Vixen[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Vixen.exe
Size

3.2MB
MD5

2d414037a4dc5b644ad6f795b113d59b
SHA1

dc744f08f981d60267b929f64787c7e47626bd87
SHA256

edc8f9c1c831cd44133bec7bca9599cc380965a9e5524f55436cf7b2db38b86c
SHA512

d4047b51709798ae6bfc0dd331e8975d117ebd60ab4d2d23234c14f481300b558f042596151fd4715d446a323090533c10a61809fe25f37ab9b6b432222b32c3
SSDEEP

49152:CRfGtlqbIU6i1Zmzj03Ch3RX3NzjK1iRIxYyYh++LXQFeEy5UDkPS2NPoI5TjnbK:2G+S0Sh3RX9zOGvx51a2mI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Vixen.exe

Files

Vixen.exe
.exe windows:6 windows x64 arch:x64

9816aa73d0119bc31a9db315de5c98db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FormatMessageA
CreateFileA
GetFileSizeEx
GetSystemTime
SystemTimeToFileTime
GetEnvironmentVariableW
WideCharToMultiByte
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
MultiByteToWideChar
PeekNamedPipe
FormatMessageW
WriteFile
GetModuleHandleW
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlVirtualUnwind
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryW
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReadFile
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
WaitForSingleObjectEx
VerifyVersionInfoA
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
VerSetConditionMask
SleepEx
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
WaitForMultipleObjects
DeviceIoControl
EnterCriticalSection
GetTickCount
GetLastError
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
Beep
CreateThread
Sleep
VirtualAlloc
SetConsoleTitleA
lstrcmpiW
CloseHandle
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
CreateFileW
GetModuleHandleExW

user32

GetWindowRect
DestroyWindow
SetWindowPos
ShowWindow
GetSystemMetrics
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
DispatchMessageW
GetWindow
CreateWindowExA
mouse_event
GetAsyncKeyState
FindWindowA
LoadIconW
SetWindowLongW
GetDesktopWindow
RegisterClassExA
UpdateWindow
GetKeyState
ScreenToClient
GetActiveWindow
ClientToScreen
LoadCursorW
SetCursor
GetClientRect
SetCursorPos
GetCursorPos
OpenClipboard
PeekMessageW
DefWindowProcA
TranslateMessage
SetLayeredWindowAttributes
GetForegroundWindow
MessageBoxA
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
IsWindow

advapi32

CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptSignHashW
CryptEnumProvidersW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?good@ios_base@std@@QEBA_NXZ
?_Throw_Cpp_error@std@@YAXH@Z
?_Random_device@std@@YAIXZ
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?_Xbad_function_call@std@@YAXXZ

d3d9

Direct3DCreate9Ex

dwmapi

DwmExtendFrameIntoClientArea

wldap32

ord301
ord200
ord143
ord32
ord33
ord22
ord35
ord27
ord30
ord41
ord50
ord45
ord26
ord60
ord211
ord46
ord79

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

wcsstr
memcpy
memset
strrchr
memmove
memcmp
memchr
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
strchr
__std_exception_destroy
strstr
__std_terminate
__std_exception_copy

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
_crt_atexit
signal
exit
strerror_s
_exit
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
terminate
_errno
_seh_filter_exe
_set_app_type
strerror
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_get_initial_narrow_environment
raise
_configure_narrow_argv
__sys_nerr
_initialize_narrow_environment
_initialize_onexit_table
_initterm_e
_initterm
system

api-ms-win-crt-stdio-l1-1-0

ferror
_fileno
fgets
fputc
fopen
__acrt_iob_func
_setmode
setvbuf
clearerr
__stdio_common_vfprintf
fputs
setbuf
_set_fmode
__stdio_common_vswprintf
puts
__p__commode
__stdio_common_vsprintf_s
_open
__stdio_common_vsscanf
fread
_close
__stdio_common_vsprintf
_wfopen
fwrite
_write
feof
fseek
fclose
fflush
_read
ftell
_lseeki64

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
calloc
realloc
malloc
free

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-string-l1-1-0

isspace
strncpy
strncmp
isprint
_strnicmp
tolower
strpbrk
_strdup
_stricmp
isupper
strspn
strcspn
strcmp

api-ms-win-crt-convert-l1-1-0

strtoull
strtoll
strtod
atof
strtol
strtoul
atoi

api-ms-win-crt-locale-l1-1-0

localeconv
_configthreadlocale

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_time64
_gmtime64

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32
_fstat64
_stat64i32
_stat64
_access

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

asin
atan2
__setusermatherr
tanf
powf
sinf
sqrt
atan2f
pow
sqrtf
floorf
ceilf
fmodf
cosf

crypt32

CertGetNameStringA
CertGetCertificateContextProperty
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
CertAddCertificateContextToStore
CertFreeCertificateChain
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertDuplicateCertificateContext

ws2_32

closesocket
send
socket
htonl
listen
ioctlsocket
WSAStartup
WSAIoctl
getaddrinfo
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
freeaddrinfo
ntohl
connect
bind
WSASetLastError
select
__WSAFDIsSet
inet_pton
WSAGetLastError
recvfrom
sendto
gethostname
shutdown
getnameinfo
recv
WSACleanup
accept

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 700KB - Virtual size: 700KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 195KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9816aa73d0119bc31a9db315de5c98db

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcp140

d3d9

dwmapi

wldap32

imm32

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

crypt32

ws2_32

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 700KB - Virtual size: 700KB

.data Size: 195KB - Virtual size: 215KB

.pdata Size: 91KB - Virtual size: 90KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 25KB - Virtual size: 25KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 700KB - Virtual size: 700KB

.data
Size: 195KB - Virtual size: 215KB

.pdata
Size: 91KB - Virtual size: 90KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 25KB - Virtual size: 25KB