eulen-main-main.zip
- SHA256 b7932954d48ddecf0768d7ebda3b658c8c70105b67b28e5a2ba90767e289e2fa
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eulen-main-main/Loader.exe
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
eulen-main-main/Loader.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
eulen-main-main/license.dll
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
eulen-main-main/license.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target eulen-main-main.zip
- Size 1012KB
- Sample240223-r3rtgabc39
- SHA256 b7932954d48ddecf0768d7ebda3b658c8c70105b67b28e5a2ba90767e289e2fa
- MD5 b4567a0a80825d5ff61f7f8e92516739
- SHA1 5b135d14d1c7dbfbf6affbaa637128960e8c134d
- SHA512 9bf430d425f77bb0c6b17fc9260af33a76083b5111baad4dda998e165c54e254ce2088cec4c84f74089c951f24a4cfa787b58b0a3095956a5ac2c3ac78d1e1fd
- SSDEEP 24576:TwMt0Z7HgShMicpLytWJQmrfjNiVrGroGxgkIKgr:Hyd1MicRJf/NqrGMGxUdr
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/eulen-main-main/Loader.exe unpack001/eulen-main-main/license.dll
File Explorer
-
eulen-main-main.zip.zip 1012KB
-
eulen-main-main/Loader.exe.exe 690KB
-
eulen-main-main/README.md432B
-
eulen-main-main/how to use.txt161B
-
eulen-main-main/license.dll.dll 1.2MB
eulen-main-main/Loader.exe
- IMPHASH 382a4d7b99200ee7e9686d1f1cde0258
- SHA256 dde02744526968833651a9f70be666ceec221599b03272c9c5fc5d729667dd72
- MD5 9ed99bd8432a2265d1f5fb611213168b
- SHA1 e215f6bfcbc91ed8828ef54cb6840eae1dc72cd0
- SHA512 f75b9ad6823ae8c4e4f5c84202893ba60c9256853d8b3924d47d59a1668e979e485a920b43414b470c5e5fd02975ff81edea3c9a2ed3a16140c13170224f2f28
- SSDEEP 12288:snlipr+FaVITo35RRLyAuilkjA/xZGHr9W8aSt2kTNvif8jedCLLA2Z:QipJIg5GFAp/St2qif8jMCLL1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
12136
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
VirtualProtect
GetModuleHandleA
GetProcAddress
VirtualAlloc
LoadLibraryA
lstrlenW
CreateThread
Sleep
WaitForSingleObject
FreeConsole
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
WriteConsoleW
RaiseException
RtlUnwind
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.tls
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.NVfSZ
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
613KB
Virtual Size
613KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
eulen-main-main/README.md
- SHA256 45da21b4ca2d68817a6d72173ac49ed2c0976382f4e8ec2fee8039b6e1bc08e6
- MD5 b8c32f655de50c34b8689e5aa5ff47c0
- SHA1 22f5a8052681de57550146f77f7c97a38644cc82
- SHA512 e250ff1f38d9f73c780c07aaccb2371672d4a0832d75db1205466f2461bd60731bc38f76a54c6dbb4053e69abd321bbfe0a6b017c6e7dd5b447254a69e7247f7
- MD5 SHA1 SHA512
eulen-main-main/how to use.txt
- SHA256 6a520bcb3649078e4cfe54231db926a095afc583e4dac47ee9c24cb4f1c9021d
- MD5 267ef5086d79fd0fdecf03819accf2df
- SHA1 0453320270894410f5efe87840eb94d858fec36c
- SHA512 97a5b7d492c244c3fe8b44c5eb69d2bfdec347051ca478d5c241842ce77f753b5c01750d87a2abfc8dfcf8b35b7c665c56966347e2392b973555c6665266b428
- MD5 SHA1 SHA512
eulen-main-main/license.dll
- IMPHASH af1f9e9303cddd092b1be17cc7157037
- SHA256 d960a2eac5e7f1aa04e9f8d0da4eb9bb0b097ca58d0ce83ea1bb8351baf26301
- MD5 36dea25d49b9dff21acebface8ea2044
- SHA1 5bd97162bc98e36c124811c360dbf29c6233405e
- SHA512 64f06db24297e30d7ec91d3cf9ccc33f28eb9041e463933866b09de0d138d964505aa38f32158be5e5491e4aa68d8ae77bccce9c068e5980d2281a24294bccf8
- SSDEEP 24576:1iE0l9oS0Cl/9qZPcYJZEiDO3ytIPMunHuGKFufrrH1:YE0l1ZlVsPc06i63aIPZnBX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
502512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Desktop\MOON-PROJECT\Moon-fivem\Build\MoonFivem.pdb
kernel32
GetProcAddress
LoadLibraryA
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
CloseHandle
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetModuleHandleW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CreateDirectoryW
CreateFileW
GetFileAttributesExW
GetFullPathNameW
GetLastError
DeviceIoControl
CreateThread
DisableThreadLibraryCalls
FreeLibraryAndExitThread
GetModuleHandleA
LocalFree
FormatMessageW
CreateDirectoryExW
IsBadReadPtr
K32GetModuleFileNameExA
FreeLibrary
FindClose
FindFirstFileExW
FindNextFileW
HeapSize
GetTimeZoneInformation
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
OutputDebugStringW
GetFileSizeEx
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
WriteConsoleW
GetModuleFileNameW
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
ReadFile
QueryPerformanceFrequency
QueryPerformanceCounter
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
FormatMessageA
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetLocaleInfoEx
GetStringTypeW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
TlsAlloc
RtlUnwind
user32
OpenClipboard
CloseClipboard
SetClipboardData
GetMonitorInfoA
GetActiveWindow
GetWindowThreadProcessId
GetClassNameA
FindWindowA
SetWindowLongPtrA
GetWindowRect
GetWindowTextA
mouse_event
DestroyWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
CallWindowProcA
DefWindowProcA
MonitorFromWindow
LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
GetClientRect
GetForegroundWindow
ReleaseCapture
SetCapture
GetCapture
GetKeyState
IsChild
EmptyClipboard
GetClipboardData
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
d3dcompiler_43
D3DCompile
?CloseBulk@Device@vfs@@UEAA_N_K@Z
?Create@Device@vfs@@UEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?CreateDirectoryA@Device@vfs@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ExtensionCtl@Device@vfs@@UEAA_NHPEAX_K@Z
?GetAttributes@Device@vfs@@UEAAIAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetDevice@vfs@@YA?AV?$fwRefContainer@VDevice@vfs@@@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetLength@Device@vfs@@UEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetLength@Device@vfs@@UEAA_K_K@Z
?GetModifiedTime@Device@vfs@@UEAA_JAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetNativeDevice@Manager@vfs@@UEAA?AV?$fwRefContainer@VDevice@vfs@@@@PEAX@Z
?GetNativeDevice@vfs@@YA?AV?$fwRefContainer@VDevice@vfs@@@@PEAX@Z
?Mount@vfs@@YAXV?$fwRefContainer@VDevice@vfs@@@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?OpenBulk@Device@vfs@@UEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEA_K@Z
?OpenRead@Manager@vfs@@UEAA?AV?$fwRefContainer@VStream@vfs@@@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?OpenRead@vfs@@YA?AV?$fwRefContainer@VStream@vfs@@@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ReadBulk@Device@vfs@@UEAA_K_K0PEAX0@Z
?RemoveDirectoryA@Device@vfs@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?RemoveFile@Device@vfs@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?RenameFile@Device@vfs@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?SetPathPrefix@Device@vfs@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Unmount@vfs@@YAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Write@Device@vfs@@UEAA_K_KPEBX0@Z
?WriteBulk@Device@vfs@@UEAA_K_K0PEBX0@Z
Name
.text
Size
859KB
Virtual Size
858KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
321KB
Virtual Size
321KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
9.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=260, version=27412,
count=23, id=259, version=27412,
count=187, id=261, version=27412,
count=2, id=156, version=21202,
count=79, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=16, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=10, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=11, id=257, version=27412,
count=241, id=1, productName=Unmarked objects,
count=5, id=260, version=31104,
count=16, id=261, version=31104,
count=1, id=256, version=31104,
count=1, id=255, version=31104,
count=1, id=258, version=31104,