HWIDR_External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
HWIDR_External.exe
Size 10.3MB
Sample260720-ryvdssft61
SHA256 4091a5846d3ad9adda334343a2f6d6b26337852eead56fb5850f18467241c6b2
MD5 eeba1902f9c6fa0d7ca52ee23a839be4
SHA1 1f4ed2ca915404b85caa2739670e918e974f1789
SHA512 9f7b12f194182c553898f22f46b91ba0a1b18ab67db8d8096a1c0bc82da53b926cd8a8ab3e3d110b6a97e5de4e13a73b792857870362cff3039ee19d2346da82
SSDEEP 49152:0K7PnNvpNAErDe9DbY8WRxBJNNqaiq+fpwn5iB27tgKPU/S7CQnfGTXbFNL3DUM0:Tt3AbyHz+fZgh
TLSH
T129B6EA4E68520ECBE6C3DA392C6D3E135C2B3B7B551C433BADEC2492536A78419CB647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HWIDR_External.exe

File Explorer

HWIDR_External.exe

.exe 10.3MB

HWIDR_External.exe

IMPHASH 9896c76084c10007da74755fae2f250e
SHA256 4091a5846d3ad9adda334343a2f6d6b26337852eead56fb5850f18467241c6b2
MD5 eeba1902f9c6fa0d7ca52ee23a839be4
SHA1 1f4ed2ca915404b85caa2739670e918e974f1789
SHA512 9f7b12f194182c553898f22f46b91ba0a1b18ab67db8d8096a1c0bc82da53b926cd8a8ab3e3d110b6a97e5de4e13a73b792857870362cff3039ee19d2346da82
SSDEEP 49152:0K7PnNvpNAErDe9DbY8WRxBJNNqaiq+fpwn5iB27tgKPU/S7CQnfGTXbFNL3DUM0:Tt3AbyHz+fZgh
TLSH
T129B6EA4E68520ECBE6C3DA392C6D3E135C2B3B7B551C433BADEC2492536A78419CB647
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9669852

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\rd\Desktop\HWIDR-External-main\examples\example_win32_directx11\Release\example_win32_directx11.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

GetExitCodeThread Sleep K32GetModuleFileNameExA GetLastError GetFileAttributesA Process32NextW GetCurrentThread Process32FirstW CloseHandle K32GetModuleBaseNameA K32GetModuleInformation Module32FirstW VirtualProtectEx GetThreadContext LocalFree ExitProcess GetCurrentProcessId GetModuleHandleW GetConsoleWindow Module32NextW K32EnumProcessModules SetThreadContext lstrcmpiW OpenThread IsDebuggerPresent CheckRemoteDebuggerPresent GetModuleFileNameA GetTempPathW DeleteFileW GetTempFileNameW FormatMessageA GetLocaleInfoEx GetStartupInfoW FindFirstFileW OpenProcess GetEnvironmentVariableA AreFileApisANSI GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive DeviceIoControl GetCurrentProcess GetCommandLineW VirtualProtect FindFirstFileA SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead CreateToolhelp32Snapshot ResumeThread CreateFileW FindClose K32EnumDeviceDrivers QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA Thread32First K32GetDeviceDriverBaseNameA Thread32Next VirtualAlloc TerminateProcess GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetFileAttributesExW WriteProcessMemory WriteFile

user32

MapVirtualKeyA GetWindowThreadProcessId DefWindowProcW DispatchMessageA GetWindowRect DestroyWindow GetKeyNameTextA SetWindowPos EnumChildWindows SetWindowLongPtrW CreateWindowExW GetSystemMetrics GetClientRect SetCursor SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetAsyncKeyState GetKeyState GetCursorPos SetCursorPos LoadCursorW GetWindowLongPtrW RegisterClassExW GetActiveWindow ShowWindow DispatchMessageW PeekMessageW GetWindowTextA GetWindowLongA SetWindowDisplayAffinity MessageBoxA EnumWindows SetLayeredWindowAttributes TranslateMessage SetWindowLongW PeekMessageA UnregisterClassA SendInput GetForegroundWindow ClientToScreen PostQuitMessage EnumDisplaySettingsW FindWindowA ScreenToClient UpdateWindow

gdi32

GetStockObject

advapi32

QueryServiceConfigA ControlService OpenProcessToken SetThreadToken RegOpenKeyExA CreateProcessAsUserW ConvertSidToStringSidW DuplicateTokenEx OpenServiceA GetTokenInformation SetTokenInformation OpenSCManagerW RegQueryValueExA CloseServiceHandle PrivilegeCheck RegCloseKey EnumServicesStatusExA RevertToSelf LookupPrivilegeValueW

msvcp140

?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Thrd_join _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Random_device@std@@YAIXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

ntdll

NtMapViewOfSection RtlReleaseRelativeName RtlDosPathNameToRelativeNtPathName_U_WithStatus NtCreateSection NtLoadDriver NtCreateFile RtlLookupFunctionEntry RtlVirtualUnwind RtlFreeHeap NtClose NtDeviceIoControlFile RtlGetFullPathName_UEx RtlInitUnicodeString RtlCreateRegistryKey NtUnloadDriver NtQuerySystemInformation RtlAllocateHeap RtlWriteRegistryValue RtlCaptureContext NtUnmapViewOfSection RtlAdjustPrivilege

crypt32

CertOpenSystemStoreA CertEnumCertificatesInStore CertCloseStore CertGetNameStringA

wevtapi

EvtClose EvtQuery

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr wcsstr strchr strrchr longjmp __std_exception_destroy memmove __std_terminate memchr memcmp __current_exception __current_exception_context __C_specific_handler __intrinsic_setjmp _CxxThrowException memcpy memset __std_exception_copy

api-ms-win-crt-stdio-l1-1-0

fsetpos _fseeki64 _get_stream_buffer_pointers ungetc __stdio_common_vfprintf __p__commode fwrite _wfopen ftell __stdio_common_vsprintf setvbuf fseek fread fgetpos fopen_s __stdio_common_vswprintf fgets fclose fflush fgetc __stdio_common_vsprintf_s __stdio_common_vsscanf fopen _set_fmode fputc __acrt_iob_func

api-ms-win-crt-heap-l1-1-0

free _callnewh _set_new_mode malloc realloc

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _wassert system terminate _errno _beginthreadex exit _register_thread_local_exe_atexit_callback abort _c_exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type __p___argv _get_initial_narrow_environment _initterm _initterm_e _exit __p___argc

api-ms-win-crt-utility-l1-1-0

rand srand qsort

api-ms-win-crt-string-l1-1-0

strncmp strcpy_s _wcsicmp strcmp wcscpy_s strncpy wcscat_s tolower _stricmp

api-ms-win-crt-convert-l1-1-0

atof strtoll strtoull wcstombs_s strtod strtol

api-ms-win-crt-math-l1-1-0

sin fmodf floorf expf tan cosf powf sqrt _dsign cos pow ceilf logf sqrtf __setusermatherr atan2f acosf _dclass sinf tanf ldexp

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

_dupenv_s

shlwapi

SHDeleteKeyW

Name

.text

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

338KB

Virtual Size

337KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

677KB

Virtual Size

691KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.1337

Size

512B

Virtual Size

60B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

HWIDR_External.exe

d3d11

d3dcompiler_47

kernel32

user32

gdi32

advapi32

msvcp140

imm32

dwmapi

ntdll

crypt32

wevtapi

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

shlwapi

generic