divineloader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
divineloader.exe
Size 60KB
Sample261022-xnylcstvbx
SHA256 4d7c31faa0b06c7c4474a8048b4a527edd5e032cf3e6631aa6121b4bd1504290
MD5 fefc67f6fd6e32a643dbce1ec7a6313c
SHA1 9b67a393f07baf02fb4d89448ebdb47ea0537f11
SHA512 74c278f0723f2673e539cead522942ef2dec321d32d86a9ce658cbde1cac97bf8e69d2232dcc052cfd11b90a6c49b53181f9fb8b4e98581c03659ec106a282f9
SSDEEP 768:FmdUCIeMdq95LPVpP56M2aKhoGX3ClW8n3a3P3LoHfseNkI20MZ34q:uUNIZpR6M3KhElWsa3PIyI2vJ
TLSH
T1C553F827DAA6A47FC22DC974CB035C42EE627CCA5794BAEB5BC04CE10995DD4AF3D201
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
divineloader.exe

File Explorer

divineloader.exe

.exe 60KB

divineloader.exe

IMPHASH 5dfb66033ce5d52099a7ac992b456b36
SHA256 4d7c31faa0b06c7c4474a8048b4a527edd5e032cf3e6631aa6121b4bd1504290
MD5 fefc67f6fd6e32a643dbce1ec7a6313c
SHA1 9b67a393f07baf02fb4d89448ebdb47ea0537f11
SHA512 74c278f0723f2673e539cead522942ef2dec321d32d86a9ce658cbde1cac97bf8e69d2232dcc052cfd11b90a6c49b53181f9fb8b4e98581c03659ec106a282f9
SSDEEP 768:FmdUCIeMdq95LPVpP56M2aKhoGX3ClW8n3a3P3LoHfseNkI20MZ34q:uUNIZpR6M3KhElWsa3PIyI2vJ
TLSH
T1C553F827DAA6A47FC22DC974CB035C42EE627CCA5794BAEB5BC04CE10995DD4AF3D201
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38812

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSAStartup

kernel32

TerminateProcess GetCurrentProcess SetLastError HeapAlloc HeapFree GetProcessHeap GetNativeSystemInfo VirtualAlloc VirtualProtect VirtualFree FreeLibrary GetProcAddress LoadLibraryA IsBadReadPtr AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead ReleaseSRWLockExclusive

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Random_device@std@@YAIXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

wininet

InternetOpenA

vcruntime140

memcpy _CxxThrowException __current_exception_context __current_exception __C_specific_handler __std_exception_copy memset memmove memcmp __std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _crt_atexit _initterm _invoke_watson _exit exit _cexit _seh_filter_exe _get_narrow_winmain_command_line _c_exit _set_app_type terminate _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _initterm_e

api-ms-win-crt-heap-l1-1-0

realloc malloc _callnewh free _set_new_mode

api-ms-win-crt-string-l1-1-0

strlen strcmp

api-ms-win-crt-utility-l1-1-0

qsort bsearch

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale