vaxy_deepcheck_v51[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
vaxy_deepcheck_v51.exe
Size 1.1MB
Sample260710-blqbbacx81
SHA256 2d07635f03ae7f0ebac22e6a6d51329a0578def25a4cdf1624a8991c8a94a25a
MD5 8121e0c7a676f8352fc83c7e1006092b
SHA1 94441829caa960ffae498d2d821ab8710192b7d6
SHA512 49c80dbaa1244539b069f31f136352c36c4406d2f70113d7f727112c8c76fe0508dada50834236628e46ef6c76280f5d66390c8897a31dc3f9d054172ca8ed13
SSDEEP 12288:AO49ALSeT25eBmlOw7WZI0zNdU93K/jDdDiPKGSEdGtgYyKimcazM3t8OTmR1Bzu:DRT25eBmow7R+Nq93K/lXHcjt8OM1hc
TLSH
T17F353B1BE6B345E8C56FD0B487579772BE70B42902347D2E1EA4EB322F21E509B2E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vaxy_deepcheck_v51.exe

File Explorer

vaxy_deepcheck_v51.exe

.exe 1.1MB

vaxy_deepcheck_v51.exe

IMPHASH 04568d6784f277b50fdd818b2bec4b3b
SHA256 2d07635f03ae7f0ebac22e6a6d51329a0578def25a4cdf1624a8991c8a94a25a
MD5 8121e0c7a676f8352fc83c7e1006092b
SHA1 94441829caa960ffae498d2d821ab8710192b7d6
SHA512 49c80dbaa1244539b069f31f136352c36c4406d2f70113d7f727112c8c76fe0508dada50834236628e46ef6c76280f5d66390c8897a31dc3f9d054172ca8ed13
SSDEEP 12288:AO49ALSeT25eBmlOw7WZI0zNdU93K/jDdDiPKGSEdGtgYyKimcazM3t8OTmR1Bzu:DRT25eBmow7R+Nq93K/lXHcjt8OM1hc
TLSH
T17F353B1BE6B345E8C56FD0B487579772BE70B42902347D2E1EA4EB322F21E509B2E714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetTokenInformation OpenProcessToken RegCloseKey RegEnumKeyExA RegEnumValueA RegOpenKeyExA

kernel32

CloseHandle CreateFileW CreateHardLinkW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EnterCriticalSection FindFirstVolumeW FindNextVolumeW FindVolumeClose FormatMessageA GetCurrentProcess GetDiskFreeSpaceExW GetDriveTypeA GetEnvironmentVariableA GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLogicalDrives GetModuleHandleA GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetTempPathW GetThreadId GetTickCount GetVolumeInformationW InitializeConditionVariable InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryW LocalFree MoveFileExW MultiByteToWideChar OpenProcess Process32First Process32Next RaiseException ReadProcessMemory RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleTitleA SetEndOfFile SetFilePointer SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery VirtualQueryEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _close _commode _errno _findclose _fmode _fstat64 _get_osfhandle _initterm _localtime64 _lock _lseeki64 _onexit _telli64 _time64 _unlock _wchdir _wchmod _wfindnext64 _wfopen _wfullpath _wgetcwd _wmkdir _wopen _wstat64 _wutime64 abort calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getchar getenv isalnum iswctype localeconv malloc memchr memcmp memcpy memmove memset realloc setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm tolower towlower towupper vfprintf wcscat wcscmp wcscoll wcscpy wcsftime wcslen wcsxfrm _wfindfirst64 _write _read _fileno _fdopen

psapi

EnumProcessModulesEx GetModuleFileNameExA

user32

EnumWindows GetWindowTextA IsWindowVisible

Name

.text

Size

873KB

Virtual Size

873KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

vaxy_deepcheck_v51.exe

advapi32

kernel32

msvcrt

psapi

user32

generic