Static task
static1
Behavioral task
behavioral1
Sample
DFDWiz.exe
Resource
win10v2004-20231020-en
General
-
Target
DFDWiz.exe
-
Size
72KB
-
MD5
a6e3cba5d22776f545d290fa7e1c25fa
-
SHA1
9f7d66cf27b30a9928d072d053d4ede2c7483b39
-
SHA256
1324bde18fcd29a46035896fb07cb99cd484cba396d5d062dd5e6f7ca4f7bff3
-
SHA512
de1a104ef93286a9b783fb0f65ba63a142f651295f4b9e3af93848e1e1b7bc37e7231ece791d9737ce3ccae024e8a0ffebb1b4c6705a0c19f5dd123a1804b476
-
SSDEEP
768:/qiFP6RvgtFKSTBaS9dPjDUpBVH7YpAZVlJ2AIq/Ne4hiiCmT7iKi0Pe840XJ5ZN:/q4NrvUZ7YpiH88PF+0Pe84055N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DFDWiz.exe
Files
-
DFDWiz.exe.exe windows:10 windows x64 arch:x64
5202942cf3b997c119d156a2b094ad7e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
TraceMessage
OpenProcessToken
RegOpenKeyExW
EventWrite
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyExW
RegDeleteKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupPrivilegeValueW
AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventRegister
EventUnregister
RegEnumValueW
kernel32
GetCurrentThreadId
HeapAlloc
GetCurrentProcess
CreateFileW
HeapFree
OpenMutexW
GetProcAddress
LocalFree
GetVersionExW
FormatMessageW
GetProcessHeap
HeapSetInformation
RegisterApplicationRestart
Sleep
CloseHandle
OutputDebugStringA
QueryActCtxW
GetModuleHandleExW
GetModuleFileNameW
CreateActCtxW
FindActCtxSectionStringW
LoadLibraryW
ActivateActCtx
GetLastError
DeactivateActCtx
CreateMutexW
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
SetLastError
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
DeviceIoControl
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetVolumePathNamesForVolumeNameW
user32
MessageBoxW
msvcrt
memcmp
__C_specific_handler
memcpy
_vsnwprintf
malloc
_callnewh
free
_XcptFilter
_amsg_exit
_ismbblead
?terminate@@YAXXZ
_commode
_fmode
_acmdln
_initterm
__setusermatherr
memset
_cexit
_exit
exit
__set_app_type
__getmainargs
__CxxFrameHandler4
_wcsicmp
ole32
CoInitializeEx
CoCreateGuid
CoCreateInstance
CoUninitialize
StringFromGUID2
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmSetDWORD
WinSqmAddToStream
WinSqmStartSession
WinSqmEndSession
setupapi
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInterfaceDetailW
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
Sections
.text Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ