Monoxide-GDI[.]exe

General

Target
Monoxide-GDI.exe
Size 116KB
Sample261113-tz7fvsdx7p
SHA256 a4ad6bb531bd8268d624f264910b15600f902fd634cef18a500c0f75a25a8042
MD5 567807ffd4dc5918c342138051a07902
SHA1 b2e19490673977db2442a10cab691f6bae2a07de
SHA512 63f776e3df52662dab41e97fe934b08b590a055126db4ba6d829208d627e79ecc367da19e433e981d7f4ea8214d9114673bf10c1b3bd88c12bef63fdbf6379fc
SSDEEP 3072:j+HVWvWAJhX3OFeOc7l+BoQ/40bMBNeuO9dH3+n:jGVWvWAf3gI+//Ngg16n
TLSH
T1A5C37D50B4C1C871E5B6093118B5BAA24E7DFA704B259FFB2798163E4FB80C09A73D67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Monoxide-GDI.exe

File Explorer

Monoxide-GDI.exe

.exe 116KB

Monoxide-GDI.exe

IMPHASH 0de8407f15a5c7f8e2c8b53b74e5c049
SHA256 a4ad6bb531bd8268d624f264910b15600f902fd634cef18a500c0f75a25a8042
MD5 567807ffd4dc5918c342138051a07902
SHA1 b2e19490673977db2442a10cab691f6bae2a07de
SHA512 63f776e3df52662dab41e97fe934b08b590a055126db4ba6d829208d627e79ecc367da19e433e981d7f4ea8214d9114673bf10c1b3bd88c12bef63fdbf6379fc
SSDEEP 3072:j+HVWvWAJhX3OFeOc7l+BoQ/40bMBNeuO9dH3+n:jGVWvWAf3gI+//Ngg16n
TLSH
T1A5C37D50B4C1C871E5B6093118B5BAA24E7DFA704B259FFB2798163E4FB80C09A73D67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

18261

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress GetProcessHeap FreeLibrary WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers DecodePointer HeapReAlloc HeapSize HeapAlloc GetFileType SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW CreateThread LoadLibraryW CloseHandle TerminateThread GetLastError Sleep GetCurrentThreadId WaitForSingleObject CreateMutexW GetStringTypeW HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetACP LCMapStringW RaiseException FindClose CreateFileW

user32

GetMessageW GetDC EnumDisplayMonitors GetSystemMetrics DrawIcon DestroyCursor DispatchMessageW SetTimer GetCursorInfo RedrawWindow TranslateMessage

gdi32

SelectObject CreateDIBSection CreateCompatibleDC StretchBlt DeleteDC CreatePen Ellipse DeleteObject CreateSolidBrush BitBlt

Name

.text

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Monoxide-GDI.exe

kernel32

user32

gdi32

generic