dwm[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dwm.exe
Size

110KB
MD5

81fc187b779d59e4fd2f646bb03ebf03
SHA1

befa5cf53d4c698fefbb707f23d9c17d742bf0c6
SHA256

e30953278af244cbf40991a1002f82783add42ec13a583c51864c0d8cabd8005
SHA512

0a17394e7da0121140c8f030b7504dffa7a7036b63d6253f34dbd4c71b9eb3fd491b7d1f06109bfc5ce09dfc4df10a834e23d58f0d480d702180ab175c072226
SSDEEP

1536:EYBrBpOEgfdof1WHH+bUuCb/moJXVjAUkCjLMw0ljJhUYTBUoKs7uO4a9:E2xgfdodWNkUhL2bhsRs4a9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dwm.exe

Files

dwm.exe
.exe windows:6 windows x64

6217c8bd23848e47b6e4731de0906b23

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

?terminate@@YAXXZ
_commode
_fmode
_acmdln
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
memmove
memcpy
memset
_onexit
__C_specific_handler
__dllonexit
_unlock
_lock
_wtof
_wcsnicmp
_wcsupr_s
wcschr
wcsncpy_s
wcsrchr
??_U@YAPEAX_K@Z
??_V@YAXPEAX@Z
_wcsicmp
_purecall
_vsnwprintf
sqrt

api-ms-win-core-synch-l1-2-0

WaitForMultipleObjectsEx
InitializeSRWLock
ReleaseSRWLockShared
CreateMutexW
DeleteCriticalSection
Sleep
InitializeCriticalSection
ReleaseMutex
AcquireSRWLockShared
SetEvent
LeaveCriticalSection
CreateEventW
WaitForSingleObject
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection

api-ms-win-core-sysinfo-l1-2-1

GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
SetErrorMode
UnhandledExceptionFilter
SetLastError

api-ms-win-core-heap-l1-2-0

HeapFree
HeapAlloc
HeapSetInformation
HeapReAlloc
GetProcessHeap

api-ms-win-core-processthreads-l1-1-2

GetExitCodeThread
GetStartupInfoW
GetThreadId
SetPriorityClass
SetThreadPriority
TerminateThread
TerminateProcess
GetCurrentProcess
CreateThread
OpenProcess
GetCurrentThread
GetCurrentProcessId
ExitProcess
GetCurrentThreadId
ProcessIdToSessionId
ResumeThread

api-ms-win-security-base-l1-2-0

CheckTokenMembership

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
LoadStringW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegGetValueW
RegSetValueExW
RegCloseKey

api-ms-win-core-rtlsupport-l1-2-0

RtlCompareMemory
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlCaptureStackBackTrace

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent

ntdll

ZwQueryWnfStateNameInformation
ZwUpdateWnfStateData
EtwEventWriteNoRegistration
NtOpenEvent
NtWaitForSingleObject
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
RtlQueryResourcePolicy
NtOpenProcess
PssNtCaptureSnapshot
NtClose
RtlUpcaseUnicodeChar
NtRequestWaitReplyPort
NtConnectPort
NtRequestPort
NtReplyWaitReceivePort
NtCompleteConnectPort
NtAcceptConnectPort
WinSqmIsOptedIn
DbgPrompt
NtQuerySystemInformation
DbgPrintEx
WinSqmAddToStreamEx
NtReplyPort
NtCreateWaitablePort
RtlInitUnicodeString
NtQueryInformationProcess
RtlInsertElementGenericTable
RtlIsGenericTableEmpty
RtlLookupElementGenericTable
RtlInitializeGenericTable
NtSetInformationProcess
RtlFreeSid
RtlAllocateAndInitializeSid
EtwEventEnabled
EtwEventRegister
EtwEventUnregister
RtlEnumerateGenericTableWithoutSplaying
RtlDeleteElementGenericTable
WinSqmIncrementDWORD
WinSqmAddToStream
EtwEventWrite
PssNtFreeSnapshot

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-kernel32-legacy-l1-1-1

LoadLibraryW

kernel32

WerSetFlags
SetProcessWorkingSetSize

user32

FillRect
IsIconic
SetTimer
GetUpdateRgn
CreateWindowInBand
InternalGetWindowText
ClientToScreen
EndPaint
RegisterGhostWindow
SetThreadDesktop
GetAncestor
IsDialogMessageW
OpenDesktopW
EndTask
GetCaretBlinkTime
IsWindow
GetWindowLongW
FlashWindowEx
EnumWindows
LogicalToPhysicalPoint
GetMonitorInfoW
AdjustWindowRectEx
MonitorFromWindow
GetClassNameW
SetClassLongPtrW
OffsetRect
GetWindowRect
RegisterFrostWindow
GhostWindowFromHungWindow
GetWindowThreadProcessId
GetThreadDesktop
SetWindowTextW
UpdateWindow
InternalGetWindowIcon
SendMessageW
GetUserObjectInformationW
SystemParametersInfoW
GetPropW
CloseDesktop
OpenThreadDesktop
GetGuiResources
UnregisterSessionPort
RegisterSessionPort
CheckProcessSession
RegisterWindowMessageW
DwmStopRedirection
DwmStartRedirection
DispatchMessageW
TranslateMessage
IsWindowVisible
SetWindowLongPtrW
PostThreadMessageW
CreateDialogParamW
GetSysColorBrush
ShowWindow
SetWindowPos
GetDCEx
GetWindowTextW
GetWindowBand
InvalidateRect
HungWindowFromGhostWindow
BeginPaint
GetClientRect
GetWindowLongPtrW
GetWindowInfo
IsHungAppWindow
GetTitleBarInfo
RegisterErrorReportingDialog
MonitorFromPoint
SetForegroundWindow
MessageBeep
IsWindowEnabled
PeekMessageW
RegisterPowerSettingNotification
GetSystemMetrics
ReleaseDC
GetDC
DestroyWindow
UnregisterPowerSettingNotification
DefWindowProcW
IsZoomed
DestroyIcon
KillTimer
EnumDisplayDevicesW
EnumDisplaySettingsW
MsgWaitForMultipleObjectsEx
PostMessageW
RegisterClassExW
CreateWindowExW
ChangeWindowMessageFilterEx
PostQuitMessage
GetWindow

gdi32

CombineRgn
D3DKMTSetProcessSchedulingPriorityClass
CreateCompatibleBitmap
DeleteObject
GetDIBits
CreateDIBSection
GetRandomRgn
GetStockObject
CreateRectRgn
GdiAlphaBlend
OffsetRgn
GetDeviceCaps
CreateCompatibleDC
SelectClipRgn
SelectObject
GetRgnBox
DeleteDC
BitBlt

imm32

ImmDisableIME

dwmredir

DwmRedirectionManagerShouldRemainOnHibernate
DwmRedirectionManagerShutdown
DwmShutdownTransport
DwmInitializeTransport
DwmRedirectionManagerEnableMMCSS
DwmVersionCheck
DwmRedirectionManagerLockMemoryAllocations
DwmRedirectionManagerWaitForMultipleObjects
DwmRedirectionManagerFailMessage
DwmRedirectionManagerDispatchMessage
DwmRenderDesktopForDDA

dwmcore

MilComposition_WaitForNextMessage
MilChannel_CommitChannel
MilCompositionEngine_UpdateSchedulerSettings
MilConnection_DestroyChannel
MilConnection_CreateChannel
MilChannel_GetMarshalType
MilComposition_PeekNextMessage
MilResource_SendCommand

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventWrite

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 316B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6217c8bd23848e47b6e4731de0906b23

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-security-base-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-debug-l1-1-1

ntdll

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

kernel32

user32

gdi32

imm32

dwmredir

dwmcore

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-delayload-l1-1-1

Sections

.text Size: 78KB - Virtual size: 78KB

.data Size: 3KB - Virtual size: 13KB

.pdata Size: 6KB - Virtual size: 6KB

.idata Size: 12KB - Virtual size: 12KB

.didat Size: 512B - Virtual size: 168B

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 512B - Virtual size: 316B

.text
Size: 78KB - Virtual size: 78KB

.data
Size: 3KB - Virtual size: 13KB

.pdata
Size: 6KB - Virtual size: 6KB

.idata
Size: 12KB - Virtual size: 12KB

.didat
Size: 512B - Virtual size: 168B

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 512B - Virtual size: 316B