Vanhelsing-cxb.zip
- SHA256 37f09188ca22ff0cfaa499c57f8119a80fc4534acbac3bbfb8405f076530ce48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Vanhelsing-cxb.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target Vanhelsing-cxb.zip
- Size 390KB
- Sample250404-bh97baxvbz
- SHA256 37f09188ca22ff0cfaa499c57f8119a80fc4534acbac3bbfb8405f076530ce48
- MD5 ab613e288ba48b7dba012420bb61c461
- SHA1 e478ae8a3261becb0b26b35eccf4d372af89e0e9
- SHA512 915f3f1a4ba98e29c01cd4f63921f380ce65104086ca268f0861d47de222ab49167eed206d08abb5e496e435ee10e2d343810f21e4fe3f6adb42535c96fe4a81
- SSDEEP 12288:BdOaM8nF05kd9ye0C2nPxL7Flzu3az0Rsw:jOa5Ft9y9PxL7F9KawRsw
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Vanhelsing-cxb.exe
File Explorer
-
Vanhelsing-cxb.zip.zip 390KB
-
Vanhelsing-cxb.exe.exe 719KB
-
__MACOSX/._Vanhelsing-cxb.exe276B
Vanhelsing-cxb.exe
- IMPHASH 9951b4b852f8bee5d019bc23e6ac6bd6
- SHA256 99959c5141f62d4fbb60efdc05260b6e956651963d29c36845f435815062fd98
- MD5 3e063dc0de937df5841cb9c2ff3e4651
- SHA1 e683bfaeb1a695ff9ef1759cf1944fa3bb3b6948
- SHA512 9a0d0c04b95bbf8c73beb398cc72fa8e9dc87e3149e8c2f43b05fca4ef8e4410c1d65ed11e50b01d24719ce6a8996448944ab56601ef65116614a17f2e10d23f
- SSDEEP 12288:aKRHZl7Lup6ySk3QYktDNYlg2317DJtY7wdD30qoifK/Ke5ABa4QP9+NrMke03f9:aKslHY7wdD30qnfsKxB+ZKX55WsSuFrl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
260123
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\ADMINI~1\AppData\Local\Temp\2\74edcda8581f9636c83352ad946821b0\1-locker\Release\1-locker.pdb
kernel32
GetStdHandle
WriteFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
GetLastError
lstrcatW
CloseHandle
GetWindowsDirectoryW
WideCharToMultiByte
lstrcpyW
AllocConsole
lstrcmpW
MoveFileW
FindFirstFileW
FindNextFileW
lstrlenW
GetLogicalDriveStringsW
GetDriveTypeW
CreateMutexA
GetFileAttributesW
Sleep
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
WriteConsoleW
SetEndOfFile
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcess
GetCommandLineW
FindClose
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
HeapReAlloc
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
GetFileType
SetFilePointerEx
GetFileSizeEx
ExitProcess
GetModuleHandleExW
ExitThread
RaiseException
RtlUnwind
LoadLibraryW
UnregisterWaitEx
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
QueryPerformanceCounter
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SetEvent
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
user32
SystemParametersInfoW
MessageBoxW
wsprintfW
SendMessageTimeoutW
advapi32
RegSetKeyValueW
RegCreateKeyW
RegOpenKeyW
SystemFunction036
shell32
SHChangeNotify
ord680
CommandLineToArgvW
SHGetFolderPathW
ws2_32
inet_pton
select
getaddrinfo
socket
WSAStartup
WSAGetLastError
ioctlsocket
freeaddrinfo
htons
inet_ntop
gethostname
closesocket
connect
netapi32
NetShareEnum
NetApiBufferFree
Name
.text
Size
501KB
Virtual Size
501KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
135KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
58KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=259, version=26715,
count=174, id=261, version=26715,
count=23, id=260, version=26715,
count=21, id=259, version=26706,
count=1, id=262, version=26715,
count=123, id=261, version=26706,
count=38, id=260, version=26706,
count=17, id=257, version=26715,
count=188, id=1, productName=Unmarked objects,
count=46, id=260, version=34808,
count=5, id=265, version=27053,
count=1, id=255, version=27053,
count=1, id=258, version=27053,
__MACOSX/._Vanhelsing-cxb.exe
- SHA256 cf1065897e6fed4766524f12ef55551cfd42b1088c3937ea129c24da8a22a3c5
- MD5 9a3dc7cff3a99a1bcb6dc4cce5c9d28f
- SHA1 a3212d51835ef6bc71e7094e74343616351d9366
- SHA512 b5a0da03540596f6183bd09e1640cba7e47ddf1a489999841aa9845cae0a385a8a5b1cbbe5129b48adf9492f6e3ba88ba238bd91781eabbb65bfdfe7f7674dca
- MD5 SHA1 SHA512