VeraCryptExpander-x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
VeraCryptExpander-x64.exe
Size 5.3MB
Sample250703-drczaadp71
SHA256 23eb320da3962d7b090a4d9f6bd715c1f83c8952a0dacd59d686f5e002c50327
MD5 ae466bcbaa95785cedb427420bf11513
SHA1 638c4bfaf91c18260213cf6380cde254e5ecdf77
SHA512 68f77893d113a67fc95ce786e5a491d0f75b0692ceb057bb152828b4195d794b79c825043a19cedee24e7c333c568e3f0dbcc3a7bf13ee9a269d73f8985165c8
SSDEEP 98304:ylfHwlOai0c4hYm0WQOEPjFbq+5CJDcduOut08LdeWdxybJ:ylf1aLcyYKzOx5nN
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

VeraCryptExpander-x64.exe

.exe 5.3MB

VeraCryptExpander-x64.exe

IMPHASH 5e9f9aed8848d9787d22e9bab3790549
SHA256 23eb320da3962d7b090a4d9f6bd715c1f83c8952a0dacd59d686f5e002c50327
MD5 ae466bcbaa95785cedb427420bf11513
SHA1 638c4bfaf91c18260213cf6380cde254e5ecdf77
SHA512 68f77893d113a67fc95ce786e5a491d0f75b0692ceb057bb152828b4195d794b79c825043a19cedee24e7c333c568e3f0dbcc3a7bf13ee9a269d73f8985165c8
SSDEEP 98304:ylfHwlOai0c4hYm0WQOEPjFbq+5CJDcduOut08LdeWdxybJ:ylf1aLcyYKzOx5nN
MD5 SHA1 SHA512 SSDEEP

Digest

bb:79:e0:28:37:76:7d:c1:25:46:70:c3:db:22:91:3d:e3:13:ea:5f:cb:0e:bf:83:7c:45:d4:ee:4b:07:f5:fc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=490 000 619,CN=IDRIX SARL,O=IDRIX SARL,STREET=5 AVENUE INGRES,L=Paris,ST=Île-de-France,C=FR,1.3.6.1.4.1.311.60.2.1.3=#13024652,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 4, 2025

SERIALNUMBER=490 000 619,CN=IDRIX SARL,O=IDRIX SARL,STREET=5 AVENUE INGRES,L=Paris,ST=Île-de-France,C=FR,1.3.6.1.4.1.311.60.2.1.3=#13024652,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=490 000 619,CN=IDRIX SARL,O=IDRIX SARL,STREET=5 AVENUE INGRES,L=Paris,ST=Île-de-France,C=FR,1.3.6.1.4.1.311.60.2.1.3=#13024652,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

11:49:0e:a7:8a:dc:e9:1d:54:f3:98:2e

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 30, 2021 - Mar 13, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

408560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dev\prj\Github\VeraCrypt\src\ExpandVolume\x64\Release\VeraCryptExpander.pdb

kernel32

GetSystemDirectoryW FreeLibrary GetProcAddress LoadLibraryW GetModuleFileNameW GetFileAttributesW GetLastError SetLastError VirtualLock CreateFileW FlushFileBuffers GetDiskFreeSpaceExW GetFileSizeEx GetFileTime GetVolumeInformationW GetVolumePathNameW SetEndOfFile SetFilePointer SetFilePointerEx SetFileTime SetFileValidData GetVolumeNameForVolumeMountPointW CloseHandle DeviceIoControl VirtualUnlock _lwrite WriteFile SetEvent WaitForSingleObject CreateEventW GetCurrentThread SetThreadPriority GetTickCount GetCommandLineA GetCommandLineW Sleep SetProcessShutdownParameters MultiByteToWideChar WideCharToMultiByte DeleteFileW InitializeCriticalSectionEx CreateDirectoryW FindFirstVolumeW FindNextVolumeW FindVolumeClose GetDriveTypeW QueryDosDeviceW ReadFile GetTempPathW DecodePointer DeleteCriticalSection GetCurrentThreadId GetModuleHandleW MoveFileExW LocalFree VerSetConditionMask SetCurrentDirectoryW GetCurrentDirectoryW DefineDosDeviceW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceW GetFileSize GetLogicalDrives UnhandledExceptionFilter SetUnhandledExceptionFilter SetErrorMode QueryPerformanceCounter QueryPerformanceFrequency HeapAlloc HeapFree GetProcessHeap InitializeCriticalSection EnterCriticalSection LeaveCriticalSection ReleaseMutex CreateMutexW GetCurrentProcess GetCurrentProcessId TerminateProcess OpenProcess GetSystemTime GetNativeSystemInfo LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW GlobalUnlock GlobalLock FormatMessageW lstrlenW SetDllDirectoryW VerifyVersionInfoW CreateToolhelp32Snapshot Process32FirstW Process32NextW ResetEvent GetSystemInfo GetFileAttributesExW GetProcessTimes GetStartupInfoW GetThreadTimes GlobalMemoryStatusEx GetProcessWorkingSetSize SetFileAttributesW GetFileType WriteConsoleW RaiseException VirtualProtect VirtualQuery LoadLibraryExA VirtualAlloc VirtualFree IsProcessorFeaturePresent ResumeThread GetStringTypeW EncodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RtlPcToFileHeader RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess SetStdHandle GetConsoleOutputCP GetConsoleMode GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime FindFirstFileExW GetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc HeapSize HeapQueryInformation GetFullPathNameW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW

Name

.text

Size

928KB

Virtual Size

927KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

401KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

37KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

VeraCryptExpander-x64.exe

kernel32

generic