chameleon_esp_release[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
chameleon_esp_release.exe
Size 829KB
Sample260730-ck8a6sbm5s
SHA256 fbf23f01ecd9dc67476cd87c27d8c9c7442f5b06987a145453423dc5a7b2a6a1
MD5 25737f83888413d6d529a73227a57a69
SHA1 3b98531860b7581e0954524a725d2c3439bcfec0
SHA512 25cff5b1f867e3e2525185d9a7f00e79e267d4315fefa8dd8a218877afc7d7a0a6cebea3cd0745879aa97907a55f1220d4c25b861a6ef3c2b39f5b90130fb287
SSDEEP 12288:YQ+7lCbF2B59yDtC/nCnMpE9+mSDT/ahqvo4y6bJZ801hmvIOnbDMWf:YzlCBAAGCMpOyv/SqvxXbyIOnbD1
TLSH
T1E8058D0AF2A801F9D0779638C9A2A717D672781A0B7096DF13D406593F736E05FBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
chameleon_esp_release.exe

File Explorer

chameleon_esp_release.exe

.exe 829KB

chameleon_esp_release.exe

IMPHASH f555fcaab8e720d8057e5e90d8b20e59
SHA256 fbf23f01ecd9dc67476cd87c27d8c9c7442f5b06987a145453423dc5a7b2a6a1
MD5 25737f83888413d6d529a73227a57a69
SHA1 3b98531860b7581e0954524a725d2c3439bcfec0
SHA512 25cff5b1f867e3e2525185d9a7f00e79e267d4315fefa8dd8a218877afc7d7a0a6cebea3cd0745879aa97907a55f1220d4c25b861a6ef3c2b39f5b90130fb287
SSDEEP 12288:YQ+7lCbF2B59yDtC/nCnMpE9+mSDT/ahqvo4y6bJZ801hmvIOnbDMWf:YzlCBAAGCMpOyv/SqvxXbyIOnbD1
TLSH
T1E8058D0AF2A801F9D0779638C9A2A717D672781A0B7096DF13D406593F736E05FBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

Minor OS version

Major OS version

Entry point

360728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage DispatchMessageA PeekMessageA PostThreadMessageA DefWindowProcA PostQuitMessage RegisterClassA CreateWindowExA MoveWindow DestroyWindow ShowWindow SetLayeredWindowAttributes SetWindowDisplayAffinity GetAsyncKeyState GetSystemMetrics CreatePopupMenu DestroyMenu AppendMenuW TrackPopupMenu ClientToScreen SetCursorPos ReleaseCapture SetCapture GetCapture GetKeyState GetActiveWindow EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetWindowLongA GetWindowLongA GetWindowRect GetForegroundWindow mouse_event GetMessageA IsWindow GetWindowThreadProcessId EnumWindows GetWindowTextA IsWindowVisible SetProcessDPIAware LoadCursorA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA ScreenToClient GetCursorPos SetCursor MessageBoxW GetClientRect EndPaint BeginPaint SetForegroundWindow

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9Ex

ws2_32

setsockopt closesocket connect htons inet_addr WSACleanup send recv socket WSAStartup

winmm

timeBeginPeriod timeEndPeriod

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

kernel32

GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc OutputDebugStringW ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue CreateFileW HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteFile ReadFile WriteConsoleW GetFileType GetStdHandle FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader GetStartupInfoW IsDebuggerPresent InitializeSListHead GetCurrentProcessId IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter HeapSize SetEndOfFile FlsAlloc GlobalLock GetFileAttributesA CloseHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetExitCodeProcess CreateThread OpenProcess GetWindowsDirectoryA GetModuleHandleA CreateToolhelp32Snapshot Module32First ReadProcessMemory WriteProcessMemory Process32First Process32Next GetTickCount GetModuleFileNameA GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringA GetLocalTime GetTickCount64 MultiByteToWideChar WideCharToMultiByte DeleteFileW GetFileAttributesW CreateRemoteThread GetExitCodeThread VirtualAllocEx VirtualFreeEx FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW Module32FirstW Module32NextW GlobalAlloc GlobalUnlock RtlUnwind GlobalFree GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetSystemTimeAsFileTime GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

Name

.text

Size

567KB

Virtual Size

567KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

223KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

866KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

chameleon_esp_release.exe

user32

dwmapi

d3d9

ws2_32

winmm

imm32

kernel32

generic