winvnc[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
winvnc.exe
Size 3.2MB
Sample260701-17ppcafs9k
SHA256 6ca6ffbdc233c5f45633b629891608c968559313dc2bda6f943dca1af9cd437a
MD5 af2530224bb9453af9b78c028a04465b
SHA1 17d8d26cfdce85fed9ec51c853915965b73d3812
SHA512 11582e1d2629c24a0a94ea872b1ae713dde93b7774be1af914ffad410e85d58ae9d2647bc1aa8385bd45f263204b867a5e47d44f12bb640660dfefe3fb70656f
SSDEEP 49152:THM8RRNEnMsWgBu+yO4J5ELJL1SqRduZvYOY0i0UdnJAUA/Jl:YHjzyGOY054W
TLSH
T1EBF54946BA909499D2628434CC6ADA72D7723C0D03F556F771E4BAD73B3BAD13A36302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

winvnc.exe

.exe 3.2MB

winvnc.exe

IMPHASH e76f0f6959586860d304438e89e9cc9f
SHA256 6ca6ffbdc233c5f45633b629891608c968559313dc2bda6f943dca1af9cd437a
MD5 af2530224bb9453af9b78c028a04465b
SHA1 17d8d26cfdce85fed9ec51c853915965b73d3812
SHA512 11582e1d2629c24a0a94ea872b1ae713dde93b7774be1af914ffad410e85d58ae9d2647bc1aa8385bd45f263204b867a5e47d44f12bb640660dfefe3fb70656f
SSDEEP 49152:THM8RRNEnMsWgBu+yO4J5ELJL1SqRduZvYOY0i0UdnJAUA/Jl:YHjzyGOY054W
TLSH
T1EBF54946BA909499D2628434CC6ADA72D7723C0D03F556F771E4BAD73B3BAD13A36302
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

bd:bf:ad:05:69:80:98:9a:f5:85:6f:a2:94:42:af:e0:70:b0:a3:b6:d0:c5:14:bc:db:9c:eb:02:ed:d1:3b:d6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Open Source Developer\, Rudi De Vos,O=Open Source Developer,L=Antwerpen,ST=Antwerpen,C=BE

Chains

Jun 14, 2026

CN=Open Source Developer\, Rudi De Vos,O=Open Source Developer,L=Antwerpen,ST=Antwerpen,C=BE

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Open Source Developer\, Rudi De Vos,O=Open Source Developer,L=Antwerpen,ST=Antwerpen,C=BE

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Open Source Developer\, Rudi De Vos,O=Open Source Developer,L=Antwerpen,ST=Antwerpen,C=BE

Serial Number

73:5d:d6:d6:6c:4e:86:18:27:8a:06:74:b2:ec:0c:5f

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 26, 2025 - Sep 26, 2026

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

1552860

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\rudi\Desktop\git_ultravnc\winvnc\winvnc\x64\Release\winvnc.pdb

ws2_32

gethostbyname getaddrinfo WSAAddressToStringA htons htonl recvfrom socket sendto inet_ntoa gethostname inet_pton WSAStartup __WSAFDIsSet accept WSAIoctl select shutdown listen freeaddrinfo getpeername inet_addr getsockname send connect recv getsockopt setsockopt WSAGetLastError inet_ntop WSACleanup bind closesocket

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

wtsapi32

WTSEnumerateSessionsA WTSFreeMemory WTSQueryUserToken

userenv

ExpandEnvironmentStringsForUserA DestroyEnvironmentBlock CreateEnvironmentBlock

kernel32

UnmapViewOfFile OpenFileMappingA MapViewOfFile GetSystemDirectoryA GetSystemInfo GetComputerNameA Process32First CreateToolhelp32Snapshot ProcessIdToSessionId GlobalAddAtomA Process32NextW Process32Next Process32FirstW WTSGetActiveConsoleSessionId GetCurrentProcessId WinExec InitializeCriticalSectionAndSpinCount RaiseException DecodePointer CreateFileMappingA Sleep CreateThread MulDiv FindFirstFileW FindNextFileW GetModuleFileNameW LoadLibraryExW VerSetConditionMask VerifyVersionInfoW OpenProcess ReadFile SetDefaultDllDirectories WriteFile OutputDebugStringA LoadLibraryExA WaitForMultipleObjects GetEnvironmentVariableA WaitForSingleObject CreateFileW GetSystemDirectoryW SetCurrentDirectoryA SetDllDirectoryA lstrcatW LoadLibraryW SetFileAttributesA CreateEventA WaitNamedPipeW GetExitCodeProcess ResumeThread ResetEvent CompareFileTime CreateFileA GetFileSize GetFileTime GetStdHandle WriteConsoleA FreeConsole FormatMessageA AllocConsole SizeofResource FindResourceA LocalAlloc LockResource LoadResource LocalFree GetExitCodeThread CreateDirectoryW lstrlenW GetShortPathNameW GetDriveTypeA SetFileTime SetErrorMode SetFilePointer SetEndOfFile GetTempPathW GetFileAttributesW SetFileAttributesW OutputDebugStringW FileTimeToSystemTime GetDiskFreeSpaceExW DeleteFileW GetLogicalDriveStringsA MoveFileExW CopyFileA FindClose GetSystemTime MoveFileW FlushFileBuffers TerminateProcess VirtualAllocEx ReadProcessMemory SetThreadExecutionState VirtualFreeEx TerminateThread CreateMutexA ReleaseMutex MoveFileExA GlobalGetAtomNameA GlobalDeleteAtom GetModuleHandleW SetProcessShutdownParameters GetVolumeInformationA RemoveDirectoryW GetFileAttributesExW GetStringTypeW FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer InitializeCriticalSectionEx CreateSemaphoreA TlsGetValue TlsAlloc GetCurrentThread DuplicateHandle SetThreadPriority ReleaseSemaphore TlsSetValue SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable SetFilePointerEx VirtualQuery QueryPerformanceCounter GetFileSizeEx GetProcessTimes GetSystemTimeAsFileTime DeleteCriticalSection InitializeCriticalSection DeleteFileA SystemTimeToFileTime GetCPInfo RtlCaptureContext RtlLookupFunctionEntry FindFirstFileA RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent LeaveCriticalSection GetCurrentProcess EnterCriticalSection GetModuleHandleA CloseHandle GetVersionExA SetEvent GetLastError GetCurrentThreadId OpenEventA GetModuleFileNameA GetTickCount FreeLibrary GetProcessHeap GetProcAddress HeapAlloc LoadLibraryA lstrlenA SetLastError HeapFree VirtualProtect GetPrivateProfileStringA GetPrivateProfileIntA GetPrivateProfileStructA WritePrivateProfileStringA WritePrivateProfileStructA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc GlobalSize MultiByteToWideChar GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader FindNextFileA TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime ExitProcess HeapReAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode ReadConsoleW GetCurrentDirectoryW GetFullPathNameW SetStdHandle GetTimeZoneInformation FindFirstFileExW IsValidCodePage IsDebuggerPresent GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize WriteConsoleW RtlUnwind

user32

ModifyMenuA GetWindow VkKeyScanA GetAsyncKeyState MapVirtualKeyA ToAscii SendInput SetClipboardViewer GetClipboardOwner WaitMessage PostThreadMessageA ChangeClipboardChain SendNotifyMessageA PeekMessageA IsWindowVisible FillRect GetIconInfo GetClassNameA WindowFromPoint ChangeWindowMessageFilter EnumDesktopWindows SetRect DrawIconEx DestroyIcon GetKeyboardState MessageBeep FlashWindow EnumDisplaySettingsExA EnumDisplayDevicesA ChangeDisplaySettingsExA GetKeyState keybd_event EnumDisplaySettingsA LoadStringA ScreenToClient GetScrollInfo EnableMenuItem MoveWindow GetCursorPos ExitWindowsEx LockWorkStation SendMessageW LoadStringW IsWindow GetWindowTextA MapWindowPoints IsDlgButtonChecked SendDlgItemMessageA CreateDialogParamA GetDlgItemInt CheckDlgButton SetDlgItemInt EnableWindow DrawIcon SetLayeredWindowAttributes UpdateWindow GetMessageA LoadImageA DispatchMessageA DestroyMenu SetMenuDefaultItem GetSubMenu LoadMenuA EnumWindows GetWindowLongA SetWindowLongA TrackPopupMenuEx SetWindowPos ShowWindow SetTimer DrawTextA RemoveMenu GetDlgItemTextW SetWindowDisplayAffinity AdjustWindowRect DefWindowProcA IsRectEmpty CreateWindowExA TranslateMessage mouse_event GetClientRect PostQuitMessage RegisterClassExA BeginPaint EndPaint SystemParametersInfoA GetWindowThreadProcessId GetUserObjectInformationA PostMessageA RegisterWindowMessageA FindWindowExA OpenDesktopA MessageBoxA GetProcessWindowStation FindWindowA GetSystemMetrics DestroyWindow EndDialog DialogBoxParamA GetDlgItemTextA SetWindowTextA SetFocus SetDlgItemTextA LoadIconA SetForegroundWindow SetThreadDesktop GetThreadDesktop CloseDesktop GetForegroundWindow OpenInputDesktop GetDesktopWindow GetDC ReleaseDC wsprintfA RemovePropA SetPropA GetWindowRect LoadCursorA GetCapture ClientToScreen CallWindowProcA GetPropA SendMessageA SetCapture SetCursor GetDlgItem GetWindowLongPtrA GetParent SetWindowLongPtrA PtInRect ReleaseCapture InvalidateRect RegisterClipboardFormatW OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData IsClipboardFormatAvailable RedrawWindow KillTimer

gdi32

GetBitmapBits SetDIBColorTable GdiFlush RealizePalette SelectPalette CreatePalette SetBkColor ExtEscape GetSystemPaletteEntries SetRectRgn OffsetRgn CreateRectRgn GetRegionData PtInRegion CombineRgn GetRgnBox CreateFontA PatBlt StretchBlt GetStockObject GetClipBox SetBkMode CreatePen Rectangle CreateSolidBrush CreateDCA BitBlt CreateCompatibleBitmap GetObjectA DeleteObject CreateFontIndirectA SetTextColor DeleteDC GetPixel GetDeviceCaps GetDIBits CreateCompatibleDC SelectObject CreateDIBSection

advapi32

RegDeleteValueA SystemFunction036 RegOpenKeyExA RegCreateKeyExA SetSecurityInfo RegCreateKeyA GetSecurityDescriptorSacl SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorA SetSecurityDescriptorSacl InitializeSecurityDescriptor CreateServiceA AdjustTokenPrivileges StartServiceCtrlDispatcherA QueryServiceStatus RegDeleteKeyA SetTokenInformation LookupPrivilegeValueA SetServiceStatus RegisterServiceCtrlHandlerA DeleteService DuplicateTokenEx EqualSid AllocateAndInitializeSid OpenProcessToken FreeSid ImpersonateLoggedOnUser RevertToSelf CloseServiceHandle OpenSCManagerA GetUserNameA LookupAccountSidA QueryServiceStatusEx OpenServiceA GetTokenInformation CreateProcessAsUserA RegCloseKey RegQueryValueExA RegSetValueExA

shell32

Shell_NotifyIconW SHGetPathFromIDListW SHGetPathFromIDListA SHGetSpecialFolderLocation SHFileOperationW SHGetMalloc SHGetFolderPathA ShellExecuteA ShellExecuteExA

ole32

CoCreateInstance CoInitialize CoUninitialize

shlwapi

PathStripPathA

imm32

ImmGetDefaultIMEWnd

dwmapi

ord102 DwmIsCompositionEnabled

iphlpapi

GetAdaptersInfo

comctl32

InitCommonControlsEx ord17 ord345

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

489KB

Virtual Size

489KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

405KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

815KB

Virtual Size

814KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

winvnc.exe

ws2_32

version

wtsapi32

userenv

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

imm32

dwmapi

iphlpapi

comctl32

generic