Static task
static1
Behavioral task
behavioral1
Sample
vefakrhhsd.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
vefakrhhsd.exe
Resource
win10v2004-20230915-en
General
-
Target
vefakrhhsd.exe
-
Size
178KB
-
MD5
6dce0d4b84ec415569cca5821ba106d5
-
SHA1
e0637609dbb4d891788adbb95176c504910c2210
-
SHA256
44e1226457db5eee46197d6817a9e6fdd306eec7bd5b2961e2dfaaa3fdfc02cd
-
SHA512
5bddfa23aa705c70e157eff1d77113c6af3eaa6162e26316fd78814a82c361a5a1dfc8b81ed1a79a42f9d234f870e86ef6889538aa7c62d5678da71c4119f0ad
-
SSDEEP
3072:i5t6pFIsBuklZ0P3o6Xw/+MkYdd4FrPYHUV:i6pqsPF6W9q7Y0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource vefakrhhsd.exe
Files
-
vefakrhhsd.exe.exe windows:6 windows x86
d59b0e57881f633c6b260140733c6722
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
imm32
ImmEscapeA
ImmGetImeMenuItemsW
ImmReSizeIMCC
ImmUnregisterWordW
ImmSetCompositionWindow
ImmGetDescriptionA
ImmGetCompositionWindow
ImmIsUIMessageW
shlwapi
PathFindExtensionW
PathParseIconLocationA
PathStripPathA
UrlCompareW
PathCreateFromUrlA
PathRemoveBackslashW
ChrCmpIA
kernel32
CreateFileW
ReadConsoleW
WriteConsoleW
SetStdHandle
OutputDebugStringW
LoadLibraryExW
GetModuleHandleW
GetProcAddress
EnumTimeFormatsW
SetFilePointerEx
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
CloseHandle
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WriteFile
GetModuleFileNameW
GetFileType
GetStdHandle
IsDebuggerPresent
GetProcessHeap
GetCurrentThreadId
GetOEMCP
GetACP
IsValidCodePage
HeapSize
GetModuleHandleExW
ExitProcess
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
GetStringTypeW
GetLastError
HeapFree
RaiseException
RtlUnwind
GetCommandLineW
GetCPInfo
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
user32
EditWndProc
InvalidateRect
GetForegroundWindow
resutils
ResUtilSetExpandSzValue
ResUtilGetProperty
ResUtilGetDwordValue
ResUtilEnumResources
ResUtilVerifyPropertyTable
ResUtilIsPathValid
ResUtilStartResourceService
ResUtilEnumPrivateProperties
ResUtilDupParameterBlock
ResUtilEnumProperties
wsnmp32
ord104
ord200
ord201
ord203
ord601
oleaut32
VarI2FromI4
VarImp
VarR4FromR8
VarDiv
VarUI4FromUI1
SafeArrayRedim
Sections
.text Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.yak Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ