DIMC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

DIMC.exe
Size

25KB
MD5

ea8a0c993231da2150f5f6dc378ef811
SHA1

5496f9f70767f0888b005f1e8ba59800fc4c8988
SHA256

67a0b476403215532896b12b7c20c2c49651b866ad323f729b668baead241b3e
SHA512

4dc3c2c68051902010760abc35aed644eae8877a469ffb8138f8cfa45aac11d70fd99a76abf935175e07f944a935a3f0f60a4d6a34c10ff3ae7148e34a6dd734
SSDEEP

384:SNxGBuBvyliu1gEcsyGLDVCPTgx2FAzYv7fHmwsFUO9/0Kh1l2mfOi4YPMhp4Rt3:1lsVGHWT7kYvT3YZmi4YPMhp4R/1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DIMC.exe

Files

DIMC.exe
.exe windows x64

40a37d1a738e3858103fa2253cd7fca2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_commode
_stricmp
_fmode
?terminate@@YAXXZ
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
wcsrchr
wcstoul
towupper
free
malloc
wcschr
_vsnwprintf
__C_specific_handler
memset

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleW
LoadStringW

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle

api-ms-win-core-file-l1-1-0

WriteFile
DeleteFileW
GetFileType

api-ms-win-core-console-l1-1-0

GetConsoleMode
GetConsoleOutputCP
WriteConsoleW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW

api-ms-win-core-localization-l1-2-0

FormatMessageW
SetThreadPreferredUILanguages

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpICW

api-ms-win-core-registry-l1-1-0

RegLoadKeyW
RegSaveKeyExW
RegUnLoadKeyW
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
RegSetValueExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

unattend

UnattendFreeNode
UnattendCtxOpenNode
UnattendCtxGetStringByNode
UnattendCtxCleanup
UnattendCtxDeserializeWithResults
UnattendFreeResults

dnsapi

DnsValidateName_W

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

ntdll

NtOpenProcessToken
NtDuplicateToken
NtSetInformationThread
RtlNtStatusToDosError
NtAdjustPrivilegesToken
NtOpenFile
NtDeviceIoControlFile
RtlInitUnicodeString
NtClose

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40a37d1a738e3858103fa2253cd7fca2

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

rpcrt4

unattend

dnsapi

api-ms-win-core-delayload-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 456B

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 44B

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 456B

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 44B