divineemucracked[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
divineemucracked.exe
Size 98KB
Sample261024-3tw8dacz8w
SHA256 bbf60232054ebe71b876cc5fc14159d810155383534e2af3d358ae7cc4329d5f
MD5 74360c02f6062930f1aa01e79b3325a3
SHA1 006785682d358cea0c9e9d0c7e0cecbf85ea50dd
SHA512 a7cc07884fb46ec70a51cc8d6e496e03c9aed474a71de95a2022438d119b135e0e6e735b49d9b792dd0d56751465edf84691685412d545fd463bfb109b02510a
SSDEEP 1536:KUNIZpR6M3KhElWsa3PILI2vJS7AG8Du6+WSss/eYwp:XNCR6SKkAIk2vJSUY6+WSvm
TLSH
T138A36C16DF96647FC22DC978CB035C52EF62788943D4EAEB57808DE209A5ED46F3D201
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
divineemucracked.exe

File Explorer

divineemucracked.exe

.exe 98KB

divineemucracked.exe

IMPHASH 5dfb66033ce5d52099a7ac992b456b36
SHA256 bbf60232054ebe71b876cc5fc14159d810155383534e2af3d358ae7cc4329d5f
MD5 74360c02f6062930f1aa01e79b3325a3
SHA1 006785682d358cea0c9e9d0c7e0cecbf85ea50dd
SHA512 a7cc07884fb46ec70a51cc8d6e496e03c9aed474a71de95a2022438d119b135e0e6e735b49d9b792dd0d56751465edf84691685412d545fd463bfb109b02510a
SSDEEP 1536:KUNIZpR6M3KhElWsa3PILI2vJS7AG8Du6+WSss/eYwp:XNCR6SKkAIk2vJSUY6+WSvm
TLSH
T138A36C16DF96647FC22DC978CB035C52EF62788943D4EAEB57808DE209A5ED46F3D201
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

74240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSAStartup

kernel32

TerminateProcess GetCurrentProcess SetLastError HeapAlloc HeapFree GetProcessHeap GetNativeSystemInfo VirtualAlloc VirtualProtect VirtualFree FreeLibrary GetProcAddress LoadLibraryA IsBadReadPtr AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead ReleaseSRWLockExclusive

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Random_device@std@@YAIXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

wininet

InternetOpenA

vcruntime140

memcpy _CxxThrowException __current_exception_context __current_exception __C_specific_handler __std_exception_copy memset memmove memcmp __std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _crt_atexit _initterm _invoke_watson _exit exit _cexit _seh_filter_exe _get_narrow_winmain_command_line _c_exit _set_app_type terminate _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _initterm_e

api-ms-win-crt-heap-l1-1-0

realloc malloc _callnewh free _set_new_mode

api-ms-win-crt-string-l1-1-0

strlen strcmp

api-ms-win-crt-utility-l1-1-0

qsort bsearch

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale