release.zip
- SHA256 ef353462f62b510483e6208c91c80fd489fc81cc4bf6362e2b611aefb5c4d56f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DwmLutGUI.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
1800 seconds
Behavioral task
behavioral2
Sample
DwmLutGUI.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
6 signatures
1800 seconds
Behavioral task
behavioral3
Sample
WindowsDisplayAPI.dll
Resource
win7-20231215-en
windows7-x64
0 signatures
1800 seconds
Behavioral task
behavioral4
Sample
WindowsDisplayAPI.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral5
Sample
dwm_lut.dll
Resource
win7-20231215-en
windows7-x64
0 signatures
1800 seconds
Behavioral task
behavioral6
Sample
dwm_lut.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
1800 seconds
General
- Target release.zip
- Size 120KB
- Sample240220-dndreaae88
- SHA256 ef353462f62b510483e6208c91c80fd489fc81cc4bf6362e2b611aefb5c4d56f
- MD5 07248bd2c2c1f4b6351d674847e3b69e
- SHA1 0cebdc6f9ad26c9b8f9b4b75468127debba696e1
- SHA512 0b200eeb9a8c6df810e6dbf8c334b0b09001814d000b4b6d496250985692c7d5b1ed1a3172c553d8ab11e1ce9f722dae8886621596af882094ace5d3f63c29a2
- SSDEEP 3072:X9vKXx8xmYwKe2myjY9MZJzXM5phNq9z7kCah3dWGeVxDtqs:X4smYJepKI5bvCg3dreV1f
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/DwmLutGUI.exe unpack001/WindowsDisplayAPI.dll unpack001/dwm_lut.dll
File Explorer
-
release.zip.zip 120KB
-
DwmLutGUI.exe.exe 41KB
-
LICENSE34KB
-
LICENSE-THIRD-PARTY22KB
-
WindowsDisplayAPI.dll.dll 65KB
-
dwm_lut.dll.dll 110KB
DwmLutGUI.exe
- SHA256 5bd14307f344f802ba2a43f18b118cd15fd2056c2e01dfeaa7b16afbe637e280
- MD5 3b4757e1a391ad8afe84a433ea044335
- SHA1 1d04873b685e26377ed7be16f1dea43f149dd07e
- SHA512 a4f95040ebb2839b6f87dacd687e22110e6f02c5a7032f4d9645c20b4bfe58cd8fb39eec9e1c59f4cb7fb6e6a23aa89e06d16713fa5fed337f0b192353574a3a
- SSDEEP 768:Xu3QbzTyrqZmr3dYzBA9dMFciV5yQIXXFABQJVDDDDDRVDDDDDsetYcFwVc6K:XaQXurqZmr3dEKjit5yQIXVABQ0iwVcl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
LICENSE
- SHA256 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986
- MD5 1ebbd3e34237af26da5dc08a4e440464
- SHA1 31a3d460bb3c7d98845187c716a30db81c44b615
- SHA512 d361e5e8201481c6346ee6a886592c51265112be550d5224f1a7a6e116255c2f1ab8788df579d9b8372ed7bfd19bac4b6e70e00b472642966ab5b319b99a2686
- SSDEEP 768:Fo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7J:Fhcycsrfrnoum
- MD5 SHA1 SHA512 SSDEEP
LICENSE-THIRD-PARTY
- SHA256 d04c74e70b4d8336b500bcfb551542e9fd5192432f46c85c11a50e46ca8a5199
- MD5 2bd014bf5c375beb4a55f9ed038f9c71
- SHA1 157ab8821ceb480611ad64c48e52afc4fe7eefe7
- SHA512 ca699c849ff172ac00ea07df82197531d68700c236b068869d363cbcf3dff66080f0ff96bd5c6cfdbac9621ea388927b3d18692941fccbaf02dac51d8dd1c88a
- SSDEEP 384:Vrs0rs71Ob9Yrs0rs719brZYrs0rs719bvHYVrUcrUBe6W7QH4zmjrs0rs73emD2:VDQOb9YDQ9brZYDQ9bvINECQHumjD3mC
- MD5 SHA1 SHA512 SSDEEP
WindowsDisplayAPI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b53a976a8e669cf59783409fbe453222eb736d4f9642e374f8c52087dba8fe86
- MD5 42b33b211f83246d7ea53420869d1733
- SHA1 1cbc13b2f46bd04f93ed5916b3a0f54d160e2a94
- SHA512 779451e87631f4cf6ee789f57ed1ba76e63ba1ee77bb31a72c06758fd3559fb2d5327ec6c8cf290bac08f957d4f3f481c03d33ede65b6566f1143ab123ef347f
- SSDEEP 1536:TkXKFDm1eNMrX5Y5SdQB6PBAiCs4mRTZ4CoKnVI2FM236:tpNMrpkAPcZmRTmCoK4/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
72262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Personal\Open-Source Projects\WindowsDisplayAPI\WindowsDisplayAPI\obj\Release\net45\WindowsDisplayAPI.pdb
mscoree
_CorDllMain
Name
.text
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dwm_lut.dll
- IMPHASH 383d12505bdf177f8fdbc0121a35d13a
- SHA256 3c69fd72fc92c093df4dc23ad9b67697201c7c2f9011069b4f6bcfdc1cfd2e1f
- MD5 487a50fb72b574969794f7bc26dde0a9
- SHA1 fe0f09157fda2fd8834ead10d62283d4f32005ad
- SHA512 e1ac3023e50bf2b22f223f2f0548d3ad4776ac1cde1503e791810fdd7bab902b3c1a515c787c2768e9de719f398896c80e6e9a02c7852d82dc7dfb30e4b81612
- SSDEEP 3072:lD8pI5tqtlZw1cFASHQvRkEkma66FzL4Yd+5UrE6:lD8qZXkmKRaT6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
RegGetValueA
d3dcompiler_47
D3DCompile
kernel32
CloseHandle
CreateToolhelp32Snapshot
DeleteCriticalSection
EnterCriticalSection
ExpandEnvironmentStringsA
FindClose
FindFirstFileA
FindNextFileA
FlushInstructionCache
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemInfo
GetThreadContext
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
InitializeCriticalSection
IsDBCSLeadByteEx
K32GetModuleInformation
LeaveCriticalSection
MultiByteToWideChar
OpenThread
ResumeThread
SetThreadContext
Sleep
SuspendThread
Thread32First
Thread32Next
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_initterm
_lock
_unlock
abort
calloc
fclose
fgets
fopen
free
fwrite
getc
islower
isspace
isupper
isxdigit
localeconv
malloc
memcpy
memset
realloc
strcpy
strlen
strncmp
strstr
strtol
strtoul
tolower
ungetc
vfprintf
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
116B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ