Dism++x64[.]exe | Triage™

General

Target
Dism++x64.exe
Size 1.0MB
Sample260809-cy7a2aydpb
SHA256 16bbdb339173d25b4332b377da96e80809aabfe6739cf35d5e70484f08cfdc42
MD5 a1a058ff98dc1f9320195b398aa06167
SHA1 d974136e6dc4b1726b50a770ec8d6f0f4fc859a7
SHA512 8517354f8579905a5ff1b581aee79ac4632d83bf1672490b653caf5807e902745ae1df109083ea895ac63f0a106786390d5e769a220dc21af8f8a7a9585dddc8
SSDEEP 12288:KU4qFPGYdX6h867AoanHh8HcMcv1mFwPxEeGzAS3pQYQYa8I1HwJVKC2+RQ:KRqFLqaB88F8SYzAS3dQYa8I1HGbi
TLSH
T1E9355A0633F804DCD5A78179CA128B2FF6B1BA835A21D2CF416586C55F3FA634D2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Dism++x64.exe

File Explorer

Dism++x64.exe

.exe 1.0MB

Dism++x64.exe

IMPHASH d1e008c8cf1935eb6666ee1a9be8a2a5
SHA256 16bbdb339173d25b4332b377da96e80809aabfe6739cf35d5e70484f08cfdc42
MD5 a1a058ff98dc1f9320195b398aa06167
SHA1 d974136e6dc4b1726b50a770ec8d6f0f4fc859a7
SHA512 8517354f8579905a5ff1b581aee79ac4632d83bf1672490b653caf5807e902745ae1df109083ea895ac63f0a106786390d5e769a220dc21af8f8a7a9585dddc8
SSDEEP 12288:KU4qFPGYdX6h867AoanHh8HcMcv1mFwPxEeGzAS3pQYQYa8I1HwJVKC2+RQ:KRqFLqaB88F8SYzAS3dQYa8I1HGbi
TLSH
T1E9355A0633F804DCD5A78179CA128B2FF6B1BA835A21D2CF416586C55F3FA634D2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

774976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\用户数据\Documents\Visual Studio 2015\Projects\Dism++\Release\Dism++x64.pdb

kernel32

HeapReAlloc HeapFree InitOnceExecuteOnce SetEvent ResetEvent WaitForSingleObject CreateEventW Sleep TerminateProcess GetSystemInfo GetSystemTimeAsFileTime GetSystemDirectoryW IsWow64Process FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW GetCurrentThreadId HeapDestroy HeapSize GetProcessHeap EnterCriticalSection LeaveCriticalSection VerifyVersionInfoW VerSetConditionMask SizeofResource LockResource LoadResource FindResourceW FindResourceExW WritePrivateProfileSectionW GetFileAttributesW DeviceIoControl GetVolumePathNameW GetVolumeInformationByHandleW GetModuleFileNameW GetEnvironmentVariableW UnmapViewOfFile MoveFileExW DeleteFileW GetNativeSystemInfo GlobalMemoryStatusEx GetUserDefaultLCID LCIDToLocaleName GetThreadLocale GetLocaleInfoEx CreateProcessW GetWindowsDirectoryW FindClose FindFirstFileW FindNextFileW IsValidLocaleName MoveFileW CreateDirectoryW GetVolumeInformationW SetVolumeLabelW RemoveDirectoryW DeleteCriticalSection GetTickCount CreateFileMappingW MapViewOfFile LocalFree GetCurrentProcess ReadFile WriteFile SetFilePointer GetTempPathA GetTempFileNameA DeleteFileA GetFileInformationByHandle FileTimeToLocalFileTime FileTimeToDosDateTime lstrcpyA lstrcpynA ReleaseMutex HeapAlloc ReleaseSRWLockExclusive InitializeCriticalSectionEx InitializeSRWLock AcquireSRWLockExclusive AcquireSRWLockShared VirtualFreeEx VirtualAllocEx DuplicateHandle WaitForMultipleObjects ExpandEnvironmentStringsW SetFilePointerEx GetFileSizeEx SetEnvironmentVariableW GetVolumeNameForVolumeMountPointW CreateMutexW GetFullPathNameW lstrcmpiA CopyFileW GetFileSize GetLocaleInfoW GetExitCodeProcess WideCharToMultiByte lstrcmpA SystemTimeToFileTime GetExitCodeThread EnumUILanguagesW CopyFileExW FreeResource SetThreadUILanguage SetThreadLocale LocaleNameToLCID OpenProcess DecodePointer VirtualProtect GetDiskFreeSpaceExW GetCurrentProcessId VirtualQuery GetProcessId GetSystemTime LoadLibraryW FormatMessageW GetLongPathNameW GetTempPathW MultiByteToWideChar GetDriveTypeW SetFileAttributesW ProcessIdToSessionId GetShortPathNameW GetLocalTime GetStartupInfoW WritePrivateProfileStringW GetModuleHandleExW GetDiskFreeSpaceW GetPrivateProfileSectionW GetVersionExW GetPrivateProfileStringW LocalFileTimeToFileTime GetCurrentDirectoryW DosDateTimeToFileTime MulDiv GetTickCount64 TerminateThread GetQueuedCompletionStatus PostQueuedCompletionStatus GlobalAlloc GlobalLock GlobalUnlock CreateIoCompletionPort ExitProcess SetErrorMode SetLastError GetLastError RaiseException CloseHandle ReleaseSRWLockShared CreateFileW QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable OutputDebugStringW IsDebuggerPresent LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer AreFileApisANSI RtlUnwindEx

comctl32

ord17 PropertySheetW DestroyPropertySheetPage CreatePropertySheetPageW ord345 InitCommonControlsEx _TrackMouseEvent

ntdll

ZwClose NtCreateFile NtQueryVolumeInformationFile RtlGetLastNtStatus LdrVerifyImageMatchesChecksum NtShutdownSystem NtReadFile NtQueryInformationFile RtlComputeCrc32 NtSetInformationFile RtlFreeUnicodeString RtlDosPathNameToNtPathName_U NtClose ZwQueryDirectoryFile NtOpenFile NtReadVirtualMemory NtDeleteKey NtQuerySystemInformation ZwAddBootEntry ZwSetBootEntryOrder NtTranslateFilePath ZwEnumerateBootEntries ZwQueryBootEntryOrder RtlNtStatusToDosError RtlAdjustPrivilege RtlImageNtHeader ZwOpenSymbolicLinkObject RtlInitUnicodeString NtWriteFile ZwQuerySymbolicLinkObject RtlImageRvaToVa NtWriteVirtualMemory NtQueryInformationProcess

msvcrt

??8type_info@@QEBAHAEBV0@@Z memset ??3@YAXPEAX@Z _purecall ??2@YAPEAX_K@Z wcsnlen memcpy _errno wcstoul wcsncpy_s wcslen memmove memcmp _wcsnicmp wcschr towupper ??_V@YAXPEAX@Z ??_U@YAPEAX_K@Z wcsftime _localtime64_s _time64 _wcstoui64 _wcsicmp _beginthreadex _wcslwr_s bsearch free malloc strlen strnlen _mktime64 wcscpy wcstol _strtoui64 realloc strcmp strtoul strtol _wtoi isdigit ??0exception@@QEAA@AEBV0@@Z ?what@exception@@UEBAPEBDXZ ??1exception@@UEAA@XZ _wcsupr_s wcsrchr wcsstr _mbschr _mbslwr_s iswspace wcscmp wcscpy_s _mbscmp __C_specific_handler calloc abs toupper wcsncpy _itow wcstod wcscat _strcmpi qsort_s _lrotl ??0exception@@QEAA@XZ ??0exception@@QEAA@AEBQEBD@Z _CxxThrowException __CxxFrameHandler3 __setusermatherr _initterm _initterm_e _set_fmode _amsg_exit __wgetmainargs _strlwr __DestructExceptionObject _invalid_parameter _msize __set_app_type _wcmdln abort _commode _XcptFilter ?terminate@@YAXXZ vswprintf_s _vscwprintf swscanf sscanf vsprintf_s _vscprintf swprintf_s

generic

count=1, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,

count=2, id=257, productName=VS2019 v16.9.5 build 29915, version=29915,

count=10, id=199, version=41118,

count=2, id=260, version=30034,

count=5, id=261, version=27412,

count=14, id=261, version=29912,

count=6, id=259, version=30034,

count=3, id=253, version=28518,

count=9, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=1, id=259, version=25508,

count=28, id=261, productName=VS2019 v16.10.3 build 30038, version=30038,

count=7, id=261, version=30034,

count=1, id=260, productName=VS2019 v16.1.2 build 27702, version=27702,

count=2, id=261, productName=VS2019 v16.1.2 build 27702, version=27702,

count=7, id=260, version=27412,

count=2, id=262, version=27412,

count=7, id=257, version=27412,

count=782, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=16, id=265, version=30040,

count=1, id=256, productName=VS2019 v16.10.4 build 30040, version=30040,

count=1, id=255, productName=VS2019 v16.10.4 build 30040, version=30040,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.10.4 build 30040, version=30040,

Sharing