Z:\Ventoy\Plugson\vs\VentoyPlugson\Release\VentoyPlugson.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0a4fbb3e20830eb5baa995194d93c2b9d50dc9cbca5e4c198485bec5573fb5fc.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0a4fbb3e20830eb5baa995194d93c2b9d50dc9cbca5e4c198485bec5573fb5fc.exe
Resource
win10v2004-20240412-en
General
-
Target
0a4fbb3e20830eb5baa995194d93c2b9d50dc9cbca5e4c198485bec5573fb5fc
-
Size
388KB
-
MD5
b145201a452ca37ce548c30cc1881e11
-
SHA1
99a113bc67002c130456a50e4d8e44f0debe8279
-
SHA256
0a4fbb3e20830eb5baa995194d93c2b9d50dc9cbca5e4c198485bec5573fb5fc
-
SHA512
3a9ee107c3924551371efd17fb58394c1d904c7288fe515f55846b960978f9712a213b8eff7979d8d4ec41290d4009d5e8d38e8726490b9715286677b3a26476
-
SSDEEP
12288:wITckjCKhx5TkAwQ8xTqMCvVPhHW2fRqkFA/RC8aBBjvrEH7Pe:TSKhxi0HRNFA/RC8afrEH7Pe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a4fbb3e20830eb5baa995194d93c2b9d50dc9cbca5e4c198485bec5573fb5fc
Files
-
0a4fbb3e20830eb5baa995194d93c2b9d50dc9cbca5e4c198485bec5573fb5fc.exe windows:6 windows x86 arch:x86
3d3cf8613a7da2d451e337783f57b0e2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLogicalDrives
WaitForSingleObject
CreateMutexA
ReleaseMutex
CloseHandle
DeleteFileA
CreateFileA
GetFileSize
SetFilePointerEx
SetEvent
WriteFile
WideCharToMultiByte
GetVolumeInformationA
CreateEventA
GetFileAttributesA
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetLastError
GetFileInformationByHandleEx
CopyFileA
DeviceIoControl
GetUserDefaultUILanguage
CreateThread
GetFullPathNameA
FindFirstFileW
TlsGetValue
FreeLibrary
GetCurrentProcess
QueryPerformanceCounter
CreateDirectoryW
SetHandleInformation
GetCurrentThread
GetSystemTimeAsFileTime
InitializeCriticalSection
TlsSetValue
LoadLibraryW
Sleep
LeaveCriticalSection
CreateProcessA
TerminateProcess
SetThreadPriority
RaiseException
GetLongPathNameW
SetLastError
GetProcAddress
EnterCriticalSection
FindClose
FindNextFileW
GetFileAttributesExW
QueryPerformanceFrequency
DeleteCriticalSection
GetCurrentThreadId
DuplicateHandle
TlsAlloc
GetVersion
DeleteFileW
TlsFree
CreateDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryW
MoveFileA
GetCurrentDirectoryA
HeapSize
GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
SetEnvironmentVariableA
WriteConsoleW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStringTypeW
OutputDebugStringW
FreeEnvironmentStringsW
SetEndOfFile
GetEnvironmentStringsW
GetCurrentProcessId
GetModuleFileNameA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FindFirstFileExW
RemoveDirectoryW
GetConsoleCP
GetExitCodeProcess
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
HeapFree
HeapAlloc
AreFileApisANSI
CreatePipe
ExitThread
EncodePointer
DecodePointer
LoadLibraryExW
GetConsoleMode
ReadConsoleW
IsDebuggerPresent
IsProcessorFeaturePresent
SetStdHandle
GetFileType
HeapReAlloc
GetCommandLineA
GetProcessHeap
ExitProcess
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetTimeZoneInformation
RtlUnwind
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
user32
SendMessageA
LoadIconA
GetDlgItem
EndDialog
EnableWindow
DialogBoxParamA
SetWindowTextW
MessageBoxW
shell32
ShellExecuteA
ws2_32
shutdown
setsockopt
WSACleanup
recv
bind
getsockname
__WSAFDIsSet
closesocket
send
listen
getnameinfo
accept
ntohs
htons
select
htonl
ntohl
WSAStartup
ioctlsocket
socket
Sections
.text Size: 228KB - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ