evangelicy (2)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
evangelicy (2).exe
Size 1.7MB
Sample260924-rq7ddsfb44
SHA256 49c2f1d7cd47637b4bfb7c30f84af1bb897013f00efb57b90f5235f37c8c4f76
MD5 0ba80329b858bebc9cc767921d023f8f
SHA1 aa7d10ca81d8e9f6ee7a6eca8fb560f2188f84a9
SHA512 15cb7617732c8077ab3e251527952250acc610fe3d671eecd19e4d8095b00bd1418e74ce6d049145e8de35f61ffccac53ebf3587ba95f3a1153f779e852a18a3
SSDEEP 49152:mw6G8+eXXw4mWZFyok0+OvAzdifa/sg218ADERUd3rcw5nhhMw:j4mIcud5xew
TLSH
T17B85BE2BB64851FCC077D438DB675213FB3A38180B368AF722E06494EF676E45A7A741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
evangelicy (2).exe

File Explorer

evangelicy (2).exe

.exe 1.7MB

evangelicy (2).exe

IMPHASH 5381fbbc9d820f72b94fe7fa4f1b3db6
SHA256 49c2f1d7cd47637b4bfb7c30f84af1bb897013f00efb57b90f5235f37c8c4f76
MD5 0ba80329b858bebc9cc767921d023f8f
SHA1 aa7d10ca81d8e9f6ee7a6eca8fb560f2188f84a9
SHA512 15cb7617732c8077ab3e251527952250acc610fe3d671eecd19e4d8095b00bd1418e74ce6d049145e8de35f61ffccac53ebf3587ba95f3a1153f779e852a18a3
SSDEEP 49152:mw6G8+eXXw4mWZFyok0+OvAzdifa/sg218ADERUd3rcw5nhhMw:j4mIcud5xew
TLSH
T17B85BE2BB64851FCC077D438DB675213FB3A38180B368AF722E06494EF676E45A7A741
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1143320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\avavu\OneDrive\Belgeler\sonoyuncu\dusunrum oreesp - automine free\bin\x64\Release\evangelicy.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea DwmSetWindowAttribute DwmGetColorizationColor DwmIsCompositionEnabled

bcrypt

BCryptDestroyHash BCryptHashData BCryptOpenAlgorithmProvider BCryptCreateHash BCryptGetProperty BCryptFinishHash BCryptCloseAlgorithmProvider

ole32

CreateStreamOnHGlobal CoInitializeEx CoCreateInstance CoUninitialize

kernel32

InitializeSListHead GetSystemTimeAsFileTime ReadFile SizeofResource GetVolumeInformationW WriteProcessMemory OutputDebugStringA GetModuleFileNameW GetProcessId K32GetModuleFileNameExW SetThreadPriority GetEnvironmentVariableW GetVolumePathNameW CreateFileW GetCurrentThreadId GetModuleHandleA K32EnumProcessModulesEx OpenProcess CreateToolhelp32Snapshot Sleep GetTickCount64 GetLastError Process32NextW K32GetModuleBaseNameW GetCurrentThread LockResource DeleteFileW Process32FirstW CloseHandle K32GetModuleInformation LoadResource FindResourceW GetWindowsDirectoryW GetProcAddress ReadProcessMemory GetComputerNameW GetCurrentProcessId GlobalMemoryStatusEx GetModuleHandleW QueryFullProcessImageNameW VirtualQueryEx GetExitCodeProcess MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte VerSetConditionMask FreeLibrary QueryPerformanceCounter AreFileApisANSI LocalFree FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentDirectoryW GlobalAlloc WideCharToMultiByte

user32

GetKeyState GetMessageExtraInfo ScreenToClient GetCapture TrackMouseEvent GetKeyboardLayout SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos EndPaint CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId DefWindowProcW GetWindow GetWindowRect DestroyWindow GetDC BeginPaint IsWindowVisible SetWindowPos MessageBoxW MonitorFromWindow OpenClipboard SetWindowLongPtrW SetWindowRgn CreateWindowExW GetSystemMetrics UnregisterClassW SetWindowTextW GetWindowLongPtrW RegisterClassExW ShowWindow IsWindow GetKeyNameTextA GetAsyncKeyState DispatchMessageW GetMonitorInfoW ClientToScreen PeekMessageW MapVirtualKeyA GetForegroundWindow EnumWindows TranslateMessage LoadCursorW GetClientRect UpdateLayeredWindow PostQuitMessage EnumDisplaySettingsW SystemParametersInfoW UpdateWindow SetForegroundWindow LoadImageW GetAncestor IsIconic ReleaseDC

gdi32

CreateRoundRectRgn DeleteDC CreateDIBSection SelectObject CreateRectRgn CreateCompatibleDC DeleteObject

advapi32

RegGetValueW

shell32

SHGetFolderPathW ShellExecuteW

msvcp140

?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ _Cnd_signal _Thrd_hardware_concurrency _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Thrd_join _Mtx_unlock _Cnd_broadcast ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

gdiplus

GdipCreatePath GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipFillPath GdipSetPenDashStyle GdipDrawLine GdipSetPixelOffsetMode GdipClosePathFigure GdipGetStringFormatFlags GdipGetGenericFontFamilySansSerif GdipFree GdipDrawPath GdipDrawString GdipSetPenLineJoin GdipFillEllipse GdipSetPenEndCap GdipCloneStringFormat GdipCloneImage GdipStringFormatGetGenericTypographic GdipDrawEllipse GdipFlush GdipGetImageGraphicsContext GdipAddPathArc GdipDeleteGraphics GdipDeleteStringFormat GdipSetCompositingMode GdipDeleteFont GdipStartPathFigure GdipDeletePen GdipCreateBitmapFromScan0 GdipCreatePen1 GdipDrawPolygon GdipNewPrivateFontCollection GdipSetStringFormatAlign GdipDeletePrivateFontCollection GdipPrivateAddMemoryFont GdipSetStringFormatFlags GdipSetSmoothingMode GdipDisposeImage GdipDeletePath GdipAlloc GdipDeleteBrush GdipCreateFontFamilyFromName GdipAddPathPolygon GdipSetCompositingQuality GdipDeleteFontFamily GdipAddPathLine GdiplusShutdown GdiplusStartup GdipMeasureString GdipSetPenStartCap GdipSetTextRenderingHint

winmm

timeBeginPeriod timeEndPeriod

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memmove __C_specific_handler __std_exception_destroy __std_exception_copy memcmp __std_terminate _CxxThrowException __current_exception_context __current_exception memset memchr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func ftell _get_stream_buffer_pointers __stdio_common_vsscanf __stdio_common_vsprintf_s __stdio_common_vswprintf_s fputc _fseeki64 __p__commode fread _set_fmode fsetpos fflush fseek ungetc setvbuf fgetpos fclose __stdio_common_vsprintf __stdio_common_vswprintf fwrite __stdio_common_vfprintf fgetc _wfopen

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _initterm _beginthreadex _register_onexit_function _initialize_onexit_table _initterm_e _get_wide_winmain_command_line exit _initialize_wide_environment _exit _seh_filter_exe _c_exit _invoke_watson _configure_wide_argv _cexit _set_app_type _register_thread_local_exe_atexit_callback

api-ms-win-crt-string-l1-1-0

strcmp wcsncpy_s _wcsicmp _stricmp tolower strncmp strncpy

api-ms-win-crt-math-l1-1-0

fmodf sqrtf sqrt floorf floor expf cosf cos ceilf atan2 acosf sinf _fdclass powf roundf hypot round remainderf _dclass sin __setusermatherr

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale