DeviceEject[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

DeviceEject.exe
Size

44KB
MD5

b041f384fb8d7947eefa8f2a5f761d28
SHA1

24235ed214bb8d2de28368d368963b8ab63f396b
SHA256

5ffe4624961183181936b5c8dcddd0bf998c30224a8054c51931dd2b5118365f
SHA512

10c21374791db99d54e7171c1d2f6b998180180b06c28eb0b4ac427ed3583594fd462b8f964bc61c23c87f8c5e233b266438b8b1cc7ff789b634d0baf138ff52
SSDEEP

384:/HIa/EHMNNMhZdGOXmQ1OTQWSwW5JY0ehA/9gnl0:/HkINMhZdGq1OUbJYQ/9gnl0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DeviceEject.exe

Files

DeviceEject.exe
.exe windows:10 windows x64 arch:x64

4e97873b8af6e0ccfd6b969879df565b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__set_app_type
swscanf
_amsg_exit
?terminate@@YAXXZ
_commode
_fmode
_acmdln
_XcptFilter
_initterm
__setusermatherr
_ismbblead
_cexit
exit
_exit
__getmainargs
__C_specific_handler

ntdll

RtlCaptureContext
RtlNtStatusToDosError
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
CheckTokenMembership
FreeSid

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleW
GetProcAddress

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW
ExitProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

shell32

CommandLineToArgvW

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e97873b8af6e0ccfd6b969879df565b

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

shell32

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 1KB

.pdata Size: 4KB - Virtual size: 264B

.rsrc Size: 16KB - Virtual size: 12KB

.reloc Size: 4KB - Virtual size: 48B

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 1KB

.pdata
Size: 4KB - Virtual size: 264B

.rsrc
Size: 16KB - Virtual size: 12KB

.reloc
Size: 4KB - Virtual size: 48B