Swing - Recoil PATCH.zip
- SHA256 581e0c4e08f68d2cd660456549d52db33350f23c94c1d30199e61e1df057fb07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
overlay.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
overlay.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
swing - Recoil.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
swing - Recoil.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
General
- Target Swing - Recoil PATCH.zip
- Size 20.8MB
- Sample260720-by1mtad17x
- SHA256 581e0c4e08f68d2cd660456549d52db33350f23c94c1d30199e61e1df057fb07
- MD5 511aa47903cbab97c76ca06ec47cc1a0
- SHA1 9fbdb8bda41f5108d98563e02a368e4ac8478ab4
- SHA512 3de8b8ed5b84a63e437773ab30abff65be8fd13b6de51f4b2c5e14eeb61dfcce5ac5de30c95b99d5ecfe666265a2504a1e8c88f91462688498fc514fb16d196c
- SSDEEP 393216:sHg9wbb/vKjJa6wkOpm1lrB+pgn7qUPJQXTjEtnVa4q6LCWogSvyIqd8tJgW:e4sb/+CDMTkgnWC2Wn26GjaIqmtJ7
- TLSH T1A7273314F8C09BF7E1976330FAE5DDA9647B02B517A60AD020B7E6DD9203B64B494F8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/overlay.exe unpack001/swing - Recoil.exe
File Explorer
-
Swing - Recoil PATCH.zip.zip 20.8MB
-
overlay.exe.exe 10.8MB
-
swing - Recoil.exe.exe 11.2MB
overlay.exe
- IMPHASH b4be2f5471d8d9c72b7a154d3695224e
- SHA256 ae85c3f0d98518f2bd1563837c10731d915667b4e85c9597530991db22692aa8
- MD5 7b9c239058e3a21d2eed5821e086f822
- SHA1 6d148f8d4b000e19c0656fae9468d4f9cc70812a
- SHA512 7f622e3a0f1f2dbe32a3c4b008e292f556dc9c008175cd1317d713e75016220a595e31be210181da4d227d8636925e6b0f06ba59037aa5a29941bbd1a46082f4
- SSDEEP 196608:LQ19x0UYav6ye5PPmRxqg5rXHKAGwJGn1YZpY4LiZ/alXTs/63dRpQ2Q:LCx0Bav6mXq4zqAGwJuAY4i/4ASN/K
- TLSH T141B62383E3D85EBAE01375384782593B2233B0340350472A7FA6D7BD9D6EAA0DB65F54
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4343
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontW
CreatePen
CreateRoundRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
Ellipse
GetStockObject
LineTo
MoveToEx
Polyline
Rectangle
RoundRect
SelectObject
SetBkMode
SetTextColor
gdiplus
GdipAlloc
GdipCloneBitmapAreaI
GdipCloneBrush
GdipCloneImage
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateFont
GdipCreateFontFamilyFromName
GdipCreateFromHDC
GdipCreateLineBrush
GdipCreateSolidFill
GdipCreateStringFormat
GdipDeleteBrush
GdipDeleteFont
GdipDeleteFontFamily
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDisposeImage
GdipDrawImageRect
GdipDrawString
GdipFillRectangle
GdipFree
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImageWidth
GdipMeasureString
GdipResetClip
GdipSetClipRect
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipSetTextRenderingHint
GdiplusShutdown
GdiplusStartup
kernel32
BaseGetNamedObjectDirectory
CloseHandle
CreateDirectoryW
CreateFileW
CreatePipe
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
EncodePointer
EnterCriticalSection
ExitThread
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FormatMessageA
FormatMessageW
FreeLibrary
GetCommandLineW
GetCurrentProcessId
GetEnvironmentVariableW
GetFileAttributesExW
GetFileAttributesW
GetLastError
GetLocalTime
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetSystemInfo
GetTempPathW
GetThreadPriority
GetTickCount64
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadResource
LocalFree
LockResource
MapViewOfFile
MultiByteToWideChar
OpenFileMappingW
QueryPerformanceFrequency
QueryUnbiasedInterruptTime
RaiseException
RaiseFailFastException
ReadFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetHandleInformation
SetLastError
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
getenv
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-private-l1-1-0
__C_specific_handler
memchr
memcmp
memcpy
memmove
strchr
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
__p__wcmdln
_cexit
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_errno
_exit
_initialize_narrow_environment
_initialize_wide_environment
_initterm
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
strerror
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
_read
fputc
fputs
fwrite
api-ms-win-crt-string-l1-1-0
iswalnum
iswspace
memset
strcmp
strlen
strncmp
towlower
wcslen
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_tzset
api-ms-win-crt-utility-l1-1-0
rand_s
ntdll
NtClose
NtCreateSection
NtDelayExecution
NtDuplicateObject
NtMapViewOfSection
NtRaiseHardError
NtReleaseKeyedEvent
NtUnmapViewOfSection
NtWaitForKeyedEvent
NtWaitForSingleObject
RtlDllShutdownInProgress
RtlNtStatusToDosError
user32
BeginPaint
CreateWindowExW
DefWindowProcW
DispatchMessageW
DrawTextW
EndPaint
FillRect
GetClientRect
GetMessageW
GetSystemMetrics
GetWindowRect
InvalidateRect
KillTimer
LoadCursorW
MessageBoxW
PostMessageW
PostQuitMessage
RegisterClassW
SetLayeredWindowAttributes
SetProcessDPIAware
SetTimer
SetWindowPos
SetWindowRgn
ShowWindow
TranslateMessage
UpdateWindow
wsprintfW
Name
.text
Size
195KB
Virtual Size
194KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
10.6MB
Virtual Size
10.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
swing - Recoil.exe
- IMPHASH a64c77985df2fa5ba819004c07616a05
- SHA256 9657254e192c0919695f547f0be04a738178544619ea113d2a595468693ce96b
- MD5 552d9189adc401be7ac8510054f7126e
- SHA1 031985d6f561717d307867df94bb758cd94759d7
- SHA512 adc5ac0aef31333399d8a49a4d0f1e0302a6d117195ae7412e7839e3f8277a2698195c241944096ea9dd32682637467352f081b6a1d9bd7dca2a7c108956cbbe
- SSDEEP 196608:fLQ19x0UYav6ye5PPmRxqg5rXHKAGwJGn1YZpY4LiZ/alXTs/63dRpQ2Q:fLCx0Bav6mXq4zqAGwJuAY4i/4ASN/K
- TLSH T1A3C62353E3E54AF9D023B5344782697A3132B0240320472B7F95CA7DAE6EEA0DF69F54
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4343
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
gdi32
AddFontResourceExW
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontW
CreatePen
CreateSolidBrush
DeleteDC
DeleteObject
Ellipse
GetStockObject
GetTextExtentPoint32W
IntersectClipRect
LineTo
MoveToEx
Polygon
Rectangle
RemoveFontResourceExW
RestoreDC
RoundRect
SaveDC
SelectObject
SetBkColor
SetBkMode
SetTextColor
gdiplus
GdipAlloc
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCloneImage
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipCreateFromHDC
GdipDeleteGraphics
GdipDisposeImage
GdipDrawImage
GdipDrawImageRect
GdipDrawImageRectI
GdipFree
GdipGetImageGraphicsContext
GdipGetImageHeight
GdipGetImageWidth
GdipGraphicsClear
GdipSetClipRectI
GdipSetInterpolationMode
GdipSetSmoothingMode
GdiplusShutdown
GdiplusStartup
kernel32
BaseGetNamedObjectDirectory
ClearCommError
CloseHandle
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreatePipe
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
EncodePointer
EnterCriticalSection
ExitThread
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FormatMessageA
FormatMessageW
FreeLibrary
GetCommState
GetComputerNameW
GetCurrentProcessId
GetEnvironmentVariableW
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetLastError
GetLocalTime
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetSystemInfo
GetTempPathW
GetThreadPriority
GetTickCount
GetTickCount64
GetVolumeInformationW
GlobalLock
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
LocalFree
LockResource
MapViewOfFile
MoveFileExW
MultiByteToWideChar
PeekNamedPipe
PurgeComm
QueryDosDeviceW
QueryPerformanceCounter
QueryPerformanceFrequency
QueryUnbiasedInterruptTime
RaiseException
RaiseFailFastException
ReadFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetCommState
SetCommTimeouts
SetConsoleCtrlHandler
SetHandleInformation
SetLastError
SetThreadPriority
SetUnhandledExceptionFilter
SetupComm
SizeofResource
Sleep
SwitchToThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileStringW
api-ms-win-crt-convert-l1-1-0
_wtoi
mbrtowc
strtol
strtoll
strtoul
strtoull
wcrtomb
wcstol
wcstoul
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
getenv
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
___mb_cur_max_func
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
floor
lround
pow
sin
api-ms-win-crt-private-l1-1-0
__C_specific_handler
memchr
memcmp
memcpy
memmove
strchr
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
__p__wcmdln
_cexit
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_errno
_exit
_initialize_narrow_environment
_initialize_wide_environment
_initterm
_set_app_type
_set_invalid_parameter_handler
_wsystem
abort
exit
signal
strerror
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
__stdio_common_vswprintf_s
_read
_wfopen
fclose
fgetwc
fgetws
fputc
fputs
fputwc
fwrite
getc
ungetc
ungetwc
api-ms-win-crt-string-l1-1-0
_wcsicmp
isspace
iswalnum
iswcntrl
iswctype
iswspace
isxdigit
mbrlen
memset
strcmp
strlen
strncmp
tolower
towlower
wcscpy_s
wcslen
wcsncpy_s
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_tzset
api-ms-win-crt-utility-l1-1-0
rand
rand_s
srand
ntdll
NtClose
NtCreateSection
NtDelayExecution
NtDuplicateObject
NtMapViewOfSection
NtRaiseHardError
NtReleaseKeyedEvent
NtUnmapViewOfSection
NtWaitForKeyedEvent
NtWaitForSingleObject
RtlDllShutdownInProgress
RtlNtStatusToDosError
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
user32
BeginPaint
CloseClipboard
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
DrawTextW
EndPaint
FillRect
GetAsyncKeyState
GetClientRect
GetClipboardData
GetDlgCtrlID
GetKeyNameTextW
GetKeyState
GetMessageW
GetSystemMetrics
GetWindowLongPtrW
GetWindowTextW
InflateRect
IntersectRect
InvalidateRect
IsDialogMessageW
IsWindow
KillTimer
LoadCursorW
MapVirtualKeyW
MessageBoxW
OpenClipboard
PostQuitMessage
PtInRect
RegisterClassW
ReleaseCapture
ScreenToClient
SendInput
SendMessageW
SetCapture
SetCursor
SetFocus
SetProcessDPIAware
SetTimer
SetWindowLongPtrW
ShowWindow
SystemParametersInfoW
TranslateMessage
UnionRect
UpdateWindow
wsprintfW
Name
.text
Size
486KB
Virtual Size
486KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
10.6MB
Virtual Size
10.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ