DisplaySwitch[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
DisplaySwitch.exe
Size 1.8MB
Sample231124-qcaxlabc25
SHA256 2cd002eed6069706c22b216329b663264c573a3d7c90c51b695341ec1a5b124e
MD5 29ada62cc0838b7eb6c92dd0b8bfe68d
SHA1 84df388ce0c6bac0d73b8242f783300358e1e259
SHA512 399669154939965cfed6abde0fb9eaa87c489de336f0f5f2e2b20063bbd8705e59461b2c36ea0397c135eb2c3061f83e98a35c2df0f643dafe7ed9576f162bc8
SSDEEP 3072:/LSG5BzXxY27S8aWbD/0b59Ri7x71CEwIKvk2XCTkunf5E:zj51xYWSrWH0b59Ri7x71CP1ET
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

DisplaySwitch.exe

.exe 1.8MB

DisplaySwitch.exe

IMPHASH dbd0e77def5aa7fc556c7b6c2687ce87
SHA256 2cd002eed6069706c22b216329b663264c573a3d7c90c51b695341ec1a5b124e
MD5 29ada62cc0838b7eb6c92dd0b8bfe68d
SHA1 84df388ce0c6bac0d73b8242f783300358e1e259
SHA512 399669154939965cfed6abde0fb9eaa87c489de336f0f5f2e2b20063bbd8705e59461b2c36ea0397c135eb2c3061f83e98a35c2df0f643dafe7ed9576f162bc8
SSDEEP 3072:/LSG5BzXxY27S8aWbD/0b59Ri7x71CEwIKvk2XCTkunf5E:zj51xYWSrWH0b59Ri7x71CP1ET
MD5 SHA1 SHA512 SSDEEP

Digest

c0:9e:a1:77:82:4c:81:64:c7:25:4e:44:c0:d5:2c:60:38:52:ae:c5:8a:57:ba:0f:db:51:be:84:5d:45:1a:f7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 22, 2023

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

85728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

EventUnregister EventRegister EventWriteTransfer RegGetValueW

kernel32

FormatMessageW GetCurrentThreadId HeapAlloc GetProcessHeap HeapFree GetModuleHandleExW GetModuleFileNameA DebugBreak GetModuleHandleW GetProcAddress IsDebuggerPresent OutputDebugStringW AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared SetLastError CloseHandle ReleaseSemaphore ReleaseMutex SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer GetLastError EnterCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WaitForSingleObject OpenSemaphoreW CreateThreadpoolTimer GetCommandLineW CompareStringOrdinal DecodePointer GetCurrentProcessId CreateMutexExW CreateSemaphoreExW LeaveCriticalSection RaiseException InitOnceExecuteOnce EncodePointer LocalFree LoadLibraryW WaitForSingleObjectEx

user32

DispatchMessageW GetMessageW SetDisplayConfig SystemParametersInfoW TranslateMessage PostThreadMessageW

msvcrt

_unlock _lock _commode _amsg_exit _wcmdln _onexit ?terminate@@YAXXZ memset __CxxFrameHandler3 __C_specific_handler _initterm __setusermatherr _cexit memcpy _exit exit __set_app_type memcmp __dllonexit _XcptFilter free _purecall memmove_s memcpy_s _vsnwprintf __wgetmainargs _fmode malloc _callnewh wcscmp

policymanager

PolicyManager_GetPolicyInt

api-ms-win-core-com-l1-1-0

CoResumeClassObjects CoRevokeClassObject CoAddRefServerProcess CoReleaseServerProcess CoUninitialize CoCreateInstance CoInitializeEx CoRegisterClassObject

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference WindowsStringHasEmbeddedNull WindowsIsStringEmpty WindowsCreateString WindowsDeleteString WindowsGetStringRawBuffer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW RoOriginateError

api-ms-win-core-winrt-l1-1-0

RoRevokeActivationFactories RoActivateInstance RoRegisterActivationFactories

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

TerminateProcess GetCurrentProcess GetStartupInfoW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetUnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary GetModuleFileNameW

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

api-ms-win-core-heap-l2-1-0

LocalAlloc

combase

ord140

imm32

ImmDisableIME

Name

.text

Size

120KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.imrsiv

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

24KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DisplaySwitch.exe

advapi32

kernel32

user32

msvcrt

policymanager

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-heap-l2-1-0

combase

imm32

generic