BROKEN_VX[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
BROKEN_VX.exe
Size 1.4MB
Sample260707-vtl4eaa18q
SHA256 83a72cd2810cbc53719f4114a8acfa7794dedca3ead73ba8a81514d7218c6893
MD5 a41a161dadba497e4c4854c54701a19c
SHA1 83225482c73a30a41d9e5775b1b1633a35c055e4
SHA512 1ed96e86632a937c3d50287a346f60dcd8fe55c0e8fc59a2cba0f1be972e3bf0ac6ed0bca9b3e2c6bbf831b0bd7143d72e38f602a442f73a721f6c88f5258f22
SSDEEP 24576:XlNX7tfb+1G+mAUBAU9BkEn0E7LHyPGbndJidn9i4OI1:HE1rmAUnednNV1
TLSH
T13F65088BE6F701F0D6BAE134F152722BF93134598738A7979BD14B4647A17A0A9BF300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BROKEN_VX.exe

File Explorer

BROKEN_VX.exe

.exe 1.4MB

BROKEN_VX.exe

IMPHASH da6bf5efb916bce93364619837b77af3
SHA256 83a72cd2810cbc53719f4114a8acfa7794dedca3ead73ba8a81514d7218c6893
MD5 a41a161dadba497e4c4854c54701a19c
SHA1 83225482c73a30a41d9e5775b1b1633a35c055e4
SHA512 1ed96e86632a937c3d50287a346f60dcd8fe55c0e8fc59a2cba0f1be972e3bf0ac6ed0bca9b3e2c6bbf831b0bd7143d72e38f602a442f73a721f6c88f5258f22
SSDEEP 24576:XlNX7tfb+1G+mAUBAU9BkEn0E7LHyPGbndJidn9i4OI1:HE1rmAUnednNV1
TLSH
T13F65088BE6F701F0D6BAE134F152722BF93134598738A7979BD14B4647A17A0A9BF300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

inecfected

Minor OS version

Major OS version

Entry point

940500

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmGetColorizationColor DwmEnableBlurBehindWindow DwmIsCompositionEnabled DwmSetWindowAttribute

shell32

ShellExecuteW SHGetFolderPathA ShellExecuteA

ole32

CoCreateInstance CoInitializeEx CreateStreamOnHGlobal CoUninitialize

advapi32

RegCloseKey RegSetValueExA RegCreateKeyExA

user32

ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseDC GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard ScreenToClient SetClipboardData CloseClipboard OpenClipboard LoadCursorA GetWindowRect SetWindowRgn UpdateWindow SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PostMessageW PeekMessageA DispatchMessageA TranslateMessage MonitorFromWindow SetProcessDPIAware GetClipboardData

kernel32

SetStdHandle CreateFileW HeapSize WriteConsoleW FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc GetFileAttributesExW CreateProcessW HeapFree WriteFile GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread CreateDirectoryA GetFileAttributesA ReadFile CloseHandle SetHandleInformation CreatePipe WaitForSingleObject GetExitCodeProcess CreateProcessA GetTickCount GetModuleFileNameA GetModuleHandleA LoadResource LockResource SizeofResource GlobalAlloc GlobalUnlock GlobalLock GlobalFree SetEndOfFile OutputDebugStringA IsValidCodePage WideCharToMultiByte VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer LCMapStringEx RtlUnwind GetSystemTimeAsFileTime GetModuleHandleW GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead LoadLibraryExW GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW GetCommandLineW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap MultiByteToWideChar FindResourceA RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

gdi32

DeleteObject CreateRectRgn CreateRoundRectRgn GetDeviceCaps

d3dcompiler_47

D3DCompile

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

195KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

BROKEN_VX.exe

d3d11

dwmapi

shell32

ole32

advapi32

user32

kernel32

imm32

gdi32

d3dcompiler_47

generic