Divine V2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Divine V2.exe
Size 45.8MB
Sample260628-a7bvdaex2r
SHA256 56934aa6980213e75a69684df7047837aa8f9f0305c9062c00ff4ac4471b6bfa
MD5 6646e8358284cb6a1f266ff791abe83a
SHA1 fe213d0472b6403c3b8a0c58265c9a60de34aaa6
SHA512 1d9c297ec0bef6d289eb66416c73115d1ef734f92bb1a48f5097a1cb881e1c2151c852d252e9a8e0471961c0b15fdcc462ee2fd98c60c82b7610342807b0fbad
SSDEEP 786432:ABr1lMFX1RTdWubiTZOcWLDxkOptRo2t0ZkRztCdgLx0gl9XXjR7JDPK:A91lMFl1dWokocWpbosFR5Cdg90OzZJG
TLSH
T172B7339B8DE59298C8835560328A47C730C9E88DC5ED99383FCF6C02A575CBF518DEB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Divine V2.exe

File Explorer

Divine V2.exe

.exe 45.8MB

Divine V2.exe

IMPHASH 636bb1508d7a5d9af1a58b76f7202d99
SHA256 56934aa6980213e75a69684df7047837aa8f9f0305c9062c00ff4ac4471b6bfa
MD5 6646e8358284cb6a1f266ff791abe83a
SHA1 fe213d0472b6403c3b8a0c58265c9a60de34aaa6
SHA512 1d9c297ec0bef6d289eb66416c73115d1ef734f92bb1a48f5097a1cb881e1c2151c852d252e9a8e0471961c0b15fdcc462ee2fd98c60c82b7610342807b0fbad
SSDEEP 786432:ABr1lMFX1RTdWubiTZOcWLDxkOptRo2t0ZkRztCdgLx0gl9XXjR7JDPK:A91lMFl1dWokocWpbosFR5Cdg90OzZJG
TLSH
T172B7339B8DE59298C8835560328A47C730C9E88DC5ED99383FCF6C02A575CBF518DEB6
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

allawi

Minor OS version

Major OS version

Entry point

44360184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

ws2_32

WSACloseEvent

crypt32

CertFreeCertificateContext

setupapi

SetupDiDestroyDeviceInfoList

bcrypt

BCryptGetProperty

kernel32

OpenProcess GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess GetModuleHandleA LoadLibraryA GetProcAddress

user32

GetCursorPos

gdi32

BitBlt

advapi32

AddAccessDeniedAce

shell32

SHGetPathFromIDListA

ole32

CoTaskMemFree

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

msvcp140

?id@?$collate@D@std@@2V0locale@2@A

shlwapi

StrStrW

rpcrt4

RpcStringFreeA

psapi

GetModuleInformation

urlmon

URLDownloadToFileA

iphlpapi

GetAdaptersInfo

wininet

InternetOpenUrlA

ntdll

NtSetInformationThread

version

GetFileVersionInfoA

mpr

WNetGetProviderNameA

wintrust

WinVerifyTrust

winhttp

WinHttpReadData

imm32

ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove

api-ms-win-crt-runtime-l1-1-0

_invoke_watson

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-filesystem-l1-1-0

_unlink

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-math-l1-1-0

fmodf

normaliz

IdnToUnicode

wldap32

ord45

Name

.text

Size

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

433KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

23.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.w59

Size

Virtual Size

16.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.qy+

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ayB

Size

45.8MB

Virtual Size

45.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Divine V2.exe

d3d11

d3dcompiler_43

ws2_32

crypt32

setupapi

bcrypt

kernel32

user32

gdi32

advapi32

shell32

ole32

d3dx11_43

msvcp140

shlwapi

rpcrt4

psapi

urlmon

iphlpapi

wininet

ntdll

version

mpr

wintrust

winhttp

imm32

dwmapi

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

normaliz

wldap32

generic