VALI URGE No FVE 9548 ABRIL 10 DEL 2024.tar
- SHA256 5008e38b7877d9c70a4fd7c48b2b3f6a4b9967ead50e91eff4a5deb59e7d95ff
Password
7090
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VALI URGE No FVE 9548 ABRIL 10 DEL 2024.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
VALI URGE No FVE 9548 ABRIL 10 DEL 2024.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target VALI URGE No FVE 9548 ABRIL 10 DEL 2024.tar
- Size 21.7MB
- Sample260403-eem46acy7w
- SHA256 5008e38b7877d9c70a4fd7c48b2b3f6a4b9967ead50e91eff4a5deb59e7d95ff
- MD5 105e34480e40d30724c59721e93ddfac
- SHA1 e473a34e9c14bff3599d1be6d56c768025e15441
- SHA512 6c3efc8372009af5508d0900e87203acb71b2d880c5f72b87860fcdcb149b753a5ae61373175d95689a6618c7c0d7a416e93f7910ba0516bc6bcd68dc689adf0
- SSDEEP 393216:gkq5tRLwvFGAmn/T9DvmEwiixLLVEYaVyDxppRwFK3q5hNBqY5H/5RLlc95rIo:gkqn2NG7T96B2VyVpTw15hNUY895r1
- TLSH T1553733F16B152CC82B7442F9928BF0DB9120DE4848960FC646AF4F7DF517247B76A2E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/VALI URGE No FVE 9548 ABRIL 10 DEL 2024.exe
File Explorer
-
VALI URGE No FVE 9548 ABRIL 10 DEL 2024.tar.rar 21.7MB
-
VALI URGE No FVE 9548 ABRIL 10 DEL 2024.exe.exe 70.2MB
VALI URGE No FVE 9548 ABRIL 10 DEL 2024.exe
- IMPHASH f927eaf33697ff09bd91c22dbec949ec
- SHA256 95aa22d791731eee133ea016387abc2fe02547643e50328ad2cd0464104ccd20
- MD5 a9b2503d832d58655c38082c52ce6a73
- SHA1 b1797fd85f8d8c2f11274747565ed41be5900cd5
- SHA512 e35f5d823cd7205304f1969a53b06e36727d3366d3b4d54e54295e2368612c0e01e8398e9096727226de3737a5f028ae29e5ef9cdfe2d72c2dba8bd7c87c908b
- SSDEEP 1572864:x5w5eNmll2Ca9N41CGwqxRXL/A3mGmkAOTIJsbXCt2X3M8VXDs09Dl:LYqV5
- TLSH T188F74C3071C68066D882A1B16728467AC7BC9D560F6CA4CF5194FD3F2927FF32A36B61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
Password
7090
PE Signature issue
Digest
d4:56:1a:0c:57:b8:9c:3c:e0:fb:56:47:cb:de:7f:29:da:18:a8:99
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Heidi Computers Ltd,O=Heidi Computers Ltd,L=Greystones,ST=Co Wicklow,C=IE
Chains
Aug 28, 2016
CN=Heidi Computers Ltd,O=Heidi Computers Ltd,L=Greystones,ST=Co Wicklow,C=IE
CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:31:89:c6:37:e8
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 2, 2011 - Aug 2, 2019
Subject
CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 8, 2016 - May 30, 2027
Subject
CN=Heidi Computers Ltd,O=Heidi Computers Ltd,L=Greystones,ST=Co Wicklow,C=IE
Serial Number
11:21:e8:97:e6:81:2d:74:23:21:d3:08:ea:46:e4:35:69:a1
Issuer
CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 2, 2015 - Oct 2, 2016
Minor OS version
0
Major OS version
6
Entry point
50339696
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\WS\tv_prel_dcr\build_cmake_win\FULL\Release\TeamViewer.pdb
dbghelp
SymInitialize
SymGetOptions
SymSetOptions
SymFromAddr
kernel32
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
GetSystemDirectoryA
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSectionEx
GetModuleFileNameW
DeleteCriticalSection
SetLastError
GetCurrentThreadId
RaiseException
WideCharToMultiByte
LocalFree
FormatMessageW
FormatMessageA
SetEvent
CreateEventW
CreateMutexW
ReleaseMutex
CloseHandle
CreateFileW
WaitForMultipleObjects
WaitForSingleObject
PostQueuedCompletionStatus
TerminateThread
QueueUserAPC
DecodePointer
CreateEventA
GetTickCount
GetUserDefaultLCID
GetStringTypeExW
LCMapStringW
LoadLibraryA
FreeLibrary
GetSystemTimeAsFileTime
UnregisterWaitEx
RegisterWaitForSingleObject
InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
SetWaitableTimer
SleepEx
CreateIoCompletionPort
CreateWaitableTimerW
UnregisterWait
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ResetEvent
MulDiv
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GlobalAlloc
GlobalFree
GlobalSize
GlobalLock
GlobalUnlock
DeleteFileW
FindFirstFileW
GetFileAttributesW
FindClose
VerifyVersionInfoW
VerSetConditionMask
GetCommandLineW
ExpandEnvironmentStringsW
WriteFile
ReadFile
SetErrorMode
SetProcessShutdownParameters
GetCurrentProcessId
ReleaseSemaphore
WaitForSingleObjectEx
CreateDirectoryW
DuplicateHandle
CreateSemaphoreA
MoveFileExW
GetTempPathW
GetUserGeoID
GetGeoInfoW
GetLocaleInfoW
GlobalMemoryStatusEx
GetComputerNameW
MoveFileW
GetStringTypeExA
LCMapStringA
FileTimeToSystemTime
GetLocalTime
SystemTimeToFileTime
SetFilePointer
GetFileInformationByHandle
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
LocalAlloc
GetCurrentDirectoryW
MultiByteToWideChar
LocalFileTimeToFileTime
SetFileTime
GetTempFileNameW
GetNativeSystemInfo
GetSystemPowerStatus
GetModuleHandleW
GetProcAddress
lstrcmpiW
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetProcessId
ProcessIdToSessionId
OpenEventW
IsWow64Process
InitializeCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
OpenProcess
FindNextFileW
WaitNamedPipeW
ResumeThread
CreateProcessW
TerminateProcess
K32GetModuleBaseNameW
QueryFullProcessImageNameW
K32GetModuleFileNameExW
K32EnumProcesses
GetExitCodeProcess
GetSystemInfo
GetCurrentThread
SetThreadPriority
lstrlenW
GlobalReAlloc
GetTimeFormatW
LockResource
FindResourceExW
CopyFileW
SetSearchPathMode
SetDllDirectoryW
HeapSetInformation
SetProcessDEPPolicy
GetSystemDirectoryW
LoadLibraryW
GetSystemTime
GetTimeZoneInformation
GetDateFormatW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetVersion
GetProcessTimes
SetPriorityClass
GetPriorityClass
GetVersionExW
GetConsoleTitleW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
CreateSemaphoreW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetFullPathNameW
CompareStringW
GetNumberFormatW
GetCurrencyFormatW
GetSystemDefaultLCID
OutputDebugStringW
GetTempPathA
GetTempFileNameA
GetCPInfo
TransactNamedPipe
DebugBreak
SetEndOfFile
FlushViewOfFile
SetHandleInformation
SetFileCompletionNotificationModes
CancelIoEx
CancelIo
SwitchToThread
SetConsoleCtrlHandler
GetFileType
GetConsoleMode
CreateFileA
FlushFileBuffers
ConnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
GetNamedPipeHandleStateW
CancelSynchronousIo
QueueUserWorkItem
CreateNamedPipeA
SetConsoleMode
GetNumberOfConsoleInputEvents
ReadConsoleInputW
ReadConsoleW
WriteConsoleW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
WriteConsoleInputW
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
GetDiskFreeSpaceW
GetFileSizeEx
RemoveDirectoryW
SetFilePointerEx
DeviceIoControl
ReOpenFile
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
GetLongPathNameW
GetShortPathNameW
ReadDirectoryChangesW
GetStdHandle
GetStartupInfoW
CreateThread
CompareFileTime
VirtualAlloc
VirtualProtect
VirtualFree
GetModuleHandleExW
GetACP
ReadConsoleA
GetExitCodeThread
GetOverlappedResult
K32EnumProcessModules
GetSystemFirmwareTable
OpenMutexW
CreateFileMappingA
OpenFileMappingA
MapViewOfFileEx
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemDefaultLangID
lstrcmpW
OutputDebugStringA
InitOnceExecuteOnce
GetTickCount64
VirtualQuery
Module32FirstW
Module32NextW
GetThreadId
AreFileApisANSI
HeapCreate
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
GetVersionExA
DeleteFileA
HeapCompact
UnlockFile
LockFileEx
GetDriveTypeW
GetLogicalDriveStringsW
GetVolumeInformationW
SetFileAttributesW
CreatePipe
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
IsDebuggerPresent
OpenEventA
OpenThread
GetComputerNameExA
GetComputerNameExW
SetUnhandledExceptionFilter
GetPrivateProfileIntW
GetPrivateProfileSectionW
GetEnvironmentVariableA
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
LCIDToLocaleName
GetDiskFreeSpaceExW
WTSGetActiveConsoleSessionId
GetThreadTimes
GetDynamicTimeZoneInformation
GetLogicalProcessorInformationEx
Sleep
LocalSize
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
GetStringTypeW
FindFirstFileExW
SetFileInformationByHandle
CreateDirectoryExW
GetLocaleInfoEx
InitOnceBeginInitialize
InitOnceComplete
SleepConditionVariableSRW
LCMapStringEx
CompareStringEx
GetFileTime
GetWindowsDirectoryW
CopyFileExW
WaitForMultipleObjectsEx
CreateWaitableTimerA
UnhandledExceptionFilter
RtlUnwind
ExitThread
FreeLibraryAndExitThread
SetStdHandle
GetConsoleOutputCP
ExitProcess
IsValidLocale
EnumSystemLocalesW
IsValidCodePage
GetOEMCP
GetCommandLineA
SetThreadExecutionState
GetSystemTimes
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
imm32
ImmNotifyIME
ImmGetCompositionStringW
ImmAssociateContextEx
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmSetCandidateWindow
Name
.text
Size
52.6MB
Virtual Size
52.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
IPPCODE
Size
262KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10.9MB
Virtual Size
10.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5.6MB
Virtual Size
8.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rodata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
CPADinfo
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
820KB
Virtual Size
820KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=253, version=31823,
count=20, id=260, version=31823,
count=30, id=259, version=31823,
count=55, id=259, version=30795,
count=123, id=261, version=31823,
count=63, id=205, version=50522,
count=1, id=263, version=30795,
count=235, id=261, version=30795,
count=77, id=260, version=30795,
count=4, id=262, version=30795,
count=2, id=171, productName=VS2010 build 30319, version=30319,
count=7, id=257, version=30795,
count=2, id=259, version=31947,
count=1030, productName=Unmarked objects (old),
count=1407, id=260, version=31947,
count=713, id=261, version=31947,
count=1395, id=1, productName=Unmarked objects,
count=8672, id=265, version=31947,
count=1, id=255, version=31947,
count=1, id=151,
count=1, id=258, version=31947,