valleyrat | acca258713692d82ea4b9bdf72dfa6dadc65083b1d37828bac0d2e6af6ba1712

Resubmissions

06/05/2026, 04:18

260506-ewxd6aev2j10

04/03/2026, 09:37

260304-llj5eafy4k8

Sharing

Copy URL Twitter E-mail

General

Target
acca258713692d82ea4b9bdf72dfa6dadc65083b1d37828bac0d2e6af6ba1712
Size 1.1MB
Sample260506-ewxd6aev2j
SHA256 acca258713692d82ea4b9bdf72dfa6dadc65083b1d37828bac0d2e6af6ba1712
MD5 267f48e174bdbece4235cf200dfc2503
SHA1 5bd82a88950e029312bcf55b1bb6528fe96a3046
SHA512 59707d95c00a96cb378aa5f4c9e2d883acab12a976db6bb0fa4c6550c0b981cee341f361cef22eea9b6f70106dfd4cd541d13b55ed30b236570990cef6727e58
SSDEEP 24576:60/bFJZqJXG4wSyhFYyw6fSfKYa2pnfkT+oCm1wzdPsCKlCnQ+dJGeP:hZqVBwS9ywfKYD86oCmyzdPsNCn3n
TLSH
T1D2453376E20548CCBF9DC5BF69C4B15ED3B66650A14C47E6F4B2DA1B512C09ACDC3E20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx valleyrat

Malware Config

Signatures

Family: valleyrat
valleyrat

https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign 1 IoCs

resource	yara_rule
static1/unpack002/out.upx	WinosStager

DLL Hijacking vulnerability 1 IoCs

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.

resource
unpack001/libvlc.dll

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/libvlc.dll	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/out.upx

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/libvlc.dll

File Explorer

acca258713692d82ea4b9bdf72dfa6dadc65083b1d37828bac0d2e6af6ba1712

.zip 1.1MB
502.exe

.exe 1021KB
libvlc.dll

.dll 796KB
out.upx

.dll 1.7MB

acca258713692d82ea4b9bdf72dfa6dadc65083b1d37828bac0d2e6af6ba1712

SHA256 acca258713692d82ea4b9bdf72dfa6dadc65083b1d37828bac0d2e6af6ba1712
MD5 267f48e174bdbece4235cf200dfc2503
SHA1 5bd82a88950e029312bcf55b1bb6528fe96a3046
SHA512 59707d95c00a96cb378aa5f4c9e2d883acab12a976db6bb0fa4c6550c0b981cee341f361cef22eea9b6f70106dfd4cd541d13b55ed30b236570990cef6727e58
SSDEEP 24576:60/bFJZqJXG4wSyhFYyw6fSfKYa2pnfkT+oCm1wzdPsCKlCnQ+dJGeP:hZqVBwS9ywfKYD86oCmyzdPsNCn3n
TLSH
T1D2453376E20548CCBF9DC5BF69C4B15ED3B66650A14C47E6F4B2DA1B512C09ACDC3E20
MD5 SHA1 SHA512 SSDEEP TLSH

502.exe

IMPHASH 132256f4cb40aaf8e829d1f1895bb3f9
SHA256 bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389
MD5 f0a4d5c3492115bfe2f346bc7bdce396
SHA1 bfcbdc7d0cbb92b68d348090fe9f381b4358a587
SHA512 8e4b2e1852fbc821cab4a7c16675afbfa2588472faa1848600829c415bfbee7cbf4713568ba15a76916e6c761d79b0fff7c5a1ae087aabd912bb7063d38a560a
SSDEEP 24576:uGKuKkPztKt9cHPrLRAqKBAy1N1UGAmnnnFnnnZnnnGnnnsddodt:uGKuKkPzgt9cHTLRAqK81k8
TLSH
T1A9254B1BE7A345EDC56FC13487A7C772AA30B86942347E2E1D95DB221F10E609F2E724
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Digest

ab:ed:19:a4:e3:f1:d7:a6:fb:d7:13:f0:cc:b9:3b:ec:84:e1:da:43:f3:6c:1e:8e:63:30:1f:71:e2:f1:12:c2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=VideoLAN,O=VideoLAN,L=Paris,C=FR

Chains

Dec 31, 2025

CN=VideoLAN,O=VideoLAN,L=Paris,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

42:ab:f3:4b:94:eb:f0:5f:f7:75:12:22:6f:19:41:de:be:ea:95:27

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=VideoLAN,O=VideoLAN,L=Paris,C=FR

Chains

Dec 31, 2025

CN=VideoLAN,O=VideoLAN,L=Paris,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=VideoLAN,O=VideoLAN,L=Paris,C=FR

Serial Number

09:d0:8e:bd:a0:6b:e0:7c:81:5e:a7:af:25:ef:68:75

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 7, 2024 - Jun 8, 2027

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Minor OS version

Major OS version

Entry point

5056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

libvlc

libvlc_add_intf libvlc_new libvlc_playlist_play libvlc_release libvlc_set_app_id libvlc_set_user_agent libvlc_wait

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext RegOpenKeyExW RegQueryValueExW

kernel32

CloseHandle CreateDirectoryW CreateFileW CreateSemaphoreW CreateThread DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessId GetStartupInfoA GetThreadContext HeapSetInformation InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar OpenThread RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetErrorMode SetEvent SetLastError SetNamedPipeHandleState SetUnhandledExceptionFilter Sleep SuspendThread TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe VirtualProtect VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno _exit _fileno fwprintf _fmode _fstat64 _initterm _ismbblead _lock _lseeki64 _onexit _setmode _snwprintf _unlock _wassert abort calloc exit fclose fflush fopen fprintf fputc fputs fputwc free fwrite iswctype localeconv malloc memchr memcmp memcpy memmove memset rand realloc setlocale setvbuf signal strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm towlower towupper vfprintf wcscmp wcscoll wcscpy wcsftime wcslen wcsncmp wcstol wcsxfrm _write _read _putenv _open _fileno _fdopen _close

shell32

CommandLineToArgvW SHGetFolderPathW

user32

MessageBoxW

wininet

HttpAddRequestHeadersW HttpOpenRequestW HttpQueryInfoW HttpSendRequestW InternetCloseHandle InternetConnectW InternetCrackUrlW InternetOpenW InternetQueryDataAvailable InternetReadFile InternetSetOptionW

Name

.text

Size

727KB

Virtual Size

727KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

66B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

libvlc.dll

SHA256 354fcbc4a16a8b47424bed435da1c040218b13ed9fa5392a5917a411b6947f4f
MD5 d1f691ef37c839d17567057a21b75bdb
SHA1 62b5a6c1a45868b2454544888aef9ce18b4367d7
SHA512 7ef0b6ff9b054552b895ea0ed89b4f39e9a30c7bc71c3d16b68658603e582a371964a85a6ab00f29fd1682585ce055b8334e3aa9e9e72dc25e1881c97c87188b
SSDEEP 24576:1LDxv2rSAf7zp/rT7grrq0smM3aGzgonU:1L9v22kzp/X7g3lsmMqGzgF
TLSH
T1800523DE1605E163FED70EB5E33A3EF228B819159B8906086D65C09C2DF1685D3C6F4E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

39:a1:9a:23:ca:3e:01:7b:c0:ed:c9:97:f4:01:aa:57:83:03:f5:cf:e3:d1:66:7c:ef:c3:5d:d2:3b:64:20:a0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TechVantage Ltd.,1.2.840.113549.1.9.1=#1300

Chains

Mar 3, 2026

CN=TechVantage Ltd.,1.2.840.113549.1.9.1=#1300

Subject

CN=TechVantage Ltd.,1.2.840.113549.1.9.1=#1300

Serial Number

6a:5e:1b:7b:33:65:6d:86:4b:f4:32:4b:72:92:c9:50

Issuer

CN=TechVantage Ltd.,1.2.840.113549.1.9.1=#1300

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 31, 2002 - Dec 30, 2099

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1825056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

LmNoPrSt QwErTyUiOp _2026_ libvlc_add_intf libvlc_audio_equalizer_get_amp_at_index libvlc_audio_equalizer_get_band_count libvlc_audio_equalizer_get_band_frequency libvlc_audio_equalizer_get_preamp libvlc_audio_equalizer_get_preset_count libvlc_audio_equalizer_get_preset_name libvlc_audio_equalizer_new libvlc_audio_equalizer_new_from_preset libvlc_audio_equalizer_release libvlc_audio_equalizer_set_amp_at_index libvlc_audio_equalizer_set_preamp libvlc_audio_filter_list_get libvlc_audio_get_channel libvlc_audio_get_delay libvlc_audio_get_mute libvlc_audio_get_track libvlc_audio_get_track_count libvlc_audio_get_track_description libvlc_audio_get_volume libvlc_audio_output_device_count libvlc_audio_output_device_enum libvlc_audio_output_device_get libvlc_audio_output_device_id libvlc_audio_output_device_list_get libvlc_audio_output_device_list_release libvlc_audio_output_device_longname libvlc_audio_output_device_set libvlc_audio_output_get_device_type libvlc_audio_output_list_get libvlc_audio_output_list_release libvlc_audio_output_set libvlc_audio_output_set_device_type libvlc_audio_set_callbacks libvlc_audio_set_channel libvlc_audio_set_delay libvlc_audio_set_format libvlc_audio_set_format_callbacks libvlc_audio_set_mute libvlc_audio_set_track libvlc_audio_set_volume libvlc_audio_set_volume_callback libvlc_audio_toggle_mute libvlc_chapter_descriptions_release libvlc_clearerr libvlc_clock libvlc_dialog_dismiss libvlc_dialog_get_context libvlc_dialog_post_action libvlc_dialog_post_login libvlc_dialog_set_callbacks libvlc_dialog_set_context libvlc_errmsg libvlc_event_attach libvlc_event_detach libvlc_event_type_name libvlc_free libvlc_get_changeset libvlc_get_compiler libvlc_get_fullscreen libvlc_get_input_thread libvlc_get_log_verbosity libvlc_get_version libvlc_log_clear libvlc_log_close libvlc_log_count libvlc_log_get_context libvlc_log_get_iterator libvlc_log_get_object libvlc_log_iterator_free libvlc_log_iterator_has_next libvlc_log_iterator_next libvlc_log_open libvlc_log_set libvlc_log_set_file libvlc_log_unset libvlc_media_add_option libvlc_media_add_option_flag libvlc_media_discoverer_event_manager libvlc_media_discoverer_is_running libvlc_media_discoverer_list_get libvlc_media_discoverer_list_release libvlc_media_discoverer_localized_name libvlc_media_discoverer_media_list libvlc_media_discoverer_new libvlc_media_discoverer_new_from_name libvlc_media_discoverer_release libvlc_media_discoverer_start libvlc_media_discoverer_stop libvlc_media_duplicate libvlc_media_event_manager libvlc_media_get_codec_description libvlc_media_get_duration libvlc_media_get_meta libvlc_media_get_mrl libvlc_media_get_parsed_status libvlc_media_get_state libvlc_media_get_stats libvlc_media_get_tracks_info libvlc_media_get_type libvlc_media_get_user_data libvlc_media_is_parsed libvlc_media_library_load libvlc_media_library_media_list libvlc_media_library_new libvlc_media_library_release libvlc_media_library_retain libvlc_media_list_add_file_content libvlc_media_list_add_media libvlc_media_list_count libvlc_media_list_event_manager libvlc_media_list_index_of_item libvlc_media_list_insert_media libvlc_media_list_is_readonly libvlc_media_list_item_at_index libvlc_media_list_lock libvlc_media_list_media libvlc_media_list_new libvlc_media_list_player_event_manager libvlc_media_list_player_get_media_player libvlc_media_list_player_get_state libvlc_media_list_player_is_playing libvlc_media_list_player_new libvlc_media_list_player_next libvlc_media_list_player_pause libvlc_media_list_player_play libvlc_media_list_player_play_item libvlc_media_list_player_play_item_at_index libvlc_media_list_player_previous libvlc_media_list_player_release libvlc_media_list_player_retain libvlc_media_list_player_set_media_list libvlc_media_list_player_set_media_player libvlc_media_list_player_set_pause libvlc_media_list_player_set_playback_mode libvlc_media_list_player_stop libvlc_media_list_release libvlc_media_list_remove_index libvlc_media_list_retain libvlc_media_list_set_media libvlc_media_list_unlock libvlc_media_new_as_node libvlc_media_new_callbacks libvlc_media_new_fd libvlc_media_new_from_input_item libvlc_media_new_location libvlc_media_new_path libvlc_media_parse libvlc_media_parse_async libvlc_media_parse_stop libvlc_media_parse_with_options libvlc_media_player_add_slave libvlc_media_player_can_pause libvlc_media_player_event_manager libvlc_media_player_get_agl libvlc_media_player_get_chapter libvlc_media_player_get_chapter_count libvlc_media_player_get_chapter_count_for_title libvlc_media_player_get_fps libvlc_media_player_get_full_chapter_descriptions libvlc_media_player_get_full_title_descriptions libvlc_media_player_get_hwnd libvlc_media_player_get_length libvlc_media_player_get_media libvlc_media_player_get_nsobject libvlc_media_player_get_position libvlc_media_player_get_rate libvlc_media_player_get_role libvlc_media_player_get_state libvlc_media_player_get_time libvlc_media_player_get_title libvlc_media_player_get_title_count libvlc_media_player_get_xwindow libvlc_media_player_has_vout libvlc_media_player_is_playing libvlc_media_player_is_seekable libvlc_media_player_navigate libvlc_media_player_new libvlc_media_player_new_from_media libvlc_media_player_next_chapter libvlc_media_player_next_frame libvlc_media_player_pause libvlc_media_player_play libvlc_media_player_previous_chapter libvlc_media_player_program_scrambled libvlc_media_player_release libvlc_media_player_retain libvlc_media_player_set_agl libvlc_media_player_set_android_context libvlc_media_player_set_chapter libvlc_media_player_set_equalizer libvlc_media_player_set_hwnd libvlc_media_player_set_media libvlc_media_player_set_nsobject libvlc_media_player_set_pause libvlc_media_player_set_position libvlc_media_player_set_rate libvlc_media_player_set_renderer libvlc_media_player_set_role libvlc_media_player_set_time libvlc_media_player_set_title libvlc_media_player_set_video_title_display libvlc_media_player_set_xwindow libvlc_media_player_stop libvlc_media_player_will_play libvlc_media_release libvlc_media_retain libvlc_media_save_meta libvlc_media_set_meta libvlc_media_set_state libvlc_media_set_user_data libvlc_media_slaves_add libvlc_media_slaves_clear libvlc_media_slaves_get libvlc_media_slaves_release libvlc_media_subitems libvlc_media_tracks_get libvlc_media_tracks_release libvlc_module_description_list_release libvlc_new libvlc_playlist_play libvlc_printerr libvlc_release libvlc_renderer_discoverer_event_manager libvlc_renderer_discoverer_list_get libvlc_renderer_discoverer_list_release libvlc_renderer_discoverer_new libvlc_renderer_discoverer_release libvlc_renderer_discoverer_start libvlc_renderer_discoverer_stop libvlc_renderer_item_flags libvlc_renderer_item_hold libvlc_renderer_item_icon_uri libvlc_renderer_item_name libvlc_renderer_item_release libvlc_renderer_item_type libvlc_retain libvlc_set_app_id libvlc_set_exit_handler libvlc_set_fullscreen libvlc_set_log_verbosity libvlc_set_user_agent libvlc_title_descriptions_release libvlc_toggle_fullscreen libvlc_toggle_teletext libvlc_track_description_list_release libvlc_track_description_release libvlc_video_filter_list_get libvlc_video_get_adjust_float libvlc_video_get_adjust_int libvlc_video_get_aspect_ratio libvlc_video_get_chapter_description libvlc_video_get_crop_geometry libvlc_video_get_cursor libvlc_video_get_height libvlc_video_get_logo_int libvlc_video_get_marquee_int libvlc_video_get_marquee_string libvlc_video_get_scale libvlc_video_get_size libvlc_video_get_spu libvlc_video_get_spu_count libvlc_video_get_spu_delay libvlc_video_get_spu_description libvlc_video_get_teletext libvlc_video_get_title_description libvlc_video_get_track libvlc_video_get_track_count libvlc_video_get_track_description libvlc_video_get_width libvlc_video_new_viewpoint libvlc_video_set_adjust_float libvlc_video_set_adjust_int libvlc_video_set_aspect_ratio libvlc_video_set_callbacks libvlc_video_set_crop_geometry libvlc_video_set_deinterlace libvlc_video_set_format libvlc_video_set_format_callbacks libvlc_video_set_key_input libvlc_video_set_logo_int libvlc_video_set_logo_string libvlc_video_set_marquee_int libvlc_video_set_marquee_string libvlc_video_set_mouse_input libvlc_video_set_scale libvlc_video_set_spu libvlc_video_set_spu_delay libvlc_video_set_subtitle_file libvlc_video_set_teletext libvlc_video_set_track libvlc_video_take_snapshot libvlc_video_update_viewpoint libvlc_vlm_add_broadcast libvlc_vlm_add_input libvlc_vlm_add_vod libvlc_vlm_change_media libvlc_vlm_del_media libvlc_vlm_get_event_manager libvlc_vlm_get_media_instance_length libvlc_vlm_get_media_instance_position libvlc_vlm_get_media_instance_rate libvlc_vlm_get_media_instance_time libvlc_vlm_pause_media libvlc_vlm_play_media libvlc_vlm_release libvlc_vlm_seek_media libvlc_vlm_set_enabled libvlc_vlm_set_input libvlc_vlm_set_loop libvlc_vlm_set_mux libvlc_vlm_set_output libvlc_vlm_show_media libvlc_vlm_stop_media libvlc_vprinterr libvlc_wait

out.upx

SHA256 684c8c769f6f6aa6ed3474c05f09fb049d9433241a8d13551b9cd469ab0b6261
MD5 ec84bd89e3a6f7cb4e2b52a23a4a9330
SHA1 20fdaf7daaa3fae87da236cb05804665ae5ce2f7
SHA512 dc034fc2d9c57925422f6586107bfb1ab6f31eeda51cdeefaeeaa47d1d851fcfd5ed631e4b670d36b143ea1d76c2ea89711452e2b05ae15ffc6cdaa062eeed8b
SSDEEP 24576:uS486MMIiLWpkwJAEDD4ph47ghzsRI7l+6S7S+m9lxyRIqRJIYDlvjwQUYrpJ:L6RLLCB8hQOJ+6S7ScI1ypcQUSJ
TLSH
T11385AF16FBAC00B5E0F79278C9678A46D2757C49536097DF03A81A9B1F379D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

98748

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

250KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

acca258713692d82ea4b9bdf72dfa6dadc65083b1d37828bac0d2e6af6ba1712

502.exe

libvlc

advapi32

kernel32

msvcrt

shell32

user32

wininet

generic

libvlc.dll

PE Signature issue

generic

out.upx

generic