Overview
overview
10Static
static
1RR.lnk
windows7-x64
3RR.lnk
windows10-2004-x64
10vibrations...ss.exe
windows7-x64
vibrations...ss.exe
windows10-2004-x64
1vibrations/croaks.sql
windows7-x64
3vibrations/croaks.sql
windows10-2004-x64
3vibrations...id.cmd
windows7-x64
1vibrations...id.cmd
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
RR.lnk
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
RR.lnk
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
vibrations/airtightness.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
vibrations/airtightness.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
vibrations/croaks.sql
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
vibrations/croaks.sql
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
vibrations/polaroid.cmd
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
vibrations/polaroid.cmd
Resource
win10v2004-20230220-en
General
-
Target
3fa790f62b5e861e92afd51a6ee9c95668112414b1087a6fe682c008a5bbd346
-
Size
203.3MB
-
MD5
6cf3a1726250e6c84903a771551f5cbf
-
SHA1
843b6f4a0e2e6b939df2badee10c67a513646676
-
SHA256
3fa790f62b5e861e92afd51a6ee9c95668112414b1087a6fe682c008a5bbd346
-
SHA512
72136566a76a90076a8905aec469693945c6129446760f8a331c6dab97d4ae060ea3bb5e900160bfadc00a0ad6fedb8eb7642fd56fc0d3fa688af60d1422e66a
-
SSDEEP
49152:wN2P39PuNYvlHTX2EMuZuzJ2z6nzK/XoY:wNimNC5ozn
Malware Config
Signatures
Files
-
3fa790f62b5e861e92afd51a6ee9c95668112414b1087a6fe682c008a5bbd346.iso
-
RR.lnk.lnk
-
head
-
vibrations/airtightness.exe.exe windows x64
96112b6b6508d4708e100f9ca644fda1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
IsValidSecurityDescriptor
GetSecurityDescriptorLength
CryptReleaseContext
CryptAcquireContextW
LookupAccountNameW
IsValidSid
ConvertSidToStringSidW
ImpersonateSelf
RevertToSelf
LookupAccountSidW
CryptGetProvParam
CryptGetUserKey
CryptGetKeyParam
CryptDestroyKey
RegCreateKeyExW
RegSetValueExW
RegSetValueExA
RegDeleteKeyExW
RegCloseKey
GetTokenInformation
GetLengthSid
CopySid
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyW
RegEnumValueW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
CryptSetProvParam
CryptGenRandom
CryptCreateHash
CryptVerifySignatureW
CryptHashData
CryptDestroyHash
CryptSetKeyParam
CryptDecrypt
CryptImportKey
RegDeleteTreeW
RegOpenKeyW
CryptGetHashParam
CryptDuplicateKey
CryptEncrypt
CryptGenKey
EventWriteTransfer
RegUnLoadKeyW
RegOpenCurrentUser
RegQueryInfoKeyW
RegLoadKeyW
RegGetValueW
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
SetNamedSecurityInfoW
AddAccessDeniedAce
AddAccessAllowedAce
AddAccessDeniedObjectAce
AddAccessAllowedObjectAce
AddAce
InitializeAcl
LsaStorePrivateData
LsaRetrievePrivateData
RegConnectRegistryW
AdjustTokenPrivileges
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
CryptEnumProvidersA
CryptGetDefaultProviderW
LogonUserExW
ImpersonateLoggedOnUser
CreateWellKnownSid
MakeAbsoluteSD
MakeSelfRelativeSD
LsaClose
LsaFreeMemory
LsaOpenPolicy
FreeSid
CheckTokenMembership
DuplicateToken
OpenThreadToken
ConvertStringSidToSidW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
SetEntriesInAclW
GetSecurityDescriptorDacl
DeleteAce
EqualSid
GetAce
GetAclInformation
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
GetSecurityDescriptorControl
CryptSignHashW
CryptSetHashParam
CryptExportKey
CryptDuplicateHash
CryptContextAddRef
kernel32
GetProfileStringA
ResetEvent
GetFileTime
lstrlenW
VirtualFree
VirtualAlloc
GetTempPathW
GetLocalTime
K32GetProcessImageFileNameW
HeapSetInformation
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetSystemInfo
GetCurrentThread
CreateDirectoryW
RemoveDirectoryW
GetConsoleOutputCP
CompareStringW
FoldStringW
GetTimeFormatW
GetDateFormatW
FileTimeToLocalFileTime
LoadLibraryExW
GetSystemDirectoryW
GetCommandLineW
FileTimeToSystemTime
WriteConsoleW
GetACP
WideCharToMultiByte
OutputDebugStringA
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
LocalFree
GetSystemTime
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalAlloc
GetFileAttributesW
FreeLibrary
CompareFileTime
CreateThread
WaitForSingleObject
GetExitCodeThread
CloseHandle
GetStdHandle
GetFileType
GetConsoleMode
SetConsoleMode
SetLastError
GetProcAddress
CreateFileW
GetFileSize
DeleteFileW
lstrcmpW
GetProcessHeap
HeapFree
HeapAlloc
FormatMessageW
GetSystemDefaultLangID
InitializeCriticalSection
DeleteCriticalSection
RaiseException
GetModuleHandleW
LoadLibraryExA
LocalReAlloc
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
OpenEventW
PulseEvent
GetTickCount64
GetLastError
OpenProcess
GetProcessTimes
QueryFullProcessImageNameW
GetCurrentProcess
GetFileAttributesExW
EncodePointer
DecodePointer
LoadLibraryW
GetTickCount
Sleep
FindFirstFileW
FindNextFileW
FindClose
ReadFile
SetFilePointer
GetComputerNameW
GetComputerNameExW
GetVersionExW
FindResourceW
LoadResource
SizeofResource
LockResource
WriteFile
SetEndOfFile
EnterCriticalSection
SetConsoleCtrlHandler
LeaveCriticalSection
VerSetConditionMask
VerifyVersionInfoW
MultiByteToWideChar
SetThreadpoolTimer
SetThreadpoolWait
FindNextChangeNotification
FindCloseChangeNotification
CloseThreadpoolWait
CloseThreadpoolTimer
GetFullPathNameW
DelayLoadFailureHook
ResolveDelayLoadedAPI
FindResourceExW
GetLocaleInfoW
SearchPathW
lstrcmpiW
IsDebuggerPresent
DebugBreak
AcquireSRWLockShared
CreateMutexExW
CompareStringEx
ReleaseSRWLockShared
CreateThreadpoolTimer
FindFirstChangeNotificationW
CreateThreadpoolWait
SetEvent
ReleaseSemaphore
TrySubmitThreadpoolCallback
CreateSemaphoreW
GetModuleFileNameA
CreateSemaphoreExW
GetModuleHandleExW
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
ReleaseMutex
CreateEventW
GetEnvironmentVariableW
GetTempFileNameW
ReleaseSRWLockExclusive
OutputDebugStringW
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
LocalFileTimeToFileTime
msvcrt
wcsncmp
_ultow
_wcsicmp
bsearch
fopen
fgets
strchr
fputs
fseek
ferror
_swab
_strlwr
fprintf
malloc
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_wcmdln
wcsstr
_commode
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
_errno
realloc
?terminate@@YAXXZ
strcmp
_wtoi
_stricmp
swscanf
_strnicmp
isdigit
__isascii
??_V@YAXPEAX@Z
free
wcscspn
qsort
?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_wcsnicmp
wcsspn
_fgetwchar
fflush
fclose
_wfopen_s
fwprintf
wcstok
wcschr
wcsrchr
iswdigit
_vsnwprintf
_purecall
__CxxFrameHandler3
??3@YAXPEAX@Z
strcspn
strncmp
_wcslwr
wcscmp
strstr
_fmode
_itoa_s
memcpy_s
wcsncpy_s
_wcserror
wcsnlen
memcmp
memset
wcscpy_s
towupper
iswlower
towlower
iswupper
sscanf_s
strpbrk
strcat_s
strcpy_s
strspn
_vsnprintf
getenv
fwrite
ftell
_wgetenv
_fileno
_setmode
wcstoul
fgetws
feof
fgetc
_wfopen
fputws
atoi
iswalpha
__iob_func
iswspace
vfwprintf
iswxdigit
gmtime
isxdigit
_wsetlocale
certcli
CAGetCAProperty
CAFindByName
CAEnumFirstCA
ord373
CACloseCertType
CAEnumNextCertType
CACertTypeAccessCheckEx
CAGetCertTypeProperty
CAEnumCertTypesForCAEx
CAFreeCertTypeExtensions
CAGetCertTypeExtensions
CACertTypeGetSecurity
CAGetCertTypeExpiration
CAGetCertTypeKeySpec
CAFreeCertTypeProperty
CAGetCertTypePropertyEx
CAGetCertTypeFlagsEx
CAEnumNextCA
CAEnumCertTypesEx
ord356
ord205
ord213
ord254
ord360
ord223
ord256
ord246
ord225
ord358
ord207
ord359
CACloseCA
CAGetCAFlags
CAGetCAExpiration
CAAccessCheck
ord361
CAGetCACertificate
CAGetCASecurity
CASetCAProperty
CAUpdateCAEx
CAFindByCertType
ord257
ord218
ord255
CAEnumCertTypesForCA
CACountCertTypes
CACertTypeAccessCheck
CACountCAs
CAFreeCAProperty
CARemoveCACertificateTypeEx
CAAddCACertificateTypeEx
CAUpdateCA
ord260
ord366
ord252
ord261
ord253
ord217
ord203
ord247
ord210
CASetCASecurity
CASetCACertificate
CASetCAFlags
CACreateNewCA
CAFindCertTypeByName
ord370
ord258
ord357
ord245
ord362
crypt32
CryptExportPKCS8
PFXExportCertStoreEx
PFXExportCertStore
CryptFreeOIDFunctionAddress
CryptGetOIDFunctionAddress
CryptInitOIDFunctionSet
CertStrToNameW
CryptDecryptMessage
CryptEncryptMessage
CryptSignMessage
CryptFormatObject
CertAddCertificateLinkToStore
CertGetIntendedKeyUsage
CryptHashPublicKeyInfo
CryptStringToBinaryW
CryptMsgOpenToDecode
CertNameToStrW
CryptSignCertificate
CryptExportPublicKeyInfoEx
CryptSignAndEncodeCertificate
CertDuplicateStore
CryptMsgUpdate
CryptMsgOpenToEncode
CryptBinaryToStringW
CertOpenServerOcspResponse
I_CryptWalkAllLruCacheEntries
I_CryptRemoveLruEntry
I_CryptGetLruEntryData
I_CryptFindLruEntry
I_CryptReleaseLruEntry
I_CryptInsertLruEntry
I_CryptCreateLruEntry
CertCloseServerOcspResponse
I_CryptFreeLruCache
I_CryptCreateLruCache
CryptMsgEncodeAndSignCTL
CertGetNameStringA
CertSetCertificateContextPropertiesFromCTLEntry
CertCreateContext
I_CertProtectFunction
CertAddStoreToCollection
CertVerifyCertificateChainPolicy
CryptMemFree
CertVerifySubjectCertificateContext
CryptVerifyCertificateSignatureEx
CertGetEnhancedKeyUsage
CertVerifyCRLTimeValidity
CertVerifyRevocation
CertVerifyTimeValidity
CryptEnumKeyIdentifierProperties
CryptImportPublicKeyInfo
CertDuplicateCRLContext
CertDeleteCRLFromStore
CertAddCTLContextToStore
CertAddCRLContextToStore
CertEnumSystemStore
CertEnumSystemStoreLocation
CertEnumPhysicalStore
CertControlStore
CertSaveStore
CertAddSerializedElementToStore
CertAddEncodedCTLToStore
CertAddEncodedCRLToStore
CertAddEncodedCertificateToStore
CertSetCTLContextProperty
CertSetCRLContextProperty
CryptFindCertificateKeyProvInfo
CryptAcquireCertificatePrivateKey
CertEnumCertificateContextProperties
CertGetCRLContextProperty
CertEnumCRLContextProperties
CertGetCTLContextProperty
CertEnumCTLContextProperties
CertSetStoreProperty
CertComparePublicKeyInfo
CryptExportPublicKeyInfo
CertFreeCTLContext
CertCreateCTLContext
CertEnumCTLsInStore
CertDeleteCertificateFromStore
CertGetNameStringW
CryptDecodeObjectEx
CryptQueryObject
CryptMsgGetParam
CryptVerifyDetachedMessageSignature
CryptMsgGetAndVerifySigner
CryptMsgControl
PFXIsPFXBlob
PFXImportCertStore
CryptImportPKCS8
CertGetPublicKeyLength
CryptMsgClose
CertAddCertificateContextToStore
CertSetCertificateContextProperty
CryptGetKeyIdentifierProperty
CertFindAttribute
CryptHashCertificate
CryptDecodeObject
CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CryptFindLocalizedName
CryptVerifyCertificateSignature
CertCompareCertificateName
CertFreeCertificateChain
CertGetCertificateChain
CryptHashCertificate2
CryptImportPublicKeyInfoEx2
CryptRegisterOIDInfo
CertCreateCertificateContext
CryptEnumOIDInfo
CertCreateCRLContext
CertFreeCRLContext
CertEnumCRLsInStore
CertCloseStore
CertGetCertificateContextProperty
CryptFindOIDInfo
CryptEncodeObjectEx
CertFreeCertificateContext
CertFindExtension
CertDuplicateCertificateContext
cabinet
ord23
ord22
ord21
ord20
comctl32
InitCommonControlsEx
cryptui
CryptUIDlgViewCertificateW
CryptUIDlgFreeCAContext
CryptUIDlgViewCRLW
gdi32
GetStockObject
ncrypt
NCryptVerifySignature
NCryptIsKeyHandle
NCryptFreeObject
BCryptVerifySignature
NCryptOpenStorageProvider
NCryptImportKey
NCryptSetProperty
NCryptFinalizeKey
BCryptSetProperty
BCryptGetProperty
BCryptCloseAlgorithmProvider
SslEnumProtocolProviders
SslOpenProvider
SslFreeBuffer
SslFreeObject
NCryptGetProperty
BCryptFreeBuffer
BCryptOpenAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptDecrypt
BCryptEncrypt
BCryptExportKey
BCryptGenRandom
BCryptSignHash
BCryptResolveProviders
BCryptEnumContextFunctions
BCryptQueryContextConfiguration
BCryptEnumContexts
BCryptQueryProviderRegistration
BCryptGenerateKeyPair
BCryptEnumAlgorithms
NCryptFreeBuffer
NCryptEnumStorageProviders
NCryptEnumKeys
NCryptIsAlgSupported
NCryptEnumAlgorithms
BCryptDestroyKey
NCryptSignHash
NCryptSecretAgreement
NCryptOpenKey
NCryptExportKey
NCryptEncrypt
NCryptDeriveKey
NCryptDeleteKey
NCryptDecrypt
NCryptCreatePersistedKey
netapi32
DsGetSiteNameW
DsGetDcNameW
NetApiBufferFree
NetUserGetGroups
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory
normaliz
IdnToAscii
IdnToUnicode
ntdll
WinSqmIncrementDWORD
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlNtStatusToDosError
RtlGetPersistedStateLocation
NtQuerySystemTime
RtlTimeToSecondsSince1970
NtQuerySystemInformationEx
ntdsapi
DsFreeDomainControllerInfoW
DsBindW
DsFreeNameResultW
DsCrackNamesW
DsUnBindW
DsGetDomainControllerInfoW
setupapi
SetupGetIntField
SetupCloseInfFile
SetupGetStringFieldW
SetupFindNextLine
SetupGetFieldCount
SetupFindFirstLineW
SetupGetLineCountW
SetupOpenInfFileW
shell32
SHGetFolderPathW
SHGetKnownFolderPath
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
wldap32
ord145
ord14
ord73
ord208
ord13
ord16
ord12
ord18
ord210
ord65
ord41
ord113
ord140
ord224
ord142
ord79
ord127
ord167
ord147
ord155
ord206
ord135
ord203
ord36
ord27
ord26
ord191
ole32
CoCreateInstance
CoTaskMemFree
CoInitialize
CoUninitialize
CoInitializeEx
CLSIDFromString
CLSIDFromProgID
StringFromCLSID
ProgIDFromCLSID
CoTaskMemAlloc
CoCreateInstanceEx
CoSetProxyBlanket
StgOpenStorageEx
PropVariantClear
oleaut32
SafeArrayGetElement
SystemTimeToVariantTime
SafeArrayGetUBound
SysFreeString
SafeArrayGetDim
VariantCopyInd
CreateErrorInfo
SetErrorInfo
SafeArrayGetLBound
VariantTimeToSystemTime
SysStringLen
SafeArrayDestroy
SafeArrayPutElement
SysStringByteLen
SafeArrayCreate
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
VariantClear
SafeArrayUnaccessData
VariantInit
SafeArrayAccessData
rpcrt4
UuidToStringW
UuidCreate
UuidIsNil
UuidFromStringW
RpcStringFreeW
NdrClientCall3
I_RpcExceptionFilter
secur32
TranslateNameW
GetUserNameExW
GetComputerObjectNameW
user32
PostQuitMessage
UpdateWindow
SetWindowLongPtrW
SetFocus
ShowWindow
GetWindowTextW
CallWindowProcW
GetWindowLongPtrW
SetWindowTextW
DialogBoxParamW
GetDlgItemTextW
IsDlgButtonChecked
GetMessageW
TranslateMessage
LoadIconW
RegisterClassW
GetDlgItemInt
EndDialog
SetDlgItemInt
CheckDlgButton
SendDlgItemMessageA
EnableWindow
GetDlgItem
SetDlgItemTextW
LoadCursorW
MessageBoxW
SendMessageW
SetCursor
CharLowerW
GetDesktopWindow
DefWindowProcW
CreateWindowExW
DispatchMessageW
PostMessageW
LoadStringW
shlwapi
PathFindFileNameW
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 374KB - Virtual size: 374KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 61KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 1024B - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
vibrations/croaks.sql
-
vibrations/polaroid.cmd