Overlord[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Overlord.exe
Size 7.5MB
Sample261013-2xfjcsss5q
SHA256 b62bb99bc99ffa133d60820d2eb773285fcb47a168cea96896b00ce1faa87b7b
MD5 81ba608d959d0f6bb51ddf10457b3cc9
SHA1 8beef877972158fb625d43a3adcb653dbf820230
SHA512 ca3cad6654195d9d741eda65713118c374470e304dfd49144593010135996120f6d770aaee0bda211377c2dfbfe2a8da0ea350eff942c253cb1801b13b8853b6
SSDEEP 98304:GNA0VaZCPM1Tut84R9NdMN7e+POSkC8QOSEZn+Q:XeaZoW+XMJBBkn5R
TLSH
T16F869F03F6A1C1E9C09EC5B4835AA633E732B88D0920B2EF57D45B212F66F506F1D75A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Overlord.exe

File Explorer

Overlord.exe

.exe 7.5MB

Overlord.exe

IMPHASH 109976ad343d358f81722fdac8152e7e
SHA256 b62bb99bc99ffa133d60820d2eb773285fcb47a168cea96896b00ce1faa87b7b
MD5 81ba608d959d0f6bb51ddf10457b3cc9
SHA1 8beef877972158fb625d43a3adcb653dbf820230
SHA512 ca3cad6654195d9d741eda65713118c374470e304dfd49144593010135996120f6d770aaee0bda211377c2dfbfe2a8da0ea350eff942c253cb1801b13b8853b6
SSDEEP 98304:GNA0VaZCPM1Tut84R9NdMN7e+POSkC8QOSEZn+Q:XeaZoW+XMJBBkn5R
TLSH
T16F869F03F6A1C1E9C09EC5B4835AA633E732B88D0920B2EF57D45B212F66F506F1D75A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4207472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

overlord_desktop.pdb

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile RtlNtStatusToDosError NtCreateFile NtCancelIoFileEx NtOpenFile NtReadFile NtCreateNamedPipeFile NtDeviceIoControlFile RtlGetVersion

kernel32

RtlPcToFileHeader LCIDToLocaleName GetUserDefaultUILanguage GetSystemTimePreciseAsFileTime RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeSListHead SetUnhandledExceptionFilter LoadLibraryW RtlUnwindEx SwitchToThread FreeEnvironmentStringsW GetSystemInfo SetLastError RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess GetCurrentProcessId WideCharToMultiByte ReleaseMutex WaitForSingleObject MultiByteToWideChar HeapAlloc lstrlenW SleepEx FormatMessageW SetHandleInformation ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle SetWaitableTimer GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimeAsFileTime SleepConditionVariableSRW RtlVirtualUnwind RtlCaptureContext GetCommandLineW SetEnvironmentVariableW AddVectoredExceptionHandler HeapReAlloc HeapFree GetProcessHeap GetCurrentThread SetThreadStackGuarantee GetModuleHandleA Sleep GetProcAddress CreateWaitableTimerExW GetTempPathW GetFileAttributesW CreateProcessW CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle SetFileTime GetFullPathNameW CreateThread WriteFileEx ReadFileEx CloseHandle WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle CreateMutexA SetNamedPipeHandleState CreateFileW WakeAllConditionVariable SetFileInformationByHandle DeleteFileW FindClose FindNextFileW FindFirstFileExW CancelIoEx WriteFile SetFileCompletionNotificationModes CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetFinalPathNameByHandleW DeleteCriticalSection GetLastError GetModuleHandleW AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryA GetCurrentDirectoryW FreeLibrary InitializeCriticalSectionEx GetEnvironmentVariableW GetCurrentThreadId LoadLibraryExA LoadLibraryExW OutputDebugStringW OutputDebugStringA

shell32

DragFinish DragQueryFileW SHGetKnownFolderPath SHAppBarMessage ShellExecuteW

ole32

CoCreateInstance CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoTaskMemFree RegisterDragDrop RevokeDragDrop OleInitialize CoUninitialize CoInitializeEx

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

comctl32

SetWindowSubclass TaskDialogIndirect RemoveWindowSubclass DefSubclassProc

user32

LoadCursorW GetForegroundWindow FlashWindowEx SetCursorPos CloseTouchInputHandle DestroyMenu DestroyIcon DestroyAcceleratorTable CreateAcceleratorTableW InsertMenuW RegisterTouchWindow IsWindow AppendMenuW SetMenuItemInfoW IsWindowEnabled IsIconic IsWindowVisible EnableWindow InvalidateRect SetPropW MonitorFromRect SystemParametersInfoW VkKeyScanW GetDC GetTouchInputInfo ClipCursor SetCursor GetClipCursor UpdateWindow DefWindowProcW RegisterRawInputDevices SetWindowTextW GetAsyncKeyState GetWindowTextW GetWindowTextLengthW FindWindowExW ReleaseDC DrawIconEx CreateMenu CreatePopupMenu DrawMenuBar GetMenuItemInfoW SetWindowDisplayAffinity ReleaseCapture ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetKeyboardState SetCapture GetKeyState GetMonitorInfoW GetParent GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW SetWindowRgn AdjustWindowRectEx GetMenu GetWindowLongW SetWindowLongW GetSystemMenu InvalidateRgn RegisterWindowMessageA TranslateAcceleratorW ShowCursor SetWindowLongPtrW MapVirtualKeyW GetUpdateRect ValidateRect GetRawInputData MsgWaitForMultipleObjectsEx DispatchMessageW GetMessageW PeekMessageW PostThreadMessageW DestroyWindow ScreenToClient GetWindow SetFocus EnumChildWindows DispatchMessageA TranslateMessage GetMessageA SetWindowPos CreateWindowExW RegisterClassExW GetSystemMetrics GetWindowLongPtrW SetParent RedrawWindow AdjustWindowRect EnumDisplayMonitors MonitorFromPoint IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos SendInput DrawTextW FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow SendMessageW PostQuitMessage SystemParametersInfoA PostMessageW GetActiveWindow SetMenu CreateIcon RemoveMenu CheckMenuItem EnableMenuItem TrackMouseEvent

gdi32

CombineRgn BitBlt SetBkMode CreateSolidBrush CreateRectRgn SetTextColor DeleteDC GetDeviceCaps DeleteObject CreateCompatibleDC SelectObject CreateDIBSection

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

oleaut32

SysFreeString SysStringLen SetErrorInfo GetErrorInfo

shlwapi

SHCreateMemStream

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey RegGetValueW EventSetInformation SystemFunction036 EventWriteTransfer EventRegister EventUnregister

ws2_32

shutdown send freeaddrinfo getaddrinfo WSACleanup WSAStartup setsockopt bind WSASend connect ioctlsocket WSASocketW recv closesocket WSAIoctl getsockname WSAGetLastError getpeername getsockopt

comdlg32

GetOpenFileNameW GetSaveFileNameW

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

round pow __setusermatherr floor trunc roundf

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen wcscmp strcpy_s

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e exit _initialize_narrow_environment _crt_atexit __p___argc _configure_narrow_argv _set_app_type _register_thread_local_exe_atexit_callback __p___argv _register_onexit_function _cexit _c_exit _get_initial_narrow_environment terminate _seh_filter_exe _exit _initialize_onexit_table abort

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc malloc _callnewh free