vanguard emulator (3)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
vanguard emulator (3).exe
Size 63.6MB
Sample260710-arprascv8y
SHA256 d052bd4d46d91be3ae984d0bad85bc5cf673392109b2e212954d8fa477506e45
MD5 cb1d46bbf0de6896c96982496809a823
SHA1 45475ca4cf45df103565e148de3b641e67b5ebc1
SHA512 a57e063a4ce60025897635d54f84cc4c92b9caeadb048178cabdb8181faff67dc73e7a585c4c9cff4fe5178be63902aed61bd588652d8e5d9d008618edac4f4e
SSDEEP 786432:Q9xridiXUJvmWj2IU7Uprpk8IWkjOMKYm+wHDwB:Q9xridiXwvmWj2IU7UprOfoHD
TLSH
T196E7724C24500AE9925BE815EAA7CF1B5FE9D6DB5BE8244DBCA88E340CD3CB71D1074B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vanguard emulator (3).exe

File Explorer

vanguard emulator (3).exe

.exe 63.6MB

vanguard emulator (3).exe

IMPHASH 17350f9b339eb9d4c05731ab4620d2c5
SHA256 d052bd4d46d91be3ae984d0bad85bc5cf673392109b2e212954d8fa477506e45
MD5 cb1d46bbf0de6896c96982496809a823
SHA1 45475ca4cf45df103565e148de3b641e67b5ebc1
SHA512 a57e063a4ce60025897635d54f84cc4c92b9caeadb048178cabdb8181faff67dc73e7a585c4c9cff4fe5178be63902aed61bd588652d8e5d9d008618edac4f4e
SSDEEP 786432:Q9xridiXUJvmWj2IU7Uprpk8IWkjOMKYm+wHDwB:Q9xridiXwvmWj2IU7UprOfoHD
TLSH
T196E7724C24500AE9925BE815EAA7CF1B5FE9D6DB5BE8244DBCA88E340CD3CB71D1074B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

55802912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\7\Desktop\all my s\vgc emulator5\vgc emulator\x64\Release\vanguard emulator.pdb

kernel32

DisconnectNamedPipe OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW Process32FirstW CloseHandle GetSystemInfo CancelIoEx GetLocalTime ExitProcess ReadProcessMemory SystemTimeToFileTime GetSystemTimeAsFileTime SetConsoleCursorPosition IsDebuggerPresent ConnectNamedPipe VirtualQueryEx GetComputerNameA CheckRemoteDebuggerPresent FlushFileBuffers GetCurrentProcessId QueryPerformanceCounter FindClose GetEnvironmentVariableA FindNextFileA CreateNamedPipeW WriteFile WriteConsoleA GetStdHandle SetUnhandledExceptionFilter WakeAllConditionVariable UnmapViewOfFile MapViewOfFile CreateFileMappingA GetCurrentProcess VirtualProtect VirtualQuery VirtualFree VirtualAlloc RemoveVectoredExceptionHandler GetThreadContext GetTickCount VirtualAllocEx SetFilePointer CreateFileA GetSystemDirectoryA VirtualFreeEx GetModuleHandleW IsWow64Process GetProcAddress GetModuleHandleA DuplicateHandle HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetProcessHeap RaiseException LoadLibraryA AddVectoredExceptionHandler K32GetModuleInformation LocalFree DecodePointer DeleteCriticalSection InitializeCriticalSectionEx GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive OutputDebugStringW SetConsoleTitleA SetConsoleTextAttribute GetConsoleScreenBufferInfo FindFirstFileA SetConsoleCtrlHandler FillConsoleOutputCharacterA GetModuleFileNameA InitializeSListHead GetFileSize ReadFile

user32

FindWindowA UnregisterClassA

advapi32

InitializeSecurityDescriptor LookupAccountSidA CopySid GetLengthSid IsValidSid GetTokenInformation OpenThreadToken ConvertSidToStringSidA GetUserNameA AdjustTokenPrivileges LookupPrivilegeValueW SetSecurityDescriptorDacl OpenProcessToken

msvcp140

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z __crtLCMapStringA _Mtx_trylock _Strxfrm _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Strcoll _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Xtime_get_ticks _Mtx_unlock ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

winhttp

WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpOpen WinHttpReceiveResponse WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpQueryHeaders WinHttpSetTimeouts WinHttpConnect

crypt32

CryptBinaryToStringA

shlwapi

ord215

userenv

UnloadUserProfile

ntdll

NtMapViewOfSection RtlImageNtHeader NtClose NtCreateSection NtUnmapViewOfSection

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memcmp memcpy __current_exception __C_specific_handler strchr __std_terminate __std_type_info_compare __current_exception_context __std_exception_destroy memset __std_exception_copy __RTtypeid _CxxThrowException

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s fwrite fgetpos fflush setvbuf ungetc fsetpos __stdio_common_vsscanf _fseeki64 fclose _get_stream_buffer_pointers __p__commode __stdio_common_vsprintf_s _set_fmode fputc fread fgetc __stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

realloc free _recalloc calloc malloc _callnewh _set_new_mode

api-ms-win-crt-string-l1-1-0

strlen wcscmp wcsncpy_s tolower strnlen strncmp strcpy strcat isalnum _wcsicmp towlower wcslen

api-ms-win-crt-runtime-l1-1-0

_invoke_watson __p___argv __p___argc system _c_exit _resetstkoflw _errno _exit terminate exit _initterm_e _beginthreadex _invalid_parameter_noinfo _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _initterm _register_onexit_function _get_initial_narrow_environment _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _cexit _crt_atexit

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_locale_name_func ___lc_collate_cp_func

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

__setusermatherr