Vyral[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Vyral.exe
Size 8.9MB
Sample260624-bzmgkshx4x
SHA256 b7e8562054d9d9a1e19c8d5a8263ec8fe44a8590dfca23aa74327614df14d030
MD5 3aea639270faeaa4ab44c6195fc73d2c
SHA1 1567cbaba05ba3dce7327f3e6e3d966cf0544254
SHA512 5d5ce493f8db77edff37fff1d5c9b05bfea2ce4f3e1c1b658e13758471f82c909bcfa4932cbeda5c5b0028c6e7a74c43ff85a9f1f810a48be7e0462caeaad2ec
SSDEEP 196608:l+LKL8+3AZVGDmGQ1unzMuyfhSk8TeUhsjpz:lIZ+dDmlyLyJS9
TLSH
T14D96F106E2A742A9DF62973884569327E6B07CC50370C7C767DC4D616FA3AF0AABD710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Vyral.exe

File Explorer

Vyral.exe

.exe 8.9MB

Vyral.exe

IMPHASH 1a9fa6cf070ba13ec1b90bf9dae17815
SHA256 b7e8562054d9d9a1e19c8d5a8263ec8fe44a8590dfca23aa74327614df14d030
MD5 3aea639270faeaa4ab44c6195fc73d2c
SHA1 1567cbaba05ba3dce7327f3e6e3d966cf0544254
SHA512 5d5ce493f8db77edff37fff1d5c9b05bfea2ce4f3e1c1b658e13758471f82c909bcfa4932cbeda5c5b0028c6e7a74c43ff85a9f1f810a48be7e0462caeaad2ec
SSDEEP 196608:l+LKL8+3AZVGDmGQ1unzMuyfhSk8TeUhsjpz:lIZ+dDmlyLyJS9
TLSH
T14D96F106E2A742A9DF62973884569327E6B07CC50370C7C767DC4D616FA3AF0AABD710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

741392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

bcrypt

BCryptEncrypt BCryptDestroyKey BCryptGetProperty BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDecrypt

ntdll

VerSetConditionMask

kernel32

GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter CreateFileW GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection CreateThread VirtualProtect CreateFileMappingW MapViewOfFile UnmapViewOfFile OutputDebugStringW GetModuleFileNameW GetModuleHandleW GetCurrentThread SetLastError FormatMessageA LocalFree EnterCriticalSection LeaveCriticalSection SleepEx GlobalAlloc GetTickCount MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetFileSizeEx AreFileApisANSI MultiByteToWideChar CheckRemoteDebuggerPresent GetComputerNameA IsDebuggerPresent VirtualQuery GetDiskFreeSpaceExA ExitProcess GetProcAddress GetThreadContext CreateFileA GetTickCount64 GetTempPathA Sleep GetModuleHandleA GetVolumeInformationA DeviceIoControl GetCurrentProcess GetSystemFirmwareTable GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GlobalFree GetSystemInfo CloseHandle VerifyVersionInfoA GetSystemDirectoryA CreateFile2 GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime QueryFullProcessImageNameW InitializeSListHead GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW GetModuleFileNameA GetFileAttributesExW

user32

SetCursor ClientToScreen GetCapture GetCursorPos ReleaseCapture FindWindowA GetKeyState PostQuitMessage SetCapture GetForegroundWindow TranslateMessage MessageBoxA PeekMessageW DispatchMessageW RegisterClassExW UnregisterClassW GetMessageExtraInfo ScreenToClient LoadCursorW TrackMouseEvent GetClientRect IsWindowUnicode SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW GetWindowRect DestroyWindow SetWindowPos SetWindowRgn CreateWindowExW GetSystemMetrics

gdi32

CreateSolidBrush

advapi32

CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA ConvertSidToStringSidA CopySid SetSecurityInfo IsValidSid InitializeAcl GetTokenInformation GetLengthSid AddAccessAllowedAce OpenProcessToken GetUserNameA CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt

shell32

ShellExecuteA

msvcp140

?id@?$ctype@D@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Xtime_get_ticks ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?uncaught_exception@std@@YA_NXZ ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ??Bid@locale@std@@QEAA_KXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?setf@ios_base@std@@QEAAHHH@Z ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xbad_function_call@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

normaliz

IdnToAscii

wldap32

ord30 ord79 ord200 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord143 ord301 ord217 ord35

crypt32

CryptStringToBinaryA CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertFindExtension PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertGetNameStringA

ws2_32

recv ntohl gethostname sendto recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind send WSAGetLastError closesocket

shlwapi

PathFindFileNameW

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __std_terminate strchr __std_exception_destroy strstr __C_specific_handler _CxxThrowException memchr memcmp memcpy memmove __current_exception_context __current_exception strrchr memset

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode realloc free _callnewh calloc

api-ms-win-crt-utility-l1-1-0

qsort rand srand

api-ms-win-crt-stdio-l1-1-0

fgets ftell fclose fputc fgetc fsetpos _lseeki64 _fseeki64 _pclose _popen setvbuf _set_fmode ungetc feof _get_stream_buffer_pointers fputs __p__commode fseek _read _write __stdio_common_vfprintf _wfopen _close _open fopen fflush fwrite __acrt_iob_func fgetpos __stdio_common_vsprintf fread fopen_s __stdio_common_vsscanf

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _stat64 remove _lock_file _unlink _unlock_file _access rename

api-ms-win-crt-runtime-l1-1-0

strerror __sys_nerr _beginthreadex _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _resetstkoflw _errno terminate exit system _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _getpid _set_app_type _seh_filter_exe _cexit abort _crt_atexit _initialize_onexit_table _register_onexit_function

api-ms-win-crt-string-l1-1-0

_strdup strspn strcspn strcmp strpbrk tolower strncmp strncpy strlen isupper

api-ms-win-crt-convert-l1-1-0

strtoul strtoull strtoll strtol strtod atoi

api-ms-win-crt-math-l1-1-0

acosf cosf ceilf sinf fmodf _dsign sqrtf __setusermatherr _dclass powf

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_localtime64 _gmtime64 strftime _time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func