nevoeiro_rename.zip
- SHA256 72d89bbbc691a2034005daef60bb5cb8f372697846c9395e1852f62b39b8d9bf
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
banking_trojan2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
banking_trojan2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
rundll32.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
rundll32.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target nevoeiro_rename.zip
- Size 673.8MB
- Sample260713-vlfxesct9n
- SHA256 72d89bbbc691a2034005daef60bb5cb8f372697846c9395e1852f62b39b8d9bf
- MD5 a45516c4b66e5db1590272373d8790fb
- SHA1 f6ded94fbc3c24c59fa21a81f14333c0da2b11a6
- SHA512 84c4545e762aae7a0846ae91a2b33dbbdba71c26a1c961ad6eb59666f4165cba5df1b663df9d2b3ea00b530df2f286708d2f2868870acb7a9baa7ef739b253f4
- SSDEEP 12582912:DuixQhU56pxmbYpUXRTPjZRyuAAyLKTE/ps/yWZtwoRQ2U0XJUwh:pxQveh1ZRKAyeTE/O/yakCh
- TLSH T136793317798680BFD0821E3AE93BA7D5273B76711F468C676BC0250CAE75FA1243E643
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/banking_trojan2.dll unpack001/rundll32.exe
File Explorer
-
nevoeiro_rename.zip.zip 673.8MB
-
banking_trojan2.dll.dll 673.8MB
-
rundll32.exe.exe 20KB
banking_trojan2.dll
- IMPHASH 4c99adea25fefa588742a4457c421053
- SHA256 94b0684d0dcd7dc59a7194f0b4cb2c1df9b6c3063e394068e021ccda96d6d30e
- MD5 9bf00e124e09988eb803f4c87583d2a9
- SHA1 1d6aaba6b98b615dee7a3cfd4f98f7867866d896
- SHA512 d33f49294ba53a9f23eff38abaf750b2d746fe2292ab9fe05c52ff76884d3b64ec7124cb1ab68fdb19fa78ffda6fcbe784f1dc94e0a3f776eaa5be4781c48b77
- SSDEEP 12582912:MuixQhU56pxmbYpUXRTPjZRyuAAyLKTE/ps/yWZtwoRQ2U0XJUw:exQveh1ZRKAyeTE/O/yakC
- TLSH T129793317798680BFD0821E3AE93BA7D5273B76711F468C676BC0250CAE75FA1243E643
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
16164891
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
winspool.drv
DocumentPropertiesW
comctl32
ImageList_GetImageInfo
shell32
Shell_NotifyIconW
user32
CopyImage
version
GetFileVersionInfoSizeW
uiautomationcore
UiaReturnRawElementProvider
oleaut32
SafeArrayPutElement
wtsapi32
WTSUnRegisterSessionNotification
advapi32
RegSetValueExW
msvcrt
memcpy
winhttp
WinHttpGetIEProxyConfigForCurrentUser
kernel32
GetVersion
GetVersionExW
shfolder
SHGetFolderPathW
ole32
IsEqualGUID
gdi32
Pie
__dbk_fcall_wrapper
dbkFCallWrapperAddr
nevoeiro
Name
.text
Size
4.7MB
Virtual Size
4.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
98KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
28KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
69B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.EWV0
Size
8.2MB
Virtual Size
8.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.EWV1
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.EWV2
Size
7.3MB
Virtual Size
7.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
653.1MB
Virtual Size
653.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
400KB
Virtual Size
399KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
rundll32.exe
- IMPHASH 491c1f369d29f44c81f51271b8c16d72
- SHA256 2b62294728b6c2463255ed96579e4769cdd6ad6acedbfb0c45157949e4f0f76d
- MD5 33b2cadb2ab6d8fc5820f72358586522
- SHA1 fa52a3c01405f8e06c3afb9d0aa7daa9a45dd885
- SHA512 625b2ea0921094b11a8447e205d3dcfb5ef41fed78a7aa22a4d7660d091769598db911c2a1416885901c2d77642fcb5237c7ae91f3775c5cd6d888339bf5520b
- SSDEEP 384:5W26GILvkwbdI5nGIywC1+/Ua+mNNNp5zwHcPuZ:56pw+dI5GIywC1XaxNr5zwwuZ
- TLSH T11F92EA16F20385AACC33B3B1C1D7D67EE661A64885621C5FFF270E18B63A6015D36367
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4159
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
RegCloseKey
RegCreateKeyExA
RegSetValueExA
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateFileA
CreateThread
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemInfo
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
SetErrorMode
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile
api-ms-win-crt-environment-l1-1-0
__p__environ
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
_cexit
_configure_narrow_argv
_crt_atexit
_exit
_initialize_narrow_environment
_initterm
_initterm_e
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vsprintf
fclose
fflush
fopen
setvbuf
api-ms-win-crt-string-l1-1-0
strlen
strncmp
ws2_32
WSAStartup
freeaddrinfo
getaddrinfo
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
200B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
644B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ