OverwackLoader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
OverwackLoader.exe
Size 361KB
Sample260626-2fynlsfy7k
SHA256 b10b7e309499e040cdd1430ae96c64bd7ae14b863587c4533ba9d802e88a3608
MD5 e313c64dfc3f2795524d01c20f0c822d
SHA1 0635891848a6912a6302724b2115f3592d13ab13
SHA512 6c045170a51bfed454de2a7f8d1f53f268ebed2e7ad1d9630567e11666a72081672df876074613e3d0225ab205befe4d6c3120f0773e4289e46101b72d02f9af
SSDEEP 6144:llN1nVcjLRw9tLkVVShFabh0dQa0hJn4iGp5egweE+fCSJQVfiGfgkULxbQRJ3Tc:/aF0dQFn4iGp5etenfCSJQVfiGfgbxb9
TLSH
T139747D92EE8291F3E6CA01B891F7AB774D358D25A3109AC3E3D15DB14C216D0A23A7DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OverwackLoader.exe

File Explorer

OverwackLoader.exe

.exe 361KB

OverwackLoader.exe

IMPHASH 0e77bb55d3480c4b648a967c9241b1bf
SHA256 b10b7e309499e040cdd1430ae96c64bd7ae14b863587c4533ba9d802e88a3608
MD5 e313c64dfc3f2795524d01c20f0c822d
SHA1 0635891848a6912a6302724b2115f3592d13ab13
SHA512 6c045170a51bfed454de2a7f8d1f53f268ebed2e7ad1d9630567e11666a72081672df876074613e3d0225ab205befe4d6c3120f0773e4289e46101b72d02f9af
SSDEEP 6144:llN1nVcjLRw9tLkVVShFabh0dQa0hJn4iGp5egweE+fCSJQVfiGfgkULxbQRJ3Tc:/aF0dQFn4iGp5etenfCSJQVfiGfgbxb9
TLSH
T139747D92EE8291F3E6CA01B891F7AB774D358D25A3109AC3E3D15DB14C216D0A23A7DD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

368640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

OpenServiceA QueryServiceStatusEx RegOpenKeyExA OpenSCManagerA RegQueryValueExA CloseServiceHandle RegCloseKey CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptGenRandom CryptReleaseContext CryptAcquireContextA CryptEncrypt

crypt32

CertFreeCertificateContext

ws2_32

sendto connect closesocket getpeername getsockname getsockopt htons ntohs setsockopt WSAIoctl bind getaddrinfo freeaddrinfo accept ioctlsocket gethostname htonl ntohl listen WSAStartup WSACleanup WSAGetLastError socket __WSAFDIsSet select WSASetLastError recv send recvfrom

wldap32

ord33 ord301 ord200 ord30 ord79 ord35 ord46 ord32 ord27 ord26 ord22 ord41 ord50 ord60 ord143 ord211

normaliz

IdnToAscii

kernel32

ExpandEnvironmentStringsA WaitForMultipleObjects PeekNamedPipe ReadFile GetFileType GetStdHandle WaitForSingleObjectEx WideCharToMultiByte FormatMessageA VerifyVersionInfoA LoadLibraryA IsDebuggerPresent GetModuleHandleW InitializeSListHead QueryPerformanceCounter GetCurrentProcessId UnhandledExceptionFilter GetCurrentThreadId SetUnhandledExceptionFilter VerSetConditionMask SleepEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SetLastError GetLastError GetTickCount64 FreeLibrary VirtualFreeEx CreateDirectoryA K32EnumProcessModules CreateProcessA CreateRemoteThread VirtualAllocEx GetProcAddress CloseHandle Process32Next DeleteFileA GetFileAttributesA GetSystemTimeAsFileTime GetSystemDirectoryA IsProcessorFeaturePresent GetTempPathA Sleep GetExitCodeThread MultiByteToWideChar CreateToolhelp32Snapshot GetModuleFileNameA Process32First GetFileAttributesExA WriteProcessMemory SetConsoleTitleA GetCurrentProcess TerminateProcess GetEnvironmentVariableA WaitForSingleObject GetModuleHandleA OpenProcess

user32

MessageBoxA

msvcp140

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

vcruntime140

memchr strstr strchr __current_exception_context memcpy memset _CxxThrowException __std_exception_copy __std_exception_destroy _except_handler4_common __CxxFrameHandler3 strrchr __current_exception memmove

api-ms-win-crt-stdio-l1-1-0

ftell fopen __acrt_iob_func ferror feof _lseeki64 fputc fgets _set_fmode fclose __stdio_common_vsprintf fseek __stdio_common_vfprintf fputs fread __p__commode fwrite __stdio_common_vsscanf _close _open _read _write fflush

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _errno __p___argv terminate _exit exit strerror __sys_nerr _beginthreadex _getpid _initterm_e __p___argc system _initterm _get_initial_narrow_environment _invoke_watson _controlfp_s _set_app_type _seh_filter_exe _cexit _c_exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-string-l1-1-0

_strdup isalpha isprint tolower strncpy islower isupper isalnum strncmp isspace isxdigit strpbrk _stricmp isdigit wcscat_s isgraph

api-ms-win-crt-convert-l1-1-0

atol strtoul strtol atoi strtoll

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode calloc malloc realloc

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _stat64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

270KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

�Y j�u:

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

OverwackLoader.exe

advapi32

crypt32

ws2_32

wldap32

normaliz

kernel32

user32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic