virtnetwork[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
virtnetwork.exe
Size 2.0MB
Sample260502-e3cckacz5k
SHA256 605096b9729bd8eedab460dbd4baf702029fb59842020a27fc0f99fd2ef63040
MD5 814d37f89ce49383a2022b9dcca637aa
SHA1 eb44914a6a8e2b603d4c73ca7855da52cb8fc93c
SHA512 54f25578c294668b4e35311219343217d7856d0a6b61ed16f622c5341798cc156445b941bd3189050c5fa9a12fe6b2f420f894cd80ca40b0e7d9cd57d60f5967
SSDEEP 24576:jqimp6QNXqsD2xTYvmrC8/InJgS8nJgtKlR7dxEpk:jqimv9qS2dY+rC/snJ6src
TLSH
T1CC957D3AB71482F2E64B81346A05A78383BB7C7A371170FAA17E12D41E5597A137E7F0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
virtnetwork.exe

File Explorer

virtnetwork.exe

.exe 2.0MB

virtnetwork.exe

IMPHASH 75012e94a9f8d4eefd3222a35dbe61c4
SHA256 605096b9729bd8eedab460dbd4baf702029fb59842020a27fc0f99fd2ef63040
MD5 814d37f89ce49383a2022b9dcca637aa
SHA1 eb44914a6a8e2b603d4c73ca7855da52cb8fc93c
SHA512 54f25578c294668b4e35311219343217d7856d0a6b61ed16f622c5341798cc156445b941bd3189050c5fa9a12fe6b2f420f894cd80ca40b0e7d9cd57d60f5967
SSDEEP 24576:jqimp6QNXqsD2xTYvmrC8/InJgS8nJgtKlR7dxEpk:jqimv9qS2dY+rC/snJ6src
TLSH
T1CC957D3AB71482F2E64B81346A05A78383BB7C7A371170FAA17E12D41E5597A137E7F0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

306924

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wrapper.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetProcAddress GetCommandLineW AllocConsole GetTickCount64 GetCurrentProcessId CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject CloseHandle Sleep GetModuleHandleA SwitchToThread QueryPerformanceCounter QueryPerformanceFrequency GetCurrentProcess GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc LoadLibraryA GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx lstrlenW CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW GetFullPathNameW CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW FindClose GetModuleHandleW FormatMessageW GetModuleFileNameW GetSystemTimePreciseAsFileTime SetFilePointerEx LoadLibraryExA FlushFileBuffers HeapSize GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlPcToFileHeader WriteFile ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW

ntdll

NtWriteFile RtlNtStatusToDosError

oleaut32

SysStringLen SysFreeString

Name

.text

Size

360KB

Virtual Size

359KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

virtnetwork.exe

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

oleaut32

generic