Static task
static1
Behavioral task
behavioral1
Sample
xenia-vfs-dump.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
xenia-vfs-dump.exe
Resource
win10v2004-20230915-en
General
-
Target
af78dd8e87e2507f770d97c8f93b893cdfd84489e3061b218684672569023d9d
-
Size
1.5MB
-
MD5
8322c3d6445a87fe31414248d773e0d7
-
SHA1
c02b45c2ac48b80d378ef923d494915f867be318
-
SHA256
af78dd8e87e2507f770d97c8f93b893cdfd84489e3061b218684672569023d9d
-
SHA512
7b88e3567bad044b450671b191f652b7a0a5b6c6bc4e10e77edb2f27152acc2c95ed0f45e09152488f4b1e152c6dafdc3bf101532468efd3a7e86c579907054c
-
SSDEEP
24576:7o75rDntanDUsdQL35ITtEQEdxLPZDOymZNaJRzu4jjLF7pZbWSWb4Qw:W5rDnt4DUse35ITtfEdxVDOa/1Rl1W3+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/xenia-vfs-dump.exe
Files
-
af78dd8e87e2507f770d97c8f93b893cdfd84489e3061b218684672569023d9d.zip
-
LICENSE
-
xenia-vfs-dump.exe.exe windows:6 windows x64
0127e34b88f47bd45d3ef9c842ffa0fd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msvcp140
_Strxfrm
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Winerror_map@std@@YAHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?id@?$collate@D@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
_Strcoll
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
_Thrd_hardware_concurrency
_Thrd_yield
_Query_perf_frequency
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
_Mtx_unlock
_Mtx_init_in_situ
_Mtx_lock
_Mtx_destroy_in_situ
?_Throw_C_error@std@@YAXH@Z
?_Xbad_function_call@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
_purecall
strchr
__RTDynamicCast
__C_specific_handler
__std_exception_copy
memcmp
__std_terminate
memchr
__current_exception_context
_CxxThrowException
memset
__current_exception
__std_exception_destroy
memmove
api-ms-win-crt-runtime-l1-1-0
exit
_invalid_parameter_noinfo_noreturn
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
free
realloc
_aligned_free
malloc
_set_new_mode
calloc
_aligned_malloc
_callnewh
api-ms-win-crt-math-l1-1-0
_fdclass
__setusermatherr
_dsign
_ldclass
_ldsign
_fdsign
_fdopen
_dclass
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
fread
fclose
fwrite
__acrt_iob_func
freopen_s
_open_osfhandle
_fseeki64
_ftelli64
_wfopen
__stdio_common_vsnprintf_s
fflush
api-ms-win-crt-convert-l1-1-0
wcstombs
api-ms-win-crt-environment-l1-1-0
_wgetenv_s
api-ms-win-crt-time-l1-1-0
_mkgmtime64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
kernel32
UnmapViewOfFile
FormatMessageA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetThreadId
QueueUserAPC
ResetEvent
CreateThread
RaiseException
GetThreadPriority
WaitForSingleObjectEx
TerminateThread
GetCurrentThread
SetEvent
Sleep
CreateEventW
ResumeThread
SuspendThread
GetCurrentThreadId
SetThreadPriority
GetCurrentProcess
SetThreadAffinityMask
AllocConsole
AttachConsole
GetStdHandle
IsDebuggerPresent
OutputDebugStringA
CloseHandle
GetFileAttributesExW
GetLastError
CreateFileW
FindClose
SetEndOfFile
FindNextFileW
FindFirstFileW
FreeLibrary
GetModuleHandleW
LocalFree
GetProcAddress
LoadLibraryW
GetCommandLineW
CreateDirectoryW
AreFileApisANSI
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
SetFilePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
FlushViewOfFile
GetSystemInfo
MapViewOfFile
CreateFileMappingW
GetFileSize
user32
MessageBoxW
shell32
CommandLineToArgvW
Sections
.text Size: 273KB - Virtual size: 272KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
xenia-vfs-dump.pdb