Static task
static1
Behavioral task
behavioral1
Sample
vloneload (1).exe
Resource
win10v2004-20230915-en
General
-
Target
vloneload (1).exe
-
Size
4.5MB
-
MD5
d3e43bd9cac3ee9c4b6be6dc57bdc184
-
SHA1
e8d23770aff1b2f7a7cf7fb82b277cf4f80c14dd
-
SHA256
12403cf47a21aa217f8396317aa95c27db46b89edf612705c9f2c655e995d834
-
SHA512
5f401e97635efdfda7bbef63e8fd3e2eeb466e618fa9058fb46cd51fea96ffc11a89f253457106f034b4a93db876a23a39846c5e704a044769a40f5c51906624
-
SSDEEP
98304:qznre1waXw6NL4fMrD2dexV1TsbX/39rbdZx3qE:qLrsXDNLRgets7ZpZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource vloneload (1).exe
Files
-
vloneload (1).exe.exe windows:6 windows x64
fc44d9b18372560fbe2809e91987c9fe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapAlloc
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMetrics
advapi32
CryptHashData
oleaut32
VariantClear
msvcp140
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
psapi
GetModuleInformation
wininet
InternetCloseHandle
ntdll
RtlCaptureContext
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertGetCertificateChain
ws2_32
getsockopt
userenv
UnloadUserProfile
vcruntime140
memchr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-environment-l1-1-0
getenv_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
shell32
ShellExecuteA
Sections
.text Size: - Virtual size: 500KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Chu Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.\C? Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.OcN Size: 4.5MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ