DivX[.]exe | Triage™

General

Target
DivX.exe
Size 1.0MB
Sample261024-2faa1sew2k
SHA256 5cc1be09f0f23fc66b108e0de730189f7401db6b1ef1c525b8cbf6c7b2999365
MD5 b9997314e52904f75468764553a63859
SHA1 2d8d3ad172421237c9acacfa177b07c26b57f45d
SHA512 b86ac4574d628b60ccd73dd727d259329f54810c59184633a5fbb277eebdd711942f722dfcaee6a413ca5316b0baa72d8a501e5025cc1a7ff04be9db17efe4f1
SSDEEP 24576:mgY1RMtj0i9lpcX0opi1hE1OfqLfs6P3:mgY16tj0eMdYE1qYJv
TLSH
T15D35BC51B3D31AF9F175F5F8C605C102AA6D6B0D0EE075AA629C731E0B225B18BFE613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DivX.exe

File Explorer

DivX.exe

.exe 1.0MB

DivX.exe

IMPHASH f6c10cda88d849d7e8df3bc898aac756
SHA256 5cc1be09f0f23fc66b108e0de730189f7401db6b1ef1c525b8cbf6c7b2999365
MD5 b9997314e52904f75468764553a63859
SHA1 2d8d3ad172421237c9acacfa177b07c26b57f45d
SHA512 b86ac4574d628b60ccd73dd727d259329f54810c59184633a5fbb277eebdd711942f722dfcaee6a413ca5316b0baa72d8a501e5025cc1a7ff04be9db17efe4f1
SSDEEP 24576:mgY1RMtj0i9lpcX0opi1hE1OfqLfs6P3:mgY16tj0eMdYE1qYJv
TLSH
T15D35BC51B3D31AF9F175F5F8C605C102AA6D6B0D0EE075AA629C731E0B225B18BFE613
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

93264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

vaclez.pdb

kernel32

CloseHandle CompareStringW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleTitleW GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLargePageMinimum GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNumberOfConsoleInputEvents GetOEMCP GetProcAddress GetProcessHandleCount GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimes GetTempPathW GetTickCount64 GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

user32

GetActiveWindow GetClassNameW GetDesktopWindow GetFocus GetForegroundWindow GetWindowLongPtrW IsIconic

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtReadFile NtWriteFile

Name

.text

Size

148KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

351KB

Virtual Size

351KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

265KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

209B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

273KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DivX.exe

kernel32

user32

api-ms-win-core-synch-l1-2-0

ntdll

generic