Tendvane-Portable.zip
- SHA256 7eeb29bbd7d37a1c6e8ab2e4345e8d265957feb3f5262b25b7ca5e1af4499e49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Tendvane.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tendvane.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target Tendvane-Portable.zip
- Size 1.1MB
- Sample260628-pepyvsg19r
- SHA256 7eeb29bbd7d37a1c6e8ab2e4345e8d265957feb3f5262b25b7ca5e1af4499e49
- MD5 bbab3311b6bdfa1c2e23bd0c1053cce5
- SHA1 61a4a036da83ddcabac030e5cace61038a7cd4cd
- SHA512 4dd5c9570aff367ceefa9c00bd35983785e8e5cb892444da280ab48bd5cdf72ad988ceae040b67e91394a8c2e0115febd372c9b72ebd4729a7a24e6ed5f996bb
- SSDEEP 24576:G4r2+W0fO80HG9W8fQPZ2x3b/U5luvRG1srENyl4IEUIW:Fq4V0m9LSZ2pUluvNCylZx
- TLSH T14E353304ED5921EB16F2A088ADFDC3D79FC51C603AE283516E18929FE57D70A3A71DC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Tendvane.exe
File Explorer
-
Tendvane-Portable.zip.zip 1.1MB
-
Tendvane.exe.exe 2.8MB
Tendvane.exe
- IMPHASH a7a8aea93116621fce7edb847ab81ec8
- SHA256 8bd261d774902ad66eaaaaff28524b2a2227f7e8946cd2f2298cb9a29d995a8b
- MD5 d6b5925b7bcf82c146883db522c95666
- SHA1 9ce515309f273e9bcd2005b2bb313d46cb5f7094
- SHA512 b7cd2960ab91104b4baef5ca432d3844b4a2fd09adc384fecc5e0b0748752dbe705783981bdbaee296a6be26c009c81bbbc60be0cd6bb6a4e595deca1f4f41f2
- SSDEEP 49152:CXGhBb5LtaiCCd6FlUi0FcbQwhv0g051qF3GmCC3ju6Qq4R0FZyGWWL+4Szid6nM:CXJUi
- TLSH T134D57DA5B3AD12E6CF6693F4E6C31F42673F358D372416432264824615BE01C5FBFA2A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
705456
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetMenuBarInfo
SetProcessDpiAwarenessContext
GetMessageW
LoadImageW
LoadIconW
LoadCursorW
OffsetRect
FillRect
MessageBoxW
GetWindowRect
GetClientRect
RedrawWindow
UpdateWindow
DrawTextW
GetMenuItemInfoW
AppendMenuW
DestroyMenu
CreateMenu
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
TranslateAcceleratorW
CreateAcceleratorTableW
GetWindowPlacement
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
RegisterClassW
PostQuitMessage
DefWindowProcW
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
SetProcessDPIAware
ole32
CoUninitialize
CoCreateInstance
GetHGlobalFromStream
CoSetProxyBlanket
CoInitializeEx
CreateStreamOnHGlobal
CoTaskMemFree
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
setupapi
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDevicePropertyW
CM_Get_DevNode_Status
newdev
UpdateDriverForPlugAndPlayDevicesW
DiInstallDriverW
advapi32
OpenProcessToken
AdjustTokenPrivileges
GetTokenInformation
LookupPrivilegeValueW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegQueryValueExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegGetValueW
RegSetValueExW
InitiateSystemShutdownExW
RegDeleteTreeW
gdi32
DeleteObject
SetBkMode
SetTextColor
CreateSolidBrush
gdiplus
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipGetImageHeight
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipSaveImageToStream
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipSetInterpolationMode
GdipDrawImageRectI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipBitmapUnlockBits
msi
ord181
ord45
ord179
ord70
shell32
CommandLineToArgvW
ShellExecuteW
SHFileOperationW
ShellExecuteExW
SHQueryRecycleBinW
SHEmptyRecycleBinW
Shell_NotifyIconW
SHCreateItemFromParsingName
SHCreateDirectoryExW
SHGetFolderPathW
SHGetKnownFolderPath
winhttp
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetTimeouts
WinHttpReceiveResponse
WinHttpSendRequest
dwmapi
DwmSetWindowAttribute
ws2_32
GetNameInfoW
connect
ioctlsocket
getsockopt
htons
inet_addr
ntohs
select
socket
WSAStartup
InetNtopW
inet_ntop
closesocket
WSACleanup
iphlpapi
GetExtendedTcpTable
GetAdaptersAddresses
SendARP
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
wevtapi
EvtFormatMessage
EvtRender
EvtQuery
EvtClose
EvtNext
EvtOpenPublisherMetadata
wlanapi
WlanQueryInterface
WlanGetProfile
WlanGetProfileList
WlanFreeMemory
WlanEnumInterfaces
WlanCloseHandle
WlanOpenHandle
bcrypt
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptGetProperty
wintrust
WinVerifyTrust
netapi32
NetUserEnum
NetApiBufferFree
kernel32
GetLocalTime
GetSystemTimeAsFileTime
GlobalMemoryStatusEx
GetSystemTimes
WriteConsoleW
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
OpenProcess
CreateProcessW
CreateThread
GetExitCodeProcess
TerminateProcess
GetCurrentProcess
Sleep
WaitForSingleObject
PeekNamedPipe
CreatePipe
SetHandleInformation
CloseHandle
GetTempPathW
WriteFile
SetFilePointer
GetEnvironmentStringsW
GetCommandLineA
FindFirstFileExW
GetTickCount64
GetWindowsDirectoryW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
GlobalSize
GlobalUnlock
GlobalLock
LocalFree
QueryFullProcessImageNameW
CopyFileW
MoveFileExW
FileTimeToSystemTime
GetSystemPowerStatus
GetOEMCP
GetACP
IsValidCodePage
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
VirtualProtect
GetFileType
HeapAlloc
HeapReAlloc
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetStdHandle
ExitProcess
SetFileAttributesW
RemoveDirectoryW
ReadFile
GetLogicalDriveStringsW
GetFileSizeEx
GetFileSize
GetFileAttributesW
GetDriveTypeW
GetDiskFreeSpaceExW
FindNextFileW
FindFirstFileW
FindClose
IsProcessorFeaturePresent
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
RtlUnwindEx
RtlLookupFunctionEntry
RaiseException
RtlPcToFileHeader
MultiByteToWideChar
WideCharToMultiByte
K32EnumProcesses
K32GetModuleBaseNameW
K32GetProcessMemoryInfo
DeleteFileW
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
SetUnhandledExceptionFilter
HeapFree
GetProcessHeap
OutputDebugStringW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetLastError
WaitForSingleObjectEx
OutputDebugStringA
LCMapStringEx
GetCPInfo
CompareStringEx
DecodePointer
EncodePointer
SleepConditionVariableSRW
WakeAllConditionVariable
QueryPerformanceCounter
DeleteCriticalSection
InitializeCriticalSectionEx
CreateFileW
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetExitCodeThread
CreateDirectoryW
CompareFileTime
ExpandEnvironmentStringsW
GetCommandLineW
GetEnvironmentVariableW
GetCurrentThreadId
Name
.text
Size
869KB
Virtual Size
868KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
238KB
Virtual Size
237KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=171, id=261, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=7, productName=Unmarked objects (old),
count=19, id=260, version=33145,
count=41, id=257, version=33145,
count=331, id=1, productName=Unmarked objects,
count=95, id=261, version=35721,
count=1, id=261, version=36248,
count=1, id=255, version=36248,
count=1, id=151,
count=1, id=258, version=36248,