LetsVPN[.]exe | Triage™

General

Target
LetsVPN.exe
Size 30.4MB
Sample260701-repdfahz2y
SHA256 b40c805adee587f29be6f98e986b92b11a545122703ab4eaea4b0fa3c3e02483
MD5 b08bef15760d186eaa84d7d841498479
SHA1 5bc427ec099e18056e052e57be56627158028323
SHA512 03d04394170ad4d0826ec164d04285100635f0744573ca745d246255a5b1268c9b8df6e9f89804acf38395fdc2309d937483b3c76892b1be09dd6f3ef6dad2b6
SSDEEP 786432:Tt/o9kq4o2+gfnzPE3dLVjI/J+wjIqFOtC3/6eJD:e4o2DzPKFgOqFOAvjJD
TLSH
T1EB671221F24AC13BE56901B1592D9A9F5129BF7A0B7140C7B3DC3E7E2BB54C21236E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LetsVPN.exe

File Explorer

LetsVPN.exe

.exe 30.4MB

LetsVPN.exe

IMPHASH 608505ff1e7e27ff4a42ea9c4e9f4192
SHA256 b40c805adee587f29be6f98e986b92b11a545122703ab4eaea4b0fa3c3e02483
MD5 b08bef15760d186eaa84d7d841498479
SHA1 5bc427ec099e18056e052e57be56627158028323
SHA512 03d04394170ad4d0826ec164d04285100635f0744573ca745d246255a5b1268c9b8df6e9f89804acf38395fdc2309d937483b3c76892b1be09dd6f3ef6dad2b6
SSDEEP 786432:Tt/o9kq4o2+gfnzPE3dLVjI/J+wjIqFOtC3/6eJD:e4o2DzPKFgOqFOAvjJD
TLSH
T1EB671221F24AC13BE56901B1592D9A9F5129BF7A0B7140C7B3DC3E7E2BB54C21236E1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2028553

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW CloseHandle WriteFile DeleteFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW CreateEventExW WaitForSingleObject CreateProcessW GetLastError GetExitCodeProcess SetEvent RemoveDirectoryW GetProcAddress GetModuleHandleW GetWindowsDirectoryW CreateDirectoryW GetTempPathW GetTempFileNameW MoveFileW EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW FindClose FindFirstFileW GetFullPathNameW InitializeCriticalSection lstrcpynW CreateThread LoadLibraryExW GetCurrentProcess Sleep WideCharToMultiByte GetDiskFreeSpaceExW DecodePointer GetExitCodeThread GetCurrentProcessId FreeLibrary GetSystemDirectoryW lstrlenW VerifyVersionInfoW VerSetConditionMask lstrcmpiW LoadLibraryW GetDriveTypeW CompareStringW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW GetShortPathNameW GetFinalPathNameByHandleW SetFileAttributesW GetFileTime CopyFileW ReadFile SetFilePointer SetFileTime SystemTimeToFileTime MultiByteToWideChar GetSystemInfo WaitForMultipleObjects GetVersionExW VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW LocalFree LocalAlloc SetUnhandledExceptionFilter FileTimeToSystemTime GetEnvironmentVariableW GetSystemTime GetDateFormatW GetTimeFormatW GetLocaleInfoW CreateToolhelp32Snapshot Process32FirstW Process32NextW FormatMessageW GetEnvironmentStringsW InitializeCriticalSectionEx LoadLibraryA GetModuleFileNameA GetCurrentThread GetConsoleOutputCP FlushFileBuffers Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection IsWow64Process SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo OutputDebugStringW GetTickCount GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetSystemDefaultLangID GetUserDefaultLangID GetLocalTime ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW CreateNamedPipeW ConnectNamedPipe TerminateThread CompareFileTime CopyFileExW OpenEventW PeekNamedPipe WaitForSingleObjectEx QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW EncodePointer LCMapStringEx CompareStringEx GetCPInfo GetSystemTimeAsFileTime IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree UnhandledExceptionFilter TerminateProcess GetStartupInfoW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetFileType LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetConsoleMode GetFileSizeEx SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle ReadConsoleW WriteConsoleW GetProcessAffinityMask GetModuleHandleA GlobalMemoryStatus ReleaseSemaphore CreateSemaphoreW

Sharing