VencordInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
VencordInstaller.exe
Size 3.7MB
Sample260802-2ppr3agg95
SHA256 97a9af55588164d61ea5140ed596a6a1c0aad0c9715765e2e55f63e0751bb59e
MD5 500777583cff99e1c01095a17bae74e0
SHA1 187174589fcc33e5840450e35ce2a595b7aa9a5b
SHA512 6db3311c5909190ea0b05587b3b5fa84a7af5f2cc807dca70e5fb5228126bd3a53f85cb762b2ef491f42df20730ba749250f651184307a246b505ad134f6f2f9
SSDEEP 49152:n5MOU1eaLjucAeY/jLA90Z5nYT8+HE8QIMvAs8pWy4y3VLuxPNyA+2dmKrTZ:5xZcA7RARjVqxDmGTZ
TLSH
T14806EF06E19742A8DF72A73895956327C2B03CC547B09BD31BDC4A686FB39F42A7E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VencordInstaller.exe

File Explorer

VencordInstaller.exe

.exe 3.7MB

VencordInstaller.exe

IMPHASH 276da19200b0dcc5dbcbad2ac1401d44
SHA256 97a9af55588164d61ea5140ed596a6a1c0aad0c9715765e2e55f63e0751bb59e
MD5 500777583cff99e1c01095a17bae74e0
SHA1 187174589fcc33e5840450e35ce2a595b7aa9a5b
SHA512 6db3311c5909190ea0b05587b3b5fa84a7af5f2cc807dca70e5fb5228126bd3a53f85cb762b2ef491f42df20730ba749250f651184307a246b505ad134f6f2f9
SSDEEP 49152:n5MOU1eaLjucAeY/jLA90Z5nYT8+HE8QIMvAs8pWy4y3VLuxPNyA+2dmKrTZ:5xZcA7RARjVqxDmGTZ
TLSH
T14806EF06E19742A8DF72A73895956327C2B03CC547B09BD31BDC4A686FB39F42A7E740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

935936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA CloseHandle ExitProcess CreateProcessW GetModuleFileNameW GetModuleHandleW WaitForSingleObject GetExitCodeProcess GetExitCodeThread VirtualAllocEx ReadProcessMemory WriteProcessMemory VirtualFreeEx CreateFileW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage WideCharToMultiByte GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetStdHandle TerminateProcess GetCurrentProcess IsProcessorFeaturePresent ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread FreeConsole AllocConsole HeapSize WriteConsoleW SetEndOfFile GetLastError CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwind Sleep GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError

user32

GetAsyncKeyState PeekMessageW LoadCursorW TranslateMessage OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo GetKeyState GetCapture EnumDisplayMonitors GetMonitorInfoW MapWindowPoints UpdateWindow MoveWindow SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW SetWindowLongW SetForegroundWindow SetProcessDPIAware MonitorFromWindow SetCapture ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseDC GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture DispatchMessageW

gdi32

DeleteObject GetDeviceCaps CreateSolidBrush CreateRectRgn

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmIsCompositionEnabled DwmExtendFrameIntoClientArea DwmGetColorizationColor DwmEnableBlurBehindWindow

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

121KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

VencordInstaller.exe

d3dx11_43

d3d11

kernel32

user32

gdi32

winhttp

imm32

d3dcompiler_47

dwmapi

generic