vagante[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

vagante.exe
Size

7.9MB
MD5

0137c5d949f9b2b2e2e66de0f4c16777
SHA1

248818fe0268b3d77ea413b1cb39f6bceccfae1a
SHA256

9af1d8cc204aca2be94f597af21ced50d77d09c1ff8f998def5f2920c3c4624c
SHA512

3222c16b00191347590afc93571d7e78fd25c07590cb3089679988b3f20356ec375b0f0bf38bd545b08ebaf6bbdb8603e4d403eb9ae2d1741e098440d5d4fa04
SSDEEP

98304:aFGJugTnlgiNYvxVC/f4FoTk9unJ/MGGPyRCWCBAn2KOVhgcfKr3Fcu:aynKieE6v9unlPqYqz

Score

1^/10

Malware Config

Signatures

Files

vagante.exe
.exe windows x86

cd562ac26449d928dad97b18a8477930

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

opengl32

glBindTexture
glColorPointer
glPopAttrib
glGetString
glScissor
glDrawElements
glTexCoordPointer
glVertexPointer
glOrtho
glLoadIdentity
glMatrixMode
glViewport
glEnableClientState
glDisable
glBlendFunc
glEnable
glPushAttrib
wglShareLists
wglMakeCurrent
wglGetProcAddress
wglDeleteContext
wglCreateContext
glIsEnabled
glGetError
glTexSubImage2D
glGenTextures
glDeleteTextures
glCopyTexSubImage2D
glTexParameteri
glTexImage2D
glGetTexImage
glGetIntegerv
glFlush
glDrawArrays
glLoadMatrixf
glClearColor
glClear

steam_api

SteamGameServer_Shutdown
SteamInternal_FindOrCreateGameServerInterface
SteamGameServer_GetHSteamUser
SteamInternal_GameServer_Init
SteamGameServer_RunCallbacks
SteamAPI_Init
SteamAPI_RunCallbacks
SteamAPI_RegisterCallResult
SteamAPI_UnregisterCallResult
SteamAPI_RegisterCallback
SteamAPI_UnregisterCallback
SteamAPI_GetHSteamUser
SteamInternal_ContextInit
SteamInternal_FindOrCreateUserInterface
SteamAPI_Shutdown

dinput8

DirectInput8Create

xinput9_1_0

XInputGetState

advapi32

CryptCreateHash
GetUserNameA
CryptReleaseContext
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptAcquireContextA
CryptDestroyHash
CryptHashData
CryptGenRandom
CryptGetHashParam

ws2_32

getsockname
connect
listen
gethostname
htonl
WSAIoctl
getsockopt
WSASetLastError
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
ioctlsocket
inet_addr
closesocket
accept
send
select
recv
getpeername
htons
setsockopt
sendto
recvfrom
ntohs
bind
freeaddrinfo
getaddrinfo
socket
ntohl
inet_ntoa

crypt32

CertFreeCertificateContext

wldap32

ord46
ord301
ord211
ord60
ord50
ord143
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41

normaliz

IdnToAscii

kernel32

FindFirstFileExW
SetStdHandle
HeapReAlloc
SetEnvironmentVariableW
GetProcessHeap
GetTimeZoneInformation
FlushFileBuffers
HeapSize
WriteConsoleW
WaitForSingleObject
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileSizeEx
HeapAlloc
HeapFree
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetCommandLineW
GetCommandLineA
ExitProcess
GetModuleFileNameW
WriteFile
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
GetACP
LoadLibraryExW
InterlockedPushEntrySList
RtlUnwind
AreFileApisANSI
MoveFileExW
CopyFileW
GetWindowsDirectoryW
DeviceIoControl
GetOEMCP
LCMapStringEx
DecodePointer
EncodePointer
GetStringTypeW
GetEnvironmentStringsW
SetFilePointerEx
SetEndOfFile
RemoveDirectoryW
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesW
DeleteFileW
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
CreateThread
FreeEnvironmentStringsW
GetNativeSystemInfo
GetExitCodeThread
GetEnvironmentVariableW
FindNextFileW
TryEnterCriticalSection
GlobalLock
GlobalUnlock
GlobalAlloc
FreeLibrary
GetModuleFileNameA
GetFileAttributesA
AcquireSRWLockExclusive
LoadLibraryA
GetProcAddress
GetLastError
CloseHandle
SetLastError
GetCurrentDirectoryA
GetThreadId
GetCurrentThreadId
SuspendThread
GetThreadContext
ResumeThread
ReadProcessMemory
VerSetConditionMask
VerifyVersionInfoW
RaiseException
GetModuleHandleA
GetSystemTime
CreateFileA
GetCurrentProcessId
GetCurrentProcess
GetCurrentThread
SetUnhandledExceptionFilter
GetTimeFormatA
GetTickCount
SetThreadStackGuarantee
SetThreadExecutionState
GetConsoleWindow
FormatMessageA
FormatMessageW
WideCharToMultiByte
LocalFree
GetUserGeoID
GetGeoInfoA
GetModuleHandleW
LoadLibraryW
Sleep
QueryPerformanceCounter
QueryPerformanceFrequency
GetVersion
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount64
InitializeCriticalSectionEx
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
WaitForSingleObjectEx
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
MultiByteToWideChar
ReleaseSRWLockExclusive
FindFirstFileW
FindClose
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
GetCurrencyFormatW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
CompareStringW
LCMapStringW
FoldStringW
EnumSystemLocalesA
IsDBCSLeadByteEx
IsValidCodePage
GetLocaleInfoA
SetEvent
CreateEventA
GetCPInfo
CompareStringEx
GetLocaleInfoEx
GetSystemTimeAsFileTime
GetEnvironmentVariableA
InitializeSRWLock

user32

GetClipboardData
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
MessageBoxA
wsprintfA
GetAsyncKeyState
IsClipboardFormatAvailable
ShowWindow
GetWindowRect
SystemParametersInfoA
MoveWindow
GetSystemMetrics
ChangeDisplaySettingsW
DestroyIcon
CreateIcon
GetWindowThreadProcessId
SetWindowLongW
GetWindowLongW
ClipCursor
MapWindowPoints
SetCursor
AdjustWindowRect
GetClientRect
SetWindowTextW
SetForegroundWindow
GetForegroundWindow
ReleaseCapture
SetCapture
GetCapture
MapVirtualKeyW
SetWindowPos
FlashWindowEx
CreateWindowExW
UnregisterClassW
RegisterClassW
CallWindowProcW
DefWindowProcW
SendMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
TrackMouseEvent
ReleaseDC
GetDC
DestroyWindow
CreateWindowExA
EnumDisplaySettingsW
ScreenToClient
GetCursorPos
LoadCursorW

gdi32

SetPixelFormat
DescribePixelFormat
GetPixelFormat
SwapBuffers
ChoosePixelFormat
GetDeviceCaps

ole32

CoUninitialize
CoSetProxyBlanket
CoInitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocString

imm32

ImmGetContext
ImmSetCompositionWindow

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

openal32

alSourcei
alcCloseDevice
alcOpenDevice
alGetSourcef
alGetSourcei
alSourcePlayv
alSourceStopv
alSourcePausev
alcDestroyContext
alcMakeContextCurrent
alcCreateContext
alListenerfv
alListener3f
alListenerf
alGetEnumValue
alSourceUnqueueBuffers
alSourceQueueBuffers
alGetBufferi
alBufferData
alDeleteBuffers
alGenBuffers
alSource3f
alDeleteSources
alGenSources
alSourcePause
alSourceStop
alSourcePlay
alSourcef

winmm

timeBeginPeriod
timeGetDevCaps
timeEndPeriod

Sections

.text
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 78KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 247KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cd562ac26449d928dad97b18a8477930

Headers

DLL Characteristics

File Characteristics

Imports

opengl32

steam_api

dinput8

xinput9_1_0

advapi32

ws2_32

crypt32

wldap32

normaliz

kernel32

user32

gdi32

ole32

oleaut32

imm32

version

openal32

winmm

Sections

.text Size: 6.0MB - Virtual size: 6.0MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 78KB - Virtual size: 102KB

_RDATA Size: 149KB - Virtual size: 148KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 247KB - Virtual size: 247KB

.text
Size: 6.0MB - Virtual size: 6.0MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 78KB - Virtual size: 102KB

_RDATA
Size: 149KB - Virtual size: 148KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 247KB - Virtual size: 247KB