vnetlib[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

vnetlib.exe
Size

1.0MB
MD5

b3f2fea473cec4803c420fb595694c80
SHA1

6d1cfdc1e9b4ca3d73762d3c23bd49b0dcfcd8dc
SHA256

f4902eef49e239e7b7e1be7460da643d043e7b81001a362ab7d8310375c561ed
SHA512

71506069dfb2c172e3b25e5acc3ebe1c56bd45e005d04ce0e7db8b362f76f8bb91ba0989785c97b1573b3d16b92432fdf07a9d4137d17de0f2d9dde6c6a55e3a
SSDEEP

24576:905WxMSs/pTFFlLMxCkHiyA79ySlbNZmCBmvz3RF:9058w/phExCkHiyAZyS5N4C8vz3z

Score

1^/10

Malware Config

Signatures

Files

vnetlib.exe
.exe windows:6 windows x86 arch:x86

f30bffdee78850e2e9a2dbd2e7e02ab8

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:0e:aa:29:4c:d4:ab:d9:eb:1c:c7:84:c9:24:24:3d
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03/12/2019, 00:00

Not After

07/12/2022, 12:00

Subject

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5d:aa:d4:1c:c1:a9:50:0b:5d:ed:a2:79:34:f4:62:3b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

13/08/2018, 00:00

Not After

11/09/2021, 23:59

Subject

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:35:01:ea:17:c5:39:29:8d:be:59:1e:52:8b:f6:60
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/02/2021, 15:35

Not After

06/03/2032, 15:35

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9d:c4:47:a0:3a:62:88:04:7a:70:a7:1b:95:ee:51:de:6e:5a:0b:4e:c7:80:c2:d8:71:2d:1a:45:ad:fb:7e:9e
Signer

Actual PE Digest

9d:c4:47:a0:3a:62:88:04:7a:70:a7:1b:95:ee:51:de:6e:5a:0b:4e:c7:80:c2:d8:71:2d:1a:45:ad:fb:7e:9e

Digest Algorithm

sha256

PE Digest Matches

true

98:f8:6a:df:2c:2a:3b:d6:36:d6:dd:29:c0:7d:1d:9c:d2:18:71:44
Signer

Actual PE Digest

98:f8:6a:df:2c:2a:3b:d6:36:d6:dd:29:c0:7d:1d:9c:d2:18:71:44

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\build\ob\bora-17966106\bora\build\build\vnetlibexe\release\win32\vnetlib.pdb

Imports

kernel32

WriteConsoleW
CloseHandle
CreateFileW
ReadConsoleW
ReadFile
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetProcessHeap
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetStringTypeW
GetFileType
SetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapFree
HeapAlloc
SetLastError
GetLastError
GetProcAddress
RtlUnwind
FreeLibrary
ExitProcess
GetModuleFileNameW
WriteFile
GetStdHandle
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
EncodePointer
LoadLibraryW
GetVersionExA
GetTempPathW
GetTempFileNameW
GetFileSizeEx
FileTimeToSystemTime
FileTimeToLocalFileTime
FindResourceA
SizeofResource
GetModuleHandleA
CreateThread
CreateEventA
SetEvent
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
MoveFileExW
Sleep
CopyFileW
FormatMessageW
GetSystemDirectoryW
DeviceIoControl
SetFileAttributesW
GetFileAttributesW
CreateDirectoryW
LocalFree
LocalAlloc
DeleteFileW
ExpandEnvironmentStringsW
GetSystemInfo
VerSetConditionMask
RaiseException
SetEndOfFile
GetTimeZoneInformation
VirtualQuery
LoadLibraryExA
ResetEvent
WaitForSingleObjectEx
CreateEventW
VirtualProtect
GetModuleHandleExW
DecodePointer
CreateFileA
InitializeCriticalSection
CreateFileMappingA
GetFileAttributesExW
GetVersionExW
DosDateTimeToFileTime
VerifyVersionInfoW
GetEnvironmentVariableW
MapViewOfFile
UnmapViewOfFile
lstrcmpA

ws2_32

inet_addr
inet_ntoa
ntohl
htonl
recvfrom
select
sendto
socket
closesocket
WSAStartup
WSAGetLastError

advapi32

LookupAccountSidW
OpenServiceA
OpenSCManagerA
EnumDependentServicesA
UnlockServiceDatabase
StartServiceA
QueryServiceStatus
QueryServiceLockStatusW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
LockServiceDatabase
EnumDependentServicesW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
ChangeServiceConfigW
FreeInheritedFromArray
GetInheritanceSourceW
SetSecurityInfo
SetNamedSecurityInfoW
GetSecurityInfo
GetNamedSecurityInfoW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
LookupPrivilegeDisplayNameA
LookupPrivilegeNameA
IsValidSecurityDescriptor
InitializeAcl
GetTokenInformation
GetSecurityDescriptorControl
GetAclInformation
GetAce
EqualSid
AddAce
SetEntriesInAclW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueA
SetSecurityDescriptorDacl
IsValidAcl
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken

setupapi

SetupDiGetDriverInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiDestroyDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiEnumDriverInfoW
SetupGetLineTextW
SetupOpenInfFileW
SetupQueryInfOriginalFileInformationW
SetupGetInfInformationW
SetupGetNonInteractiveMode
SetupGetLineTextA
SetupCloseInfFile
SetupOpenInfFileA
SetupGetInfFileListA
CM_Get_DevNode_Status
SetupDiClassGuidsFromNameW
SetupDiClassNameFromGuidW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDescriptionW
SetupDiBuildClassInfoList
SetupDiGetClassDevsW
CMP_WaitNoPendingInstallEvents
SetupCopyOEMInfW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInstallParamsA
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyA
SetupDiCallClassInstaller
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiDeleteDeviceInfo
SetupDiGetDeviceInstanceIdW
SetupDiCreateDeviceInfoA
SetupDiCreateDeviceInfoList
SetupSetNonInteractiveMode
SetupDiBuildDriverInfoList

iphlpapi

GetIpAddrTable

user32

SendMessageA
DestroyWindow
GetDlgItem
IsWindow
EnumChildWindows
GetWindowThreadProcessId
LoadStringA
LoadStringW
CreateWindowExW

ole32

StringFromGUID2
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoQueryProxyBlanket
CoTaskMemFree

oleaut32

VariantClear
SafeArrayPutElement
SafeArrayDestroy
SafeArrayCreate
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetDim
SysStringLen
SysFreeString
SysAllocString
VariantInit

newdev

UpdateDriverForPlugAndPlayDevicesW

shell32

SHGetKnownFolderPath
SHGetFolderPathW

rpcrt4

UuidCreate

crypt32

CryptMsgOpenToDecode
CryptMsgClose
CryptMsgUpdate
CryptMsgGetParam
CertOpenStore
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertGetNameStringW
CryptQueryObject

wintrust

WinVerifyTrust

Sections

.text
Size: 592KB - Virtual size: 592KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 338KB - Virtual size: 337KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f30bffdee78850e2e9a2dbd2e7e02ab8

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

61:1c:b2:8a:00:00:00:00:00:26Certificate

Key Usages

09:0e:aa:29:4c:d4:ab:d9:eb:1c:c7:84:c9:24:24:3dCertificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

5d:aa:d4:1c:c1:a9:50:0b:5d:ed:a2:79:34:f4:62:3bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

01:35:01:ea:17:c5:39:29:8d:be:59:1e:52:8b:f6:60Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

9d:c4:47:a0:3a:62:88:04:7a:70:a7:1b:95:ee:51:de:6e:5a:0b:4e:c7:80:c2:d8:71:2d:1a:45:ad:fb:7e:9eSigner

98:f8:6a:df:2c:2a:3b:d6:36:d6:dd:29:c0:7d:1d:9c:d2:18:71:44Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

advapi32

setupapi

iphlpapi

user32

ole32

oleaut32

newdev

shell32

rpcrt4

crypt32

wintrust

Sections

.text Size: 592KB - Virtual size: 592KB

.rdata Size: 338KB - Virtual size: 337KB

.data Size: 46KB - Virtual size: 55KB

.didat Size: 512B - Virtual size: 20B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 36KB - Virtual size: 35KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

61:1c:b2:8a:00:00:00:00:00:26
Certificate

09:0e:aa:29:4c:d4:ab:d9:eb:1c:c7:84:c9:24:24:3d
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

5d:aa:d4:1c:c1:a9:50:0b:5d:ed:a2:79:34:f4:62:3b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

01:35:01:ea:17:c5:39:29:8d:be:59:1e:52:8b:f6:60
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

9d:c4:47:a0:3a:62:88:04:7a:70:a7:1b:95:ee:51:de:6e:5a:0b:4e:c7:80:c2:d8:71:2d:1a:45:ad:fb:7e:9e
Signer

98:f8:6a:df:2c:2a:3b:d6:36:d6:dd:29:c0:7d:1d:9c:d2:18:71:44
Signer

.text
Size: 592KB - Virtual size: 592KB

.rdata
Size: 338KB - Virtual size: 337KB

.data
Size: 46KB - Virtual size: 55KB

.didat
Size: 512B - Virtual size: 20B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 36KB - Virtual size: 35KB