Vape v4.rar
- SHA256 155dd0cb64f5aa19d227440a5de7dfa12bdb179a74c24a065c373f8c7845f346
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Vape v4/Injector.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Vape v4/Injector.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Vape v4/Leeme!!!.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Vape v4/Leeme!!!.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Vape v4/penis.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Vape v4/penis.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Vape v4.rar
- Size 13.1MB
- Sample260727-k2nxvszbma
- SHA256 155dd0cb64f5aa19d227440a5de7dfa12bdb179a74c24a065c373f8c7845f346
- MD5 49e33d07fee6265cb7711ac19b8a9ec3
- SHA1 6bd4e95c8c4317ac57d622525b3cb70cbb073aa6
- SHA512 73c744c7bf82ee860e06c09d2281b735ce092a55d1f79abbd45718b47fd2057ed9da620b571cd2ffde34ebb72900617614bef6d4ed7e9d3bc2e312c31817289f
- SSDEEP 393216:9YZFCsHeARYuPgr3JpglN3YYmza/AvkwCfMwWZ1PCr:9kFpHfLS3J2oYmeckwCfMNZ1qr
- TLSH T134D63306909CE5E6ED958F4E55C885CF1DA95A7FC09FA4220FF52CE36C8A3090BF614B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Vape v4/Injector.exe unpack001/Vape v4/penis.dll
File Explorer
-
Vape v4.rar.rar 13.1MB
-
Vape v4/Injector.exe.exe 14KB
-
Vape v4/Leeme!!!.txt646B
-
Vape v4/penis.dll.dll 13.8MB
Vape v4/Injector.exe
- IMPHASH 6b17da9f8dda6c0a63f02b463d6a725e
- SHA256 6f04843c9a6467cbbf90e47e59ae57929a130928ae5ecabf6f847e8f299acd82
- MD5 ec5ad03e8d860913a007cd08879c6598
- SHA1 9aac9c29c9c7569c91aa5a4aa3bf100d2612de76
- SHA512 ad7ea1cbf175a3100e21ced49643fedf39131ef815338c976c9d11904bdbcf9162b2244e9db35a3b1e9ad909a7d3a36d4b9627c1bef51b8bba40809125703987
- SSDEEP 192:iCdHvYL73pkN6eaJdsd7575Bfh9OdS/C3Q5tfTcd:Jtw3ppL+ZL63d
- TLSH T1A8623B0677961CEAC416D1728C731925D4F6B23603224BCF77E4C92E2F796D1BC3628A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6352
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleFileNameA
WriteProcessMemory
lstrlenA
GetModuleHandleA
OpenProcess
Sleep
GetFileAttributesA
CloseHandle
GetProcAddress
VirtualAllocEx
CreateRemoteThread
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
RtlCaptureContext
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
user32
EnumWindows
GetWindowTextA
GetClassNameA
GetWindowThreadProcessId
vcruntime140
__C_specific_handler
__current_exception
__current_exception_context
memset
strrchr
memcpy
api-ms-win-crt-stdio-l1-1-0
__p__commode
__acrt_iob_func
__stdio_common_vfscanf
__stdio_common_vfprintf
_set_fmode
api-ms-win-crt-string-l1-1-0
strcat_s
strncpy_s
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
terminate
system
_seh_filter_exe
_set_app_type
_exit
__p___argv
__p___argc
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
516B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33218,
count=19, id=261, version=33218,
count=10, id=260, version=33218,
count=4, id=259, version=33218,
count=5, id=257, version=30795,
count=70, id=1, productName=Unmarked objects,
count=1, id=265, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
Vape v4/Leeme!!!.txt
- SHA256 9b5e6aa4028dacb66c2d6d79a9d5a31cd7f5c8e26f2c878e4133efe84dbb681c
- MD5 8ec52639f99677e7dd581a112421398c
- SHA1 a9c7040b2902f542e3159b6322eb1fb9d714207a
- SHA512 a75baa9a87e9deff80bc3b92b7daba5467e2f3cbf0e9aebf8b11eead5cfabdd5ee5770cf9d7f2457a27c51aef81b8cd2233f94fe6a8868913e4a3eb1fe3c00a2
- TLSH T121F0085E3FC1775BA1E453A41781CF1FBA5886CC7501D93190F7D71C10A95644349DED
- MD5 SHA1 SHA512 TLSH
Vape v4/penis.dll
- IMPHASH 27bcd2c8cc3937a9e881ba5555f2995e
- SHA256 67c58fc5eb0b6e9ddd6aabc5002133b86fc329b590ede10ac7f7fa48e14eb4b7
- MD5 7fce408c974353663954085be4178497
- SHA1 fdf06397a5211a2b21ff8324a81d8bf3021d0244
- SHA512 1658446c00c679ddf9bb3af9ea706f7debaf2c07f0372b42ba748b89f55e90517e80a33b4fabdb35b657f364dc47d931beb4be3b4fcf4271e1332877e17a780f
- SSDEEP 196608:kDZqzRveB54fsfzGXPqzHmaTUY24FYyLx+PQ1XtJa9RvmUkhEBqhg/gUlvHyT:aqve2/6HmV1QX1deOU8zh+gU9HyT
- TLSH T141E61235E8D96575E437A13061224923BA3F76CDF04FA17A95F89CA31C338AE4F06B25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
22440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
CloseHandle
CreateThread
GetModuleHandleA
GetProcAddress
GetDriveTypeA
FreeLibraryAndExitThread
GetLastError
GetFileAttributesA
GetModuleHandleW
CreateDirectoryA
Sleep
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
HeapCreate
user32
TranslateMessage
GetForegroundWindow
MessageBoxA
GetCursorPos
PeekMessageW
DispatchMessageW
GetAsyncKeyState
GetClassNameW
MapVirtualKeyA
PostMessageW
GetKeyNameTextA
shell32
SHGetFolderPathA
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Xbad_alloc@std@@YAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
__std_exception_destroy
__std_exception_copy
__C_specific_handler
_CxxThrowException
memset
__std_type_info_destroy_list
memcpy
__std_terminate
api-ms-win-crt-heap-l1-1-0
malloc
free
calloc
_callnewh
api-ms-win-crt-stdio-l1-1-0
fgetpos
fwrite
setvbuf
fsetpos
fgetc
fread
fclose
fflush
fputc
_fseeki64
ungetc
_get_stream_buffer_pointers
api-ms-win-crt-string-l1-1-0
strcmp
strncpy_s
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_cexit
_invalid_parameter_noinfo_noreturn
_crt_atexit
_initterm_e
_initterm
Java_cn_gov_vape_util_jvmti_JVMTIUtil_disposeEnvironment
Java_cn_gov_vape_util_jvmti_JVMTIUtil_init
Java_cn_gov_vape_util_jvmti_JVMTIUtil_redefineClass
Java_cn_gov_vape_util_jvmti_JVMTIUtil_retransformClass
Java_cn_gov_vape_util_jvmti_JVMTIUtil_setClassLoadHook
Java_cn_gov_vape_util_jvmti_JVMTIUtil_wrap
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13.7MB
Virtual Size
13.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=34321,
count=8, id=260, version=34321,
count=18, id=261, version=34321,
count=6, id=257, version=34321,
count=4, id=260, version=30141,
count=7, id=257, version=30795,
count=161, id=1, productName=Unmarked objects,
count=5, id=265, version=34436,
count=1, id=256, version=34436,
count=1, id=255, version=34436,
count=1, id=151,
count=1, id=258, version=34436,