Static task
static1
Behavioral task
behavioral1
Sample
dsefix.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dsefix.exe
Resource
win10v2004-20240508-en
General
-
Target
dsefix.exe
-
Size
94KB
-
MD5
d98e78fd57db58a11f880b45bb659767
-
SHA1
ab70c0d3bd9103c07632eeecee9f51d198ed0e76
-
SHA256
414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0
-
SHA512
aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831
-
SSDEEP
1536:KNSuvn3R+Vjj3d38uezp0Dw+49tKMgVxAlIi8:ah+Vjj3d38uezp0U9vgLAy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dsefix.exe
Files
-
dsefix.exe.exe windows:6 windows x64 arch:x64
b9c03d01e3110584eae1adb0a0a2095e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
GetCommandLineW
GetStdHandle
SetConsoleMode
DeviceIoControl
LoadLibraryExA
GetSystemDirectoryW
GetConsoleMode
GetSystemDirectoryA
GetLastError
ExitProcess
GetModuleHandleW
FreeLibrary
SetConsoleTitleW
GetFileAttributesW
MoveFileExW
IsProcessorFeaturePresent
TerminateProcess
Sleep
CreateFileW
SetLastError
GetProcessHeap
WriteConsoleW
HeapAlloc
HeapFree
WriteFile
GetProcAddress
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
user32
wsprintfW
advapi32
CreateServiceW
RegCloseKey
RegOpenKeyExW
CloseServiceHandle
OpenSCManagerW
DeleteService
ControlService
StartServiceW
OpenServiceW
ntdll
NtQueryDirectoryObject
RtlFreeHeap
NtOpenDirectoryObject
NtQuerySystemInformation
RtlAllocateHeap
RtlGetVersion
NtAllocateVirtualMemory
NtDeleteFile
RtlInitUnicodeString
NtFreeVirtualMemory
NtClose
RtlUnwindEx
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
shrd Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ