KEVLAR[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
KEVLAR.exe
Size 27.4MB
Sample260822-ga7dcaec52
SHA256 eaca067b5ecf9d123ee31badd86eefbc650d420b22db878d1492cbd31eb9fe61
MD5 241525f223c45803abd11a5a6926524a
SHA1 5cd681908ff53595f98c7d9e5574c48d8d6cd4fa
SHA512 648311979425d9a7308573e6d1c2ede538e927c8d91c2e1fa3ac31ed84988140e1e286ec991a52e8d514062fb7bd559c85252e1e70c9ce04279194e978c209ed
SSDEEP 196608:fwh6KWq3cWTicRpwOLZGdf73bVQo95sQ55hQ2Lbr/lavfzv3CE/DPUANwetWyOSd:fwbU7LVQo9GQ55hzLSdNwJpu
TLSH
T13A57B653E37705E2E4BEC1399562A627BDB230A48339A7DF9B4066075B217F0EE39341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KEVLAR.exe

File Explorer

KEVLAR.exe

.exe 27.4MB

KEVLAR.exe

IMPHASH 5e2eee566457e6bf489b838b6af55eac
SHA256 eaca067b5ecf9d123ee31badd86eefbc650d420b22db878d1492cbd31eb9fe61
MD5 241525f223c45803abd11a5a6926524a
SHA1 5cd681908ff53595f98c7d9e5574c48d8d6cd4fa
SHA512 648311979425d9a7308573e6d1c2ede538e927c8d91c2e1fa3ac31ed84988140e1e286ec991a52e8d514062fb7bd559c85252e1e70c9ce04279194e978c209ed
SSDEEP 196608:fwh6KWq3cWTicRpwOLZGdf73bVQo95sQ55hQ2Lbr/lavfzv3CE/DPUANwetWyOSd:fwbU7LVQo9GQ55hzLSdNwJpu
TLSH
T13A57B653E37705E2E4BEC1399562A627BDB230A48339A7DF9B4066075B217F0EE39341
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21370796

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\santi\Desktop\claude\KEVLAR\builds\KEVLAR.pdb

kernel32

GetCurrentThreadId LoadLibraryA GetProcAddress SetThreadPriority GetNativeSystemInfo GetCurrentProcessId CreateEventW SetEvent GetModuleHandleA lstrlenW GetTickCount64 GetCurrentThread ReadFile WriteFile CreateFileW GetFileAttributesW MultiByteToWideChar SetConsoleTextAttribute GetStdHandle WaitForMultipleObjects CreateMutexW ReleaseMutex ResetEvent ReleaseSemaphore CreateSemaphoreW GetTimeZoneInformation GetFileAttributesExW GetLastError ExitThread OpenThread WideCharToMultiByte QueryUnbiasedInterruptTime GetModuleFileNameA SetPriorityClass GetCurrentProcess SetConsoleMode GetConsoleMode GetModuleHandleExA SetUnhandledExceptionFilter QueryPerformanceCounter GetACP VirtualProtect LoadLibraryExA DebugBreak VirtualQuery GetLocalTime SetWaitableTimer CreateWaitableTimerA GetSystemInfo VirtualAlloc VirtualFree InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LocalFree FormatMessageA GetLogicalProcessorInformation AddVectoredExceptionHandler RemoveVectoredExceptionHandler GetSystemTime SystemTimeToFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead HeapAlloc HeapFree GetProcessHeap FreeLibrary CreateThread QueryPerformanceFrequency Sleep CloseHandle GetOEMCP WaitForSingleObject ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW AreFileApisANSI GetFileInformationByHandleEx InitOnceComplete InitOnceBeginInitialize GetStringTypeW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey

ole32

StringFromGUID2

urlmon

URLDownloadToFileW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__uncaught_exceptions __vcrt_LoadLibraryExW __vcrt_GetModuleFileNameW __std_exception_destroy __std_exception_copy __C_specific_handler strrchr strstr wcschr wcsstr wcsrchr _purecall __std_terminate memcpy memset memmove memcmp longjmp __current_exception __current_exception_context __C_specific_handler_noexcept __intrinsic_setjmp _CxxThrowException

api-ms-win-crt-heap-l1-1-0

_aligned_malloc realloc calloc free malloc _aligned_free _callnewh _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_invoke_watson abort _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit _wassert _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _beginthreadex _endthreadex terminate exit _cexit strerror _crt_atexit _set_abort_behavior system set_terminate _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv raise _errno

api-ms-win-crt-string-l1-1-0

strcat strcmp strcpy _strdup towupper wcscpy_s _wcsnicmp strcspn strlen wcsncmp iswalpha strncmp _strnicmp wcscat_s towlower _wcsicmp isupper strcat_s _wcsdup _stricmp islower strncpy strncpy_s strcpy_s wcsnlen __strncnt tolower toupper

api-ms-win-crt-stdio-l1-1-0

setvbuf __stdio_common_vswprintf_s __stdio_common_vsprintf fsetpos __stdio_common_vsprintf_s fread fopen fseek putchar _wfsopen fflush __stdio_common_vfprintf __stdio_common_vswprintf ungetc fputc fclose __p__commode fgetc fwrite __acrt_iob_func puts _fseeki64 _get_stream_buffer_pointers fopen_s fgetpos _set_fmode

api-ms-win-crt-convert-l1-1-0

wcstombs wcstoul

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

_lock_locales _configthreadlocale localeconv _unlock_locales ___mb_cur_max_func ___lc_locale_name_func ___lc_codepage_func setlocale __pctype_func

api-ms-win-crt-math-l1-1-0

pow log cos atan2 ceil fmaf fma sqrt fabs _fdpcomp _dpcomp _fdsign _dsign floor _fdclass _dclass sin _ldclass rint __setusermatherr sqrtf tan frexp ceilf

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort abs bsearch rand_s

Name

.text

Size

20.4MB

Virtual Size

20.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

914KB

Virtual Size

913KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

fakek

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

hookacce

Size

1024B

Virtual Size

754B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

223KB

Virtual Size

222KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

KEVLAR.exe

kernel32

advapi32

ole32

urlmon

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic