SndVol[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SndVol.exe
Size

307KB
MD5

2305bff2966d73694972fd7531bc5baa
SHA1

2513d16692cd0819cdcd4bcc842f53cc68ba426c
SHA256

5bf1e2db134fea741897c2720343f69b16a8ba2753f2a95d1282c2733b6e0866
SHA512

b03ddde01e1b732df582cce3e2186b1651dee9d5d672a90e1aa9dbb1a6cf38382e1db3d6cf87f9622f7a003458bbe92d08cd99ed819228e2c8cdea6801ed785c
SSDEEP

6144:dW7h5RHYUX6uL5u28DBaKO1BT/MADrHfAjU+iO7B0xy4Ajry10:w7TR4UX6uL5uJDBa11BT/MADTA3hBv9y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SndVol.exe

Files

SndVol.exe
.exe windows x86

67c65bdc980fd02b1e6c38aee3b6c3e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

Rectangle
BeginPath
CreatePen
SetBkMode
EndPath
PathToRegion
Polygon
SetTextColor
SetBkColor
GetStockObject
GetObjectW
GetDeviceCaps
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
CreateFontIndirectW
DeleteObject

user32

AdjustWindowRectEx
MonitorFromRect
GetMonitorInfoW
IsWindowEnabled
SetCursor
OffsetRect
DrawFocusRect
LoadImageW
SystemParametersInfoW
EqualRect
SendMessageW
BringWindowToTop
DefWindowProcW
DestroyWindow
DialogBoxParamW
CreateWindowExW
CallWindowProcW
SetWindowLongW
GetWindowLongW
DialogBoxIndirectParamW
RegisterClassExW
LoadCursorW
GetClassInfoExW
RegisterWindowMessageW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
DestroyAcceleratorTable
GetSysColor
GetWindow
GetFocus
SetFocus
IsChild
EndPaint
FillRect
BeginPaint
GetClientRect
IsWindow
RedrawWindow
SetWindowPos
SetRectEmpty
GetParent
CharNextW
GetDesktopWindow
ReleaseDC
GetDC
CreateAcceleratorTableW
MoveWindow
ClientToScreen
ScreenToClient
DrawEdge
SetClassLongW
GetClassLongW
EnumWindows
FrameRect
ValidateRect
PrivateExtractIconsW
FindWindowW
SetForegroundWindow
ReleaseCapture
SetCapture
InvalidateRect
InvalidateRgn
GetDlgItem
MapWindowPoints
LoadStringW
GetSysColorBrush
DrawTextW
InflateRect
GetSystemMetrics
DestroyMenu
GetMenuItemInfoW
TrackPopupMenuEx
CheckMenuRadioItem
GetMenuItemCount
InsertMenuItemW
CreatePopupMenu
IntersectRect
MapDialogRect
GetWindowRect
ShowWindow
SendDlgItemMessageW
SetDlgItemTextW
SetWindowContextHelpId
SetWindowRgn
CreateDialogIndirectParamW
PostQuitMessage
GetDlgCtrlID
SubtractRect
PostMessageW
SetProcessDPIAware
SetProcessDefaultLayout
GetActiveWindow
GetClassNameW
GhostWindowFromHungWindow
UnregisterClassA
IsWindowVisible
InternalGetWindowText
GetIconInfoExW
SetScrollInfo
GetScrollPos
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsDlgButtonChecked
CheckDlgButton
CopyRect
SetRect
EnableWindow
EndDialog
EnumChildWindows
DestroyIcon
KillTimer
SetTimer
CalculatePopupWindowPosition
GetForegroundWindow
GetWindowThreadProcessId
GetDoubleClickTime
LoadIconW
NotifyWinEvent
PtInRect

msvcrt

_wtoi
wcstol
_CxxThrowException
__CxxFrameHandler3
??_V@YAXPAX@Z
??3@YAXPAX@Z
_isnan
??2@YAPAXI@Z
memset
memcpy_s
malloc
free
??_U@YAPAXI@Z
swprintf_s
_ftol2_sse
_vsnwprintf
memmove_s
calloc
_vscwprintf
vswprintf_s
_controlfp
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
_errno
realloc
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
iswspace
memcpy
_XcptFilter
_exit
_cexit
__wgetmainargs
_resetstkoflw
_wcsicmp
_purecall

api-ms-win-core-localregistry-l1-1-0

RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegCloseKey

comctl32

ImageList_ReplaceIcon
ord17
ImageList_Destroy
ImageList_SetBkColor
ImageList_Create
ord381
ImageList_Draw
ImageList_Remove

ole32

StringFromGUID2
OleLockRunning
CLSIDFromString
PropVariantClear
CLSIDFromProgID
CoGetClassObject
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoCreateGuid
CoUninitialize

oleaut32

SysAllocString
VariantInit
VariantClear
SysAllocStringLen
SysStringLen
SysStringByteLen
OleCreateFontIndirect
VarBstrCmp
LoadRegTypeLi
LoadTypeLi
SysFreeString

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFileInfoW
Shell_NotifyIconGetRect

gdiplus

GdipCreateSolidFill
GdiplusStartup
GdiplusShutdown
GdipFree
GdipAlloc
GdipCreateLineBrush
GdipCreatePen1
GdipDeletePen
GdipCreatePath
GdipDeletePath
GdipCloneBrush
GdipFillPath
GdipFillRectangle
GdipDrawLine
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipAddPathLine
GdipDeleteBrush

ntdll

EtwEventWrite
EtwTraceMessage
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags

uxtheme

DrawThemeTextEx
BeginBufferedPaint
EndBufferedPaint
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
DrawThemeParentBackground
DrawThemeParentBackgroundEx
GetThemeTextExtent
SetWindowTheme
IsThemeActive
OpenThemeData
DrawThemeBackground
DrawThemeText
CloseThemeData
BufferedPaintUnInit
BufferedPaintInit
GetThemeColor
BufferedPaintSetAlpha

dwmapi

DwmRegisterThumbnail
DwmUpdateThumbnailProperties
DwmUnregisterThumbnail
DwmSetWindowAttribute
DwmQueryThumbnailSourceSize
DwmIsCompositionEnabled

shlwapi

PathParseIconLocationW
ord487
StrTrimW
PathFindExtensionW
PathFindFileNameW
ord348

imm32

ImmDisableIME

kernel32

GetStartupInfoW
VirtualAlloc
VirtualFree
LoadLibraryA
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
GetProcAddress
DelayLoadFailureHook
QueryFullProcessImageNameW
UnregisterWaitEx
GetTickCount
GetExitCodeProcess
RegisterWaitForSingleObject
QueueUserWorkItem
FormatMessageW
LocalFree
SetEvent
WaitForSingleObject
SetUnhandledExceptionFilter
CreateThread
SetThreadPriority
CreateEventW
GetCurrentProcessId
CreateProcessW
QueryPerformanceCounter
FindResourceExW
SizeofResource
lstrlenA
MultiByteToWideChar
Sleep
LeaveCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
GetModuleFileNameW
MulDiv
lstrcmpW
lstrlenW
GlobalLock
GlobalUnlock
FindResourceW
GlobalAlloc
LoadResource
LockResource
GlobalHandle
EnterCriticalSection
GetCurrentProcess
FlushInstructionCache
RaiseException
GetCurrentThreadId
SetLastError
CreateMutexW
GetLastError
CloseHandle
HeapSetInformation
GlobalFree
ResetEvent
GetModuleHandleA
ExpandEnvironmentStringsW
FreeResource
LoadLibraryExW
GetUserDefaultUILanguage
GetLocaleInfoW
EnumUILanguagesW
OutputDebugStringA
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
OpenProcess

Sections

.text
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

67c65bdc980fd02b1e6c38aee3b6c3e3

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

msvcrt

api-ms-win-core-localregistry-l1-1-0

comctl32

ole32

oleaut32

shell32

gdiplus

ntdll

uxtheme

dwmapi

shlwapi

imm32

kernel32

Sections

.text Size: 229KB - Virtual size: 229KB

.data Size: 1KB - Virtual size: 4KB

.rsrc Size: 65KB - Virtual size: 65KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 229KB - Virtual size: 229KB

.data
Size: 1KB - Virtual size: 4KB

.rsrc
Size: 65KB - Virtual size: 65KB

.reloc
Size: 9KB - Virtual size: 9KB