Divine Perm.rar
- SHA256 355413f94450a6733f72ac33350531fa88090308201fc6cbfef07647c55826e2
Static task
static1
1 signatures
General
- Target Divine Perm.rar
- Size 47.4MB
- Sample260824-a2veja1grc
- SHA256 355413f94450a6733f72ac33350531fa88090308201fc6cbfef07647c55826e2
- MD5 a5a9651054b878d573df9d5b54694a3d
- SHA1 cec452444e455d1ccc89dbe4bde3a3d7c951f9b8
- SHA512 fdb39769819c29c2b7984f64ddcc2b3376bfeea73f6c4be74c2dd27ecc6793f1ef860693d258625148841cf983e87c90d332170d30d4d514a8d7530642c1f762
- SSDEEP 786432:x6q5q0a3cXICga355BsMFIRXMPW/wf70MRZek0yf+cUX3:Ucq13c6e55BsLcu/wf70Mddo
- TLSH T10DB733A35423350078B27FD86B10C8A53D8A7BBFD5A106F40AD35FB691E352F509E2AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Divine Perm/Divine V2.exe
File Explorer
-
Divine Perm.rar.rar 47.4MB
-
Divine Perm/Divine Serial Checker.bat782B
-
Divine Perm/Divine V2.exe.exe 45.8MB
-
Divine Perm/Internet Drivers/REALTEK.exe.exe 5.0MB
Divine Perm/Divine Serial Checker.bat
- SHA256 513e2be8337c007cf79d8b9b7b36a09480d8ee8d36eb0085baaeff7f5905a963
- MD5 1fff859bcb187b553e503634aa7e884a
- SHA1 987bd8853706a05498d26de38f233be455deb5fa
- SHA512 da221236bd70008378f997a2446b8caa974160e665df366784d010bd2d0685ac8e065d1cc07ba920b03a5be7c7ba4341c5d45675b68b15f7bcd5b2f4c320bf9c
- TLSH T127014C34FE4CE6605871C91A2E784A43F617408349639ED90C7F81345E554DB7B5ED4D
- MD5 SHA1 SHA512 TLSH
Divine Perm/Divine V2.exe
- IMPHASH 636bb1508d7a5d9af1a58b76f7202d99
- SHA256 56934aa6980213e75a69684df7047837aa8f9f0305c9062c00ff4ac4471b6bfa
- MD5 6646e8358284cb6a1f266ff791abe83a
- SHA1 fe213d0472b6403c3b8a0c58265c9a60de34aaa6
- SHA512 1d9c297ec0bef6d289eb66416c73115d1ef734f92bb1a48f5097a1cb881e1c2151c852d252e9a8e0471961c0b15fdcc462ee2fd98c60c82b7610342807b0fbad
- SSDEEP 786432:ABr1lMFX1RTdWubiTZOcWLDxkOptRo2t0ZkRztCdgLx0gl9XXjR7JDPK:A91lMFl1dWokocWpbosFR5Cdg90OzZJG
- TLSH T172B7339B8DE59298C8835560328A47C730C9E88DC5ED99383FCF6C02A575CBF518DEB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
44360184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
ws2_32
WSACloseEvent
crypt32
CertFreeCertificateContext
setupapi
SetupDiDestroyDeviceInfoList
bcrypt
BCryptGetProperty
kernel32
OpenProcess
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
GetCursorPos
gdi32
BitBlt
advapi32
AddAccessDeniedAce
shell32
SHGetPathFromIDListA
ole32
CoTaskMemFree
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
msvcp140
?id@?$collate@D@std@@2V0locale@2@A
shlwapi
StrStrW
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
urlmon
URLDownloadToFileA
iphlpapi
GetAdaptersInfo
wininet
InternetOpenUrlA
ntdll
NtSetInformationThread
version
GetFileVersionInfoA
mpr
WNetGetProviderNameA
wintrust
WinVerifyTrust
winhttp
WinHttpReadData
imm32
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
fmodf
normaliz
IdnToUnicode
wldap32
ord45
Name
.text
Size
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
433KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
23.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.w59
Size
Virtual Size
16.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.qy+
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ayB
Size
45.8MB
Virtual Size
45.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Divine Perm/Internet Drivers/REALTEK.exe
- IMPHASH 3764040f14dce7c10295b2086d0b20f8
- SHA256 37cd4a7f7e4d159aeb1e2b9cdbd445fc901b8842a9c96b238c72bc59f37e1330
- MD5 71392d71a4f6305dff5e17706efb8ff8
- SHA1 1beaf27c6fafd20e2df2cb63b46b36783d11dc56
- SHA512 2019af4e1950ec6ad6e4b42b7bb74a0a0b0e52acb55d3920ef2333ad74155643c0f6d46b3d67e6d36b8f7b29d34ec015795729d66e56616df739b1dfcef6773b
- SSDEEP 98304:ct5jl1PS+6w3RdnWiL7pxSVAZ+KaRdbZZ/uUCArf/7G8yCzvweW1CV9x8:c/XS+6w3RLVxSVAi32W7GnCzvLW1I9x8
- TLSH T18136336728F8C8A1D74112B04473666477785ABE376785EF52C9B23C4FB7580B6323AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2b:3b:90:bc:b6:6d:f7:bb:c3:47:cb:80:b3:df:8b:85:40:84:ea:3a:69:7d:b5:10:94:63:89:5b:8f:c0:4a:3c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Chains
May 2, 2023
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Serial Number
03:39:02:2c:f9:8d:da:04:2a:02:96:1e:e0:62:e4:9c
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 30, 2022 - Jun 30, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
104034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
SysStringLen
SysAllocStringLen
VariantClear
user32
DialogBoxParamW
SetWindowLongW
GetWindowLongW
GetDlgItem
LoadStringW
CharUpperW
DestroyWindow
EndDialog
PostMessageW
SetWindowTextW
ShowWindow
MessageBoxW
SendMessageW
LoadIconW
KillTimer
SetTimer
shell32
ShellExecuteExW
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
memset
wcsstr
free
malloc
memcpy
_CxxThrowException
_purecall
memmove
memcmp
wcscmp
__CxxFrameHandler
kernel32
CloseHandle
GetStartupInfoA
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
lstrlenW
lstrcatW
VirtualFree
VirtualAlloc
Sleep
GetStdHandle
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileSize
GetFileInformationByHandle
GetFileAttributesW
GetModuleHandleA
FindNextFileW
FindFirstFileW
FindClose
GetCurrentThreadId
GetTickCount
GetCurrentProcessId
GetTempPathW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetLastError
DeleteFileW
CreateDirectoryW
GetModuleHandleW
GetProcAddress
RemoveDirectoryW
SetFileAttributesW
CreateFileW
SetFileTime
GetSystemDirectoryW
FormatMessageW
LocalFree
GetModuleFileNameW
LoadLibraryExW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
GetVersionExW
GetCommandLineW
CreateProcessW
WaitForSingleObject
Name
.text
Size
103KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
150KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=135, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=67, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=12, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,