ev[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ev.exe
Size

993KB
MD5

42b68946b386fc3f1df7e4d24775c4ab
SHA1

87a257861d2d9f90a81102db7c0e8946aee04624
SHA256

578ff3f18bf8736cdf1617a63202d777c4f10e770406659a84ca85ac8174300e
SHA512

2a355e9cf3fcef1518e7f880920c3bfeb3f14429010642ecdbe5d919a6fa5ded4a52ade8fc827b8a8012c1182e71d1b227c56100886babcc9d3e9aca33e34c60
SSDEEP

24576:t+NTtig+yCcQSR6xqhpeo7rs/KHII77Db1qIjZGfyzaiLW5:tiTtigr/vEzo77NqIjgfoaiC

Score

1^/10

Malware Config

Signatures

Files

ev.exe
.exe windows:4 windows x64 arch:x64

b5c6aaf4daebeb8ea5b3c1ce7ae25e3c

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:30

Not After

03/03/2021, 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b7:a9:8f:81:f1:f0:6c:d0:6a:d1:f4:05:1b:d0:ac:d4:8f:c5:f7:b5:49:91:d2:6e:c3:1e:19:06:90:42:1d:31
Signer

Actual PE Digest

b7:a9:8f:81:f1:f0:6c:d0:6a:d1:f4:05:1b:d0:ac:d4:8f:c5:f7:b5:49:91:d2:6e:c3:1e:19:06:90:42:1d:31

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateThread
GetLastError
GetModuleHandleA
GetProcAddress
VirtualProtect
WaitForSingleObject

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 948KB - Virtual size: 948KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5c6aaf4daebeb8ea5b3c1ce7ae25e3c

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

b7:a9:8f:81:f1:f0:6c:d0:6a:d1:f4:05:1b:d0:ac:d4:8f:c5:f7:b5:49:91:d2:6e:c3:1e:19:06:90:42:1d:31Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 2KB - Virtual size: 2KB

.data Size: 948KB - Virtual size: 948KB

.rdata Size: 512B - Virtual size: 272B

.pdata Size: 512B - Virtual size: 192B

.xdata Size: 512B - Virtual size: 180B

.idata Size: 512B - Virtual size: 388B

.rsrc Size: 18KB - Virtual size: 17KB

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

b7:a9:8f:81:f1:f0:6c:d0:6a:d1:f4:05:1b:d0:ac:d4:8f:c5:f7:b5:49:91:d2:6e:c3:1e:19:06:90:42:1d:31
Signer

.text
Size: 2KB - Virtual size: 2KB

.data
Size: 948KB - Virtual size: 948KB

.rdata
Size: 512B - Virtual size: 272B

.pdata
Size: 512B - Virtual size: 192B

.xdata
Size: 512B - Virtual size: 180B

.idata
Size: 512B - Virtual size: 388B

.rsrc
Size: 18KB - Virtual size: 17KB