Vixen[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Vixen.exe
Size

3.2MB
MD5

02d4689d26110abf2f051266bd3d518c
SHA1

22f03e0895cf79f1df1c82a8d82d0ee12dfaee24
SHA256

3a5c8f55a8dce003a3429f614fd8ce54e3ac628bd097245f9045d9ec0a0a8288
SHA512

e0a9470fd98d98d97f4e3b14fd7d1c9e2efc4ea3488d2490a379d08eb14cd5baf5be5a15909f538c897b1773b3f014fd512f714e2a6cbba623968659dbb667d7
SSDEEP

49152:SRrGtlq8IU6ihTFpvA7kbxUaKpqUkDoEQ4evaR/ftmbt5iJ7jbicmMDoNPoUqTFK:GF+i7MUaKp4wc+rcm2omUb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Vixen.exe

Files

Vixen.exe
.exe windows:6 windows x64 arch:x64

Password: discord.gg/vixen

c091210ce67e6ed0ac80411e3b5c90b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FormatMessageA
CreateFileA
GetFileSizeEx
GetSystemTime
SystemTimeToFileTime
GetEnvironmentVariableW
WideCharToMultiByte
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
MultiByteToWideChar
PeekNamedPipe
FormatMessageW
WriteFile
GetModuleHandleW
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlVirtualUnwind
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryW
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReadFile
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
WaitForSingleObjectEx
VerifyVersionInfoA
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
VerSetConditionMask
SleepEx
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
WaitForMultipleObjects
Sleep
EnterCriticalSection
GetTickCount
GetLastError
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
Beep
CreateThread
VirtualAlloc
SetConsoleTitleA
lstrcmpiW
CloseHandle
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
CreateFileW
DeviceIoControl
GetModuleHandleExW

user32

GetWindowRect
DestroyWindow
SetWindowPos
ShowWindow
GetSystemMetrics
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
DispatchMessageW
GetWindow
CreateWindowExA
mouse_event
GetAsyncKeyState
FindWindowA
LoadIconW
SetWindowLongW
GetDesktopWindow
RegisterClassExA
UpdateWindow
GetKeyState
ScreenToClient
GetActiveWindow
ClientToScreen
LoadCursorW
SetCursor
GetClientRect
SetCursorPos
GetCursorPos
OpenClipboard
PeekMessageW
DefWindowProcA
TranslateMessage
SetLayeredWindowAttributes
GetForegroundWindow
MessageBoxA
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
IsWindow

advapi32

CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptSignHashW
CryptEnumProvidersW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?good@ios_base@std@@QEBA_NXZ
?_Throw_Cpp_error@std@@YAXH@Z
?_Random_device@std@@YAIXZ
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?_Xbad_function_call@std@@YAXXZ

d3d9

Direct3DCreate9Ex

dwmapi

DwmExtendFrameIntoClientArea

wldap32

ord301
ord200
ord143
ord32
ord33
ord22
ord35
ord27
ord30
ord41
ord50
ord45
ord26
ord60
ord211
ord46
ord79

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

wcsstr
memcpy
memset
strrchr
memmove
memcmp
memchr
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
strchr
__std_exception_destroy
strstr
__std_terminate
__std_exception_copy

api-ms-win-crt-runtime-l1-1-0

terminate
_beginthreadex
_crt_atexit
signal
exit
strerror_s
_exit
_register_thread_local_exe_atexit_callback
_cexit
_c_exit
__p___argv
__p___argc
_seh_filter_exe
_errno
_set_app_type
_get_initial_narrow_environment
strerror
_invalid_parameter_noinfo_noreturn
raise
_configure_narrow_argv
__sys_nerr
_initialize_narrow_environment
_initialize_onexit_table
system
_initterm_e
_initterm
_register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_set_fmode
fgets
fputc
fopen
feof
ferror
__acrt_iob_func
_fileno
__stdio_common_vsprintf_s
fputs
_setmode
clearerr
setbuf
puts
_lseeki64
__stdio_common_vfprintf
__stdio_common_vswprintf
__stdio_common_vsscanf
fread
__p__commode
__stdio_common_vsprintf
_wfopen
fwrite
_read
setvbuf
fseek
fclose
fflush
_open
ftell
_close
_write

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
realloc
malloc
free
calloc

api-ms-win-crt-utility-l1-1-0

qsort
rand

api-ms-win-crt-string-l1-1-0

isspace
strncpy
strncmp
strspn
tolower
strpbrk
isprint
isupper
strcspn
_strnicmp
_strdup
_stricmp
strcmp

api-ms-win-crt-convert-l1-1-0

strtoull
strtoll
strtod
atof
strtol
strtoul
atoi

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64_s
_gmtime64

api-ms-win-crt-filesystem-l1-1-0

_access
_fstat64
_stat64i32
_fstat64i32
_stat64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

atan
atan2f
__setusermatherr
ceilf
asin
tanf
floorf
fmodf
pow
powf
atan2
cosf
sinf
sqrt
sqrtf

crypt32

CertGetNameStringA
CertGetCertificateContextProperty
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
CertAddCertificateContextToStore
CertFreeCertificateChain
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertDuplicateCertificateContext

ws2_32

closesocket
send
socket
htonl
listen
ioctlsocket
WSAStartup
WSAIoctl
getaddrinfo
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
freeaddrinfo
ntohl
connect
bind
WSASetLastError
select
__WSAFDIsSet
inet_pton
WSAGetLastError
recvfrom
sendto
gethostname
shutdown
getnameinfo
recv
WSACleanup
accept

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 701KB - Virtual size: 700KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 195KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: discord.gg/vixen

c091210ce67e6ed0ac80411e3b5c90b9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcp140

d3d9

dwmapi

wldap32

imm32

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

crypt32

ws2_32

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 701KB - Virtual size: 700KB

.data Size: 195KB - Virtual size: 215KB

.pdata Size: 91KB - Virtual size: 90KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 25KB - Virtual size: 25KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 701KB - Virtual size: 700KB

.data
Size: 195KB - Virtual size: 215KB

.pdata
Size: 91KB - Virtual size: 90KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 25KB - Virtual size: 25KB