DiskSnapshot[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

DiskSnapshot.exe
Size

90KB
MD5

ece311ff51bd847a3874bfac85449c6b
SHA1

61b4d8d4757e15259e1e92c8236f37237b5380d1
SHA256

c7b9591eb4dd78286615401c138c7c1a89f0e358caae1786de2c3b08e904ffdc
SHA512

8334fcd3e551fcaf21fe2aa88218a411a7c6ba8ffb91eb2880f5970ba3ac4893ef214318eb0da298353c515370a18124fee9970bed55002cd9145cafaa181fd8
SSDEEP

1536:ew6HOlxhH1IFf9mNm+QfjgU4H+En4x9Xl0B4ki/5co:esk2fAgUq+En43l0BdmP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DiskSnapshot.exe

Files

DiskSnapshot.exe
.exe windows x64

69bdabb73b409f40ad05f057cec29380

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_errno
??1exception@@UEAA@XZ
_wfopen
memcpy
time
_CxxThrowException
memmove
fwrite
rand
_XcptFilter
_amsg_exit
_wcslwr_s
__wgetmainargs
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
fputws
fclose
memcmp
memset
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
wcsstr
_lock
_commode
?what@exception@@UEBAPEBDXZ
memcpy_s
??0exception@@QEAA@AEBQEBD@Z
towlower
_fmode
_callnewh
__C_specific_handler
srand
_wcsdup
_wstat
_initterm
_vsnwprintf
__setusermatherr
swprintf_s
_cexit
_exit
_purecall
??3@YAXPEAX@Z
wprintf
__CxxFrameHandler3
fwprintf
wcsrchr
__iob_func
_wcsicmp
exit
_unlock
malloc
fread
free
__set_app_type
wcschr
feof
wcscmp

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlGetVersion
RtlOsDeploymentState
RtlGetDeviceFamilyInfoEnum
NtQueryLicenseValue

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
GetEnvironmentVariableW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegGetValueW
RegCloseKey
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyExW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventRegister

rpcrt4

UuidFromStringW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-com-l1-1-0

CoCreateInstance

api-ms-win-core-synch-l1-1-0

OpenMutexW
WaitForSingleObject
ReleaseMutex
CreateMutexW

api-ms-win-core-file-l1-1-0

CreateFileW
GetDiskFreeSpaceExW
ReadFile

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetTickCount
GetSystemTimeAsFileTime

crypt32

CryptBinaryToStringW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
FreeLibrary

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

cryptsp

CryptReleaseContext
CryptGetHashParam
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69bdabb73b409f40ad05f057cec29380

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

rpcrt4

api-ms-win-core-io-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

crypt32

api-ms-win-core-registry-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

cryptsp

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l1-1-0

Sections

.text Size: 54KB - Virtual size: 53KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 440B

.text
Size: 54KB - Virtual size: 53KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 440B