Vise[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Vise.exe
Size 1022KB
Sample260517-vgf2mae19m
SHA256 12f27975401cd9e423c13c78e202f0a3dc9c437988de838af935437d15631671
MD5 452dadbb19862e394a7bc18fa347441c
SHA1 58f52b7c789b950a5569f7719b4631f19846123b
SHA512 1a22425cdfeda2d3f752a9a91c6003709d259cd5ab788ea8ae366520cc58bafd01057ac7308dbf5969e0b855aeb7397beb2a32cc14e5f369e9c9e81b102528ae
SSDEEP 24576:BIYvI5yd9k4Y3z1GtxNST/XpZEpXlqBgtJ2PCZFl6b0UlQAMp:eGd9kVeSF41qBgtJ2PCZFl6b0UqAS
TLSH
T13825AF1A67A405E9C1B7D17CC6578617E7B270090371EBEF06E086A52F23BD16B3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Vise.exe

File Explorer

Vise.exe

.exe 1022KB

Vise.exe

IMPHASH bf9a2347f2ec72dda7f1aa5069e3719b
SHA256 12f27975401cd9e423c13c78e202f0a3dc9c437988de838af935437d15631671
MD5 452dadbb19862e394a7bc18fa347441c
SHA1 58f52b7c789b950a5569f7719b4631f19846123b
SHA512 1a22425cdfeda2d3f752a9a91c6003709d259cd5ab788ea8ae366520cc58bafd01057ac7308dbf5969e0b855aeb7397beb2a32cc14e5f369e9c9e81b102528ae
SSDEEP 24576:BIYvI5yd9k4Y3z1GtxNST/XpZEpXlqBgtJ2PCZFl6b0UlQAMp:eGd9kVeSF41qBgtJ2PCZFl6b0UqAS
TLSH
T13825AF1A67A405E9C1B7D17CC6578617E7B270090371EBEF06E086A52F23BD16B3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

779088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess GetCurrentProcessId CreateThread GetCurrentThreadId GetTickCount64 GetSystemDirectoryW VirtualProtect CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW AddDllDirectory SetDefaultDllDirectories QueryFullProcessImageNameW SetDllDirectoryW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection HeapReAlloc LocalFree QueryPerformanceCounter GetProcAddress LoadLibraryW SleepEx GetSystemInfo GetTickCount MultiByteToWideChar WideCharToMultiByte MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW GetFileSizeEx FormatMessageA GetLocaleInfoEx SleepConditionVariableSRW HeapAlloc HeapDestroy AddVectoredExceptionHandler GetLastError CloseHandle GetFileAttributesA LeaveCriticalSection CreateFileW GetCurrentDirectoryW CreateDirectoryW FindClose QueryPerformanceFrequency FreeLibrary SetUnhandledExceptionFilter FindFirstFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI OutputDebugStringW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime Sleep WakeAllConditionVariable GetFileInformationByHandleEx

user32

SendInput MessageBoxA GetAsyncKeyState

msvcp140

_Thrd_detach ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?fail@ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ _Cnd_do_broadcast_at_thread_exit ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Random_device@std@@YAIXZ ?_Xbad_function_call@std@@YAXXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Query_perf_frequency _Query_perf_counter _Xtime_get_ticks ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsFree DnsQuery_A

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr __C_specific_handler __current_exception_context __current_exception strchr memset memmove memcpy memcmp memchr _CxxThrowException strrchr __std_terminate __std_exception_copy __std_exception_destroy wcschr

api-ms-win-crt-runtime-l1-1-0

_initterm_e _c_exit abort _initterm __sys_nerr __sys_errlist _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo _get_initial_narrow_environment _beginthreadex _resetstkoflw __p___argv _errno _seh_filter_exe __p___argc _invoke_watson _set_app_type terminate _exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table exit _register_onexit_function _crt_atexit _cexit system

api-ms-win-crt-string-l1-1-0

isxdigit isspace tolower _stricmp strcmp strlen wcslen _wcsdup strcspn strncmp towlower strspn wcsncmp strpbrk wcsncpy _strdup wcspbrk

api-ms-win-crt-math-l1-1-0

_fdopen _dclass _dsign __setusermatherr

api-ms-win-crt-heap-l1-1-0

free calloc realloc malloc _callnewh _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtoll strtol strtod atoi strtoull strtoul wcstombs

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

fflush fclose _get_stream_buffer_pointers fgetpos fgets fputc fread fsetpos _fseeki64 fwrite _pclose _popen setvbuf ungetc __stdio_common_vsprintf _read _fileno _close __p__commode __acrt_iob_func fputs _set_fmode fseek ftell fgetc _lseeki64 __stdio_common_vsscanf _wopen _wfopen _write feof

api-ms-win-crt-filesystem-l1-1-0

_lock_file _wstat64 _unlink _unlock_file _fstat64

api-ms-win-crt-time-l1-1-0

_gmtime64 _localtime64 strftime _time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv

api-ms-win-crt-utility-l1-1-0

qsort

ws2_32

getsockname htons recv setsockopt socket WSAIoctl __WSAFDIsSet select accept getpeername listen recvfrom sendto ioctlsocket gethostname connect WSAStartup ntohl getaddrinfo freeaddrinfo WSACleanup bind inet_pton htonl inet_ntop getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSASetLastError WSAWaitForMultipleEvents closesocket WSAGetLastError ntohs

crypt32

CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertGetCertificateChain CertAddCertificateContextToStore CryptDecodeObjectEx CertOpenStore PFXImportCertStore CryptStringToBinaryW CertFindExtension CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertFreeCertificateChain

advapi32

CryptAcquireContextW CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptEncrypt CryptGetHashParam CryptReleaseContext ConvertSidToStringSidA CopySid SetSecurityInfo RegDeleteKeyA RegCreateKeyExA IsValidSid InitializeAcl GetTokenInformation OpenProcessToken AddAccessAllowedAce GetLengthSid CryptImportKey

shell32

ShellExecuteA