DIVINE (2)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DIVINE (2).exe
Size 17.6MB
Sample261024-rb7qlsat41
SHA256 7e56d830c58541d05dc256e4e5d1968821801d5f2e813d06774b3fcabb399018
MD5 2a144f10bea52a32b82c85921294c8e0
SHA1 5a00a68403218b8578ec0356048e4c9042975321
SHA512 a5695a6e9bda880f5559606e4691561909d4ec02f8eef59bed5e094076bf68ebb7ec2b8b860c83c24b1618ac805463eded7b3e7b267691fe55d6ab800705bd09
SSDEEP 393216:6y6u2i4OoEtJqOSVlcfWB2B75B9MNsLWFR/g9P5cy:n6u2goEyO6lB2BKsyn/g3c
TLSH
T1F1072307F703420DDB122C3446968783B731BC1167A586CB76EF69E86F8B1E21DA7AC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DIVINE (2).exe

File Explorer

DIVINE (2).exe

.exe 17.6MB

DIVINE (2).exe

IMPHASH ab18a1383322fc5b395e0ac87f162230
SHA256 7e56d830c58541d05dc256e4e5d1968821801d5f2e813d06774b3fcabb399018
MD5 2a144f10bea52a32b82c85921294c8e0
SHA1 5a00a68403218b8578ec0356048e4c9042975321
SHA512 a5695a6e9bda880f5559606e4691561909d4ec02f8eef59bed5e094076bf68ebb7ec2b8b860c83c24b1618ac805463eded7b3e7b267691fe55d6ab800705bd09
SSDEEP 393216:6y6u2i4OoEtJqOSVlcfWB2B75B9MNsLWFR/g9P5cy:n6u2goEyO6lB2BKsyn/g3c
TLSH
T1F1072307F703420DDB122C3446968783B731BC1167A586CB76EF69E86F8B1E21DA7AC5
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

430912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9

Direct3DCreate9Ex

d3dx9_43

D3DXCreateTextureFromFileInMemory

kernel32

GlobalFree GlobalLock GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetModuleFileNameA FillConsoleOutputCharacterA SetConsoleCtrlHandler WriteProcessMemory VirtualProtect GetConsoleScreenBufferInfo SetConsoleTextAttribute GetCurrentProcess GetStdHandle SetConsoleMode TerminateProcess UnmapViewOfFile OpenProcess CreateToolhelp32Snapshot GetConsoleMode GetTickCount64 Process32NextW GetCurrentThread Process32FirstW GetSystemInfo CreateThread Module32FirstW FillConsoleOutputAttribute GetThreadContext ExitProcess DeleteFileW GetConsoleWindow QueryFullProcessImageNameW CreateFileMappingW SetConsoleCursorPosition MapViewOfFile lstrcmpiW SetConsoleTitleW IsDebuggerPresent CheckRemoteDebuggerPresent SetUnhandledExceptionFilter Sleep AreFileApisANSI CreateFile2 GetFileAttributesExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GlobalAlloc FlushFileBuffers WideCharToMultiByte MoveFileExW Module32NextW GetFileAttributesW SetFilePointer VirtualAlloc VirtualFree GetFileSizeEx MultiByteToWideChar GetModuleFileNameW GetModuleHandleW GetCurrentProcessId CloseHandle GetLastError CreateFileW GetWindowsDirectoryW WriteFile GetFileInformationByHandleEx SetThreadExecutionState

user32

GetWindowThreadProcessId DefWindowProcW GetWindowRect DestroyWindow SetWindowPos MessageBoxW CreateWindowExW GetSystemMetrics ReleaseCapture RegisterClassExW ShowWindow IsWindow DispatchMessageW SetWindowLongA PeekMessageW SetWindowDisplayAffinity UnregisterClassW EnumWindows SetLayeredWindowAttributes SetFocus TranslateMessage IsWindowUnicode GetCursorPos GetAsyncKeyState GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetMessageExtraInfo GetKeyState GetWindowTextW UpdateWindow FindWindowA GetDesktopWindow PostQuitMessage SetWindowLongW GetClassNameW FindWindowW OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData SetCursorPos

advapi32

QueryServiceStatusEx CreateServiceW CloseServiceHandle OpenSCManagerW OpenServiceW StartServiceW ControlService DeleteService

msvcp140

?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Xbad_alloc@std@@YAXXZ _Xtime_get_ticks _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z _Thrd_detach ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

winmm

timeBeginPeriod

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memcpy __std_terminate __std_exception_destroy __std_exception_copy strstr __C_specific_handler wcsstr wcsrchr __current_exception __current_exception_context _CxxThrowException memchr memcmp memset

api-ms-win-crt-runtime-l1-1-0

_set_app_type _cexit _get_initial_narrow_environment _initterm _register_onexit_function _crt_atexit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback abort _beginthreadex terminate _initialize_narrow_environment _configure_narrow_argv _errno exit _seh_filter_exe _initterm_e _initialize_onexit_table _exit

api-ms-win-crt-heap-l1-1-0

_set_new_mode free _callnewh malloc

api-ms-win-crt-stdio-l1-1-0

fclose fgetc fflush fputc __p__commode __stdio_common_vfprintf __acrt_iob_func _set_fmode fwrite __stdio_common_vsprintf_s fgetpos setvbuf __stdio_common_vsscanf __stdio_common_vsprintf _wfopen fseek ftell ungetc _get_stream_buffer_pointers _fseeki64 fread fsetpos

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

_wcsicmp strcmp strlen strncmp wcscmp wcslen

api-ms-win-crt-utility-l1-1-0

srand qsort rand

api-ms-win-crt-convert-l1-1-0

strtol strtof

api-ms-win-crt-math-l1-1-0

tanf powf ceilf cos sqrt acosf expf sqrtf sin sinf cosf __setusermatherr

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale