evilpassword[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
evilpassword.exe
Size 5.4MB
Sample230426-l2r5ysae21
SHA256 dd0ec925f314210edfffb5638487233cbed59aabcf085d2d372527124ebc759e
MD5 b9f5126557c1e87d2927c6cc43c0ea52
SHA1 f0cb5ba72effa8b135e88cd745f6f622ce916d6d
SHA512 2355e52a86aa1d656ec4a1d1742d5b721375d26ce384ae4c7d94f14b7265d8f5d7a0721f8fe055a6a5d6c32b72c12af72d997c5103fe41e49f65b5656e79606d
SSDEEP 98304:F251mABibwQAyFAbJzVzArOSqeDalc6d+EW:qmAkbwQubJJc9BDalmEW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
evilpassword.exe

File Explorer

evilpassword.exe

.exe 5.4MB

evilpassword.exe

IMPHASH 53f76c13f842893054859981f2972c44
SHA256 dd0ec925f314210edfffb5638487233cbed59aabcf085d2d372527124ebc759e
MD5 b9f5126557c1e87d2927c6cc43c0ea52
SHA1 f0cb5ba72effa8b135e88cd745f6f622ce916d6d
SHA512 2355e52a86aa1d656ec4a1d1742d5b721375d26ce384ae4c7d94f14b7265d8f5d7a0721f8fe055a6a5d6c32b72c12af72d997c5103fe41e49f65b5656e79606d
SSDEEP 98304:F251mABibwQAyFAbJzVzArOSqeDalc6d+EW:qmAkbwQubJJc9BDalmEW
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

647543

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalLock GlobalAlloc SuspendThread TerminateThread ReleaseMutex CreateMutexA GetCurrentProcess GetWindowsDirectoryA GetSystemDirectoryA SetLastError IsBadReadPtr VirtualFree VirtualAlloc InterlockedExchange SetStdHandle GlobalUnlock CompareStringW CompareStringA SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA IsBadWritePtr LCMapStringW LCMapStringA SetEnvironmentVariableA HeapCreate HeapDestroy GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetACP HeapSize RaiseException GetLocalTime GetSystemTime GetTimeZoneInformation TerminateProcess RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GetCurrentProcessId GetEnvironmentVariableA CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource SizeofResource ReadFile lstrlenW GetModuleFileNameA WideCharToMultiByte MultiByteToWideChar GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA CreateThread CreateEventA Sleep GlobalHandle TlsAlloc LocalAlloc lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer DuplicateHandle lstrcpynA FileTimeToLocalFileTime FileTimeToSystemTime LocalFree InterlockedDecrement InterlockedIncrement GetTempPathA FindFirstFileA FindClose GetFileAttributesA DeleteFileA GetCurrentDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress CloseHandle MulDiv GetCommandLineA GetTickCount WaitForSingleObject IsBadCodePtr

user32

wsprintfA CloseClipboard GetClipboardData OpenClipboard SetClipboardData EmptyClipboard GetSystemMetrics GetCursorPos MessageBoxA SetWindowPos SendMessageA DestroyCursor SetParent IsWindow PostMessageA GetTopWindow GetParent GetFocus GetClientRect InvalidateRect ValidateRect UpdateWindow EqualRect GetWindowRect SetForegroundWindow DestroyMenu IsChild ReleaseDC IsRectEmpty FillRect GetDC SetCursor LoadCursorA SetCursorPos SetActiveWindow GetSysColor SetWindowLongA GetForegroundWindow LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos GetWindowTextA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow LoadStringA GetSysColorBrush SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA UnregisterClassA

gdi32

SetPolyFillMode SetBkColor CreateRectRgnIndirect SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject CreatePen PatBlt CombineRgn CreateRectRgn FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps SaveDC RestoreDC SetBkMode SetROP2 SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect GetTextMetricsA Escape ExtTextOutA TextOutA RectVisible PtVisible GetViewportExtEx ExtSelectClipRgn LineTo MoveToEx

winmm

midiStreamClose midiOutReset midiStreamStop midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader waveOutRestart midiStreamRestart

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegCloseKey RegQueryValueA RegSetValueExA RegOpenKeyExA RegCreateKeyExA

shell32

ShellExecuteA Shell_NotifyIconA SHGetSpecialFolderPathA

ole32

CLSIDFromProgID OleInitialize OleUninitialize CLSIDFromString CoCreateInstance OleRun

oleaut32

RegisterTypeLi VariantCopy VariantClear VariantChangeType SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetDim SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetElement VariantCopyInd VariantInit SysAllocString SafeArrayDestroy SafeArrayCreate SafeArrayPutElement LHashValOfNameSys LoadTypeLi UnRegisterTypeLi

comctl32

ImageList_Destroy ord17

ws2_32

recvfrom WSAAsyncSelect ioctlsocket inet_ntoa WSAStartup recv closesocket WSACleanup getpeername accept ntohl gethostbyname

comdlg32

GetOpenFileNameA ChooseColorA GetSaveFileNameA GetFileTitleA