Vencord[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Vencord.exe
Size 3.5MB
Sample260720-xd5xpab14j
SHA256 cfb1cb6b76bdb54169ff4e98a9be99575097a1e1c4263970a14e6cebbc8b5b32
MD5 68b183a3c879617ff8898e3575dc9a12
SHA1 192bc2a73fbc4fd0378fd0710773892c4e45a8f0
SHA512 c86c844f71ac4ff8ead3325eb0d00e70b93658bfdc46bb0af3d00215482773447dbfaa468d296602fb924a96e7c509cde5bf55b571e7e7fb2137b302fa6f2dc7
SSDEEP 49152:ENOvtYtfTxn3fdqcLAvyRE5T9I9ol1Z7057IeYExQurjIGPol9iRdhBjwAknG:noRdqSAvxT1wF62DjR
TLSH
T169067C43F2A290E8D06AC174C25A6737FA327C8D47217AEB57D44A353E61FE06B79B04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Vencord.exe

File Explorer

Vencord.exe

.exe 3.5MB

Vencord.exe

IMPHASH 14578347b27d53147323f5297187223f
SHA256 cfb1cb6b76bdb54169ff4e98a9be99575097a1e1c4263970a14e6cebbc8b5b32
MD5 68b183a3c879617ff8898e3575dc9a12
SHA1 192bc2a73fbc4fd0378fd0710773892c4e45a8f0
SHA512 c86c844f71ac4ff8ead3325eb0d00e70b93658bfdc46bb0af3d00215482773447dbfaa468d296602fb924a96e7c509cde5bf55b571e7e7fb2137b302fa6f2dc7
SSDEEP 49152:ENOvtYtfTxn3fdqcLAvyRE5T9I9ol1Z7057IeYExQurjIGPol9iRdhBjwAknG:noRdqSAvxT1wF62DjR
TLSH
T169067C43F2A290E8D06AC174C25A6737FA327C8D47217AEB57D44A353E61FE06B79B04
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2121884

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

SendInput SetForegroundWindow AttachThreadInput GetForegroundWindow ClipCursor SetWindowPos SetWindowLongPtrW GetWindowLongPtrW SetCursor SetFocus SetActiveWindow DispatchMessageW GetKeyState TranslateMessage PeekMessageW EnumDisplaySettingsW GetMonitorInfoW MonitorFromWindow GetDpiForWindow UpdateWindow ShowWindow SetLayeredWindowAttributes CreateWindowExW RegisterClassW LoadCursorW SetProcessDpiAwarenessContext GetAsyncKeyState ReleaseDC GetDC SetClipboardData EmptyClipboard CloseClipboard GetClipboardData OpenClipboard FindWindowExW DefWindowProcW BeginPaint EndPaint PostQuitMessage GetWindowRect MoveWindow FindWindowW GetWindowThreadProcessId

kernel32

WideCharToMultiByte SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime LoadLibraryExA ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WriteConsoleW MultiByteToWideChar GetConsoleOutputCP GetConsoleMode GetStdHandle DuplicateHandle GetCurrentProcess GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW DeleteFileW CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle CreateFileW FindNextFileW HeapAlloc GetTempPathW GetFullPathNameW SetWaitableTimer CreateWaitableTimerExW CreateThread ExitProcess GetModuleFileNameW FormatMessageW lstrlenW FreeEnvironmentStringsW GetEnvironmentStringsW GetProcessHeap HeapFree HeapReAlloc FindClose UnmapViewOfFile CloseHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency OpenFileMappingW MapViewOfFile OpenProcess GetModuleHandleW GetProcAddress VirtualAllocEx WriteProcessMemory CreateRemoteThread WaitForSingleObject GetExitCodeThread VirtualFreeEx CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW ReadProcessMemory GetCurrentProcessId GetSystemTimePreciseAsFileTime CreateFileMappingW CreateEventW SetEvent GlobalLock GlobalUnlock GlobalAlloc SetConsoleCtrlHandler GetExitCodeProcess GetCurrentThreadId SwitchToThread Sleep GetModuleHandleA CompareStringOrdinal AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetSystemInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW WriteFileEx SleepEx ReadFileEx FindFirstFileExW CopyFileExW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

winmm

PlaySoundW timeEndPeriod timeBeginPeriod

gdi32

DeleteObject DeleteDC SetBkMode CreateFontW CreateDIBSection GetTextExtentPoint32W CreateCompatibleDC SelectObject TextOutW SetTextColor

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9

ntdll

NtWriteFile NtCreateNamedPipeFile NtOpenFile RtlNtStatusToDosError NtReadFile

oleaut32

SysFreeString SysStringLen GetErrorInfo

ole32

CoTaskMemFree CoUninitialize CoInitializeEx CoCreateInstance

bcryptprimitives

ProcessPrng

shell32

SHCreateItemFromParsingName

vcruntime140

strstr __current_exception_context __current_exception __C_specific_handler memchr __CxxFrameHandler3 memmove memset memcmp memcpy

api-ms-win-crt-math-l1-1-0

ceilf powf expf atan2f ceil cosf sinf roundf __setusermatherr acosf pow fmodf log sqrtf logf floorf

api-ms-win-crt-string-l1-1-0

strcmp strncmp strncpy strlen

api-ms-win-crt-runtime-l1-1-0

_set_app_type terminate _crt_atexit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _register_onexit_function _seh_filter_exe _wassert _initialize_onexit_table __p___argv _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf fwrite ftell fseek fread fopen __p__commode fclose __acrt_iob_func _set_fmode fflush

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-locale-l1-1-0

_configthreadlocale