KRV FREE TEMP[.]exe

General

Target
KRV FREE TEMP.exe
Size 443KB
Sample261011-dvm9esvvcv
SHA256 3be885cc9bb02df4d1fc26e786d24af93e67b1cbaca20c80a4e575646bf3454e
MD5 8a4dd9695d4e40f5a0b9d5d41e736e21
SHA1 ad8f40bef69b1cc3c30a0c9606635c5bf9c5d2b2
SHA512 c770db6900683601ddf0a33a6578f82c8ccea4e03fa6def4d5a8b794d9aed95f17da200fbdf35d03f6763326e638f4ca00017b09b317fb8ccf7160252a4dbc34
SSDEEP 6144:YFPyBeVrWevgSFAw1f7w41O8e/wSPZVWXNniAGNfmeTHwExwCaeddddddddcp:GqqFxqjRoSB6bYHwEix
TLSH
T131A49E26F7A404F9D067C578C9934902EB727C520760ABDF2390A9B61F236D49F3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KRV FREE TEMP.exe

File Explorer

KRV FREE TEMP.exe

.exe 443KB

KRV FREE TEMP.exe

IMPHASH 7aec070ec149f28af3c4078b433f69e9
SHA256 3be885cc9bb02df4d1fc26e786d24af93e67b1cbaca20c80a4e575646bf3454e
MD5 8a4dd9695d4e40f5a0b9d5d41e736e21
SHA1 ad8f40bef69b1cc3c30a0c9606635c5bf9c5d2b2
SHA512 c770db6900683601ddf0a33a6578f82c8ccea4e03fa6def4d5a8b794d9aed95f17da200fbdf35d03f6763326e638f4ca00017b09b317fb8ccf7160252a4dbc34
SSDEEP 6144:YFPyBeVrWevgSFAw1f7w41O8e/wSPZVWXNniAGNfmeTHwExwCaeddddddddcp:GqqFxqjRoSB6bYHwEix
TLSH
T131A49E26F7A404F9D067C578C9934902EB727C520760ABDF2390A9B61F236D49F3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

94000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxA

kernel32

GetConsoleMode SetConsoleCursorInfo CreateFileA CloseHandle GetLogicalDriveStringsA SetFilePointerEx GetCurrentProcessId SetConsoleOutputCP CreateDirectoryA GetTickCount SetConsoleTitleW Sleep VirtualFree VirtualAlloc GetCurrentThreadId GetModuleHandleA GetProcAddress VerSetConditionMask VerifyVersionInfoW CreateFileW GetModuleFileNameW GetTempPathW WriteConsoleW GetVolumeInformationA GetEnvironmentVariableA GetDriveTypeA DeviceIoControl GetConsoleCursorInfo SetConsoleMode WriteFile GetStdHandle SetConsoleTitleA ReadFile SetEndOfFile FlushFileBuffers GetModuleHandleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW RtlUnwind QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetConsoleCP DuplicateHandle GetCurrentProcess CreateProcessW DeleteFileW IsProcessorFeaturePresent ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType ReadConsoleInputW ReadConsoleW WaitForSingleObject GetExitCodeProcess GetFileAttributesExW CreatePipe GetFileSizeEx GetConsoleOutputCP IsValidCodePage GetACP GetOEMCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW

advapi32

RegSetKeyValueW RegDeleteTreeW RegCreateKeyW RegOpenKeyW AllocateAndInitializeSid FreeSid CheckTokenMembership RegCloseKey RegGetValueA RegCreateKeyExA RegSetValueExA RegOpenKeyExA

ntdll

NtQuerySystemInformation RtlAdjustPrivilege NtUnloadDriver NtLoadDriver RtlInitUnicodeString

Name

.text

Size

246KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

KRV FREE TEMP.exe

user32

kernel32

advapi32

ntdll

generic