VapeCrack.rar
- SHA256 eac5c75a8f382613a593a62f32603b09c77ca3659d20ca366c1e9bc97dc89bf1
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VapeCrack.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target VapeCrack.rar
- Size 13.1MB
- Sample260719-dcs2ysc13z
- SHA256 eac5c75a8f382613a593a62f32603b09c77ca3659d20ca366c1e9bc97dc89bf1
- MD5 d5dee9e9c4beb07a7125b4dc51e084fa
- SHA1 cfaa9612450007b60d6683bfc094d9ddf37d6083
- SHA512 8cb1c53e24760ff3493dacd213efb58f3124188081b21e340aad80d155a168552a7aac25cf0811a4a90de3bc6134fcf552727da57b2c2cae615853fe6165fd01
- SSDEEP 393216:3eCHkC9IxvqCu381BHec73bOkyxkQOKodcOZghz1Ao/oS:3hH19m2M1BNkxkQT+cOZghzqo/oS
- TLSH T13FD6331140ACF295D5AA8F5E0ACC96CB1DD9987DD21794670EF02C9BFD8B28D1AF304B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/VapeCrack/Injector.exe unpack001/VapeCrack/penis.dll
File Explorer
-
VapeCrack.rar.rar 13.1MB
-
VapeCrack/Injector.exe.exe 14KB
-
VapeCrack/penis.dll.dll 13.8MB
VapeCrack/Injector.exe
- IMPHASH 6b17da9f8dda6c0a63f02b463d6a725e
- SHA256 3361545f3f475f0467d249db6511046b5f9717e7aa80d736c16065e267045150
- MD5 2629d4edafe5cbd84dc3ec22865d52d5
- SHA1 c826d177cf65fee52b4d0adc4a2a330106db54ad
- SHA512 33c633237c71227a59c95f31e34becb615e67ef2950c5d2b3ba09892c952d915a4cf4a95471681e2361a24b6615d43ec6ea29e1237950b755cacca6ea4e2e879
- SSDEEP 192:iCdHvYL73pkN6eaJdsd7515Bfh9OdS/C3Q5tfTcd:Jtw3ppLwZL63d
- TLSH T1C5623A0677961CEAC416D1728C731925D4F6B23603224BCF77E4C82A2F796D1BC3A28A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6352
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleFileNameA
WriteProcessMemory
lstrlenA
GetModuleHandleA
OpenProcess
Sleep
GetFileAttributesA
CloseHandle
GetProcAddress
VirtualAllocEx
CreateRemoteThread
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
RtlCaptureContext
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
user32
EnumWindows
GetWindowTextA
GetClassNameA
GetWindowThreadProcessId
vcruntime140
__C_specific_handler
__current_exception
__current_exception_context
memset
strrchr
memcpy
api-ms-win-crt-stdio-l1-1-0
__p__commode
__acrt_iob_func
__stdio_common_vfscanf
__stdio_common_vfprintf
_set_fmode
api-ms-win-crt-string-l1-1-0
strcat_s
strncpy_s
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
terminate
system
_seh_filter_exe
_set_app_type
_exit
__p___argv
__p___argc
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
516B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33218,
count=19, id=261, version=33218,
count=10, id=260, version=33218,
count=4, id=259, version=33218,
count=5, id=257, version=30795,
count=70, id=1, productName=Unmarked objects,
count=1, id=265, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
VapeCrack/penis.dll
- IMPHASH 27bcd2c8cc3937a9e881ba5555f2995e
- SHA256 9b2bf838a8598b98363cd94bb33b3667d853b44e0643516617070629cdc7561e
- MD5 3532ab68c068445fe40a19a29cb51156
- SHA1 576733ae1132736b20a68edb1a5750c973126dd6
- SHA512 65b70af070c989bce5994e227c3c65897d0ff674f63eeb8bf3993352b916ae3254c3e67613eddaef0b9054b5bfec8b224696252cef7abbad56263ae7a12e39ef
- SSDEEP 196608:EDZqzRveB54fsfzGXPqzHmaTUY24FYyLx+PQ1XtJa9RvmUkhEBqhg/gUlvHyT:6qve2/6HmV1QX1deOU8zh+gU9HyT
- TLSH T1C7E61235E8D96575E437A13061224923BA3F76CDF04FA17A95F89CA31C338AE4F06B25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
22440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
CloseHandle
CreateThread
GetModuleHandleA
GetProcAddress
GetDriveTypeA
FreeLibraryAndExitThread
GetLastError
GetFileAttributesA
GetModuleHandleW
CreateDirectoryA
Sleep
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
HeapCreate
user32
TranslateMessage
GetForegroundWindow
MessageBoxA
GetCursorPos
PeekMessageW
DispatchMessageW
GetAsyncKeyState
GetClassNameW
MapVirtualKeyA
PostMessageW
GetKeyNameTextA
shell32
SHGetFolderPathA
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Xbad_alloc@std@@YAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
__std_exception_destroy
__std_exception_copy
__C_specific_handler
_CxxThrowException
memset
__std_type_info_destroy_list
memcpy
__std_terminate
api-ms-win-crt-heap-l1-1-0
malloc
free
calloc
_callnewh
api-ms-win-crt-stdio-l1-1-0
fgetpos
fwrite
setvbuf
fsetpos
fgetc
fread
fclose
fflush
fputc
_fseeki64
ungetc
_get_stream_buffer_pointers
api-ms-win-crt-string-l1-1-0
strcmp
strncpy_s
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_cexit
_invalid_parameter_noinfo_noreturn
_crt_atexit
_initterm_e
_initterm
Java_cn_gov_vape_util_jvmti_JVMTIUtil_disposeEnvironment
Java_cn_gov_vape_util_jvmti_JVMTIUtil_init
Java_cn_gov_vape_util_jvmti_JVMTIUtil_redefineClass
Java_cn_gov_vape_util_jvmti_JVMTIUtil_retransformClass
Java_cn_gov_vape_util_jvmti_JVMTIUtil_setClassLoadHook
Java_cn_gov_vape_util_jvmti_JVMTIUtil_wrap
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13.7MB
Virtual Size
13.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=34321,
count=8, id=260, version=34321,
count=18, id=261, version=34321,
count=6, id=257, version=34321,
count=4, id=260, version=30141,
count=7, id=257, version=30795,
count=161, id=1, productName=Unmarked objects,
count=5, id=265, version=34436,
count=1, id=256, version=34436,
count=1, id=255, version=34436,
count=1, id=151,
count=1, id=258, version=34436,