExW
FindResourceExW
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleW
LoadLibraryExA

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
CreateEventW
DeleteCriticalSection
SetEvent
CreateEventExW
InitializeCriticalSection
CreateMutexW
LeaveCriticalSection
EnterCriticalSection
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexExW
WaitForSingleObject
ReleaseMutex
OpenSemaphoreW
ReleaseSRWLockExclusive
WaitForSingleObjectEx

api-ms-win-core-heap-l1-1-0

HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
HeapAlloc
HeapSetInformation
HeapDestroy

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

CreateThread
SetThreadPriority
TerminateProcess
GetCurrentProcessId
GetExitCodeProcess
GetCurrentThreadId
CreateProcessW
GetStartupInfoW
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserPreferredUILanguages
GetLocaleInfoEx

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalFree

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
QueueUserWorkItem

api-ms-win-appmodel-runtime-l1-1-0

GetPackageFamilyName

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache
OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList
InterlockedPushEntrySList

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-ntuser-sysparams-l1-1-0

SystemParametersInfoW
GetMonitorInfoW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f3f3778a963e0c44dcfb0f587f80b8a

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

4b:40:aa:b7:ce:cb:6a:27:c4:ec:17:05:a9:1e:35:80:94:3b:00:79:71:57:f3:47:8d:c5:71:20:02:ff:64:20Signer

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

msvcrt

api-ms-win-core-registry-l1-1-0

comctl32

ole32

oleaut32

shell32

gdiplus

ntdll

uxtheme

dwmapi

shlwapi

imm32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-shcore-stream-winrt-l1-1-0

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 120KB - Virtual size: 119KB

.imrsiv Size: - Virtual size: 4B

.data Size: 1KB - Virtual size: 4KB

.idata Size: 12KB - Virtual size: 11KB

.didat Size: 512B - Virtual size: 92B

.rsrc Size: 65KB - Virtual size: 65KB

.reloc Size: 8KB - Virtual size: 7KB

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

4b:40:aa:b7:ce:cb:6a:27:c4:ec:17:05:a9:1e:35:80:94:3b:00:79:71:57:f3:47:8d:c5:71:20:02:ff:64:20
Signer

.text
Size: 120KB - Virtual size: 119KB

.imrsiv
Size: - Virtual size: 4B

.data
Size: 1KB - Virtual size: 4KB

.idata
Size: 12KB - Virtual size: 11KB

.didat
Size: 512B - Virtual size: 92B

.rsrc
Size: 65KB - Virtual size: 65KB

.reloc
Size: 8KB - Virtual size: 7KB