vService[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
vService.exe
Size 3.3MB
Sample260712-3fh4laby21
SHA256 8c22ece3be7102ecfaf72269cc8b937d9c632bac21fd919105216db99e7eb2ce
MD5 8a576399df1f4140b0ca9d1cfc72a980
SHA1 407dcc02f03956a4931a4fe6a6054fe7c0d501cc
SHA512 e7f4d9edb9948d9ab905e3b259c227e20e8e8918d466e183e0adfbe79204a595fc9a47481e04f2fd09532b22728ae823f2afcf60a8d1a6df3c9fcea87ca50755
SSDEEP 49152:0SThZjEoNhMxP5i3MLcAXZMPS7s8JyeaaTt:0iXNcrcAXps8JyeaaTt
TLSH
T144F5F84369DB0DE5CED677B861D72339A734FD718A291F2BAA08C5312D536C4AD2EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vService.exe

File Explorer

vService.exe

.exe 3.3MB

vService.exe

IMPHASH 45854eae0a04a8812eee5c361cb1b51b
SHA256 8c22ece3be7102ecfaf72269cc8b937d9c632bac21fd919105216db99e7eb2ce
MD5 8a576399df1f4140b0ca9d1cfc72a980
SHA1 407dcc02f03956a4931a4fe6a6054fe7c0d501cc
SHA512 e7f4d9edb9948d9ab905e3b259c227e20e8e8918d466e183e0adfbe79204a595fc9a47481e04f2fd09532b22728ae823f2afcf60a8d1a6df3c9fcea87ca50755
SSDEEP 49152:0SThZjEoNhMxP5i3MLcAXZMPS7s8JyeaaTt:0iXNcrcAXps8JyeaaTt
TLSH
T144F5F84369DB0DE5CED677B861D72339A734FD718A291F2BAA08C5312D536C4AD2EB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken

crypt32

CryptBinaryToStringA

kernel32

CancelIoEx CloseHandle ConnectNamedPipe CreateEventA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeW CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DisconnectNamedPipe DuplicateHandle EnterCriticalSection FileTimeToSystemTime FlushFileBuffers FormatMessageA GetCPInfo GetConsoleScreenBufferInfo GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetFileInformationByHandle GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessAffinityMask GetProcessTimes GetStdHandle GetSystemTimeAdjustment GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleTextAttribute SetConsoleTitleA SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleOutputCharacterA WriteFile

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _exit _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _get_osfhandle _initterm _localtime64 _lseeki64 _read _setjmp _setmode _strdup _time64 _vscprintf _vsnprintf _wcsicmp _wfopen _write abort atexit calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset putc putwc realloc setlocale setvbuf sscanf_s strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm system towupper ungetwc towlower ungetc vfprintf vswprintf_s wcscoll wcsftime wcslen wcsxfrm

user32

GetAsyncKeyState GetForegroundWindow

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

115KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

vService.exe

advapi32

crypt32

kernel32

msvcrt

user32

winhttp

generic