revive_shell[.]exe

Resubmissions

24/07/2026, 15:47

260724-s79erahd223

24/07/2026, 15:45

260724-s7bhqatckg3

24/07/2026, 05:34

260724-f9ea6sstd13

Sharing

Copy URL Twitter E-mail

General

Target
revive_shell.exe
Size 1.1MB
Sample260724-f9ea6sstd1
SHA256 c651138b1daca32a11ce61614773069e4a41338214162ffb3701699426c3d9e9
MD5 87ba429a34004a50a2cd55dcf55d0bd3
SHA1 4cd3faa80344462f8430e848989ea71abc63b1ce
SHA512 24fc4c738071dcd8094c0a53533a33eb2e843b7332d64adcfcf487d86b6f43cafa426fc6675aba49c8c07d05f27675110d172f6679a5e94718617c7784f2ebca
SSDEEP 6144:AAgFp3X5opl+hYuYL4vxbOMvfbJeKrtoFWc+pS6gCgs2NJmgLNFVLa:opHXsqtoknpS6gZs2Bxm
TLSH
T1BD4573579666669CC47BC0388542B51AF9E434EA8334D3EF66C14AC32BB17F4AE3D381
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
revive_shell.exe

File Explorer

revive_shell.exe

.exe 1.1MB

revive_shell.exe

IMPHASH c84b554a3b514a6b78ce045b4a1d1b3f
SHA256 c651138b1daca32a11ce61614773069e4a41338214162ffb3701699426c3d9e9
MD5 87ba429a34004a50a2cd55dcf55d0bd3
SHA1 4cd3faa80344462f8430e848989ea71abc63b1ce
SHA512 24fc4c738071dcd8094c0a53533a33eb2e843b7332d64adcfcf487d86b6f43cafa426fc6675aba49c8c07d05f27675110d172f6679a5e94718617c7784f2ebca
SSDEEP 6144:AAgFp3X5opl+hYuYL4vxbOMvfbJeKrtoFWc+pS6gCgs2NJmgLNFVLa:opHXsqtoknpS6gZs2Bxm
TLSH
T1BD4573579666669CC47BC0388542B51AF9E434EA8334D3EF66C14AC32BB17F4AE3D381
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7571

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\shahb\CLionProjects\Revive Shell H\cmake-build-debug\revive_shell.pdb

user32

UpdateWindow TrackPopupMenu LoadImageW LoadIconW GetCursorPos GetWindowTextLengthW SetWindowTextW RemovePropW GetPropW SetPropW GetMessageW TranslateMessage DispatchMessageW PostMessageW DefWindowProcW RegisterClassExW GetDC ReleaseDC BeginPaint EndPaint InvalidateRect GetClientRect FillRect GetWindowLongPtrW SetWindowLongPtrW LoadCursorW SendMessageW PostQuitMessage CreateWindowExW DestroyWindow ShowWindow SetWindowPos CreatePopupMenu DestroyMenu AppendMenuW SetForegroundWindow

gdi32

SetTextColor SetBkColor RoundRect CreateFontW MoveToEx SelectObject DeleteObject DeleteDC CreateSolidBrush CreatePen CreateCompatibleDC CreateCompatibleBitmap BitBlt LineTo

shell32

Shell_NotifyIconW ShellExecuteExW

advapi32

OpenSCManagerW GetTokenInformation CloseServiceHandle StartServiceW OpenServiceW OpenProcessToken ControlService

comctl32

InitCommonControlsEx

uxtheme

SetWindowTheme

kernel32

AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive Process32NextW Process32FirstW CreateToolhelp32Snapshot K32EmptyWorkingSet TryAcquireSRWLockExclusive GetSystemTimes OpenProcess CreateProcessW WaitForSingleObject TryAcquireSRWLockShared SleepConditionVariableSRW Sleep GetCurrentThreadId GetTickCount64 IsDebuggerPresent RaiseException GetProcAddress MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead AcquireSRWLockShared DeviceIoControl CreatePipe SetHandleInformation SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GlobalMemoryStatusEx ReadFile CreateFileW CloseHandle GetCurrentProcess GetModuleFileNameW CreateDirectoryW DeleteFileW MoveFileW

msvcp140d

?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEAPEA_W0PEAH001@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ

vcruntime140d

memmove __std_exception_destroy _CxxThrowException memset memchr memcmp __C_specific_handler __C_specific_handler_noexcept __std_type_info_destroy_list __current_exception __current_exception_context __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_LoadLibraryExW memcpy __std_exception_copy

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

_rotl fgetpos _malloc_dbg _CrtDbgReportW _callnewh malloc _seh_filter_exe _set_app_type __setusermatherr _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _set_fmode _cexit _c_exit _register_thread_local_exe_atexit_callback _configthreadlocale terminate strlen _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit strcpy_s strcat_s __stdio_common_vsprintf_s _wmakepath_s _wsplitpath_s round fgetc fflush fclose _get_stream_buffer_pointers ungetwc fputwc fgetwc _CrtDbgReport wcscpy_s __p__commode fmod __stdio_common_vswprintf strtod _errno wcstod iswspace wcslen _unlock_file _lock_file ungetc setvbuf _beginthreadex fwrite _fseeki64 _set_new_mode fsetpos _free_dbg

Name

.text

Size

774KB

Virtual Size

774KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

221KB

Virtual Size

220KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

revive_shell.exe

user32

gdi32

shell32

advapi32

comctl32

uxtheme

kernel32

msvcp140d

vcruntime140d

vcruntime140_1d

ucrtbased

generic