Static task
static1
Behavioral task
behavioral1
Sample
tokrev.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
tokrev.exe
Resource
win10v2004-20240802-en
General
-
Target
tokrev.exe
-
Size
13KB
-
MD5
9c4eb7cc01f8393e71e754df754034cb
-
SHA1
b3c5b1d7e906bf103213f61f73ff2cf2b722263a
-
SHA256
35620425194fdf5b8af176582bb99d9fb23fa19e2c83673daee36332bda0311f
-
SHA512
52d0ff18e5ca76e82e9c0fe2dc2bbf675bb41a707f9885f4054fb20d8f915148797309d35c8f6851a3cb610c032468717b71e3fa67d19341eedf039057b1a2e0
-
SSDEEP
384:ILizAdzzrLWB4lWGR8XMHYYF22/2QHvupMQ:ILiz6rLWB4WXMHtFHY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tokrev.exe
Files
-
tokrev.exe.exe windows:5 windows x64 arch:x64
13b6781b251e80b616de3fdc2cc2b478
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
ws2_32
send
msvcr100
atoi
Sections
.NWLMYH1 Size: 11KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.NQHKGM2 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE