Release.zip
- SHA256 a95e3e88ecb9875925d4fc8598d48eb228cf763993662d0766bdc78948737f38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Release/DwmLutGUI.exe
Resource
win11-20240802-en
windows11-21h2-x64
56 signatures
1800 seconds
General
- Target Release.zip
- Size 83KB
- Sample240808-c1jbzssclf
- SHA256 a95e3e88ecb9875925d4fc8598d48eb228cf763993662d0766bdc78948737f38
- MD5 69b1b9dc3f4895d23f2ad606793ba22b
- SHA1 371153ef608929c6b6163abc27fa2bfb152ee15d
- SHA512 5acad387d737039cc1e2d261ad4cbf095833b2756e096f33f12c3b55818c1de5ac13b5ad96f4b776760e634b9cf8f6daa43924b1986bde7ea246e330bac3e67a
- SSDEEP 1536:zhZqSPCcRYTljbYNiUDbxSBjl0X60S99L6fmt2TAMQeTVNy+Jgcp9QbtQ+254:SSaFbPQFol0KDo1vNFJJp9954
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release/DwmLutGUI.exe unpack001/Release/WindowsDisplayAPI.dll unpack001/Release/dwm_lut.dll
File Explorer
-
Release.zip.zip 83KB
-
Release/DwmLutGUI.exe.exe 48KB
-
Release/DwmLutGUI.exe.config187B
-
Release/WindowsDisplayAPI.dll.dll 65KB
-
Release/WindowsDisplayAPI.xml.xml 107KB
-
Release/dwm_lut.dll.dll 47KB
Release/DwmLutGUI.exe
- SHA256 4ac8778ddb796a771072f22cce6bba6fe36bcd7f10b66379ccc6c40fe7ff0a2b
- MD5 940026092c35c84f5de3369dbec24576
- SHA1 679ec6ca51d3e47dfac2a1cdbe3b0b153be1b2b6
- SHA512 40a8893e3ebceb30d3f73eee5d5b6de8a2cff76387ec04955327b834bd487d0b3d7f9bcd251266a9b6aff634a527f3c1a089dc034836cd9d4df8d3918e9eb94c
- SSDEEP 768:O/FOFRvMtpRGM7pnXm1V0q5nCI2CH8kSiJVDDDDDxVDDDDDsytYcFwVc6K:8E2XHq5nCI2K8kSiUewVcl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Release/DwmLutGUI.exe.config
- SHA256 f82338e8e9c746b5d95cd2ccc7bf94dd5de2b9b8982fffddf2118e475de50e15
- MD5 15c8c4ba1aa574c0c00fd45bb9cce1ab
- SHA1 0dad65a3d4e9080fa29c42aa485c6102d2fa8bc8
- SHA512 52baac63399340427b94bfdeb7a42186d5359ce439c3d775497f347089edfbf72a6637b23bb008ab55b8d4dd3b79a7b2eb7c7ef922ea23d0716d5c3536b359d4
- MD5 SHA1 SHA512
Release/WindowsDisplayAPI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b53a976a8e669cf59783409fbe453222eb736d4f9642e374f8c52087dba8fe86
- MD5 42b33b211f83246d7ea53420869d1733
- SHA1 1cbc13b2f46bd04f93ed5916b3a0f54d160e2a94
- SHA512 779451e87631f4cf6ee789f57ed1ba76e63ba1ee77bb31a72c06758fd3559fb2d5327ec6c8cf290bac08f957d4f3f481c03d33ede65b6566f1143ab123ef347f
- SSDEEP 1536:TkXKFDm1eNMrX5Y5SdQB6PBAiCs4mRTZ4CoKnVI2FM236:tpNMrpkAPcZmRTmCoK4/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
72262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Personal\Open-Source Projects\WindowsDisplayAPI\WindowsDisplayAPI\obj\Release\net45\WindowsDisplayAPI.pdb
mscoree
_CorDllMain
Name
.text
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/WindowsDisplayAPI.xml
- SHA256 338806b7f6e4b64181ba3608412aaaeaa942da28e8c1576dac7c1036691750f2
- MD5 fe8c19d56a84d2ea829943fdf453db12
- SHA1 d63eb79d054a79c70f998f66df7c67ef080fb132
- SHA512 3d6d57e7b80d3a35ab4b8c736c5ed2a85b531280b1eedf504b28c4338c0a22a91476c692f2743c78ed63930576505127002329db78fc95d49f185ce615a9bea6
- SSDEEP 384:ZJ76747YKZwgeWmysTq0Wodyb1DrhYyd1eiZ3RszsEsfsiwfJhxmmm7GrZgtiLFm:nS+QE4tePmjy6Q
- MD5 SHA1 SHA512 SSDEEP
Release/dwm_lut.dll
- IMPHASH 6342a933064a1ce7bf380f84d6cfbfcb
- SHA256 10fc06b3142475231b1d19eb22791886e8da5ca40034a8bcbdcc69941ee43360
- MD5 3e83531c7c7d26c453f40fe70cb86589
- SHA1 b9afe877f9aeff9619b8fd42232c56d15fd13b7a
- SHA512 c01402efa1eb6d08c86f517ebb06000d2d11869bfc072481b666f6b6fc546f0cf1a6e53cb2b2ce3e5745ba08294b285bb93117a43797cfe561434e0d00b6d191
- SSDEEP 768:0De3QRJuUBM/jlYSv9/96/lf9wq61BHlKl5ZSLQ8CR:Oe3wkUBWlYSF/gdf9OFmMgR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
22840
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Authority\Desktop\RE stuff\lutdwm\x64\Release\dwm_lut.pdb
kernel32
FindNextFileA
GetModuleHandleW
K32GetModuleInformation
GetCurrentProcess
VerSetConditionMask
VerifyVersionInfoW
ExpandEnvironmentStringsA
Sleep
CloseHandle
FindClose
FindFirstFileA
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
SetThreadContext
FlushInstructionCache
VirtualProtect
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetThreadContext
HeapCreate
advapi32
RegGetValueA
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uncaught_exceptions@std@@YAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
d3dcompiler_47
D3DCompile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_destroy_list
_CxxThrowException
__C_specific_handler
__std_exception_destroy
__std_exception_copy
__std_terminate
memcmp
strstr
memset
memcpy
api-ms-win-crt-stdio-l1-1-0
fopen
__stdio_common_vsprintf
fgets
__stdio_common_vsscanf
fclose
api-ms-win-crt-heap-l1-1-0
free
malloc
realloc
_callnewh
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_invalid_parameter_noinfo_noreturn
_execute_onexit_table
_initialize_onexit_table
_cexit
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=261, version=31935,
count=8, id=260, version=31935,
count=4, id=259, version=31935,
count=1, id=261, version=30795,
count=6, id=257, version=31935,
count=4, id=260, version=31942,
count=7, id=257, version=30795,
count=144, id=1, productName=Unmarked objects,
count=2, id=265, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,