VeroMacro[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VeroMacro.exe
Size 361KB
Sample260522-dsffssds7n
SHA256 cde1b60bf064624a39d2f6970f44564988e11094d8918b0d7d1a52fca876acd1
MD5 110b62cb5fbd3c28412bf3f49552c82d
SHA1 572c03e21976df6804f74ee22d5d44d339bbe8a7
SHA512 ff4a18a77c53aa00246eed65ad99852cf0b08c07678904c5882df09b2e06188203cd9fca956ef1a4dcf9f7dd828b0f874b3738bf2adc3e9f934372d8b2d64ee9
SSDEEP 6144:GT2IWuowZ9I72T1dDxE6+3m0l9lAxuMPE1itAAQsbRboeZUsZWmFYbaxbDJbPb4v:GT2IWNwZ9M2T3Dh+Wq0cUDQsbRboeZUR
TLSH
T191747D29F69408FAE16BC178CD62C502E7B17CCA476196CF37A40AA65F376D04E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VeroMacro.exe

File Explorer

VeroMacro.exe

.exe 361KB

VeroMacro.exe

IMPHASH acb4c724a454155040c699f125fb7254
SHA256 cde1b60bf064624a39d2f6970f44564988e11094d8918b0d7d1a52fca876acd1
MD5 110b62cb5fbd3c28412bf3f49552c82d
SHA1 572c03e21976df6804f74ee22d5d44d339bbe8a7
SHA512 ff4a18a77c53aa00246eed65ad99852cf0b08c07678904c5882df09b2e06188203cd9fca956ef1a4dcf9f7dd828b0f874b3738bf2adc3e9f934372d8b2d64ee9
SSDEEP 6144:GT2IWuowZ9I72T1dDxE6+3m0l9lAxuMPE1itAAQsbRboeZUsZWmFYbaxbDJbPb4v:GT2IWNwZ9M2T3Dh+Wq0cUDQsbRboeZUR
TLSH
T191747D29F69408FAE16BC178CD62C502E7B17CCA476196CF37A40AA65F376D04E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

118884

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

webview2loader

CreateCoreWebView2EnvironmentWithOptions

user32

GetMessageW TranslateMessage DispatchMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW FrameRect InvalidateRect EndPaint BeginPaint UpdateWindow GetSystemMetrics SetLayeredWindowAttributes CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW MapVirtualKeyA SendInput VkKeyScanA GetAsyncKeyState LoadCursorW GetDesktopWindow ScreenToClient GetWindowRect GetClientRect SetWindowPos ShowWindow

gdi32

SelectObject LineTo Ellipse DeleteObject CreateSolidBrush CreatePen GetStockObject MoveToEx

ole32

CoInitializeEx CoTaskMemFree

winmm

timeEndPeriod timeBeginPeriod

kernel32

GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo FlushFileBuffers GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx GetFileSizeEx GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc CreateFileW GetOEMCP InitializeSListHead LCMapStringW LoadLibraryExW VirtualProtect WideCharToMultiByte Beep QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentProcess SetThreadPriority SetPriorityClass GetModuleHandleW GetSystemTimePreciseAsFileTime CloseHandle GetLastError WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread IsProcessorFeaturePresent ExitProcess TerminateProcess GetProcAddress WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc OutputDebugStringW

Name

.text

Size

236KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

VeroMacro.exe

webview2loader

user32

gdi32

ole32

winmm

kernel32

generic