main.rar
- SHA256 aeab4b66da21ca4ff328d202cb2db093849448b968fa12099ff10f23e19dc60e
Password
vape
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
main/VapeProtecion.dll
Resource
win11-20240611-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target main.rar
- Size 1.2MB
- Sample240614-ezzzfsvekh
- SHA256 aeab4b66da21ca4ff328d202cb2db093849448b968fa12099ff10f23e19dc60e
- MD5 1d3810b4b5ff911729c4a5570e4f93f9
- SHA1 349ded523e9019061fafb0249082e62ca9366712
- SHA512 5dd7f54018df357b6c15e5b367ec09fc579e17b458b48fc7a8c017982c0ca0f084b0c00fdddacd300708385c7356ef94f9960abba34b4379c3bced0f2e61fc74
- SSDEEP 24576:a6TD87frfThI4dqvQWTicH0QBEalE8gxKlVtwn5vn+MS9NQYBNUFZQJ2wC8D:ak8fBVdqBHVB/ETxgtwn5kZvEKJ24D
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/main/VapeProtecion.dll unpack001/main/main.v1.exe
File Explorer
-
main.rar.rar 1.2MB
-
main/README.txt93B
-
main/VapeProtecion.dll.dll 116KB
-
main/main.v1.exe.exe 1.2MB
main/README.txt
- SHA256 80a720dda3694e18ee981f5ff240c04dffb5f732877e7198a5a883420b3bf81a
- MD5 2ac12bd274bd3abb1c5aed92d18389af
- SHA1 d531c9852e140656e1a07276ea97ecf2d7612307
- SHA512 62509d68fbbbd1a2ce682b310b8c30298c3531f1cc480a27b593b8ef4a89e465251f9f886084de9b65ae589f470186e1a352b55442bb9b0f9ee2f25db5ed46fe
- MD5 SHA1 SHA512
main/VapeProtecion.dll
- IMPHASH 1851ff453adce0cef5274e320d5bed3c
- SHA256 25b940a7a9a86d5b00bce52315332fa313ef583159486c5bc7147e9c8ce845bb
- MD5 3a83c36b9906297c92ff29b2d89ed243
- SHA1 12d97851b68cdd175d0b262764e9e69d9c666918
- SHA512 73a8b7d72255b7a53bb7d033c50746d69496d9cfab7960f5f416928b16b69fc644811eed489e43cee8e5670f4bd320a12324d4b6e47e5839223ee99ae94c65f6
- SSDEEP 3072:rmcqYHq7Aiytzg2ScpvgJcG5sqYX6UoHrlBS:K0Hq7AiyegZgJZSXwLH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
vape
Minor OS version
2
Major OS version
5
Entry point
8864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetStringTypeW
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW
RaiseException
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=241, version=40116,
count=124, id=243, version=40116,
count=14, id=242, version=40116,
count=7, id=259, version=24123,
count=20, id=261, version=24123,
count=17, id=260, version=24123,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=90, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
main/main.v1.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6666c3ef1bb36779fd6725d4ec308dd4a5a7677931844691d1d3fdba46c3278f
- MD5 dc34a8f3b65df10c070951e4badc0dc4
- SHA1 cf3f53df78152e416ae517dd09a2d8e874c3cb05
- SHA512 a52afa789dc5ac42c50a2364c2d9e8138aaee833ac4e266f99473a01412e46fcbfa3351adf538ec023df13234203b90c0b8d3e429155b4515da1210657f9e008
- SSDEEP 24576:vGjmmvk+tKHCeYhDM/gRZGJ1FkRlqY3Jna5ptgJBXc1mz7MljDBdUaUk/0nF:+6mvoieODMo/GJQoYpantgbv81ck0n
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
vape
Minor OS version
0
Major OS version
4
Entry point
1313662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ