FuckVacAgain[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
FuckVacAgain.dll
Size 2.1MB
Sample260706-2l4f2sh14m
SHA256 af02612545e4f84920bad38b9fe5ec6c60d6bce656931afe215e42821eb6d319
MD5 466be4079e228e25f9d443df728cc0b7
SHA1 16ca585ddbe423d85fcfcb0e147ea3530e91d4f0
SHA512 15272ffde44d6432f498d36199ebb2b6a8f93b62ce66822728a97cebc2056f5ef1562672b780f95e00c86a02b39e1eb8acd565777a3ffdbc76da7968432c751b
SSDEEP 49152:46Vle7nD0RXAv/JedzLrDx5YKcNDAtjIEx6WdIny0V++:rCURSxedXodNkfx6WEi+
TLSH
T115A52255F9D29B78C5F2823417C341B0B08B24144CAA9FABF6FA9A017C72C9E624775F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FuckVacAgain.dll

File Explorer

FuckVacAgain.dll

.dll 2.1MB

FuckVacAgain.dll

IMPHASH 7b43ed892119923fba3d6b4febcda4f1
SHA256 af02612545e4f84920bad38b9fe5ec6c60d6bce656931afe215e42821eb6d319
MD5 466be4079e228e25f9d443df728cc0b7
SHA1 16ca585ddbe423d85fcfcb0e147ea3530e91d4f0
SHA512 15272ffde44d6432f498d36199ebb2b6a8f93b62ce66822728a97cebc2056f5ef1562672b780f95e00c86a02b39e1eb8acd565777a3ffdbc76da7968432c751b
SSDEEP 49152:46Vle7nD0RXAv/JedzLrDx5YKcNDAtjIEx6WdIny0V++:rCURSxedXodNkfx6WEi+
TLSH
T115A52255F9D29B78C5F2823417C341B0B08B24144CAA9FABF6FA9A017C72C9E624775F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4118233

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ntdll

RtlUnwindEx RtlPcToFileHeader RtlCaptureContext RtlVirtualUnwind NtProtectVirtualMemory NtAllocateVirtualMemory RtlLookupFunctionEntry RtlUnwind

kernel32

AreFileApisANSI GetEnvironmentStringsW HeapSize VirtualFree GetCurrentProcess GetSystemInfo VirtualQuery HeapCreate HeapFree Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot Sleep HeapReAlloc CloseHandle HeapAlloc HeapDestroy GetThreadContext GetProcAddress GetCurrentProcessId GetModuleHandleW FlushInstructionCache SetThreadContext OpenThread SetConsoleTextAttribute GetStdHandle SetConsoleTitleA AttachConsole FreeConsole GetConsoleWindow AllocConsole FindClose FindNextFileW GetLastError SetLastError MultiByteToWideChar WideCharToMultiByte GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetEndOfFile SetStdHandle GetProcessHeap OutputDebugStringW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead LocalFree FormatMessageA GetLocaleInfoEx FindFirstFileExW LCMapStringW QueryPerformanceFrequency InitOnceBeginInitialize InitOnceComplete GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo InterlockedFlushSList RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW IsDebuggerPresent UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent CreateFileW ReadFile GetConsoleMode ReadConsoleW WriteFile GetConsoleOutputCP ExitProcess FreeLibrary GetFileSizeEx SetFilePointerEx FlushFileBuffers VirtualProtect LoadLibraryExW FreeEnvironmentStringsW HeapAlloc HeapFree ExitProcess GetModuleHandleA LoadLibraryA GetProcAddress

user32

PostMessageW

ole32

CoTaskMemFree

Name

.text

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

382KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.#I5

Size

Virtual Size

636KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.=ly

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.#?n

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

FuckVacAgain.dll

ntdll

kernel32

user32

ole32

generic