demida[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
demida.exe
Size 581KB
Sample260816-qpm3payepf
SHA256 029e5d9d8550d0f32a8648c7d8e39fdf1c5797ac2275bac880a0e6bdc986c1dd
MD5 ae98dcccbd43b18e9ade3af3eb39e862
SHA1 07bd865c9c0e6eefaadc35ccba40120492716fc3
SHA512 487e1ac27dd8dbb5d48526c89c87f89aab3f7c4d9d66cdab08f20bbe8a5649bbda8920ae8dcd58da03c8e9b1f1f83a4d432f900569ce045a254fc6fb1cbc03ab
SSDEEP 12288:K1b2OSoVdR4vJjyDxQYDj/d5OFcOSYmjH:K92AR4vVchDj/dkFcOSYmjH
TLSH
T163C45B43D3A795DFC89AE67482736336FB317C054B356AEB939497302EA1BD05A3A700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
demida.exe

File Explorer

demida.exe

.exe 581KB

demida.exe

IMPHASH 14b1165c7b47750e3430e63ca81f58db
SHA256 029e5d9d8550d0f32a8648c7d8e39fdf1c5797ac2275bac880a0e6bdc986c1dd
MD5 ae98dcccbd43b18e9ade3af3eb39e862
SHA1 07bd865c9c0e6eefaadc35ccba40120492716fc3
SHA512 487e1ac27dd8dbb5d48526c89c87f89aab3f7c4d9d66cdab08f20bbe8a5649bbda8920ae8dcd58da03c8e9b1f1f83a4d432f900569ce045a254fc6fb1cbc03ab
SSDEEP 12288:K1b2OSoVdR4vJjyDxQYDj/d5OFcOSYmjH:K92AR4vVchDj/dkFcOSYmjH
TLSH
T163C45B43D3A795DFC89AE67482736336FB317C054B356AEB939497302EA1BD05A3A700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle ContinueDebugEvent CreateFileW CreateProcessW CreateToolhelp32Snapshot DebugActiveProcessStop DebugSetProcessKillOnExit DeleteCriticalSection EnterCriticalSection FlushInstructionCache FormatMessageW FreeEnvironmentStringsW GetEnvironmentStringsW GetFileSizeEx GetFinalPathNameByHandleW GetLastError GetModuleHandleW GetNativeSystemInfo GetProcAddress GetSystemDirectoryW GetSystemInfo GetThreadContext GetTickCount64 InitializeCriticalSection IsWow64Process K32GetModuleFileNameExW LeaveCriticalSection LocalFree Module32FirstW Module32NextW OpenThread ReadFile ReadProcessMemory ResumeThread SetThreadContext SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess Thread32First Thread32Next TlsGetValue VirtualAllocEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForDebugEvent WaitForSingleObject Wow64GetThreadContext Wow64SetThreadContext WriteFile WriteProcessMemory __C_specific_handler

libc++

_ZNKSt3__110error_code7messageEv _ZNKSt3__14__fs10filesystem4path10__filenameEv _ZNKSt3__14__fs10filesystem4path11__extensionEv _ZNKSt3__14__fs10filesystem4path11__root_nameEv _ZNKSt3__14__fs10filesystem4path13__parent_pathEv _ZNKSt3__14__fs10filesystem4path16__root_directoryEv _ZNKSt3__14__fs10filesystem4path6__stemEv _ZNKSt3__16locale9has_facetERNS0_2idE _ZNKSt3__16locale9use_facetERNS0_2idE _ZNKSt3__18ios_base6getlocEv _ZNSt11logic_errorC2EPKc _ZNSt12length_errorD1Ev _ZNSt12out_of_rangeD1Ev _ZNSt20bad_array_new_lengthC1Ev _ZNSt20bad_array_new_lengthD1Ev _ZNSt3__110to_wstringEj _ZNSt3__110to_wstringEm _ZNSt3__112__next_primeEy _ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKcy _ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE9push_backEc _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE21__grow_by_and_replaceEyyyyyyPKw _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6insertEyPKwy _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6resizeEyw _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE9__grow_byEyyyyyy _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE9push_backEw _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEEaSERKS5_ _ZNSt3__113__hash_memoryEPKvy _ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE5writeEPKcx _ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED0Ev _ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED1Ev _ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED2Ev _ZNSt3__113basic_ostreamIwNS_11char_traitsIwEEE5flushEv _ZNSt3__113basic_ostreamIwNS_11char_traitsIwEEED0Ev _ZNSt3__113basic_ostreamIwNS_11char_traitsIwEEED1Ev _ZNSt3__113basic_ostreamIwNS_11char_traitsIwEEED2Ev _ZNSt3__113basic_ostreamIwNS_11char_traitsIwEEElsEb _ZNSt3__113basic_ostreamIwNS_11char_traitsIwEEElsEj _ZNSt3__113basic_ostreamIwNS_11char_traitsIwEEElsEm _ZNSt3__113basic_ostreamIwNS_11char_traitsIwEEElsEy _ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE5uflowEv _ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE6xsgetnEPcx _ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE9showmanycEv _ZNSt3__115basic_streambufIwNS_11char_traitsIwEEE4syncEv _ZNSt3__115basic_streambufIwNS_11char_traitsIwEEE5imbueERKNS_6localeE _ZNSt3__115basic_streambufIwNS_11char_traitsIwEEE5uflowEv _ZNSt3__115basic_streambufIwNS_11char_traitsIwEEE6setbufEPwx _ZNSt3__115basic_streambufIwNS_11char_traitsIwEEE6xsgetnEPwx _ZNSt3__115basic_streambufIwNS_11char_traitsIwEEE6xsputnEPKwx _ZNSt3__115basic_streambufIwNS_11char_traitsIwEEE9showmanycEv _ZNSt3__115system_categoryEv _ZNSt3__117bad_function_callD1Ev _ZNSt3__14__fs10filesystem11__copy_fileERKNS1_4pathES4_NS1_12copy_optionsEPNS_10error_codeE _ZNSt3__14__fs10filesystem12__equivalentERKNS1_4pathES4_PNS_10error_codeE _ZNSt3__14__fs10filesystem14__current_pathEPNS_10error_codeE _ZNSt3__14__fs10filesystem20__create_directoriesERKNS1_4pathEPNS_10error_codeE _ZNSt3__14__fs10filesystem8__statusERKNS1_4pathEPNS_10error_codeE _ZNSt3__14wcinE _ZNSt3__15ctypeIwE2idE _ZNSt3__15wcerrE _ZNSt3__15wcoutE _ZNSt3__16localeC1ERKS0_ _ZNSt3__16localeC1Ev _ZNSt3__16localeD1Ev _ZNSt3__17codecvtIcc9_MbstatetE2idE _ZNSt3__18ios_base33__set_badbit_and_consider_rethrowEv _ZNSt3__18ios_base4initEPv _ZNSt3__18ios_base5clearEj _ZNSt3__19basic_iosIcNS_11char_traitsIcEEED2Ev _ZNSt3__19basic_iosIwNS_11char_traitsIwEEED2Ev _ZNSt3__19to_stringEi _ZNSt8bad_castC1Ev _ZNSt8bad_castD1Ev _ZNSt9exceptionD2Ev _ZSt19uncaught_exceptionsv _ZSt9terminatev _ZTVN10__cxxabiv117__class_type_infoE _ZTVN10__cxxabiv120__si_class_type_infoE _ZTVN10__cxxabiv121__vmi_class_type_infoE _ZTVNSt3__115basic_streambufIcNS_11char_traitsIcEEEE _ZTVNSt3__115basic_streambufIwNS_11char_traitsIwEEEE _ZTVNSt3__117bad_function_callE _ZTVSt12length_error _ZTVSt12out_of_range _ZTVSt18bad_variant_access _ZTv0_n24_NSt3__113basic_ostreamIcNS_11char_traitsIcEEED0Ev _ZTv0_n24_NSt3__113basic_ostreamIcNS_11char_traitsIcEEED1Ev _ZTv0_n24_NSt3__113basic_ostreamIwNS_11char_traitsIwEEED0Ev _ZTv0_n24_NSt3__113basic_ostreamIwNS_11char_traitsIwEEED1Ev _ZdaPv _ZdlPv _Znay _Znwy __cxa_allocate_exception __cxa_begin_catch __cxa_end_catch __cxa_free_exception __cxa_rethrow __cxa_throw __gxx_personality_seh0

libunwind

_Unwind_Resume

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf _fseeki64 _ftelli64 _wfopen fclose fflush fread fseek fwrite setbuf setvbuf

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _cexit _configure_wide_argv _crt_atexit _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove

api-ms-win-crt-string-l1-1-0

iswalnum memset strcmp strlen strncmp tolower towlower wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf log2

api-ms-win-crt-environment-l1-1-0

__p__wenviron

Name

.text

Size

336KB

Virtual Size

335KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

demida.exe

kernel32

libc++

libunwind

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic