WestMods.rar
- SHA256 cfda4a0e134217e2c43acba83c5a14fd72fc6a0decfc8d88e739d34a3f8d37cb
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nouveau dossier/OverwackLoader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target WestMods.rar
- Size 26KB
- Sample260905-tzjd2aybla
- SHA256 cfda4a0e134217e2c43acba83c5a14fd72fc6a0decfc8d88e739d34a3f8d37cb
- MD5 48ae422fd9eb2d9316db615046bbd98b
- SHA1 49434ef812112440ff12bddd946c7684e4eb1dce
- SHA512 e4c26db765ff2164a6589144893e2509c89d02a5b9add6112bc566273d6109eb5b3125e91d697cf601e881f6384eb6e204fbbb5929bd329bfee5b5fb224979ed
- SSDEEP 768:xnk4fBrbZzL24Fb1do8um8YJM+oAJwAjueMsbp:xnjBHZzL22RLuWM+ouwAjueMsbp
- TLSH T161C2F158C1BA681EC1B91C055FFD80CE1C4297A9B78815F9F21A2DF06D4CC794A136BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Nouveau dossier/OverwackLoader.exe
File Explorer
-
WestMods.rar.rar 26KB
-
Nouveau dossier/Montana Menu.lua.svg 96KB
-
Nouveau dossier/OverwackLoader.exe.exe 43KB
Nouveau dossier/Montana Menu.lua
- SHA256 53d6e839fed4abf31a63478b2c5976f69fe5442911f0327e71b4a69fc54f1bb6
- MD5 09e096988163d0a6fc4502d3dc944d5e
- SHA1 1990f909af528746c98046274a3408c091594218
- SHA512 64a9523b0f885af1b062858dca7e69b73be465d99a8e8ffd93d9005d26aefc26d089564f41b40b7fb8160ab918fafe931b7ef257967a591f636172c418162c5b
- SSDEEP 1536:FMPZUIMpFMdTbDCe62DNjxsKoYeYNEHs/ShH:ps/ShH
- TLSH T174A3ACF7200B577876A7AE8698A31A03EB3954264D3C7D1BB55D80707F2DB8D42E2F90
- MD5 SHA1 SHA512 SSDEEP TLSH
Nouveau dossier/OverwackLoader.exe
- IMPHASH 066523f57648142114f223f86cdb2eb0
- SHA256 dd35bf3faa7c2370262984f23b86bb81db8e6678b905f28c48ce84edf16bc7f8
- MD5 086bdd4d659a8d002485fefba80f9136
- SHA1 528529394f13da129a99543caeee0ebb87c81ccb
- SHA512 b3c7bff8ba62e78f94cd1f05700613c64de66a9765cf59d11edc5d4bfad318611663b75add18b5fd56fd29a8a860692e4a63f2beacd3856bf0f62b1518a7786a
- SSDEEP 768:xCaSqym7+KahsAQ0MoYiT1w6a16aa6YsPZKGbhpPWzlEClmvmkvKDiHIfW9Ja:xCaSqym7+Kaq+MoYiu6a16aa6PPFN6Ei
- TLSH T15913940BDC17F537EF480C70D5136A869D569CF2CFE5B88BEB911CD20896998E71B222
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
26274
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
OpenProcess
CreateToolhelp32Snapshot
MultiByteToWideChar
GetExitCodeThread
Sleep
GetTempPathA
GetFileAttributesA
LoadLibraryA
DeleteFileA
Process32Next
GetModuleHandleA
GetProcAddress
VirtualAllocEx
CreateRemoteThread
CreateProcessA
K32EnumProcessModules
VirtualFreeEx
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
WaitForSingleObject
GetCurrentProcess
SetConsoleTitleA
WriteProcessMemory
GetFileAttributesExA
Process32First
GetModuleFileNameA
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
ReleaseSRWLockExclusive
user32
MessageBoxA
advapi32
CloseServiceHandle
RegQueryValueExA
OpenSCManagerA
RegOpenKeyExA
QueryServiceStatusEx
OpenServiceA
RegCloseKey
msvcp140
?_Xlength_error@std@@YAXPBD@Z
vcruntime140
memcpy
strrchr
memset
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler3
_CxxThrowException
__current_exception
_except_handler4_common
memmove
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
fopen
__stdio_common_vsprintf
fwrite
__acrt_iob_func
_set_fmode
fclose
__p__commode
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
exit
_exit
_set_app_type
__p___argc
__p___argv
_c_exit
_get_initial_narrow_environment
_seh_filter_exe
_cexit
_invoke_watson
terminate
_controlfp_s
system
_crt_atexit
_register_thread_local_exe_atexit_callback
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-string-l1-1-0
wcscat_s
_stricmp
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
_set_new_mode
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35207,
count=12, id=260, version=35207,
count=28, id=261, version=35207,
count=4, id=257, version=35207,
count=7, id=257, version=33145,
count=104, id=1, productName=Unmarked objects,
count=1, id=265, version=35223,
count=1, id=255, version=35223,
count=1, id=258, version=35223,