vpk[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

vpk.exe
Size

183KB
MD5

2fadce619e80092b92a9190eb03c0700
SHA1

05ffa280b4def5999ecf7867d6cb28386ac75b17
SHA256

60eb7ebc78cae471729cee0296f13ff834ec194b2f0497bd69d79dab4f32b2e9
SHA512

8f5e9d0989bcbff0b22e95382199c1cf15400a8fd0f5b0f2529d8ddbfbffb379d38d24baaab51191b14ead1c458f9c99af4e0c2107293ae88b5041482c2df647
SSDEEP

3072:5CboRvuDdWRPffxVTu2EplfGU5wKW5CBNyBNvAg0Fuz1a8lF:couDdWRPfffS2EpJj5wX0UxAOzsQ

Score

1^/10

Malware Config

Signatures

Files

vpk.exe
.exe windows:5 windows x86 arch:x86

1838491623a9a3006b34eb05d5ef2926

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

05:4f:46:6c:ec:cb:e9:d6:be:e8:1f:54:35:e6:4d:47
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/10/2018, 00:00

Not After

07/10/2021, 12:00

Subject

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ba:d5:93:b1:00:fa:1a:15:de:1d:91:93:d5:df:65:d4:45:b0:78:e9
Signer

Actual PE Digest

ba:d5:93:b1:00:fa:1a:15:de:1d:91:93:d5:df:65:d4:45:b0:78:e9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\buildslave\l4d2_rel_win32\build\src\utils\vpk\Release\vpk.pdb

Imports

tier0

StackToolsNotify_LoadedLibrary
GetThreadedLoadLibraryFunc
?Lock@CThreadFastMutex@@ACEXII@Z
Warning
?DevMsg@@YAXPBDZZ
InstallProgressReportHandler
CommandLine_Tier0
GetCPUInformation
Plat_FloatTime
Error
g_pMemAlloc
ThreadWaitForObjects
Plat_IsInDebugSession
ReleaseThreadHandle
CreateSimpleThread
?DevWarning@@YAXPBDZZ

vstdlib

KeyValuesSystem

kernel32

FreeEnvironmentStringsW
CreateFileMappingA
LoadLibraryExA
GetModuleHandleA
CreateFileW
MultiByteToWideChar
WideCharToMultiByte
GetCurrentThreadId
CreateFileA
ReadFile
SetFilePointer
CloseHandle
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineA
HeapSetInformation
GetDriveTypeW
GetLastError
GetFullPathNameA
EncodePointer
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameW
HeapFree
HeapAlloc
RaiseException
GetModuleFileNameA
WriteConsoleW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetStringTypeW
GetCurrentDirectoryW
Sleep
HeapSize
RtlUnwind
GetConsoleCP
GetConsoleMode
HeapReAlloc
FlushFileBuffers
SetStdHandle

Exports

Exports

CreateInterface
cvar
g_pCVar

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1838491623a9a3006b34eb05d5ef2926

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

05:4f:46:6c:ec:cb:e9:d6:be:e8:1f:54:35:e6:4d:47Certificate

Extended Key Usages

Key Usages

ba:d5:93:b1:00:fa:1a:15:de:1d:91:93:d5:df:65:d4:45:b0:78:e9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

tier0

vstdlib

kernel32

Exports

Exports

Sections

.text Size: 108KB - Virtual size: 107KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 8KB - Virtual size: 83KB

.reloc Size: 12KB - Virtual size: 11KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

05:4f:46:6c:ec:cb:e9:d6:be:e8:1f:54:35:e6:4d:47
Certificate

ba:d5:93:b1:00:fa:1a:15:de:1d:91:93:d5:df:65:d4:45:b0:78:e9
Signer

.text
Size: 108KB - Virtual size: 107KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 8KB - Virtual size: 83KB

.reloc
Size: 12KB - Virtual size: 11KB