evofixed[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
evofixed.rar
Size 476KB
Sample260714-ylldpae17s
SHA256 63b0d8973e7c130a7505d9b081b0b717f7004defba1fbeb28b14c2cc11142c1b
MD5 459dcddc51b9b19504125f4e1a2c679f
SHA1 d549c834fdc0f90f51326c0faa6c0ff487a462ce
SHA512 7689b1dd84706006a98690172e5f87bf041572ac65ac5995adc9ae86c628c4c8985fa728ab892b8204f4010efc3c0cc2b0e0fd999abc53e9b71d70a09b280095
SSDEEP 12288:Y3CSJpduOMTvFZlOX6jIWe0Q7IwiAbgA/6BqAlvh1NIi79Qs:Y3CG/vM7FZ86jIWXkPrB/M9FII9
TLSH
T108A42385DA9B92CC53DA287B08AD295A1C17D6F92CF151733396CE074B0B9835BCD48F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/evofixed/evofixed.exe

File Explorer

evofixed.rar

.rar 476KB
evofixed/evofixed.exe

.exe 971KB

evofixed.rar

SHA256 63b0d8973e7c130a7505d9b081b0b717f7004defba1fbeb28b14c2cc11142c1b
MD5 459dcddc51b9b19504125f4e1a2c679f
SHA1 d549c834fdc0f90f51326c0faa6c0ff487a462ce
SHA512 7689b1dd84706006a98690172e5f87bf041572ac65ac5995adc9ae86c628c4c8985fa728ab892b8204f4010efc3c0cc2b0e0fd999abc53e9b71d70a09b280095
SSDEEP 12288:Y3CSJpduOMTvFZlOX6jIWe0Q7IwiAbgA/6BqAlvh1NIi79Qs:Y3CG/vM7FZ86jIWXkPrB/M9FII9
TLSH
T108A42385DA9B92CC53DA287B08AD295A1C17D6F92CF151733396CE074B0B9835BCD48F
MD5 SHA1 SHA512 SSDEEP TLSH

evofixed/evofixed.exe

IMPHASH b2b439eb10120435f95e45bf3c227bd3
SHA256 288c31cbdb0dd340b1b6d7f3ed03b50cf1a2559b7847818fefbe7a9b0835397d
MD5 ed77ca1f4208771d795533359331c139
SHA1 acbab936b2c06c82424761d43ce250e196880611
SHA512 954eaf96d827d335f9e03f34334cf610260e3afeb420b1c031b1d78f4ea61075c58fcbb648db30882237752b52a8c73b5c8fa15b76cb48ead991c2677264e839
SSDEEP 24576:42zfCUuZuPmsTzmeRJSuPxni3nfOcdh+YW28:42zEiXzmWB5i3nf1h+z2
TLSH
T1C7259E05B7F445B8D17BE138C9A3EB17F63674480730AADB27E04A582F677E04A76B21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

621408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

kernel32

SetConsoleTitleA GetStdHandle DeviceIoControl GetConsoleScreenBufferInfoEx WaitForSingleObject CreateFileW CreateToolhelp32Snapshot Sleep SetConsoleScreenBufferInfoEx Process32Next CloseHandle Beep lstrcmpiA CreateProcessA GetCurrentProcess Module32Next Module32First GetCurrentThread QueryPerformanceFrequency GetThreadContext GetCurrentProcessId QueryPerformanceCounter GetTickCount IsDebuggerPresent CheckRemoteDebuggerPresent GetModuleHandleA GetModuleHandleW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA WakeAllConditionVariable FreeLibrary Process32First AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx GetLastError AreFileApisANSI CreateFile2 GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree GetSystemTimeAsFileTime SetConsoleTextAttribute SleepConditionVariableSRW GetCurrentThreadId SetUnhandledExceptionFilter InitializeSListHead GetProcAddress

user32

OpenClipboard CloseClipboard SetWindowPos GetKeyState LoadCursorA ScreenToClient GetSystemMetrics DispatchMessageA SetClipboardData ShowWindow GetAsyncKeyState SetWindowLongA GetWindowLongA SetWindowDisplayAffinity MessageBoxA GetClipboardData SetMenu SetLayeredWindowAttributes TranslateMessage mouse_event PeekMessageA EmptyClipboard FindWindowA UpdateWindow GetCursorPos SetCursorPos GetClientRect SetCursor ClientToScreen GetForegroundWindow GetKeyboardLayout

shell32

ShellExecuteA

ole32

CoInitialize

msvcp140

_Thrd_detach _Cnd_do_broadcast_at_thread_exit _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler memcmp memchr strstr memcpy memmove _CxxThrowException __std_exception_destroy __std_exception_copy strchr __std_terminate __current_exception_context __current_exception memset

api-ms-win-crt-stdio-l1-1-0

ftell __p__commode _set_fmode __stdio_common_vsscanf _wfopen _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf fwrite __stdio_common_vfprintf fgetc __stdio_common_vsprintf_s fputc fseek __acrt_iob_func fflush fclose

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc realloc _callnewh

api-ms-win-crt-string-l1-1-0

strlen strcmp toupper strncpy_s tolower strncmp strncpy wcslen

api-ms-win-crt-math-l1-1-0

acosf acos _dsign tanf atan2 sqrt __setusermatherr sinf logf asin cosf powf log fmodf sqrtf ldexp pow ceilf

api-ms-win-crt-convert-l1-1-0

strtoll strtoull strtod strtol atof

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file remove

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-runtime-l1-1-0

_c_exit __p___argv __p___argc _beginthreadex _register_thread_local_exe_atexit_callback _errno _exit exit system _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv terminate abort

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale