Behavioral task
behavioral1
Sample
VG Tool 4.1.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
VG Tool 4.1.exe
Resource
win10v2004-20240412-en
General
-
Target
VG Tool 4.1.exe
-
Size
141KB
-
MD5
976d50986b5c48b73ae5a15b504528f6
-
SHA1
ec9dd04c26e45d915ab1addf15f4c7f7fd968902
-
SHA256
771361a1334b12aef6f2eb39b95fb12d7800e950dadd98da66abfc4a6e774d34
-
SHA512
a4458aa8e2cbcff54b1fafd1828d088d774d6a6b264ef075efbcf94cc9e651c106350bb6a28ef29f7d87a85447a1a53438715f7b449d5c930700b7e8bf8569ea
-
SSDEEP
3072:oNfSK66amzbibCFx/BB1kHNa2NnnzfqmvG3kbzRyp:E0fmzbigNGrNnzfqmvG3kb1
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VG Tool 4.1.exe
Files
-
VG Tool 4.1.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.wDvP Size: 512B - Virtual size: 134B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.null Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ