REVOSD_45000021449_20260921[.]exe[.]zip

General

Target
REVOSD_45000021449_20260921.exe.zip
Size 4.9MB
Sample260924-e5n45s1x2j
SHA256 961b2bcf052eb0f6db40f4441f1cf256466008e90863196342f24726591bda0e
MD5 bcac1ba4227df5272632d7e436ff05e6
SHA1 0a977f07ff28830c91556cd85cf1a9f0c33b1d38
SHA512 977aa34180c1eb51cd03979d9ca76404b8ed71d346c5c521eb643876ba32e89955936c1dd186ab531a1f47a90ab3eb4a2ec480d02cad4ca09e8a6723e5df7fcb
SSDEEP 98304:ASUGEvtROdro1U1gCdytcPOWeFbMrFHgdlKhOTYKh7a7YTUodZXm:ASUGstRO9UU1x+tMrFAdlKhOTYeO7YwT
TLSH
T18A3633492F69F2EAF463224AC986650CB04472C14F7DDEBF88D68BA65500E9FE47C50F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/REVOSD_45000021449_20260921.exe.bin

File Explorer

REVOSD_45000021449_20260921.exe.zip

.zip 4.9MB
REVOSD_45000021449_20260921.exe.bin

.exe 7.0MB

REVOSD_45000021449_20260921.exe.zip

SHA256 961b2bcf052eb0f6db40f4441f1cf256466008e90863196342f24726591bda0e
MD5 bcac1ba4227df5272632d7e436ff05e6
SHA1 0a977f07ff28830c91556cd85cf1a9f0c33b1d38
SHA512 977aa34180c1eb51cd03979d9ca76404b8ed71d346c5c521eb643876ba32e89955936c1dd186ab531a1f47a90ab3eb4a2ec480d02cad4ca09e8a6723e5df7fcb
SSDEEP 98304:ASUGEvtROdro1U1gCdytcPOWeFbMrFHgdlKhOTYKh7a7YTUodZXm:ASUGstRO9UU1x+tMrFAdlKhOTYeO7YwT
TLSH
T18A3633492F69F2EAF463224AC986650CB04472C14F7DDEBF88D68BA65500E9FE47C50F
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

REVOSD_45000021449_20260921.exe.bin

IMPHASH a46cc72b550adb245047c9a14f95beb2
SHA256 205486ad300765070545758b2ef8ca00acbf606baa4e5995354898c152348d3a
MD5 4e66f6b5b66363c4c867403e45edee55
SHA1 0ecbc23174d41dd33cb9686c6662301fbd13a86a
SHA512 af97299968f12af0bdebd8e67f218c55b749497f9abfabd1a9f707df1cd832b6d8cf471e7a11a8535e468f43d5caf97c35803b82cc8fc1bc4f020db2e275b779
SSDEEP 196608:Tzb3YCta7gQ1Oqk0AxVSN4zwl2IdlUNbR:DXfxVo4zg2IjyR
TLSH
T1DE76D03BD6AAC5EDC856D435A5A55B33A1703C0E85329177E7C21F242EB6328CEBD708
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

6

Entry point

13024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle ContinueDebugEvent CreateEventW CreateFileMappingW CreateFileW DeleteCriticalSection DeleteProcThreadAttributeList DeviceIoControl EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentStringsW GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage K32GetModuleInformation LCMapStringW LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UpdateProcThreadAttribute WaitForDebugEvent WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile lstrcatW lstrcmpiW lstrcpyW

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

d3d11

D3D11CreateDevice

Resubmissions

Sharing