VSSVC-6C8F0C66[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
VSSVC-6C8F0C66.exe
Size 8.2MB
Sample260718-xxe6dady2x
SHA256 5360127988817cafa7d151c143c36798334afea654ebe6c05ca7d644eb678532
MD5 96c0c4226833af72eb7b7fff4f1b9837
SHA1 e7e65ae5cd883ad267726de7dacee7fca1afd732
SHA512 aeae1b14aae4e1bee375d14e680d408c39e2c14d8eacfab6b41ec18376f09f783307ac3c2ff5337ee93c78d206d1f7441ac11b755056ae0735ecd6ea8bb9ec41
SSDEEP 196608:qu6pRMBUk0GtaqG0xiz/abGBiIQ/vOhr7Fvk:q+zaemeG0L/vOV+
TLSH
T15386CF60A6AC4A9DF036B039C1975617A7F17C0D1730CFCB96D09DAB0E2F6E0B56A709
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VSSVC-6C8F0C66.exe

File Explorer

VSSVC-6C8F0C66.exe

.exe 8.2MB

VSSVC-6C8F0C66.exe

IMPHASH e07f4788ceb15d6c85f4c2f6ff816ce7
SHA256 5360127988817cafa7d151c143c36798334afea654ebe6c05ca7d644eb678532
MD5 96c0c4226833af72eb7b7fff4f1b9837
SHA1 e7e65ae5cd883ad267726de7dacee7fca1afd732
SHA512 aeae1b14aae4e1bee375d14e680d408c39e2c14d8eacfab6b41ec18376f09f783307ac3c2ff5337ee93c78d206d1f7441ac11b755056ae0735ecd6ea8bb9ec41
SSDEEP 196608:qu6pRMBUk0GtaqG0xiz/abGBiIQ/vOhr7Fvk:q+zaemeG0L/vOV+
TLSH
T15386CF60A6AC4A9DF036B039C1975617A7F17C0D1730CFCB96D09DAB0E2F6E0B56A709
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3906128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Downloads\mojo upd\mojo\Mojo Source\Twish\build\Release\Oblivion.pdb

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory D3DX11CreateShaderResourceViewFromFileA D3DX11GetImageInfoFromFileA

winmm

mciSendStringA PlaySoundW timeBeginPeriod

ntdll

RtlUnwindEx RtlPcToFileHeader RtlLookupFunctionEntry RtlCaptureContext VerSetConditionMask RtlVirtualUnwind RtlUnwind

kernel32

SetPriorityClass GetCurrentProcess SetThreadPriority UnmapViewOfFile SetEvent GetCurrentThread CreateFileMappingA GetModuleHandleW CreateEventA MapViewOfFile K32EnumProcessModulesEx OpenProcess Process32NextW K32GetModuleBaseNameW Process32FirstW K32GetModuleInformation VirtualAllocEx VirtualFreeEx GetExitCodeProcess CreateDirectoryW FindFirstFileW GetFileSizeEx VirtualProtect FindNextFileW WriteFile SetEndOfFile FindClose CreateFileW ExitThread SetFilePointerEx ExitProcess GetCurrentProcessId CreateProcessW VirtualQuery FlushFileBuffers GetCommandLineW ProcessIdToSessionId WriteProcessMemory GetExitCodeThread LoadLibraryW VirtualProtectEx ReadProcessMemory SizeofResource LockResource LoadResource FindResourceW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetLocalTime LoadLibraryExW HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent TerminateProcess IsProcessorFeaturePresent WriteConsoleW GetFileType GetStdHandle ReadFile GetModuleHandleExW FreeLibraryAndExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW GetStringTypeW GetCPInfo CompareStringEx WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx AreFileApisANSI HeapReAlloc CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetLocaleInfoEx LocalFree IsValidCodePage QueryPerformanceCounter FreeLibrary IsDBCSLeadByte QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar OutputDebugStringA CreateRemoteThread WaitForSingleObject GetModuleFileNameW GetTickCount GetProcAddress GetModuleHandleA SetUnhandledExceptionFilter Module32NextW Module32FirstW CloseHandle GetLastError GetTickCount64 Sleep CreateToolhelp32Snapshot GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SleepConditionVariableSRW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize OutputDebugStringW GetConsoleOutputCP ReadConsoleW GetConsoleMode RaiseException GetSystemInfo LoadLibraryExA InitOnceComplete InitOnceBeginInitialize FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId

user32

MapVirtualKeyW GetKeyboardState ToUnicode SetWindowDisplayAffinity GetWindowThreadProcessId GetWindowTextLengthW IsWindowVisible EnumWindows GetClassNameW GetWindowTextW GetWindowLongW DestroyWindow CreateWindowExW GetSystemMetrics RegisterClassExW ShowWindow IsWindow GetMonitorInfoW IsChild MoveWindow SetLayeredWindowAttributes BringWindowToTop LoadIconW UpdateWindow GetWindowRect SetWindowPos SetWindowLongPtrW GetWindowLongPtrW MapWindowPoints GetRawInputData ClipCursor SetForegroundWindow DefWindowProcW GetKeyState GetMessageExtraInfo MonitorFromWindow ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData EnumDisplayDevicesA MessageBoxW DispatchMessageW PeekMessageW TranslateMessage SetCursor GetClientRect GetAsyncKeyState RegisterRawInputDevices UnregisterClassW

advapi32

RegOpenKeyExW RegQueryValueExA RegCloseKey RegDeleteValueA RegOpenKeyExA AdjustTokenPrivileges RevertToSelf SetTokenInformation ImpersonateLoggedOnUser CreateProcessAsUserW DuplicateTokenEx GetTokenInformation LookupPrivilegeValueW OpenProcessToken

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

267KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

VSSVC-6C8F0C66.exe

d3dcompiler_43

d3dx11_43

winmm

ntdll

kernel32

user32

advapi32

shell32

imm32

generic