Velocity[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

Velocity.rar
Size

69.5MB
MD5

f3544c7e693a6288ed6e56dda19c5f0a
SHA1

7012b612cda98120bae9d8c3768f64f12a1c3f9a
SHA256

675001e81791e41480a18e7e4694fd2706fe7c481fa53d6f7fd3db9a983dfad6
SHA512

cd94d32c66af34eba17e742b3f8388e063dbc532977dada31e26c992e1db4f7e47442d7477604c81320ce025e890abb5302749325dd1c15d3f4e62e0f1573c30
SSDEEP

1572864:opiGXQrhkMskXTszF+DbWYR0EgNgeoQKlk:+MzTssDS40/eeTKu

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DSE-Patcher.exe
unpack001/Loader.exe
unpack001/Velocity.exe

Files

Velocity.rar
.rar
DSE-Patcher.exe
.exe windows:6 windows x64 arch:x64

aa895e308078800a6f5ae68d54e68314

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memset
malloc
?terminate@@YAXXZ
strcpy
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__C_specific_handler
__getmainargs
strrchr
_stricmp
strcat
sprintf
free

shlwapi

PathFileExistsA

newdev

UpdateDriverForPlugAndPlayDevicesA

setupapi

SetupDiRemoveDevice
SetupDiSetDeviceRegistryPropertyA
SetupDiCreateDeviceInfoList
SetupDiGetINFClassA
SetupDiCreateDeviceInfoA
SetupDiCallClassInstaller
SetupDiDestroyDeviceInfoList

comctl32

ord6

kernel32

GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
GetCurrentProcessId
GetStartupInfoW
FreeLibrary
LocalFree
GetProcAddress
CloseHandle
lstrcpyA
DeleteFileA
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
DeviceIoControl
CreateFileA
CreateThread
MulDiv
GetModuleFileNameA
GetCurrentProcess
WriteFile
LoadLibraryExA
lstrlenA
LocalAlloc
lstrcatA
Sleep
GetLastError
GetSystemDirectoryA
LoadLibraryA

user32

KillTimer
GetDC
MessageBoxA
SetTimer
EnableWindow
ReleaseDC
GetDlgItem
GetClientRect
LoadIconA
SendMessageA
SetFocus
CreateWindowExA
DialogBoxParamA
EndDialog

gdi32

CreateFontIndirectA
GetDeviceCaps

advapi32

QueryServiceStatusEx
CreateServiceA
SetSecurityDescriptorDacl
SetEntriesInAclA
AdjustTokenPrivileges
RegCloseKey
CloseServiceHandle
SetNamedSecurityInfoA
AllocateAndInitializeSid
LookupPrivilegeValueA
OpenSCManagerA
DeleteService
ControlService
GetNamedSecurityInfoA
StartServiceA
RegSetValueExA
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
RegOpenKeyExA
SetFileSecurityA
OpenServiceA

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Loader.exe
.exe windows:6 windows x64 arch:x64

91e0ccbbce05d40b53e800e309d13280

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

HeapReAlloc
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

SetWindowPos

advapi32

CryptHashData

shell32

ShellExecuteA

oleaut32

VariantClear

msvcp140

?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

ntdll

RtlCaptureContext

normaliz

IdnToAscii

wldap32

ord301

crypt32

CertFreeCertificateChainEngine

ws2_32

recv

rpcrt4

UuidCreate

userenv

UnloadUserProfile

vcruntime140

strchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-time-l1-1-0

strftime

api-ms-win-crt-math-l1-1-0

_dclass

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-utility-l1-1-0

qsort

Sections

.text
Size: - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.S<M
Size: - Virtual size: 19.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.p`c
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.[~K
Size: 33.7MB - Virtual size: 33.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Velocity.exe
.exe windows:5 windows x64 arch:x64

b1c5b1beabd90d9fdabd1df0779ea832

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb

Imports

kernel32

LocalFree
GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetCurrentProcessId
CreateDirectoryW
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
GetVersionExW
GetModuleFileNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
ExpandEnvironmentStringsW
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
GlobalMemoryStatusEx
LoadResource
SizeofResource
GetTimeFormatW
GetDateFormatW
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetNumberFormatW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RtlUnwindEx
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
GetStringTypeW
HeapReAlloc
LCMapStringW
FindFirstFileExA

oleaut32

SysAllocString
SysFreeString
VariantClear

gdiplus

GdipCloneImage
GdipFree
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipAlloc

Sections

.text
Size: 282KB - Virtual size: 281KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa895e308078800a6f5ae68d54e68314

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

shlwapi

newdev

setupapi

comctl32

kernel32

user32

gdi32

advapi32

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 1.8MB - Virtual size: 1.8MB

.pdata Size: 512B - Virtual size: 480B

.rsrc Size: 76KB - Virtual size: 75KB

.reloc Size: 512B - Virtual size: 16B

91e0ccbbce05d40b53e800e309d13280

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

oleaut32

msvcp140

shlwapi

psapi

ntdll

normaliz

wldap32

crypt32

ws2_32

rpcrt4

userenv

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

Sections

.text Size: - Virtual size: 487KB

.rdata Size: - Virtual size: 117KB

.data Size: - Virtual size: 1.6MB

.pdata Size: - Virtual size: 20KB

.S<M Size: - Virtual size: 19.5MB

.p`c Size: 5KB - Virtual size: 5KB

.[~K Size: 33.7MB - Virtual size: 33.7MB

.rsrc Size: 512B - Virtual size: 480B

b1c5b1beabd90d9fdabd1df0779ea832

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

oleaut32

gdiplus

Sections

.text Size: 282KB - Virtual size: 281KB

.rdata Size: 74KB - Virtual size: 74KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 1.8MB - Virtual size: 1.8MB

.pdata
Size: 512B - Virtual size: 480B

.rsrc
Size: 76KB - Virtual size: 75KB

.reloc
Size: 512B - Virtual size: 16B

.text
Size: - Virtual size: 487KB

.rdata
Size: - Virtual size: 117KB

.data
Size: - Virtual size: 1.6MB

.pdata
Size: - Virtual size: 20KB

.S<M
Size: - Virtual size: 19.5MB

.p`c
Size: 5KB - Virtual size: 5KB

.[~K
Size: 33.7MB - Virtual size: 33.7MB

.rsrc
Size: 512B - Virtual size: 480B

.text
Size: 282KB - Virtual size: 281KB

.rdata
Size: 74KB - Virtual size: 74KB

.data
Size: 6KB - Virtual size: 57KB

.pdata
Size: 12KB - Virtual size: 12KB

.didat
Size: 1024B - Virtual size: 864B

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 57KB - Virtual size: 56KB

.reloc
Size: 2KB - Virtual size: 2KB