dxdiag[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
dxdiag.exe
Size 332KB
Sample260624-hpdj9aax21
SHA256 401dc9f2dfa1807bbaf70223174a28b05e0611aeda21009922f419a91bc92c81
MD5 b1366beff8ca5c05be97365e53d3429b
SHA1 89b5b0377f2c4700f538ba0bed07fd0405f1e068
SHA512 adfa463013a03a67ddf4a9c2661d90f51b3721a59b7f5bd8d5590f66da5e333b4a73c2c2f7408c55027abde9b2e2bc52c302ccb6a262b114654b2ac4d5131fe6
SSDEEP 6144:o5/B+ToQ8b4CLSubWHZeHpbY/m5a9Li45JkdWP:CmoRPLWHZU0iXWP
TLSH
T17B74E61A62E90060F2B38A388A739023D9737C516B3195DF1254A6696FB7ED0F971F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dxdiag.exe

File Explorer

dxdiag.exe

.exe 332KB

dxdiag.exe

IMPHASH fcc446c58fd4b3ff245f727283b22088
SHA256 401dc9f2dfa1807bbaf70223174a28b05e0611aeda21009922f419a91bc92c81
MD5 b1366beff8ca5c05be97365e53d3429b
SHA1 89b5b0377f2c4700f538ba0bed07fd0405f1e068
SHA512 adfa463013a03a67ddf4a9c2661d90f51b3721a59b7f5bd8d5590f66da5e333b4a73c2c2f7408c55027abde9b2e2bc52c302ccb6a262b114654b2ac4d5131fe6
SSDEEP 6144:o5/B+ToQ8b4CLSubWHZeHpbY/m5a9Li45JkdWP:CmoRPLWHZU0iXWP
TLSH
T17B74E61A62E90060F2B38A388A739023D9737C516B3195DF1254A6696FB7ED0F971F33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dxdiag.pdb

advapi32

EventActivityIdControl RegQueryValueExW RegDeleteValueW EventUnregister RegOpenKeyExW RegSetValueExW EventSetInformation RegCreateKeyExW RegFlushKey EventRegister EventWriteTransfer RegCloseKey RegNotifyChangeKeyValue RegEnumValueW RegEnumKeyExW

kernel32

HeapSetInformation DeleteCriticalSection FreeLibrary RegisterApplicationRestart GetVersionExW LoadLibraryW Wow64EnableWow64FsRedirection GetNativeSystemInfo GetSystemInfo CreateMutexExW CloseHandle SetEvent GetLastError GetSystemDirectoryW GetProcAddress GetCurrentDirectoryW HeapAlloc CreateThreadpoolTimer WaitForSingleObject SetThreadpoolTimer OpenSemaphoreW WaitForSingleObjectEx AcquireSRWLockExclusive CloseThreadpoolTimer OutputDebugStringW ReleaseSRWLockExclusive CreateEventW ReleaseMutex GetFileAttributesW WaitForThreadpoolTimerCallbacks InitializeCriticalSectionEx GetModuleFileNameW GetModuleHandleExW ReleaseSemaphore lstrlenW SetLastError HeapFree CreateSemaphoreExW GetModuleFileNameA GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeCriticalSection LeaveCriticalSection GetProcessHeap WideCharToMultiByte Sleep FormatMessageW GetCurrentThreadId WaitForMultipleObjects GetCommandLineW EnterCriticalSection ReleaseSRWLockShared DebugBreak GetFullPathNameW AcquireSRWLockShared WriteFile CreateFileW

gdi32

GetTextMetricsW GetTextExtentPoint32W SelectObject

user32

CheckDlgButton KillTimer GetDlgItem GetClientRect SetWindowsHookExW LoadIconW TranslateMessage SetFocus UnhookWindowsHookEx IsWindowEnabled PeekMessageW IsDialogMessageW SetTimer DispatchMessageW ShowWindow LoadStringW GetWindowLongPtrW GetDesktopWindow DialogBoxParamW SetWindowTextW EndDialog CallNextHookEx SendMessageW ScreenToClient MessageBoxW SetWindowPos GetDC DestroyWindow GetFocus GetWindowRect PostMessageW ShowScrollBar GetKeyState AdjustWindowRectEx CreateDialogParamW SetScrollInfo PostQuitMessage MsgWaitForMultipleObjects GetWindowLongW ScrollWindow UpdateWindow SetForegroundWindow ReleaseDC GetScrollInfo EnableWindow

msvcp_win

??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ ??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z ?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z ?_Incref@facet@locale@std@@UEAAXXZ ?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??Bid@locale@std@@QEAA_KXZ ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ

api-ms-win-crt-string-l1-1-0

wcscmp memset wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e _c_exit _register_thread_local_exe_atexit_callback _initterm

api-ms-win-crt-private-l1-1-0

_o___stdio_common_vswprintf _o___stdio_common_vswprintf_s _o___stdio_common_vswscanf _o__beginthreadex _o__callnewh _o__cexit _o__configthreadlocale _o__configure_narrow_argv _o__crt_atexit _o__errno _o__exit _o__get_narrow_winmain_command_line _o__initialize_narrow_environment _o__initialize_onexit_table _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn __CxxFrameHandler3 _o__purecall _o__putws _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_fmode _o__set_new_mode _o__wcsnicmp _o__wtoi _o__wtoi64 _o_exit _o_free _o_iswdigit _o_malloc _o_rand _o_realloc _o_terminate _o_wcstok __C_specific_handler __current_exception __current_exception_context _CxxThrowException _o___stdio_common_vsprintf memcmp memcpy _o___std_exception_destroy _o___std_exception_copy _o___p__commode wcsrchr __std_terminate wcsstr __CxxFrameHandler4 wcschr memmove

comctl32

ord17 ImageList_Destroy ImageList_Create ImageList_ReplaceIcon

comdlg32

GetSaveFileNameW

shell32

ShellExecuteW

ole32

CoInitializeSecurity CoUninitialize CoCreateInstance CoInitializeEx

oleaut32

VariantInit SysAllocString SysFreeString VariantClear

Name

.text

Size

192KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dxdiag.exe

advapi32

kernel32

gdi32

user32

msvcp_win

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

comctl32

comdlg32

shell32

ole32

oleaut32

generic