OverlordShell[.]exe

General

Target
OverlordShell.exe
Size 8.1MB
Sample260624-yn7dyaft6m
SHA256 4e5e1e678936ebcae76ad2d407efff35dc2bce515f9868f2f318386792fa95dc
MD5 e8014a52e4cd0231c560d8b18cb01bbf
SHA1 1857717f92990c55c66fec8ecc6facd37b2f331d
SHA512 a3b6507a71466df7dc5d200c8f6eb003a1ed45f1fb8d4a23daf34e986f8bbb3796e49e8d35d566ae469dfb80071c1abd8fdc712afd2e688ff2edfdcec5d64b4c
SSDEEP 196608:s4kUe/HmrNqxJnW8V1k7V6KnB3axdkGzgT+PKZ8Z4DimP:SUhrNeWMg0oB3axdk9T+DZ4emP
TLSH
T15F8633471FD80616EE3B413BE3368CDC85498320FF51FB4E4BC9D3A7608F994AAA1695
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OverlordShell.exe

File Explorer

OverlordShell.exe

.exe 8.1MB

OverlordShell.exe

IMPHASH 94b296fd6db6bacd93252d155867825d
SHA256 4e5e1e678936ebcae76ad2d407efff35dc2bce515f9868f2f318386792fa95dc
MD5 e8014a52e4cd0231c560d8b18cb01bbf
SHA1 1857717f92990c55c66fec8ecc6facd37b2f331d
SHA512 a3b6507a71466df7dc5d200c8f6eb003a1ed45f1fb8d4a23daf34e986f8bbb3796e49e8d35d566ae469dfb80071c1abd8fdc712afd2e688ff2edfdcec5d64b4c
SSDEEP 196608:s4kUe/HmrNqxJnW8V1k7V6KnB3axdkGzgT+PKZ8Z4DimP:SUhrNeWMg0oB3axdk9T+DZ4emP
TLSH
T15F8633471FD80616EE3B413BE3368CDC85498320FF51FB4E4BC9D3A7608F994AAA1695
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\olika\Downloads\snagg\OverlordShell\x64\Release\OverlordShell.pdb

kernel32

SwitchToFiber GetLastError LockResource LoadResource DeleteFiber ConvertFiberToThread ConvertThreadToFiber CreateFiber GetSystemTimeAsFileTime GetModuleFileNameW VirtualAlloc FindResourceW SizeofResource GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW InitializeSListHead

advapi32

RegSetValueExW RegOpenKeyExW RegCloseKey

vcruntime140

__std_exception_copy __C_specific_handler __current_exception __current_exception_context __std_exception_destroy _CxxThrowException memcpy

api-ms-win-crt-runtime-l1-1-0

exit _initterm_e _initialize_onexit_table _cexit _crt_atexit terminate _get_narrow_winmain_command_line _exit _initialize_narrow_environment _c_exit _register_onexit_function _configure_narrow_argv _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _initterm

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh _set_new_mode

api-ms-win-crt-string-l1-1-0

wcslen

Sharing