SecuriteInfo[.]com[.]Win64[.]Evo-gen[.]247[.]3191[.]exe

Resubmissions

25/03/2024, 15:00

240325-sdp41seb4z10

24/03/2024, 15:29

240324-swwphsgb9z10

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Win64.Evo-gen.247.3191.exe
Size 4.1MB
Sample240325-sdp41seb4z
SHA256 cac7fc4ae9c97eba7455992b2d41449ee257ec485c562bfc7245a90033b1d774
MD5 c59b5442a81703579cded755bddcc63e
SHA1 c3e36a8ed0952db30676d5cf77b3671238c19272
SHA512 c9c834860982652e7ec1db085e534f6b1c35298ce75b29c2cbb0ac04ff40cd64363b458bcbd8c0983cf1ed778a4269372c6bc4ce7f831a6e1e70ee5f4a0772f9
SSDEEP 49152:JtW1B+dRs6iY7idGOL8/actfDdAvNgFzzP/v0x5+TXwwF:L1F0OpF
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

SecuriteInfo.com.Win64.Evo-gen.247.3191.exe

.exe 4.1MB

SecuriteInfo.com.Win64.Evo-gen.247.3191.exe

IMPHASH c6cb129ed43fdb4b64636582dff56a11
SHA256 cac7fc4ae9c97eba7455992b2d41449ee257ec485c562bfc7245a90033b1d774
MD5 c59b5442a81703579cded755bddcc63e
SHA1 c3e36a8ed0952db30676d5cf77b3671238c19272
SHA512 c9c834860982652e7ec1db085e534f6b1c35298ce75b29c2cbb0ac04ff40cd64363b458bcbd8c0983cf1ed778a4269372c6bc4ce7f831a6e1e70ee5f4a0772f9
SSDEEP 49152:JtW1B+dRs6iY7idGOL8/actfDdAvNgFzzP/v0x5+TXwwF:L1F0OpF
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

97:b0:72:dd:c1:c5:59:b1:2d:25:ec:4b:77:d7:f6:11:c7:50:76:19:5d:66:f5:36:2c:e7:5e:53:9e:29:4c:ea

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 24, 2024

Minor OS version

Major OS version

Entry point

438016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegCreateKeyExW RegDeleteValueW RegSetValueExW GetTokenInformation DuplicateTokenEx OpenThreadToken RevertToSelf ImpersonateLoggedOnUser CheckTokenMembership EventWrite EventRegister EventEnabled

bcrypt

BCryptGenRandom BCryptEncrypt BCryptDecrypt BCryptImportKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptOpenAlgorithmProvider

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RaiseException RtlPcToFileHeader CloseThreadpoolIo ExitProcess MultiByteToWideChar GetStdHandle TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentProcessorNumber GetCurrentProcess GetCurrentThread WaitForSingleObject Sleep CreateThreadpoolWork CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CloseThreadpoolWait InitializeCriticalSection InitializeConditionVariable DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable WaitForMultipleObjectsEx GetLastError SetLastError GetFullPathNameW GetLongPathNameW LocalAlloc GetConsoleOutputCP WideCharToMultiByte GetProcAddress RaiseFailFastException CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CreateDirectoryW CreateFileW DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetCurrentDirectoryW GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW LoadLibraryExW ReadFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetThreadErrorMode CreateThread ResumeThread DuplicateHandle GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW VirtualAllocEx CreateProcessW GetThreadContext SetThreadContext WriteProcessMemory VirtualProtect GetExitCodeProcess TerminateProcess OpenProcess K32EnumProcesses GetProcessId CreatePipe GetCPInfoExW GetConsoleCP FlushProcessWriteBuffers GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread SuspendThread FlushInstructionCache VirtualAlloc VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetTickCount GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry InitializeSListHead GetCurrentProcessId InitializeCriticalSectionAndSpinCount

ole32

CoUninitialize CoTaskMemAlloc CoGetApartmentType CoCreateGuid CoTaskMemFree CoWaitForMultipleHandles CoInitializeEx

user32

LoadStringW

api-ms-win-crt-heap-l1-1-0

free _callnewh calloc malloc _set_new_mode

api-ms-win-crt-math-l1-1-0

ceil floor __setusermatherr pow sin tan cos modf

api-ms-win-crt-string-l1-1-0

strcmp wcsncmp strncpy_s _stricmp strcpy_s _wcsicmp

api-ms-win-crt-runtime-l1-1-0

_get_initial_wide_environment _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv __p___argc _exit exit _initterm_e terminate _crt_atexit _initterm _register_onexit_function _initialize_onexit_table _initialize_wide_environment _configure_wide_argv _set_app_type abort _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __p__commode __stdio_common_vsprintf_s _set_fmode __stdio_common_vsscanf __acrt_iob_func

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

464KB

Virtual Size

463KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

191KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

SecuriteInfo.com.Win64.Evo-gen.247.3191.exe

PE Signature issue

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic