DesirePrivate[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
DesirePrivate.exe
Size 2.7MB
Sample261102-dagadazwcv
SHA256 3fa5f079278bf3999cd2b5b0dcd4b88f6c5ce052e0b6c5d21a6f0489c0aef1cc
MD5 91c426ff9999772b0eaf8906bf4f827c
SHA1 55b2b36619cca661e42eef411b41d2f63c436538
SHA512 7f7d1c9a64f7f757467574083962b1756aaa7d24518bd03db510a546971663c26f25680a45c6582a73c2348b07d8cba2ee802eaad0e750f5e99bcef8d4e1ad41
SSDEEP 49152:gKQ0bt1Jj6jN8N8wAer0KT8+HEnaplCpno0z2IFBpsMtZy4Xd:DeKAaploRayZNX
TLSH
T1EDD5F106B2B602BCC5A7D57C8A93971BF7327848073086EB73E445955FA72F04E3BA91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DesirePrivate.exe

File Explorer

DesirePrivate.exe

.exe 2.7MB

DesirePrivate.exe

IMPHASH e8aa160643152847cc0979960df7fe6d
SHA256 3fa5f079278bf3999cd2b5b0dcd4b88f6c5ce052e0b6c5d21a6f0489c0aef1cc
MD5 91c426ff9999772b0eaf8906bf4f827c
SHA1 55b2b36619cca661e42eef411b41d2f63c436538
SHA512 7f7d1c9a64f7f757467574083962b1756aaa7d24518bd03db510a546971663c26f25680a45c6582a73c2348b07d8cba2ee802eaad0e750f5e99bcef8d4e1ad41
SSDEEP 49152:gKQ0bt1Jj6jN8N8wAer0KT8+HEnaplCpno0z2IFBpsMtZy4Xd:DeKAaploRayZNX
TLSH
T1EDD5F106B2B602BCC5A7D57C8A93971BF7327848073086EB73E445955FA72F04E3BA91
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

843716

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\srcs\des priv\mj private\x64\Release\DesirePrivate.pdb

d3d11

D3D11CreateDeviceAndSwapChain

xinput1_4

ord2

kernel32

IsDebuggerPresent VirtualFree VirtualAlloc Sleep GetSystemFirmwareTable ReadFile SetNamedPipeHandleState WriteFile DeviceIoControl GetLastError CreateFileA CreateDirectoryA TerminateProcess RaiseException ExitProcess GetTickCount CreateDirectoryW FillConsoleOutputCharacterA GetConsoleScreenBufferInfo SetConsoleTitleA SetConsoleScreenBufferSize GetStdHandle SetConsoleMode SetConsoleWindowInfo GetConsoleScreenBufferInfoEx CreateFileW GetConsoleMode SetConsoleScreenBufferInfoEx Process32NextW QueryPerformanceFrequency Process32FirstW FillConsoleOutputAttribute Beep FreeLibrary WideCharToMultiByte GetConsoleWindow SetConsoleCursorPosition lstrcmpiW QueryPerformanceCounter MultiByteToWideChar DeleteFileW GetTempPathW MoveFileExW GetFileAttributesA GetSystemDirectoryA GetFileSize K32EnumDeviceDrivers K32GetDeviceDriverBaseNameA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA GetCurrentProcessId SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead LocalFree FormatMessageA GetLocaleInfoEx GetModuleHandleW CreateToolhelp32Snapshot GetCurrentThreadId FindClose FindFirstFileW GetFileAttributesExW GetCurrentProcess AreFileApisANSI GetFileInformationByHandleEx GetProcAddress CloseHandle LoadLibraryA SetFileAttributesW GetModuleHandleA WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetTickCount64

user32

GetKeyState SetWindowLongA DispatchMessageW GetAsyncKeyState ShowWindow GetSystemMetrics keybd_event SetWindowPos GetWindowLongW SetClipboardData FindWindowA GetCursorPos UpdateWindow PeekMessageW TranslateMessage SetLayeredWindowAttributes SetMenu GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetCursorPos GetClientRect SetCursor PostQuitMessage GetWindowLongA SetWindowDisplayAffinity ScreenToClient ClientToScreen GetKeyboardLayout GetForegroundWindow LoadCursorW MoveWindow GetWindowRect MessageBoxA

advapi32

FreeSid CheckTokenMembership RegGetValueA RegCloseKey RegOpenKeyExW RegQueryValueExW AllocateAndInitializeSid RegCreateKeyW RegDeleteTreeW RegSetKeyValueW

shell32

ShellExecuteA

ole32

CoInitialize

msvcp140

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Query_perf_counter ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Xbad_alloc@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?_Syserror_map@std@@YAPEBDH@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Random_device@std@@YAIXZ _Mtx_lock _Mtx_unlock ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z

ntdll

RtlCaptureContext RtlVirtualUnwind RtlInitUnicodeString NtUnloadDriver NtQuerySystemInformation RtlLookupFunctionEntry NtLoadDriver

winhttp

WinHttpCrackUrl WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders

bcrypt

BCryptGetProperty BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptGenRandom

dbghelp

SymLoadModuleEx SymGetModuleBase64 SymCleanup SymGetModuleInfo64 SymSetSearchPath SymInitialize SymSetOptions SymFromName

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp memchr memset _CxxThrowException __C_specific_handler __current_exception_context memcpy strchr strstr __std_terminate __std_exception_copy __std_exception_destroy __current_exception memmove

api-ms-win-crt-runtime-l1-1-0

abort terminate _seh_filter_exe _errno _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _invoke_watson _initialize_narrow_environment _configure_narrow_argv exit _beginthreadex

api-ms-win-crt-string-l1-1-0

strncpy_s strncmp _stricmp toupper strcpy_s strncpy tolower towlower strcmp

api-ms-win-crt-stdio-l1-1-0

_wfopen fsetpos ungetc setvbuf fgetpos _dup2 freopen_s _dup _fseeki64 _fileno __stdio_common_vsprintf _close __stdio_common_vsscanf fwrite _set_fmode __acrt_iob_func fgetc fseek __stdio_common_vfprintf __p__commode __stdio_common_vsprintf_s fclose ftell _get_stream_buffer_pointers fflush fread fputc

api-ms-win-crt-filesystem-l1-1-0

remove _lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_callnewh realloc malloc _set_new_mode free

api-ms-win-crt-convert-l1-1-0

strtol strtod strtoll strtoull atof

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

fmodf cosf ceilf powf tan __setusermatherr sinf atan2f atan2 asin _dsign acosf sqrtf sqrt fmaxf ldexp _dclass tanf

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

qsort rand