MenuOverlay[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MenuOverlay.exe
Size 1.1MB
Sample261113-e4f25sf17q
SHA256 02db64d9369521a4a5c38a31a3513033cf1bcc1ef45a557d6db1a6fc38ef647f
MD5 3edfc54813035664b336f9d093ee3468
SHA1 cfa31f6609fd7ef7f7c15a421d927f883e60b1df
SHA512 cf020e791a3175d54d0e7ce1e3dc2387c09289f22b62bb8110345a9f99ac440e418338bc0f603feaffbd6d69a9ed32fc1a905de6f5088cbfa9201f09fb56c1da
SSDEEP 24576:MiF6t6UvZOcH7VdvRU+4RwMi+nrZOYKP:MisDHxdi0+naP
TLSH
T12E459D51F1B941FCD03AE1B8DA96664BE631380907209ADF13D01A592FB7BE45AFF312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MenuOverlay.exe

File Explorer

MenuOverlay.exe

.exe 1.1MB

MenuOverlay.exe

IMPHASH 0d8f833556638b410e60bd8fc817b117
SHA256 02db64d9369521a4a5c38a31a3513033cf1bcc1ef45a557d6db1a6fc38ef647f
MD5 3edfc54813035664b336f9d093ee3468
SHA1 cfa31f6609fd7ef7f7c15a421d927f883e60b1df
SHA512 cf020e791a3175d54d0e7ce1e3dc2387c09289f22b62bb8110345a9f99ac440e418338bc0f603feaffbd6d69a9ed32fc1a905de6f5088cbfa9201f09fb56c1da
SSDEEP 24576:MiF6t6UvZOcH7VdvRU+4RwMi+nrZOYKP:MisDHxdi0+naP
TLSH
T12E459D51F1B941FCD03AE1B8DA96664BE631380907209ADF13D01A592FB7BE45AFF312
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

672064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetLastError GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter RaiseException

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx WaitForSingleObjectEx DeleteCriticalSection LeaveCriticalSection EnterCriticalSection CreateMutexW CreateEventW SetEvent ReleaseSRWLockExclusive AcquireSRWLockExclusive WaitForSingleObject

api-ms-win-core-processthreads-l1-1-0

TerminateProcess CreateThread ExitThread GetCurrentProcess GetExitCodeThread ExitProcess GetStartupInfoW GetCurrentProcessId GetCurrentThreadId

api-ms-win-ntuser-sysparams-l1-1-0

SystemParametersInfoW GetMonitorInfoW

api-ms-win-mm-time-l1-1-0

timeBeginPeriod timeEndPeriod

api-ms-win-core-com-l1-1-0

CoUninitialize CoCreateInstance CoInitializeEx CoCreateFreeThreadedMarshaler

api-ms-win-core-synch-l1-2-0

Sleep SleepConditionVariableSRW WakeAllConditionVariable

ws2_32

inet_pton

winhttp

WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpen WinHttpCloseHandle WinHttpOpenRequest WinHttpReceiveResponse WinHttpConnect WinHttpReadData WinHttpSendRequest WinHttpQueryHeaders

iphlpapi

IcmpSendEcho IcmpCreateFile IcmpCloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW GetModuleFileNameW GetProcAddress FreeLibrary FreeLibraryAndExitThread LoadLibraryExW GetModuleHandleW

api-ms-win-core-string-l1-1-0

GetStringTypeW MultiByteToWideChar WideCharToMultiByte CompareStringW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA IsDebuggerPresent

api-ms-win-core-heap-l2-1-0

LocalFree GlobalFree GlobalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock GlobalUnlock

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-localization-l1-2-0

IsValidLocale LCMapStringEx GetLocaleInfoW LCMapStringW GetCPInfo GetUserDefaultLCID IsValidCodePage GetOEMCP GetLocaleInfoA FormatMessageA GetACP IsDBCSLeadByte EnumSystemLocalesW GetLocaleInfoEx

d3dcompiler_47

D3DCompile

winmm

PlaySoundW

comdlg32

GetOpenFileNameW

shell32

Shell_NotifyIconW ShellExecuteW

user32

GetWindowThreadProcessId SetWindowLongPtrW GetWindowLongPtrW GetCursorPos MessageBoxW SetForegroundWindow ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect IsWindowUnicode ReleaseCapture GetForegroundWindow SetCapture GetCapture GetKeyState GetMessageExtraInfo LoadCursorW GetKeyboardLayout EmptyClipboard GetClipboardData UpdateWindow TrackPopupMenu AppendMenuW SetClipboardData CloseClipboard OpenClipboard MapVirtualKeyA GetKeyNameTextA ReleaseDC GetDC GetAsyncKeyState SetProcessDpiAwarenessContext MonitorFromPoint DestroyMenu CreatePopupMenu SetFocus SetWindowDisplayAffinity SetWindowPos LoadIconW TrackMouseEvent SetLayeredWindowAttributes TranslateMessage DispatchMessageW PeekMessageW AttachThreadInput DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW IsWindow DestroyWindow ShowWindow

gdi32

SelectObject DeleteDC CreateCompatibleDC DeleteObject StretchBlt SetStretchBltMode CreateDIBSection GdiFlush

advapi32

GetUserNameW

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-processenvironment-l1-1-0

SetStdHandle SetEnvironmentVariableW GetStdHandle FreeEnvironmentStringsW GetCommandLineA GetCommandLineW GetEnvironmentStringsW

api-ms-win-core-file-l1-1-0

SetEndOfFile GetFileSizeEx FlushFileBuffers SetFilePointerEx WriteFile ReadFile GetFileType GetFileAttributesExW SetFileInformationByHandle CreateFileW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader RtlVirtualUnwind RtlLookupFunctionEntry RtlUnwindEx RtlUnwind RtlCaptureContext

api-ms-win-core-fibers-l1-1-0

FlsAlloc FlsFree FlsGetValue FlsSetValue

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-heap-l1-1-0

HeapSize HeapReAlloc HeapAlloc GetProcessHeap HeapFree

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP WriteConsoleW GetConsoleMode ReadConsoleW

api-ms-win-core-memory-l1-1-0

VirtualProtect

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

Name

.text

Size

856KB

Virtual Size

856KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

221KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

MenuOverlay.exe

d3d11

dwmapi

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-mm-time-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

ws2_32

winhttp

iphlpapi

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-localization-l1-2-0

d3dcompiler_47

winmm

comdlg32

shell32

user32

gdi32

advapi32

imm32

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l2-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-heap-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

oleaut32

generic