DepotBoxTool[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
DepotBoxTool.exe
Size 212.5MB
Sample260819-lemlyss1cx
SHA256 015ab18a9eb41ec150d5c60b794cd8c9a2f1db9b666a2c96e67dac30e3135866
MD5 2dd0349ff9c543250af7f05547db4522
SHA1 26969ca256d8ef31565c25fc0cc477b8d72752ec
SHA512 e05840164d1ba06cdef149e1a350d2e57a29dfa3a1a47f590a13684cec1ab08f0571b5c714b40fc344f9a9832d562eda082ea3e79d6a97a166556cc6bba57944
SSDEEP 1572864:MVSqDJBiLvd5orojjjn0CKHCu5Phsmf9aitHdVpfqBjhzhJrCkzRv9gclek/:A85g6r01HP5wMVpfahzhYkV1h
TLSH
T116B86D6BCE80A918E1DB052D7F7F7A9280B5783E5F3DE9DE458F22C6313805F4A95A01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DepotBoxTool.exe

File Explorer

DepotBoxTool.exe

.exe 212.5MB

DepotBoxTool.exe

IMPHASH f8c6bd6e48b7aebe7150c4a80fd3c400
SHA256 015ab18a9eb41ec150d5c60b794cd8c9a2f1db9b666a2c96e67dac30e3135866
MD5 2dd0349ff9c543250af7f05547db4522
SHA1 26969ca256d8ef31565c25fc0cc477b8d72752ec
SHA512 e05840164d1ba06cdef149e1a350d2e57a29dfa3a1a47f590a13684cec1ab08f0571b5c714b40fc344f9a9832d562eda082ea3e79d6a97a166556cc6bba57944
SSDEEP 1572864:MVSqDJBiLvd5orojjjn0CKHCu5Phsmf9aitHdVpfqBjhzhJrCkzRv9gclek/:A85g6r01HP5wMVpfahzhYkV1h
TLSH
T116B86D6BCE80A918E1DB052D7F7F7A9280B5783E5F3DE9DE458F22C6313805F4A95A01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

62067088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipAddPathEllipse GdipAlloc GdipCloneImage GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateFromHDC GdipCreateHBITMAPFromBitmap GdipCreatePath GdipCreatePathGradientFromPath GdipCreateSolidFill GdipDeleteBrush GdipDeleteGraphics GdipDeletePath GdipDisposeImage GdipDrawImageRectI GdipFillPath GdipFree GdipGetImageGraphicsContext GdipGetImageHeight GdipGetImageWidth GdipGetPathGradientPointCount GdipGraphicsClear GdipLoadImageFromFile GdipSetClipPath GdipSetCompositingMode GdipSetCompositingQuality GdipSetInterpolationMode GdipSetPathGradientCenterColor GdipSetPathGradientCenterPoint GdipSetPathGradientFocusScales GdipSetPathGradientSurroundColorsWithCount GdipSetPixelOffsetMode GdipSetSmoothingMode GdiplusShutdown GdiplusStartup

comctl32

InitCommonControlsEx

shell32

CommandLineToArgvW DragAcceptFiles DragFinish DragQueryFileW ShellExecuteExW ShellExecuteW Shell_NotifyIconW

ole32

CoCreateInstance CoTaskMemFree CreateStreamOnHGlobal

user32

AttachThreadInput BeginPaint BringWindowToTop CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DrawFocusRect DrawTextW EmptyClipboard EnableWindow EndPaint EnumWindows FillRect FindWindowW GetClientRect GetCursorPos GetDC GetDoubleClickTime GetForegroundWindow GetMessageW GetParent GetPropW GetSystemMetrics GetWindow GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InflateRect InvalidateRect IsIconic IsWindow IsWindowVisible KillTimer LoadCursorW LoadIconW MessageBoxW OpenClipboard PostMessageW PostQuitMessage PtInRect RegisterClassW ReleaseCapture ReleaseDC SendMessageW SetActiveWindow SetCapture SetClipboardData SetForegroundWindow SetLayeredWindowAttributes SetPropW SetTimer SetWindowPos SetWindowRgn SetWindowTextW ShowWindow TrackMouseEvent TranslateMessage UpdateLayeredWindow

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontW CreatePen CreateRoundRectRgn CreateSolidBrush DeleteDC DeleteObject GetStockObject LineTo MoveToEx RoundRect SelectObject SetBkColor SetBkMode SetTextColor

advapi32

RegCloseKey RegCreateKeyExA RegCreateKeyExW RegDeleteValueA RegGetValueW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW

kernel32

AcquireSRWLockExclusive AreFileApisANSI CheckRemoteDebuggerPresent CloseHandle CompareStringEx CompareStringW CopyFile2 CopyFileW CreateDirectoryW CreateFile2 CreateFileW CreateMutexW CreatePipe CreateProcessA CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableA GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempFileNameW GetTempPathW GetTickCount GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadResource LocalFree LockResource MoveFileExW MoveFileW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetDllDirectoryA SetEndOfFile SetEnvironmentVariableA SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SystemTimeToFileTime TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

crypt32

CryptBinaryToStringA

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

Name

.text

Size

59.4MB

Virtual Size

59.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

150.0MB

Virtual Size

150.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DepotBoxTool.exe

gdiplus

comctl32

shell32

ole32

user32

gdi32

advapi32

kernel32

crypt32

winhttp

bcrypt

generic