C:\malware\Venoma\x64\Release\Venoma.pdb
Static task
static1
Behavioral task
behavioral1
Sample
275d12c11b70a3c4854333e79f82e7d3194c91c18700c398f32c6e1dc60c6ec9.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
275d12c11b70a3c4854333e79f82e7d3194c91c18700c398f32c6e1dc60c6ec9.exe
Resource
win10v2004-20240802-en
General
-
Target
275d12c11b70a3c4854333e79f82e7d3194c91c18700c398f32c6e1dc60c6ec9
-
Size
20KB
-
MD5
a8b90f70554e33d44ffc37de95109853
-
SHA1
d91b807eb9fe21854765929cf50008cef20b99e6
-
SHA256
275d12c11b70a3c4854333e79f82e7d3194c91c18700c398f32c6e1dc60c6ec9
-
SHA512
b15601cb60bddd4a6defebd2ea43b7c7e990769dd528da8545d3f4401596e254dc801dbf6d888836796c22947dcc60059f98b1d411863e0128ae51ca7f04fbe1
-
SSDEEP
384:+y9jvcnHTKS9UPat8p+BydnNW7Esju350y3h9:+BT72PLptdnNW7EsK3ey3h9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 275d12c11b70a3c4854333e79f82e7d3194c91c18700c398f32c6e1dc60c6ec9
Files
-
275d12c11b70a3c4854333e79f82e7d3194c91c18700c398f32c6e1dc60c6ec9.exe windows:6 windows x64 arch:x64
1756e802348ea56a97ba0d5897ebbedf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
MultiByteToWideChar
Sleep
UpdateProcThreadAttribute
Process32NextW
SetFileInformationByHandle
Process32FirstW
CreateToolhelp32Snapshot
HeapAlloc
GetProcessHeap
CreateProcessA
lstrcmpiW
RtlLookupFunctionEntry
OpenProcess
CreateFileW
InitializeProcThreadAttributeList
GetModuleFileNameW
lstrlenW
GetCurrentProcess
HeapFree
CloseHandle
RtlVirtualUnwind
UnhandledExceptionFilter
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
TerminateProcess
RtlCaptureContext
advapi32
CryptDestroyKey
CryptAcquireContextW
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptDecrypt
vcruntime140
__current_exception_context
__std_exception_copy
__std_exception_destroy
memcpy
__C_specific_handler
__current_exception
_CxxThrowException
memset
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__p__commode
__stdio_common_vfprintf
__acrt_iob_func
_set_fmode
api-ms-win-crt-string-l1-1-0
tolower
_wcsicmp
api-ms-win-crt-runtime-l1-1-0
__p___argc
_get_initial_narrow_environment
_initterm
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_crt_atexit
terminate
_initialize_narrow_environment
_configure_narrow_argv
_c_exit
_cexit
_exit
__p___argv
_set_app_type
_seh_filter_exe
exit
_register_onexit_function
_initterm_e
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 624B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ