ValosploitV3_Installer[.]zip | Triage

Sharing

General

Target

ValosploitV3_Installer.zip
Size

12.6MB
MD5

4008fea604e2ccd3a3bf5383c7777206
SHA1

6dbe00645d5d782ef8925fc00635b67ce49e69d0
SHA256

f7ba1f62f5168638cbe3ccf0df5af38f68b55962ea3a639f6d0e2a464ab180a0
SHA512

5ca41c7f3f0c567346bbee4ff08b5fb4a5889c6d8c002627b8d8199583fdd229421f3c394135ffb635980501e689ce16ad92fa3d6ab40f6e3c9d00339a95d198
SSDEEP

393216:JYbAEUpJZ++WgSt3LvPGLS+uWJZS0bFm4Q1YxN75jakmYQHR2:JYb+pJ1St3buNuWjS0bFpqYjtmR2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/ValosploitV3_Installer/Installer.exe

Files

ValosploitV3_Installer.zip
.zip

Password: 2023
ValosploitV3_Installer/Installer.exe
.exe windows:4 windows x86 arch:x86

Password: 2023

6f462fcc6b830b77fb3fef2add9dc570

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

malloc
_sleep
memset
strcmp
strcpy
getenv
sprintf
fopen
fwrite
fclose
__argc
__argv
_environ
_XcptFilter
__set_app_type
_controlfp
__getmainargs
exit

shell32

ShellExecuteA

kernel32

SetUnhandledExceptionFilter

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12.5MB - Virtual size: 12.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ