v[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

v.exe
Size

35.1MB
MD5

80aece3be7f2f889480ab7a82a0c6658
SHA1

a4345d6da3670f494a6e40e41679885307360ff9
SHA256

a8403cfa8b3534ed8e60e1a1ccb4a7d476e4beb2af1f683532ce8a1b5bd71967
SHA512

7e3eb9a099e369bd1ce3eb5c820a04f08fd1d1e4331ef2073691c8a5bb9856c9792a438e2fd44196a98bb9a035c73c2a06f1240d4a9c863e6ca71fa8dc7ee3a7
SSDEEP

786432:ahnofMonMKj7mlZ9DxTt0Dv/GShYBiY4sL2mfERSVg/v7:ahofMoMKj7AXt07/6Bi1uEQV07

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
v.exe

Files

v.exe
.exe windows:6 windows x86 arch:x86

6080bfe3235cf25f8aae61b780e07a41

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
GetModuleHandleW
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
IsWow64Process
OpenProcess
GetLastError
DuplicateHandle
GetCommandLineW
OpenFileMappingW
MapViewOfFile
SetEvent
UnmapViewOfFile
CloseHandle
GetCommandLineA
CreateFileW
CreateFileMappingW
GetFileSizeEx
VirtualAlloc
VirtualFree
LoadLibraryW
ExitProcess
GetModuleHandleA

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xcpad
Size: - Virtual size: 992KB

.reloc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ