dw[.]exe | Triage™

General

Target
dw.exe
Size 156KB
Sample260809-q6be8ayflf
SHA256 032a632213680a6292d26840bf63972094b209dc7807571f6e13f9e2de0be74a
MD5 3a56fa952c6cc4b1856ce9e6a73b3c4b
SHA1 e9885949c23efee94ec085237ffb1a28b12b7f3d
SHA512 1d6d6bc4e4974d335e61145b18ef93d2adf9071a8eaeb8a3b06ea03112861298dacff83802a07d4fcb5fb0bee7bca09bf9d1124e48e103e90c8693a3bc376002
SSDEEP 3072:9MdkOUreuLMW1YuscQOd7rSv2EVvqx4OawKgHwoDvX:9cklrBLMxuD7rSv2ErwjH5v
TLSH
T112F36C47B2A520FDE177923588921A06F77678360750ABEF43A0477A1F237D1AD3BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dw.exe

File Explorer

dw.exe

.exe 156KB

dw.exe

IMPHASH d09178038ea9a8f8fac77e1d764bdef0
SHA256 032a632213680a6292d26840bf63972094b209dc7807571f6e13f9e2de0be74a
MD5 3a56fa952c6cc4b1856ce9e6a73b3c4b
SHA1 e9885949c23efee94ec085237ffb1a28b12b7f3d
SHA512 1d6d6bc4e4974d335e61145b18ef93d2adf9071a8eaeb8a3b06ea03112861298dacff83802a07d4fcb5fb0bee7bca09bf9d1124e48e103e90c8693a3bc376002
SSDEEP 3072:9MdkOUreuLMW1YuscQOd7rSv2EVvqx4OawKgHwoDvX:9cklrBLMxuD7rSv2ErwjH5v
TLSH
T112F36C47B2A520FDE177923588921A06F77678360750ABEF43A0477A1F237D1AD3BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

29572

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetDC ReleaseDC SetCursorPos FillRect GetMonitorInfoA EnumDisplayMonitors SetProcessDPIAware GetSystemMetrics

gdi32

DeleteObject TextOutA MoveToEx SetTextColor StretchBlt SetPixel SetBkMode SelectObject PatBlt BitBlt CreatePen CreateSolidBrush Ellipse LineTo

winmm

waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite waveOutReset waveOutClose waveOutOpen

kernel32

GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc CreateFileW WriteConsoleW TerminateProcess FlushFileBuffers GetProcessHeap GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW Beep Sleep GetTickCount QueryPerformanceCounter QueryPerformanceFrequency CloseHandle WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW WideCharToMultiByte RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar

Name

.text

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dw.exe

user32

gdi32

winmm

kernel32

generic