DemsLite[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DemsLite.exe
Size 891KB
Sample260808-grgh9avvav
SHA256 2129c470d35ddc49fcf7179f62534a075f4e56209daf7fab0c1c35d9acfafdaf
MD5 a8226007b945d5b61c47443899d0e179
SHA1 77dc9127c8069db64da2a2f6020373a358881ba8
SHA512 1babeb2859e379618a5e670f0f7dd0dba24c03433ced9924eb8973912764e6fb571059a1e1dcc8fec289e815440a1283e77303e7069b912bd78e1a831ca08b13
SSDEEP 12288:+Sz7kYWFwdxU4jr3eskLHTwnVGPZ9WUNdcyEJMf5m4ozAUicnYox2I:hom/jWzsGPZIAQyf5m8UicnYI2
TLSH
T141159D19F2A801FDD077D078CA929A07EA72785A07305ADF23E04A5A3F636F45E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DemsLite.exe

File Explorer

DemsLite.exe

.exe 891KB

DemsLite.exe

IMPHASH 048d6c93ec19396ebde4213c692fa1f5
SHA256 2129c470d35ddc49fcf7179f62534a075f4e56209daf7fab0c1c35d9acfafdaf
MD5 a8226007b945d5b61c47443899d0e179
SHA1 77dc9127c8069db64da2a2f6020373a358881ba8
SHA512 1babeb2859e379618a5e670f0f7dd0dba24c03433ced9924eb8973912764e6fb571059a1e1dcc8fec289e815440a1283e77303e7069b912bd78e1a831ca08b13
SSDEEP 12288:+Sz7kYWFwdxU4jr3eskLHTwnVGPZ9WUNdcyEJMf5m4ozAUicnYox2I:hom/jWzsGPZIAQyf5m8UicnYI2
TLSH
T141159D19F2A801FDD077D078CA929A07EA72785A07305ADF23E04A5A3F636F45E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

486976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winhttp

WinHttpReceiveResponse WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpReadData WinHttpQueryHeaders WinHttpConnect WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable

kernel32

DeleteFileA CloseHandle GetLastError ReleaseMutex CreateMutexW Sleep TerminateProcess OpenProcess MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualProtectEx ReadProcessMemory WriteProcessMemory GetModuleHandleW GetProcAddress K32EnumProcessModules K32GetModuleBaseNameW GlobalAlloc GlobalUnlock GlobalLock GlobalFree WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA IsValidCodePage HeapReAlloc GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetACP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle GetModuleFileNameW ExitProcess GetCurrentProcess IsProcessorFeaturePresent ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW RtlUnwindEx RtlLookupFunctionEntry FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile GetConsoleOutputCP RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId RtlUnwind ReleaseSRWLockExclusive AcquireSRWLockExclusive LocalFree FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI MoveFileExW GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId

user32

DispatchMessageW TranslateMessage GetWindowRect PeekMessageW ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SystemParametersInfoW LoadCursorW FindWindowW GetCursorPos MessageBoxW PostMessageW SetForegroundWindow UpdateWindow ReleaseCapture SetCapture IsIconic SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW

shell32

ShellExecuteA ShellExecuteW

comdlg32

GetOpenFileNameW

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

671KB

Virtual Size

670KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

648B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DemsLite.exe

d3d11

d3dcompiler_47

winhttp

kernel32

user32

shell32

comdlg32

advapi32

imm32

generic