antigravity_recovery[.]exe

General

Target
antigravity_recovery.exe
Size 330KB
Sample260809-yjfenaxyhz
SHA256 77b2fa791ec19b6042988d576f995bdf1069fc7e0fa84142ec2d1d64fe02128d
MD5 c5f69734d58132ccb2d29b5d9408359c
SHA1 6df9a0e29159dbb6fc19108f0d668a48d6117d36
SHA512 5f5d9ac16dd719ea0004c9bad66d0fa609005bf10d04ac8cdf4db64a8cb1c12da126ea13fd38bf866dc9ba44da039b2899b00d049f64f0d83ce95a82549a6e9d
SSDEEP 3072:m+bMhpXQavUCGeXgbGH56RwThM2PWw8eodEcgUsAHS2++RlX36PKQXNk4EmmVjAJ:ATXcdERUsAHS2++rq7ERegvNO
TLSH
T1F674294EFAA520F5D5BBC038C582651EF97178A24370ABCB67914A572F23BE4AD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
antigravity_recovery.exe

File Explorer

antigravity_recovery.exe

.exe 330KB

antigravity_recovery.exe

IMPHASH 0fb757368f4161de811a602458311c19
SHA256 77b2fa791ec19b6042988d576f995bdf1069fc7e0fa84142ec2d1d64fe02128d
MD5 c5f69734d58132ccb2d29b5d9408359c
SHA1 6df9a0e29159dbb6fc19108f0d668a48d6117d36
SHA512 5f5d9ac16dd719ea0004c9bad66d0fa609005bf10d04ac8cdf4db64a8cb1c12da126ea13fd38bf866dc9ba44da039b2899b00d049f64f0d83ce95a82549a6e9d
SSDEEP 3072:m+bMhpXQavUCGeXgbGH56RwThM2PWw8eodEcgUsAHS2++RlX36PKQXNk4EmmVjAJ:ATXcdERUsAHS2++rq7ERegvNO
TLSH
T1F674294EFAA520F5D5BBC038C582651EF97178A24370ABCB67914A572F23BE4AD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

106220

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LocalFree FormatMessageA GetLocaleInfoEx CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI CloseHandle GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW SetEndOfFile RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW HeapFree WaitForSingleObject GetExitCodeProcess CreateProcessW HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW RtlUnwind

Name

.text

Size

225KB

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

antigravity_recovery.exe

kernel32

generic