v3lite4[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

v3lite4.exe
Size

1.6MB
MD5

8b620d29cb5dc994eee74470adf83785
SHA1

9d11e249d7e5906be3c2bf65d5b96eea40374028
SHA256

d0e575a029f0824dd09f378fff1791b297c539f47de28204ac016400c35e4dea
SHA512

4fab4c8f50d5c249bb49361a7405cf39ccb184fe647642079d149fe416421fc62397624497f29cf8ea3578b8086b17ea834f8a1bd8e579584b2d1a9878459323
SSDEEP

24576:XBGV9y/XhOaiRw9TDi3jE+Kky84iftEAh+6h7i1kntl7D5N3u:X6yvB+fyG0IO1knv5N+

Score

1^/10

Malware Config

Signatures

Files

v3lite4.exe
.exe windows:5 windows x64 arch:x64

629247497f053b97a14e15fcbb2ffe92

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:03:43:da:68:34:f4:51:3c:e9:a1:a5:80:9e:5e:a5
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/11/2022, 00:00

Not After

06/11/2023, 23:59

Subject

SERIALNUMBER=110111-1138985,CN=AhnLab\, Inc.,O=AhnLab\, Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130b53656f6e676e616d2d7369,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

47:71:6f:da:18:46:fc:cd:16:d5:b2:bb:19:81:af:75:72:7e:42:64:33:91:1b:b9:f8:cf:d7:bf:44:12:b2:5e
Signer

Actual PE Digest

47:71:6f:da:18:46:fc:cd:16:d5:b2:bb:19:81:af:75:72:7e:42:64:33:91:1b:b9:f8:cf:d7:bf:44:12:b2:5e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\Build\Product\ASPack\V3Lite\4.0\building\build\Product\ASPack\V3Lite\4.0\Trunk\Build\X64Release\v3lite4.pdb

Imports

mfc90u

ord333
ord3267
ord5849
ord6062
ord5531
ord5544
ord5718
ord5653
ord5777
ord6023
ord6199
ord4270
ord6196
ord5738
ord6202
ord5741
ord2592
ord2121
ord2122
ord5599
ord882
ord4173
ord3291
ord5560
ord3104
ord676
ord434
ord5772
ord5857
ord5770
ord3249
ord332
ord513
ord6179
ord3862
ord2289
ord2432
ord1306
ord614
ord355
ord728
ord3073
ord1615
ord1686
ord3694
ord3343
ord5449
ord1205
ord6432
ord5460
ord6443
ord2014
ord2015
ord5966
ord6288
ord1310
ord2001
ord3331
ord2141
ord4207
ord3783
ord3690
ord4225
ord2184
ord386
ord792
ord1255
ord1975
ord5767
ord3247
ord5532
ord2531
ord2435
ord1772
ord1976
ord1040
ord1061
ord2433
ord1595
ord664
ord424
ord1963
ord6427
ord6429
ord266
ord265
ord5658
ord5692
ord4103
ord1287
ord1512
ord5846
ord6147
ord760
ord568
ord285
ord3008
ord1519
ord5845
ord913
ord916
ord280
ord2975
ord6259
ord4108
ord4231
ord2320
ord5771
ord1307
ord3297
ord1980
ord2378
ord1149
ord3376
ord5861
ord4465
ord5314
ord4322
ord4856
ord5013
ord4699
ord1714
ord1713
ord1582
ord3135
ord6053
ord1429
ord5335
ord4373
ord3269
ord4145
ord4121
ord6422
ord3901
ord6424
ord4438
ord2110
ord2065
ord5713
ord3906
ord2142
ord5230
ord6363
ord5511
ord3932
ord1966
ord3005
ord5356
ord5358
ord4050
ord4687
ord5362
ord5345
ord5696
ord2907
ord4596
ord1186
ord3740
ord617
ord362
ord1080
ord1071
ord1148
ord1152
ord791
ord286
ord4676
ord5043
ord2301
ord1959
ord2680
ord5136
ord5139
ord4421
ord4243
ord3020
ord5027
ord3017
ord6030
ord3018
ord6032
ord958
ord5485
ord3074
ord2490
ord2489
ord1588
ord4047
ord5280
ord2227
ord1333
ord6026
ord1626
ord4351
ord3408
ord756
ord3560
ord403
ord648
ord3747
ord4411
ord2214
ord4454
ord5052
ord4388
ord5503
ord5297
ord5077
ord2719
ord1104
ord5009
ord4995
ord3492
ord3858
ord5337
ord4277
ord4558
ord5619
ord577
ord772
ord3930
ord2303
ord3424
ord3072
ord2326
ord3535
ord4645
ord2860
ord1603
ord3975
ord3979
ord6008
ord2956
ord6006
ord6000
ord2936
ord6127
ord2946
ord3548
ord632
ord2532
ord2319
ord2951
ord3899
ord769
ord3780
ord6368
ord3493
ord6003
ord6264
ord3750
ord671
ord3583
ord655
ord3301
ord4347
ord1589
ord1677
ord911
ord6321
ord6315
ord877
ord1280
ord5576
ord394
ord3013
ord1949
ord777
ord1454
ord6209
ord4035
ord2437
ord6234
ord887
ord4126
ord4376
ord1103
ord2067
ord4222
ord1422
ord6207
ord588
ord296
ord3137
ord6056
ord1661
ord1658
ord4048
ord1430
ord4355
ord5284
ord1954
ord5201
ord6421
ord4294
ord5346
ord3494
ord4843
ord4393
ord1635
ord6101
ord5367
ord5365
ord938
ord943
ord947
ord945
ord949
ord2455
ord2475
ord2459
ord2465
ord2463
ord2461
ord2478
ord2473
ord2457
ord2480
ord2468
ord2450
ord2452
ord2470
ord2233
ord2226
ord1553
ord6423
ord3902
ord6425
ord3436
ord5093
ord6027
ord3014
ord1389
ord2010
ord1699
ord1698
ord1634
ord5332
ord2602
ord2797
ord2904
ord4419
ord2780
ord2932
ord2605
ord2711
ord2598
ord3818
ord3819
ord3809
ord643
ord2814
ord4033
ord1469
ord2336
ord2344
ord1335
ord2230
ord3419
ord2709
ord4051
ord4601
ord2139
ord4349
ord2937
ord6002
ord1697
ord5574
ord1215
ord1233
ord1211
ord789
ord1209
ord5844
ord6146
ord735
ord541
ord2515
ord1025
ord1585
ord4372
ord3428
ord722
ord512
ord1188
ord5307
ord3784
ord775
ord583
ord779

msvcr90

_errno
sin
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__wgetmainargs
_amsg_exit
strlen
_commit
_get_osfhandle
_write
_read
_lseek
_close
_wsopen
_msize
srand
rand
strrchr
__C_specific_handler
memcmp
_ismbblead
strpbrk
_mbspbrk
strchr
_strnicmp
_mbsnbicmp
realloc
memcpy
_mbschr
_vsnwprintf
_vsnprintf
wcscspn
wcsspn
wcslen
memset
_wcslwr_s
_localtime64_s
_ultoa_s
_strlwr_s
strncmp
wcstok_s
_wsplitpath_s
_mktime64
_recalloc
floor
ceil
_CxxThrowException
_wtoi
wcsrchr
__CxxFrameHandler3
fclose
fseek
wcsncmp
ftell
fread
wcsstr
wcstol
cos
_wfopen
strerror
_wcsnicmp
wcschr
wcsnlen
swscanf_s
_invalid_parameter_noinfo
vswprintf_s
??0exception@std@@QEAA@AEBV01@@Z
??0exception@std@@QEAA@AEBQEBD@Z
??0exception@std@@QEAA@XZ
??1exception@std@@UEAA@XZ
?what@exception@std@@UEBAPEBDXZ
_vscwprintf
malloc
_time64
memcpy_s
_wmakepath_s
_beginthreadex
_purecall
_wcsicmp
calloc
memmove_s
free

kernel32

WideCharToMultiByte
lstrlenW
GetPrivateProfileStringA
GetPrivateProfileIntW
GetLastError
LeaveCriticalSection
EnterCriticalSection
CloseHandle
WaitForSingleObject
SetEvent
CreateEventW
HeapDestroy
HeapReAlloc
HeapSize
DeleteCriticalSection
HeapAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
SetUnhandledExceptionFilter
GetStartupInfoW
VirtualAlloc
VirtualFree
GetSystemTimeAsFileTime
MoveFileW
GetSystemDirectoryA
GetProcessHeap
InitializeCriticalSection
HeapFree
CreateMutexA
DeleteFileA
GetFileAttributesA
MoveFileExA
MoveFileExW
FindFirstFileA
CreateFileA
GetFullPathNameA
GetFullPathNameW
lstrcmpA
GetSystemTime
GetCurrentThreadId
DuplicateHandle
PulseEvent
ReleaseSemaphore
CreateSemaphoreW
InitializeCriticalSectionAndSpinCount
LocalAlloc
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
ProcessIdToSessionId
GetModuleHandleA
SetEndOfFile
SystemTimeToFileTime
CompareStringW
CreateProcessW
GetSystemWindowsDirectoryW
OutputDebugStringW
GetStdHandle
WriteConsoleW
ExpandEnvironmentStringsW
ReadFile
SetFilePointer
GetFileSize
DeleteFileW
FindClose
CreateDirectoryW
FindFirstFileW
lstrcmpiW
FileTimeToSystemTime
SetFileAttributesW
GetSystemWow64DirectoryW
CopyFileW
GetVolumeInformationW
OpenEventW
Sleep
WaitForMultipleObjects
WriteFile
CreateFileW
GetCommandLineW
GetOEMCP
GetACP
GetCurrentProcess
SetProcessWorkingSetSize
ResumeThread
QueryPerformanceCounter
QueryPerformanceFrequency
FindFirstVolumeW
QueryDosDeviceW
GetFileAttributesW
FindNextVolumeW
FindVolumeClose
GetTimeFormatW
GetDateFormatW
GetTickCount
SetThreadExecutionState
GetSystemInfo
GetDriveTypeW
GetLogicalDriveStringsW
ReleaseMutex
CreateMutexW
ResetEvent
RaiseException
GetUserDefaultUILanguage
GetExitCodeProcess
GetModuleFileNameW
LockResource
SizeofResource
LoadResource
FindResourceW
FindResourceExW
OpenMutexW
SetLastError
GetSystemDirectoryW
LoadLibraryExW
GetCurrentProcessId
LoadLibraryW
GetWindowsDirectoryW
GetLocalTime
VerifyVersionInfoW
GetModuleHandleW
VerSetConditionMask
LocalFree
GetProcAddress
FreeLibrary
GetPrivateProfileStringW
MultiByteToWideChar
lstrlenA

user32

PostThreadMessageW
EnableWindow
GetUserObjectSecurity
SetUserObjectSecurity
GetProcessWindowStation
OpenWindowStationW
SetProcessWindowStation
OpenDesktopW
CloseWindowStation
CloseDesktop
CharNextA
CharPrevA
ExitWindowsEx
DrawFrameControl
GetCapture
DestroyIcon
CheckMenuItem
EnableMenuItem
GetParent
GetWindowLongPtrW
GetWindowPlacement
IsWindow
SetForegroundWindow
GetLastActivePopup
ShowWindowAsync
IsIconic
MessageBoxW
LoadCursorW
GetKeyState
MonitorFromRect
SetCursor
ReleaseCapture
SetCapture
IsZoomed
SetFocus
ShowWindow
SetWindowTextW
DrawTextW
TabbedTextOutW
DrawTextExW
DrawFocusRect
GrayStringW
GetSysColor
GetFocus
GetDC
SetTimer
ReleaseDC
OffsetRect
GetWindowDC
KillTimer
AppendMenuW
PtInRect
InsertMenuW
CreatePopupMenu
GetCursorPos
PeekMessageW
MsgWaitForMultipleObjects
NotifyWinEvent
InflateRect
GetDesktopWindow
GetShellWindow
GetForegroundWindow
GetWindowRect
MonitorFromWindow
GetSystemMetrics
GetMonitorInfoW
MonitorFromPoint
CopyRect
UpdateWindow
LoadIconW
InvalidateRect
GetClientRect
ScreenToClient
PostMessageW
IsWindowVisible
FindWindowW
ClientToScreen
RegisterClassW
GetClassInfoW
RegisterWindowMessageW
SendMessageW

gdi32

Escape
RectVisible
TextOutW
CreateFontIndirectW
GetObjectW
CreateBitmap
Pie
BitBlt
CreateCompatibleDC
DeleteObject
CreateCompatibleBitmap
GetTextExtentPoint32W
CreatePen
PtVisible
ExtTextOutW
CreateSolidBrush
EnumFontFamiliesExW
PatBlt
StretchBlt

msimg32

TransparentBlt

advapi32

RegDeleteKeyW
RegQueryValueExW
RegCloseKey
GetTokenInformation
CopySid
GetLengthSid
RegQueryInfoKeyW
RegEnumKeyExW
GetSecurityDescriptorControl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorLength
MakeAbsoluteSD
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
LookupAccountNameA
GetFileSecurityA
SetFileSecurityA
LookupAccountNameW
GetFileSecurityW
SetFileSecurityW
RegOpenKeyExA
RegQueryValueExA
LookupAccountSidW
EqualSid
AddAccessAllowedAce
GetAclInformation
InitializeAcl
GetAce
AddAce
ImpersonateLoggedOnUser
RevertToSelf
DuplicateTokenEx
SetTokenInformation
LogonUserW
OpenSCManagerW
CloseServiceHandle
CreateProcessAsUserW
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegEnumValueW
MakeSelfRelativeSD
RegOpenKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegDeleteValueW
RegCreateKeyExW
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
RegSetValueExW
RegOpenKeyExW

shell32

ShellExecuteW
SHGetFolderPathW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetFileInfoW
CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteExW

comctl32

_TrackMouseEvent
InitCommonControlsEx

shlwapi

StrFormatByteSizeW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathIsNetworkPathW
PathIsRootW
PathStripPathW
StrStrIW
PathRemoveBackslashW

ole32

CoInitialize
CoInitializeEx
CoCreateInstance
CoUninitialize

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime

urlmon

URLDownloadToCacheFileW

msvcp90

??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@AEBV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@PEB_W@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBAPEBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@AEBV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@PEBD@Z

wininet

InternetCheckConnectionW
DeleteUrlCacheEntryW

Sections

.text
Size: 929KB - Virtual size: 928KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 437KB - Virtual size: 437KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

629247497f053b97a14e15fcbb2ffe92

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

06:03:43:da:68:34:f4:51:3c:e9:a1:a5:80:9e:5e:a5Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

47:71:6f:da:18:46:fc:cd:16:d5:b2:bb:19:81:af:75:72:7e:42:64:33:91:1b:b9:f8:cf:d7:bf:44:12:b2:5eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc90u

msvcr90

kernel32

user32

gdi32

msimg32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

urlmon

msvcp90

wininet

Sections

.text Size: 929KB - Virtual size: 928KB

.rdata Size: 437KB - Virtual size: 437KB

.data Size: 67KB - Virtual size: 115KB

.pdata Size: 72KB - Virtual size: 71KB

.rsrc Size: 51KB - Virtual size: 51KB

.reloc Size: 29KB - Virtual size: 29KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

06:03:43:da:68:34:f4:51:3c:e9:a1:a5:80:9e:5e:a5
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

47:71:6f:da:18:46:fc:cd:16:d5:b2:bb:19:81:af:75:72:7e:42:64:33:91:1b:b9:f8:cf:d7:bf:44:12:b2:5e
Signer

.text
Size: 929KB - Virtual size: 928KB

.rdata
Size: 437KB - Virtual size: 437KB

.data
Size: 67KB - Virtual size: 115KB

.pdata
Size: 72KB - Virtual size: 71KB

.rsrc
Size: 51KB - Virtual size: 51KB

.reloc
Size: 29KB - Virtual size: 29KB