Z:\Ventoy\Plugson\vs\VentoyPlugson\Release\VentoyPlugson.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dd54bb52e75f62445a1c038ad54da73d7987fba3ba6f1003876ec2f1b529d5c5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dd54bb52e75f62445a1c038ad54da73d7987fba3ba6f1003876ec2f1b529d5c5.exe
Resource
win10v2004-20231215-en
General
-
Target
dd54bb52e75f62445a1c038ad54da73d7987fba3ba6f1003876ec2f1b529d5c5
-
Size
388KB
-
MD5
db76d3bc62d60764cfe92e9a56e27f38
-
SHA1
fb22fbaaa1cd92753f302eb4820c241b6aa783e1
-
SHA256
dd54bb52e75f62445a1c038ad54da73d7987fba3ba6f1003876ec2f1b529d5c5
-
SHA512
d4cb0567528b696e0fb556701eade496515d294a0b3e9ec5ffa9f3db078173ab66f9205538e4b61fa2e025ee4763745b001aec1a896f21f8a666cb97fb2572d3
-
SSDEEP
12288:bo8Le5R2KW20jkjTz9MjzCVXHvLY9OpRRjr9hPoQN9qghiaXwTECmBb0UDTARqkk:pe5R2KW20az9MjzC12OpRR39Z1N9PQaX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd54bb52e75f62445a1c038ad54da73d7987fba3ba6f1003876ec2f1b529d5c5
Files
-
dd54bb52e75f62445a1c038ad54da73d7987fba3ba6f1003876ec2f1b529d5c5.exe windows:6 windows x86 arch:x86
3d3cf8613a7da2d451e337783f57b0e2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLogicalDrives
WaitForSingleObject
CreateMutexA
ReleaseMutex
CloseHandle
DeleteFileA
CreateFileA
GetFileSize
SetFilePointerEx
SetEvent
WriteFile
WideCharToMultiByte
GetVolumeInformationA
CreateEventA
GetFileAttributesA
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetLastError
GetFileInformationByHandleEx
CopyFileA
DeviceIoControl
GetUserDefaultUILanguage
CreateThread
GetFullPathNameA
FindFirstFileW
TlsGetValue
FreeLibrary
GetCurrentProcess
QueryPerformanceCounter
CreateDirectoryW
SetHandleInformation
GetCurrentThread
GetSystemTimeAsFileTime
InitializeCriticalSection
TlsSetValue
LoadLibraryW
Sleep
LeaveCriticalSection
CreateProcessA
TerminateProcess
SetThreadPriority
RaiseException
GetLongPathNameW
SetLastError
GetProcAddress
EnterCriticalSection
FindClose
FindNextFileW
GetFileAttributesExW
QueryPerformanceFrequency
DeleteCriticalSection
GetCurrentThreadId
DuplicateHandle
TlsAlloc
GetVersion
DeleteFileW
TlsFree
CreateDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryW
MoveFileA
GetCurrentDirectoryA
HeapSize
GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
SetEnvironmentVariableA
WriteConsoleW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStringTypeW
OutputDebugStringW
FreeEnvironmentStringsW
SetEndOfFile
GetEnvironmentStringsW
GetCurrentProcessId
GetModuleFileNameA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FindFirstFileExW
RemoveDirectoryW
GetConsoleCP
GetExitCodeProcess
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
HeapFree
HeapAlloc
AreFileApisANSI
CreatePipe
ExitThread
EncodePointer
DecodePointer
LoadLibraryExW
GetConsoleMode
ReadConsoleW
IsDebuggerPresent
IsProcessorFeaturePresent
SetStdHandle
GetFileType
HeapReAlloc
GetCommandLineA
GetProcessHeap
ExitProcess
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetTimeZoneInformation
RtlUnwind
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
user32
SendMessageA
LoadIconA
GetDlgItem
EndDialog
EnableWindow
DialogBoxParamA
SetWindowTextW
MessageBoxW
shell32
ShellExecuteA
ws2_32
shutdown
setsockopt
WSACleanup
recv
bind
getsockname
__WSAFDIsSet
closesocket
send
listen
getnameinfo
accept
ntohs
htons
select
htonl
ntohl
WSAStartup
ioctlsocket
socket
Sections
.text Size: 228KB - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ