vava[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

vava.rar
Size

23.9MB
MD5

d55c1e8bc3d002116051668661201de4
SHA1

b01b4af2681931d119bd70517456d263149aa53f
SHA256

276c24113307ee6bc8e1e8778c02e3bdbac1f7958d382614cf303e9811714914
SHA512

bac0cb4a1a0285c55912c3d0b3de6ee87599087a3d55de6df7caef834e514255db93b12603efab4c4b04d2671fde4cc5569e121fc678bb8a2c278ca0298af485
SSDEEP

393216:7KDy6rIaz97kiCHfvbIxzEB5aGB4kNaj4XKgfqHO6luMsJ8xdBLyKnMOCPAhw:7Ke6EY94iC/vbAzKVfk0q1luMO8/fnMr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ShadownColor.exe

Files

vava.rar
.rar
ShadownColor.exe
.exe windows:6 windows x64 arch:x64

332f4fd6e37c3d2d767f1c0b4155dbf3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegQueryValueA

kernel32

GetModuleHandleA

shell32

SHGetDiskFreeSpaceExW

user32

ValidateRect

Sections

Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 11.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 11.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE