over32[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
over32.exe
Size 8.8MB
Sample260925-ppdzcassbs
SHA256 2af2d82ac1b143dc3858f394d64142b313190a8a8bf3ab5c4398c8746a700ec5
MD5 ea75dd40ca47aa5cfe4d9a39de624d37
SHA1 6bbb9e7c021085f237f9fd52cdce57ddf9c74423
SHA512 1b2943ddc0a6b9e5a19b4d75b13111fc66563e1f6b1e873e33931fe68530c5e34f2e9677e49b980fcb41938e0bc83a8e4555f8a57b86bb07b5d9ddb07d7c312c
SSDEEP 196608:n0qHSkl1364eAeVRBtSj4EymAkxLTTMfoxQoL8TzzhqmNUA0WKp0T:n6PBtSj3AkZTTCir8TzzjUArKp
TLSH
T13F9633B2638395FED266C83CC7119925BA63799147617FFF0AA80536DF9BBC32E24014
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
over32.exe

File Explorer

over32.exe

.exe 8.8MB

over32.exe

IMPHASH 9bb57ff8e1dd5c675d257f596c23845f
SHA256 2af2d82ac1b143dc3858f394d64142b313190a8a8bf3ab5c4398c8746a700ec5
MD5 ea75dd40ca47aa5cfe4d9a39de624d37
SHA1 6bbb9e7c021085f237f9fd52cdce57ddf9c74423
SHA512 1b2943ddc0a6b9e5a19b4d75b13111fc66563e1f6b1e873e33931fe68530c5e34f2e9677e49b980fcb41938e0bc83a8e4555f8a57b86bb07b5d9ddb07d7c312c
SSDEEP 196608:n0qHSkl1364eAeVRBtSj4EymAkxLTTMfoxQoL8TzzhqmNUA0WKp0T:n6PBtSj3AkZTTCir8TzzjUArKp
TLSH
T13F9633B2638395FED266C83CC7119925BA63799147617FFF0AA80536DF9BBC32E24014
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

92384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

kernel32

EncodePointer CreateFileW QueryPerformanceCounter GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId SetLastError GetEnvironmentVariableW GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcess lstrlenW GetCurrentProcessId CreateMutexA CloseHandle ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetModuleHandleA GetModuleHandleW FormatMessageW QueryPerformanceFrequency CreateWaitableTimerExW SetWaitableTimer Sleep ExitProcess SetFilePointerEx FlushFileBuffers HeapSize GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlPcToFileHeader WriteFile GetModuleFileNameW TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW

ntdll

NtWriteFile RtlNtStatusToDosError

Name

.text

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text._Z

Size

512B

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8.7MB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

over32.exe

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

generic