Revil[.]bin[.]zip | Triage

Sharing

General

Target

Revil.bin.zip
Size

117KB
MD5

62fac67e4a542b6cbd1941823d883bf6
SHA1

7223e28ccbcbe201a0f2da3e227370f8f8ec315b
SHA256

740ad8ea62f10de39e0b794cf6f579f25af1b8d79f859b48ecd41edc1f92cf13
SHA512

36d4fbd234e918d7cd23b57a9111d495a0d951f396ce01457f1b0872174e6d7e253041d7ef8c143538ba105bd7092d27d911218b15d1404ab1f3c43b9f1042f9
SSDEEP

3072:4Nv3BtRUwsIWn0evqneX8QfR5wVoPad+c43cG+r49WnFf5IO1:49BtRUwsz07nY5w+PZ4r7B5P1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

unpack001/Revil.bin

Files

Revil.bin.zip
.zip

Password: infected
Revil.bin
.exe windows x86

Password: infected

95c9dbd11f21d2c0fa6c3dccccbdebb5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
ExitProcess
LoadLibraryA
GetProcAddress
GetCurrentProcessId
GetModuleHandleA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 534B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

enc
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ