Remove-EdgeWeb[.]exe

General

Target
Remove-EdgeWeb.exe
Size 7.7MB
Sample241108-yvanjsyfmp
SHA256 798a7c7a1dfe7d822f1c85c6f05965f54f03a3d695cad876f7586bd0f07735c4
MD5 e593600b27b955018094cff096c98cea
SHA1 ca675c0a032a5a646d6205180d0e18125876d47d
SHA512 71599f3558a9c7e3b6bfd1cd554a7821d6c8edce5d593cb9e76d17dbead8f4f467e6300e95e57cc2b3f9480115234be58e451355ad926b849754522ba953ba75
SSDEEP 196608:D/8Olb2w9+L0YFqQxA10++MvJHDO6D3U/7F1gG:Dplq5L0HQK1HnEzFaG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

File Explorer

Remove-EdgeWeb.exe

.exe 7.7MB
edge.pyc

.ps1 10KB

Remove-EdgeWeb.exe

IMPHASH 7f6374fa43fb59c8c933315a94a24259
SHA256 798a7c7a1dfe7d822f1c85c6f05965f54f03a3d695cad876f7586bd0f07735c4
MD5 e593600b27b955018094cff096c98cea
SHA1 ca675c0a032a5a646d6205180d0e18125876d47d
SHA512 71599f3558a9c7e3b6bfd1cd554a7821d6c8edce5d593cb9e76d17dbead8f4f467e6300e95e57cc2b3f9480115234be58e451355ad926b849754522ba953ba75
SSDEEP 196608:D/8Olb2w9+L0YFqQxA10++MvJHDO6D3U/7F1gG:Dplq5L0HQK1HnEzFaG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects Pyinstaller

pyinstaller

PE Signature issue

Digest

d6:9e:89:59:65:e8:38:4d:85:4b:4d:43:da:8b:bd:31:9e:82:b4:5a:c7:43:29:42:2e:58:cd:cf:8b:1f:23:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

O=ShadowWhisperer,ST=Some-State,C=US

Chains

Nov 5, 2024

Minor OS version

1

Major OS version

5

Entry point

43600

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetWindowThreadProcessId ShowWindow

kernel32

GetModuleFileNameW CreateSymbolicLinkW GetProcAddress GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW GetTempPathW WaitForSingleObject Sleep GetExitCodeProcess CreateProcessW SetDllDirectoryW FreeLibrary LoadLibraryExW SetConsoleCtrlHandler FindClose FindFirstFileExW CloseHandle GetCurrentProcess GetCurrentProcessId LocalFree FormatMessageW MultiByteToWideChar WideCharToMultiByte GetConsoleWindow HeapSize GetLastError WriteConsoleW SetEndOfFile GetStartupInfoW TlsGetValue UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc DecodePointer TlsSetValue TlsFree EncodePointer RaiseException GetCommandLineA CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameW RemoveDirectoryW FindNextFileW SetStdHandle DeleteFileW ReadFile GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc CompareStringW LCMapStringW GetCurrentDirectoryW FlushFileBuffers HeapReAlloc GetFileAttributesExW GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation

advapi32

ConvertSidToStringSidW GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW

Sharing