valo_x2[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

valo_x2.exe
Size

13.2MB
MD5

e0950a3d2ab37185f160aaf6a79da18e
SHA1

95eaf19d3daea18083fd11717074d903b8c9b100
SHA256

9ab2e83b485fd3fe892d829fa93d324f3983fb3a9fa6f3f5fafd2015b592f345
SHA512

605f5ce74ca55b8aeaf625bc654b2ee47de110690629350a139047db8783feb5060b0e030b0327c3a954d50fcf4d41f69383a43250329703c38e1e07b5645c8c
SSDEEP

393216:Ck7KRIC5dCYC/rBUo6sCgq6woLHq6jcPEcvhXWe:CaKRIMYBh8LwV6vvh9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
valo_x2.exe

Files

valo_x2.exe
.exe windows:5 windows x64 arch:x64

4114ceb393e5bd19f17d5099af394a77

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

msvcrt

__C_specific_handler

shell32

SHFileOperationW

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 71KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

./VB
Size: - Virtual size: 10.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.$W;
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.'=y
Size: 13.2MB - Virtual size: 13.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4114ceb393e5bd19f17d5099af394a77

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

shell32

user32

Sections

.text Size: - Virtual size: 107KB

.data Size: - Virtual size: 272B

.rdata Size: - Virtual size: 10KB

.eh_fram Size: - Virtual size: 4B

.pdata Size: - Virtual size: 2KB

.xdata Size: - Virtual size: 2KB

.bss Size: - Virtual size: 71KB

.idata Size: - Virtual size: 3KB

.CRT Size: - Virtual size: 96B

.tls Size: - Virtual size: 16B

./VB Size: - Virtual size: 10.7MB

.$W; Size: 2KB - Virtual size: 2KB

.'=y Size: 13.2MB - Virtual size: 13.2MB

.reloc Size: 512B - Virtual size: 184B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 107KB

.data
Size: - Virtual size: 272B

.rdata
Size: - Virtual size: 10KB

.eh_fram
Size: - Virtual size: 4B

.pdata
Size: - Virtual size: 2KB

.xdata
Size: - Virtual size: 2KB

.bss
Size: - Virtual size: 71KB

.idata
Size: - Virtual size: 3KB

.CRT
Size: - Virtual size: 96B

.tls
Size: - Virtual size: 16B

./VB
Size: - Virtual size: 10.7MB

.$W;
Size: 2KB - Virtual size: 2KB

.'=y
Size: 13.2MB - Virtual size: 13.2MB

.reloc
Size: 512B - Virtual size: 184B

.rsrc
Size: 1KB - Virtual size: 1KB