chameleon_esp[.]exe

General

Target
chameleon_esp.exe
Size 193KB
Sample260708-tdgcjsb17k
SHA256 0a39e5da35c2a8c554446e9b42352516ce067c034d23d24c28f623e49f5991d2
MD5 737ecf0bf3e97d0ba89b0985a9749102
SHA1 28f74a7fbf1829083676ae754be37827ff03db64
SHA512 e4f6e32d5f96253f42d1feb9a0abb1b20dc7365c612e596102934510736c9dbd1e23d70ba1b4091576b526034bd99d82ffe10d04b4c2e4ca48de7daae0d898d5
SSDEEP 3072:Urbt/qSW/o++XcUD2k5O8GR4nNhnlUDK5BGTCY+4lY74+74:uqWX9xwR4/DGAc+c
TLSH
T18C148D1572A600F9E0B39134CD616A47F772781507209AEF03A48B76AF373E1AD7BB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
chameleon_esp.exe

File Explorer

chameleon_esp.exe

.exe 193KB

chameleon_esp.exe

IMPHASH 2041fda958ab18517bdf1bbb749e512f
SHA256 0a39e5da35c2a8c554446e9b42352516ce067c034d23d24c28f623e49f5991d2
MD5 737ecf0bf3e97d0ba89b0985a9749102
SHA1 28f74a7fbf1829083676ae754be37827ff03db64
SHA512 e4f6e32d5f96253f42d1feb9a0abb1b20dc7365c612e596102934510736c9dbd1e23d70ba1b4091576b526034bd99d82ffe10d04b4c2e4ca48de7daae0d898d5
SSDEEP 3072:Urbt/qSW/o++XcUD2k5O8GR4nNhnlUDK5BGTCY+4lY74+74:uqWX9xwR4/DGAc+c
TLSH
T18C148D1572A600F9E0B39134CD616A47F772781507209AEF03A48B76AF373E1AD7BB52
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

30496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

DispatchMessageA PeekMessageA DefWindowProcA GetWindowThreadProcessId EnumWindows SetWindowLongA GetWindowLongA FillRect GetWindowRect GetClientRect GetWindowTextA EndPaint BeginPaint ReleaseDC GetDC GetForegroundWindow GetSystemMetrics SendInput GetAsyncKeyState IsWindowVisible MoveWindow SetLayeredWindowAttributes ShowWindow DestroyWindow IsWindow CreateWindowExA RegisterClassA PostQuitMessage TranslateMessage

gdi32

TextOutA MoveToEx SetTextColor SetBkMode SelectObject Rectangle LineTo GetStockObject Ellipse DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontA CreateCompatibleDC CreateCompatibleBitmap BitBlt

dwmapi

DwmExtendFrameIntoClientArea

kernel32

MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage WideCharToMultiByte FindFirstFileExW FindClose GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap SetFilePointerEx ReadFile ReadConsoleW CreateFileW GetFileSizeEx HeapSize HeapReAlloc WriteConsoleW SetEndOfFile FindNextFileW SetLastError GetFileType CloseHandle GetLastError Sleep GetExitCodeProcess OpenProcess GetTickCount ReadProcessMemory GetModuleHandleA CreateToolhelp32Snapshot Process32First Process32Next Module32First QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW

Name

.text

Size

130KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

chameleon_esp.exe

user32

gdi32

dwmapi

kernel32

generic