DWMBlurGlass[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
DWMBlurGlass.exe
Size 1.4MB
Sample260925-pv673ssvct
SHA256 2770e2aed9c70cad1773ed5439c435a0a124a76a8f1261e32f7065132144736d
MD5 40c016c41fdfd275809617f28c34bb28
SHA1 6879b4544441e7b34e8e8f624f0d192f9ae9bbe9
SHA512 38740dc44b5688d0fd96ff39b51a24e3281cc05063d88175559b66c43727920eeabd8b44c021f6bf7856efa08f93e16d89594a74887888809bf611d9d94d845f
SSDEEP 24576:V0qj6TGhOlrF2dt5beWabVywA5aCNXuSnJztDQGQzz8J:V0qj6EOlZK/beWabVj4uKztDQX8
TLSH
T1EE652A2372AA02F1DCB5D2349F7A15E5E732B852032AC7DF11B6461D0F6B2D12D3A792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DWMBlurGlass.exe

File Explorer

DWMBlurGlass.exe

.exe 1.4MB

DWMBlurGlass.exe

IMPHASH 2ca61373b4b115b0dd0691c41354a991
SHA256 2770e2aed9c70cad1773ed5439c435a0a124a76a8f1261e32f7065132144736d
MD5 40c016c41fdfd275809617f28c34bb28
SHA1 6879b4544441e7b34e8e8f624f0d192f9ae9bbe9
SHA512 38740dc44b5688d0fd96ff39b51a24e3281cc05063d88175559b66c43727920eeabd8b44c021f6bf7856efa08f93e16d89594a74887888809bf611d9d94d845f
SSDEEP 24576:V0qj6TGhOlrF2dt5beWabVywA5aCNXuSnJztDQGQzz8J:V0qj6EOlZK/beWabVj4uKztDQX8
TLSH
T1EE652A2372AA02F1DCB5D2349F7A15E5E732B852032AC7DF11B6461D0F6B2D12D3A792
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

621824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Project\DWMBlurGlass\Build\x64\Release\DWMBlurGlass.pdb

kernel32

HeapFree ReleaseSemaphore GetModuleHandleExW GetCurrentThreadId ReleaseMutex FormatMessageW GetLastError OutputDebugStringW WaitForSingleObjectEx OpenSemaphoreW K32GetModuleInformation HeapAlloc CreateMutexExW GetModuleFileNameA FreeLibrary WideCharToMultiByte DebugBreak LoadLibraryExW IsDebuggerPresent TerminateProcess ProcessIdToSessionId CreateProcessW CreateMutexW CreateSemaphoreExW VirtualFreeEx K32EnumProcessModules GetModuleHandleW CreateRemoteThread GetCurrentProcessId VirtualAllocEx GetProcAddress Process32FirstW Process32NextW GetExitCodeThread CreateToolhelp32Snapshot OpenProcess WaitForSingleObject K32GetModuleFileNameExW GetLocaleInfoEx GetCurrentProcess WriteProcessMemory SetLastError CloseHandle GetPrivateProfileStringW CreateFileW GetModuleFileNameW WritePrivateProfileStringW GetProcessHeap GetFileSizeEx WriteConsoleW SetEndOfFile HeapSize FlushFileBuffers SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapReAlloc GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetConsoleMode SetFilePointerEx QueryPerformanceCounter QueryPerformanceFrequency Sleep MultiByteToWideChar GetStringTypeW InitializeCriticalSectionEx GetSystemTimeAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LocalFree LCMapStringEx GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GlobalAlloc LoadLibraryW GlobalLock GlobalUnlock MulDiv RtlUnwindEx InterlockedPushEntrySList RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ReadFile FindClose FindFirstFileExW FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetStdHandle WriteFile GetFileType

user32

EnumWindows MessageBoxW KillTimer SendMessageW SetTimer DispatchMessageW LoadIconW wsprintfW IsWindow RegisterClassExW CreateWindowExW TranslateMessage SetCursor LoadCursorW ReleaseCapture SetCapture SetFocus TrackMouseEvent GetCursorPos ReleaseDC SetClipboardData IntersectRect GetSysColor EmptyClipboard CloseClipboard ClientToScreen OffsetRect OpenClipboard ScreenToClient FillRect GetDC GetKeyState SetCursorPos MonitorFromWindow EnableWindow IsIconic PostQuitMessage IsZoomed GetClientRect SetLayeredWindowAttributes UpdateLayeredWindowIndirect MoveWindow IsWindowEnabled ValidateRect GetMonitorInfoW GetWindowPlacement GetWindowLongPtrW SetWindowTextW SetWindowLongPtrW SetWindowPos IsWindowVisible GetWindowRect FindWindowExW SetProcessDpiAwarenessContext ShowWindow FindWindowW InvalidateRect GetWindowThreadProcessId GetMessageW DefWindowProcW PostMessageW UnregisterClassW

advapi32

RegOpenKeyExW RegQueryValueExW OpenProcessToken GetTokenInformation RegCloseKey

shell32

ShellExecuteW SHGetKnownFolderPath

ole32

CoCreateInstance CoTaskMemFree CoInitialize

oleaut32

SetErrorInfo SysStringLen SysAllocString VariantClear SysFreeString VariantInit

shlwapi

ord12 PathFileExistsW PathRemoveFileSpecW

dbghelp

SymGetSymbolFileW SymCleanup SymSetSearchPathW SymUnloadModule64 SymInitialize SymLoadModuleExW SymRegisterCallbackW64 UnDecorateSymbolName SymSetOptions SymEnumSymbols

dwmapi

DwmGetColorizationColor

winmm

timeBeginPeriod timeEndPeriod

msimg32

AlphaBlend

uxtheme

GetThemeSysSize

gdi32

GetViewportOrgEx CreateFontIndirectW CreateSolidBrush DeleteObject GetObjectW DeleteDC CreateCompatibleDC CreateDIBSection SelectObject BitBlt GetDeviceCaps GetStockObject SelectClipRgn GetCurrentObject

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

gdiplus

GdiplusShutdown GdiplusStartup GdipSaveImageToFile GdipSetStringFormatFlags GdipDrawLineI GdipSetStringFormatAlign GdipCreatePen1 GdipCreateBitmapFromScan0 GdipSaveImageToStream GdipCreateBitmapFromFile GdipGetImageWidth GdipDeleteStringFormat GdipGetImageEncodersSize GdipAddPathArc GdipFillRectangleI GdipDeleteRegion GdipCloneBrush GdipRestoreGraphics GdipDrawEllipse GdipGetClip GdipFillEllipse GdipCreateFromHDC GdipDrawString GdipDrawPath GdipResetLineTransform GdipTranslateLineTransform GdipClosePathFigure GdipSetClipRectI GdipAddPathEllipse GdipSetPixelOffsetMode GdipFree GdipGraphicsClear GdipGetPenWidth GdipFillPath GdipCreateRegion GdipSetStringFormatTrimming GdipDeleteGraphics GdipSetInterpolationMode GdipSetStringFormatLineAlign GdipCreatePath GdipSetClipPath GdipSetSmoothingMode GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCreateBitmapFromStream GdipDeleteBrush GdipCloneImage GdipCreateLineBrushI GdipSaveGraphics GdipResetClip GdipDrawRectangleI GdipGetImageEncoders GdipGetRegionHRgn GdipGetImageHeight GdipCreateStringFormat GdipDeletePen GdipGetFontSize GdipDeleteFont GdipSetLineColors GdipGetSolidFillColor GdipSetSolidFillColor GdipSetPenWidth GdipAddPathStringI GdipGetPathWorldBounds GdipGetFontStyle GdipSetLinePresetBlend GdipCreateFont GdipCreateLineBrush GdipDeletePath GdipSetPenColor GdipCreateFontFamilyFromName GdipGetFamily GdipDeleteFontFamily GdipCreateSolidFill GdipCreateHBITMAPFromBitmap

Name

.text

Size

838KB

Virtual Size

837KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

299KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

222KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.DWMBlur

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DWMBlurGlass.exe

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

dbghelp

dwmapi

winmm

msimg32

uxtheme

gdi32

imm32

gdiplus

generic