Static task
static1
Behavioral task
behavioral1
Sample
_vbxinsi.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
_vbxinsi.exe
Resource
win10v2004-20230220-en
General
-
Target
_vbxinsi.exe
-
Size
366KB
-
MD5
27ceb7bc5ae41ec85d3b7f20f2b16088
-
SHA1
80b9010e312b040f77bbe604320645a4fa3e0ad8
-
SHA256
1950d2e706fbc6263d376c0c4f16bd5acfd543248ee072657ba3dd62da8427eb
-
SHA512
d403df5ca8b213ca5761bf53eb5d4e9093d5c81fc0e1cf71173a4845c80b40cd3853f193bfc8f0cf4d189b61360057b50d30df57bfcc79a0fce1a3222f5fe5f8
-
SSDEEP
6144:J4v0+9bugqTKRR5kZZGxM0cY/97TRhEP/pLi:Jm0+pfhaAlhEP/t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource _vbxinsi.exe
Files
-
_vbxinsi.exe.exe windows x64
26e662de614ca18f1a750933d47dce6d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
gdiplus
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipAlloc
GdipCreateBitmapFromStreamICM
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
ntdll
_snwprintf
__chkstk
towupper
_wcslwr
towlower
iswdigit
iswspace
_wcsicmp
strstr
strchr
wcsstr
wcsrchr
wcstombs
wcschr
__C_specific_handler
mbstowcs
wcsncat
strrchr
strncmp
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ZwWriteVirtualMemory
ZwReadVirtualMemory
ZwQueryInformationThread
ZwOpenThread
ZwQueryInformationProcess
tolower
ZwOpenKey
_wcsnicmp
wcsncmp
ZwClose
ZwQueryValueKey
memset
RtlQueryRegistryValues
RtlNtStatusToDosError
ZwQuerySystemInformation
memmove
memchr
memcpy
memcmp
RtlCaptureContext
RtlVirtualUnwind
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
_wtoi
kernel32
GetStringTypeW
HeapSize
HeapReAlloc
CompareStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetProcessHeap
SetEndOfFile
GetConsoleMode
GetConsoleCP
Sleep
SetFilePointer
SetHandleCount
SetStdHandle
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStdHandle
WriteFile
ExitProcess
HeapCreate
GetVersion
HeapSetInformation
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
GetStartupInfoW
DecodePointer
EncodePointer
CreateThread
ResumeThread
ExitThread
GetFileType
ReadFile
HeapAlloc
HeapFree
GetVersionExW
GetLastError
OpenProcess
CloseHandle
FreeLibrary
LoadLibraryA
LockResource
LoadResource
SizeofResource
FindResourceA
VirtualFree
FreeEnvironmentStringsW
GetModuleHandleW
GetCurrentProcessId
lstrlenW
GetFileTime
CreateFileW
WaitForSingleObject
SetEvent
TerminateThread
DeleteCriticalSection
FindCloseChangeNotification
ResetEvent
FindNextChangeNotification
WaitForMultipleObjects
LeaveCriticalSection
FindFirstChangeNotificationW
EnterCriticalSection
CreateEventW
InitializeCriticalSection
GetFullPathNameW
MultiByteToWideChar
FindNextFileW
FindClose
SetLastError
FindFirstFileW
lstrlenA
GetFileAttributesW
QueryPerformanceCounter
GetTickCount
QueryPerformanceFrequency
GetFileSizeEx
DebugBreak
OutputDebugStringW
GetTimeFormatW
GetDateFormatW
WideCharToMultiByte
GetShortPathNameW
RaiseException
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
GetProcAddress
lstrcmpiW
FindResourceW
LoadLibraryExW
GetModuleFileNameW
CreateMutexW
GetLocaleInfoW
GetThreadLocale
WritePrivateProfileStringW
CopyFileW
FlushFileBuffers
GetPrivateProfileStringW
GetCommandLineW
ExpandEnvironmentStringsW
SetFileTime
CreateProcessW
GetSystemTimeAsFileTime
GetEnvironmentStringsW
LoadLibraryW
WriteConsoleW
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
VirtualAlloc
CreateDirectoryW
user32
DefWindowProcW
EnumWindows
SendMessageTimeoutW
DestroyWindow
GetWindowTextW
GetWindowRect
GetSystemMetrics
InflateRect
CharLowerW
MessageBoxW
EqualRect
MonitorFromWindow
EnumDisplayMonitors
LoadStringW
IntersectRect
GetMonitorInfoW
IsRectEmpty
CharNextW
CopyRect
PostMessageW
advapi32
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
shell32
ShellExecuteW
SHGetFolderPathW
SHFileOperationW
ole32
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
oleaut32
VarUI4FromStr
shlwapi
StrCmpLogicalW
comctl32
InitCommonControlsEx
Sections
.text Size: 293KB - Virtual size: 292KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ