diskshadow[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

diskshadow.exe
Size

431KB
MD5

ee6daef7cdb52ea62b4e7bb0c9601961
SHA1

6a8b13c1f7efd9c3965a81d072ec86d2b44f54bf
SHA256

7d08b3b10f1918135c0270bb0cf1ced0927ef61e7348e908ccae8ca00132f0d8
SHA512

37a181c570252bc6d2dfae3535b8b67a7123d58818b63b04915e5ebfae9c281650dbdeac9b39f7b84b627b742f3ed7bb906f7de9cd4ce5a4b6620f21e4f8adbe
SSDEEP

6144:T9zxMYiej4GcxUp6Ki2tXpC98i0e6AQNs3/6dB7RIHrad5t11XEh/SJfcJ+:T9zm1ej1B6990RsS72I5/dOJ+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
diskshadow.exe

Files

diskshadow.exe
.exe windows x64

fd2a36fbbaee53a16de80ca1d24ace93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ExpandEnvironmentStringsW
GetFullPathNameW
WideCharToMultiByte
MultiByteToWideChar
SetEnvironmentVariableW
GetFileSize
ReadFile
GetComputerNameW
CreateFileA
SetFilePointer
DeleteFileA
GetTempPathA
GetTempFileNameA
GetFileInformationByHandle
FileTimeToDosDateTime
GetFileAttributesA
GetDateFormatW
LocalAlloc
WaitForSingleObject
CreateProcessW
GetExitCodeProcess
SetThreadUILanguage
SetConsoleCtrlHandler
GetStdHandle
GetConsoleMode
WriteConsoleW
GetConsoleOutputCP
GetTempFileNameW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetVolumePathNamesForVolumeNameW
LoadLibraryExW
FreeLibrary
GetCurrentThread
GetCommandLineW
FindNextFileW
FindFirstFileW
GetFileAttributesW
GetVolumePathNameW
FindClose
GetVolumeNameForVolumeMountPointW
GetFileAttributesExW
GlobalFree
WriteFile
CreateFileW
CloseHandle
GetLastError
DeviceIoControl
GetTimeFormatW
GetFileType
GetThreadLocale
FormatMessageW
GetTempPathW
LocalFree

msvcrt

time
wcscspn
malloc
_wtoi
wcschr
memset
_onexit
__dllonexit
wcsspn
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
wcstok
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_CxxThrowException
_wcsnicmp
realloc
free
wcsncmp
iswalpha
wcspbrk
_wcsicmp
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
__iob_func
_vsnprintf
wcsftime
_vsnwprintf
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
__CxxFrameHandler3
mbstowcs_s
_commode
exit
setlocale
setvbuf
localtime
_unlock
memcpy
wcscmp

atl

ord30

oleaut32

GetErrorInfo
SysAllocString
VariantClear
SysFreeString

api-ms-win-core-com-l1-1-0

CLSIDFromString
CoCreateInstance
CoTaskMemAlloc
CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CoInitializeSecurity
CoUninitialize

rpcrt4

RpcStringFreeW
UuidToStringW

cabinet

ord10
ord14
ord13
ord11

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

setupapi

SetupIterateCabinetW

vssapi

ShouldBlockRevertInternal
CreateVssBackupComponentsInternal
VssFreeSnapshotPropertiesInternal

winbrand

BrandingFormatString

vsstrace

ord1
ord4
ord11
ord2
ord5
ord9
ord7
ord8
ord6
ord3
ord10

advapi32

OpenProcessToken
GetTokenInformation
ReportEventW
RegisterEventSourceW
OpenThreadToken
ConvertSidToStringSidW
DeregisterEventSource

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW

Sections

.text
Size: 303KB - Virtual size: 302KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd2a36fbbaee53a16de80ca1d24ace93

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

atl

oleaut32

api-ms-win-core-com-l1-1-0

rpcrt4

cabinet

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

setupapi

vssapi

winbrand

vsstrace

advapi32

api-ms-win-security-lsalookup-l1-1-0

Sections

.text Size: 303KB - Virtual size: 302KB

.rdata Size: 115KB - Virtual size: 114KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 8KB - Virtual size: 8KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 128B

.text
Size: 303KB - Virtual size: 302KB

.rdata
Size: 115KB - Virtual size: 114KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 128B