OverwackLoader_new[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
OverwackLoader_new.exe
Size 4.1MB
Sample260806-vxnfmsbc34
SHA256 443f0ff472b105494e2280d8fa23bce54e0bdc35993a6aa094ba0918826837ca
MD5 d555b9091659ea1ed29272eb4c3b740e
SHA1 94787f84c47e6e9a92ced0c5c9debedcb66b5394
SHA512 1f885522d7d6dd246228d28f04984c2014a6746b7b5fe8d6e49f745391fccd2f35ba5e4edb4969c3561f9ae55f477065e61d60a8e5be9a9137e7e4c74a2cf1f9
SSDEEP 49152:I6PxsdeUu+SkL3WivK2f5Y3QAcFQ3yBnbNuzfe3LJrWYt08WMN8:FiIUFSgTa3MVuurWM/
TLSH
T1D816BE427832C8E2C54501B5A8673F875D6D4A30C3D46CD7A3D60E9492E62F2B6AFB3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OverwackLoader_new.exe

File Explorer

OverwackLoader_new.exe

.exe 4.1MB

OverwackLoader_new.exe

IMPHASH 4a10b569c3bc9bbe489edc78715d4c10
SHA256 443f0ff472b105494e2280d8fa23bce54e0bdc35993a6aa094ba0918826837ca
MD5 d555b9091659ea1ed29272eb4c3b740e
SHA1 94787f84c47e6e9a92ced0c5c9debedcb66b5394
SHA512 1f885522d7d6dd246228d28f04984c2014a6746b7b5fe8d6e49f745391fccd2f35ba5e4edb4969c3561f9ae55f477065e61d60a8e5be9a9137e7e4c74a2cf1f9
SSDEEP 49152:I6PxsdeUu+SkL3WivK2f5Y3QAcFQ3yBnbNuzfe3LJrWYt08WMN8:FiIUFSgTa3MVuurWM/
TLSH
T1D816BE427832C8E2C54501B5A8673F875D6D4A30C3D46CD7A3D60E9492E62F2B6AFB3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

575406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

CryptReleaseContext OpenServiceA QueryServiceStatusEx CryptGetHashParam RegOpenKeyExA CryptDestroyHash CryptHashData CryptCreateHash OpenSCManagerA RegQueryValueExA CloseServiceHandle RegCloseKey CryptAcquireContextA CryptEncrypt CryptImportKey CryptDestroyKey CryptGenRandom

ws2_32

getsockopt getsockname htons select closesocket __WSAFDIsSet ntohs setsockopt WSAIoctl bind freeaddrinfo accept send listen recvfrom sendto ioctlsocket gethostname htonl ntohl WSASetLastError recv getaddrinfo socket connect getpeername WSAGetLastError WSACleanup WSAStartup

crypt32

CertFreeCertificateContext

wldap32

ord41 ord50 ord60 ord211 ord46 ord143 ord301 ord200 ord30 ord79 ord35 ord22 ord33 ord32 ord27 ord26

normaliz

IdnToAscii

d3d9

Direct3DCreate9

kernel32

IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter ExpandEnvironmentStringsA AcquireSRWLockExclusive PeekNamedPipe ReadFile GetStartupInfoW GetModuleHandleW GetFileType GetStdHandle WaitForSingleObjectEx FormatMessageA VerifyVersionInfoA GetSystemDirectoryA ReleaseSRWLockExclusive WakeAllConditionVariable IsDebuggerPresent SleepConditionVariableSRW SleepEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SetLastError GetLastError GetTickCount64 QueryPerformanceCounter FreeLibrary VerSetConditionMask IsDBCSLeadByte QueryPerformanceFrequency GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetLocaleInfoA WaitForMultipleObjects GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc OutputDebugStringA GetModuleFileNameA SizeofResource Process32First GetFileAttributesExA WriteProcessMemory GetCurrentProcess TerminateProcess Thread32Next GetFullPathNameA Thread32First FindResourceA GetEnvironmentVariableA WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetExitCodeThread Sleep GetTempPathA K32GetModuleFileNameExA GetFileAttributesA LoadLibraryA LockResource DeleteFileA Process32Next CloseHandle K32GetModuleBaseNameA LoadResource QueueUserAPC GetProcAddress VirtualAllocEx ReadProcessMemory CreateRemoteThread CreateProcessA GetSystemTimeAsFileTime K32EnumProcessModules CreateDirectoryA VirtualFreeEx OpenThread

user32

GetKeyboardLayout GetDC ClientToScreen GetForegroundWindow GetKeyState TrackMouseEvent LoadCursorA GetCapture SetCapture SetCursor SetProcessDPIAware IsWindowUnicode ReleaseCapture GetMessageExtraInfo SetCursorPos ReleaseDC UpdateWindow PostQuitMessage PeekMessageA GetClientRect LoadIconA TranslateMessage SetLayeredWindowAttributes MessageBoxA ShowWindow GetActiveWindow RegisterClassExW UnregisterClassW GetSystemMetrics ScreenToClient CreateWindowExW PostMessageA SetWindowPos DestroyWindow GetWindowRect DispatchMessageA MonitorFromPoint DefWindowProcW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos

gdi32

GetDeviceCaps

shell32

ShellExecuteW

msvcp140

_Thrd_detach _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_join

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140

_except_handler4_common __current_exception_context __current_exception _CxxThrowException memchr strstr memmove memcpy strchr strrchr __std_terminate __std_exception_copy __std_exception_destroy __CxxFrameHandler3 memset

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fwrite ferror feof __stdio_common_vsprintf __stdio_common_vfscanf _lseeki64 fputc fread __acrt_iob_func fflush _set_fmode _wfopen __stdio_common_vsscanf fclose fgets __p__commode fopen fputs ftell _read _write _close _open fseek

api-ms-win-crt-runtime-l1-1-0

_controlfp_s _invoke_watson _register_thread_local_exe_atexit_callback _c_exit _exit exit _initterm_e _initterm strerror __sys_nerr _getpid _get_narrow_winmain_command_line _beginthreadex _set_app_type _seh_filter_exe _cexit _errno terminate system _crt_atexit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function

api-ms-win-crt-string-l1-1-0

tolower _strdup isgraph wcscat_s _stricmp isprint islower isupper isalnum strncpy isspace isdigit strpbrk isxdigit isalpha strncmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode realloc _callnewh calloc malloc free

api-ms-win-crt-convert-l1-1-0

atol strtoul strtol atoi strtoll

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _stat64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

ceil _libm_sse2_sin_precise _CIfmod _libm_sse2_acos_precise __setusermatherr _libm_sse2_sqrt_precise _libm_sse2_cos_precise

api-ms-win-crt-locale-l1-1-0

_configthreadlocale