Evgh.bin
- SHA256 e99697188323e143ea9f2f595726cff836de361dfae04a2d461545a7c70d5483
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Evgh. rvs Armenia. 30.04.2024.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Evgh. rvs Armenia. 30.04.2024.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
Attn104/Jiber/Superintendentens/Chaptaliseringernes.ps1
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
Attn104/Jiber/Superintendentens/Chaptaliseringernes.ps1
Resource
win10v2004-20240419-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target Evgh.bin
- Size 437KB
- Sample240430-nxt5vsbe7z
- SHA256 e99697188323e143ea9f2f595726cff836de361dfae04a2d461545a7c70d5483
- MD5 7a31a25ab61dbd164950a2f144c944a6
- SHA1 974ef264762ac0b0dc076182f78052e6c1ecffca
- SHA512 3aba2b165d6d726b6ec325b7815652cf1f69e7664191ac3e5de5ee756b0d49a1e89eec5432dabc11def6128bca2a15e417439a082051465f1bd3d357ddd8252c
- SSDEEP 6144:o7pnisY3azNhyyBTaqkZHH7pNc8NBeHeJOKRwB0mcTY0TYpx9AJDqCLbdu6/y0Bv:LsY36bBTStHnNBqIOQRLTa9A9Zj3ZH
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Evgh. rvs Armenia. 30.04.2024.exe - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/Evgh. rvs Armenia. 30.04.2024.exe nsis_installer_1 static1/unpack001/Evgh. rvs Armenia. 30.04.2024.exe nsis_installer_2
File Explorer
-
Evgh.bin.zip 437KB
-
Evgh. rvs Armenia. 30.04.2024.exe.exe 783KB
-
Anstalters/Faulty/Smallhearted115/Kommuneskatten/hektowattens.txt541B
-
Attn104/Jiber/Superintendentens/Chaptaliseringernes.Kro.ps1 59KB
-
Attn104/Jiber/Superintendentens/chatrum.sag1KB
-
Hypopharynx/Udbuler/Eomecon/Boligtilsynet/Insipidly.Stu289KB
Evgh. rvs Armenia. 30.04.2024.exe
- IMPHASH 076b06e6a65c9b7cca5a61be0cd82165
- SHA256 0d8b7479bd9156032cf3287faee1807e96d68c7bce3835c7e3435951446bade1
- MD5 6775321bbbe02737daff72cbfef1d3a5
- SHA1 778fb1443b71b7afbf8965d6fad12247c7e2befc
- SHA512 0970f311b772c014384a17d0c3b51a47f7046096d2d140db7fbe665087369fde3123c77283304121ac37517a3aa117787c42914884ec82f985ddf88c7531b810
- SSDEEP 12288:DrC48OWaxjjtjj9bHGMIvxV7G5iMOQrLTI9AVZ/RZF:H7/jxjjtjj9JIvxV7G5iMN/0GZ/RZF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12505
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
Sleep
SetFileAttributesA
GetFileAttributesA
GetTickCount
GetModuleFileNameA
GetCurrentProcess
CopyFileA
GetFileSize
ExitProcess
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
GetVersion
SetErrorMode
lstrlenA
lstrcpynA
ExpandEnvironmentStringsA
SetEnvironmentVariableA
GetFullPathNameA
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
lstrcmpiA
lstrcmpA
SetCurrentDirectoryA
MoveFileA
CompareFileTime
GetShortPathNameA
SearchPathA
CloseHandle
SetFileTime
GlobalLock
GetDiskFreeSpaceA
GlobalUnlock
GlobalFree
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
MulDiv
WritePrivateProfileStringA
FreeLibrary
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
user32
GetSystemMenu
SetClassLongA
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
ScreenToClient
GetWindowRect
GetDlgItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
LoadImageA
CreateDialogParamA
SetTimer
SetWindowTextA
SetWindowLongA
SetForegroundWindow
ShowWindow
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
DrawTextA
EndPaint
DestroyWindow
wsprintfA
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegDeleteKeyA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
465KB
Virtual Size
464KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=160, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Anstalters/Faulty/Smallhearted115/Kommuneskatten/hektowattens.txt
- SHA256 a4c9e26743d76d4b7d7c357dfaba14bc0ef918ce05bbc8472c1fe6e2ccb2392c
- MD5 87da0589aa2102c1224d596aa149e56b
- SHA1 1e1cce9146840b718221d8d69cb511a57af9ccd9
- SHA512 04878e203a6d30cc6087a5781a4c8cb781b023938883bb7bf312fd504b70c9bf8256463112998d679c8a9686af5c8d83db840cb4913155d250a477dd7f8b2de8
- MD5 SHA1 SHA512
Attn104/Jiber/Superintendentens/Chaptaliseringernes.Kro
- SHA256 b7d771d62b14d618608d7541302035b824e69cee7a497ab326a14e7562800f3a
- MD5 7a00c4088c123d61422f4fe0db41bd24
- SHA1 8dcb56788e82418c69556771808bb6c7b977067f
- SHA512 e5c309d5d1cec2083750e242d901f8bdc3a845018603f6ed16436f65ebda2e1e7f5978ac3dc838199cae22ab7b0c12c930cf941bb25c33886731d76c5598ae37
- SSDEEP 1536:YZzbiRU2WUoHhEBe6aOe0P2vG2Ib4OO5S3oaT:gzbUUnU2hmVaM2vR7NS3d
- MD5 SHA1 SHA512 SSDEEP
Attn104/Jiber/Superintendentens/chatrum.sag
- SHA256 3072a2428ce58559feb3541dd0e2ad2e3c54e05cf802c9a9a149a2386737b004
- MD5 0b5446b68158ab6494017bdfc85db330
- SHA1 d5612e7254f06481257959c7f70fc0625c59f434
- SHA512 636a24ca3652a52f14c62d322c9be0452c5f82397cc7d1f37b7a541ae80b2529a81472e28e10919a202f8ccc555f26c55b42f97aa281375265e90f0dde045497
- MD5 SHA1 SHA512
Hypopharynx/Udbuler/Eomecon/Boligtilsynet/Insipidly.Stu
- SHA256 5be338accfc2df976a1bd39007957e5d5240336fbc7542d3e89cf3b17b0ee028
- MD5 961a103dacf6f59cff06d81648a2f791
- SHA1 dc779ee2a3129db451895e52f413592764c03e17
- SHA512 3c0a75b3bb598c0883fb43a39bd94aa34f5a3c44b2c849a7cea3d2ff33f48cb48e58d64285568bbb522d1584bd49af48e77e712b0e74f03182331e23580e25fe
- SSDEEP 6144:d+VnvDv+carHKpS+bdwr2LDxZZOhmBS1/8MLluKE2a4Op3VEJMB:dgbBaHKpSOdwr2LD4hmBC8uMXFVEJI
- MD5 SHA1 SHA512 SSDEEP