umbral | VapeV4[.]exe

General

Target
VapeV4.exe
Size 12.0MB
Sample240728-cpceaswapf
SHA256 14a16b4fcb0af8c5fae891e060a5175f58c020a735be9e5a2242ac76c4327946
MD5 5f3fabec375e5a1acc1431477309ab48
SHA1 c12fc1f9da09dd799601cc8c852cd742e6d2b32e
SHA512 9b9567c649e98964949dc00a6865d0656c2fa600f294a654ef4264b48a6b34f0d3096c20603acafbb47c4e1568893078dc53c5a619a9b839fee434853bfb9d72
SSDEEP 98304:DemvHzXnfpOfKEmZH0H7UpjSSJgEEjZoTsBbZAqSsraMh+QIUuoMOWucEZ8:DNHrxygH87BdjZ/JPraxzNo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

umbral

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
sample	family_umbral

Umbral family
umbral

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VapeV4.exe

File Explorer

VapeV4.exe

.exe 12.0MB

VapeV4.exe

IMPHASH 9222d372923baed7aa9dfa28449a94ea
SHA256 14a16b4fcb0af8c5fae891e060a5175f58c020a735be9e5a2242ac76c4327946
MD5 5f3fabec375e5a1acc1431477309ab48
SHA1 c12fc1f9da09dd799601cc8c852cd742e6d2b32e
SHA512 9b9567c649e98964949dc00a6865d0656c2fa600f294a654ef4264b48a6b34f0d3096c20603acafbb47c4e1568893078dc53c5a619a9b839fee434853bfb9d72
SSDEEP 98304:DemvHzXnfpOfKEmZH0H7UpjSSJgEEjZoTsBbZAqSsraMh+QIUuoMOWucEZ8:DNHrxygH87BdjZ/JPraxzNo
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detect Umbral payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\DarkCoderSc\Desktop\Celesty Binder\Stub\STATIC\Stub.pdb

kernel32

CreateFileA FindResourceA FreeLibrary LoadResource WriteFile SizeofResource GetProcAddress LoadLibraryA LockResource EnumResourceNamesA CloseHandle FreeResource GetWindowsDirectoryA OutputDebugStringA GetTempPathA GetModuleHandleW ExitProcess DecodePointer EncodePointer GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle GetModuleFileNameW Sleep HeapSize GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc LCMapStringW MultiByteToWideChar GetStringTypeW

shell32

ShellExecuteA SHGetSpecialFolderPathA

Sharing