Virtual[.]gg External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Virtual.gg External.exe
Size 854KB
Sample260802-l22dmagd93
SHA256 f5fd7668f827cb809f9f7e405bdf96082f78d2a78a84fe98f104cd54aada07b1
MD5 c7a6f9b9f605d8a90c3ebef2073013a0
SHA1 c5797361034cfb5ab6921d5fdf93d3f0ac3ed95c
SHA512 29ef78710ba19cc48facb0abc922996d2d29a37c817a7c2cca6c5757c1b6bfd50f6e3f76f8710049f853c8c0f409734e44e779451f17a700d49fcf9218fdc64b
SSDEEP 12288:3/fWqlx5uxF3DrzW5C1pTNix+s+BPukpo5RghnoUu2k:PMPHzN1GxY0kpKRghno
TLSH
T143159E56E2A800F5D0B7D039C5A66607EAB13846077086DF23E44A6A3FA77E05FBF711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Virtual.gg External.exe

File Explorer

Virtual.gg External.exe

.exe 854KB

Virtual.gg External.exe

IMPHASH 1c73f86d64e491338df27438fc7f2695
SHA256 f5fd7668f827cb809f9f7e405bdf96082f78d2a78a84fe98f104cd54aada07b1
MD5 c7a6f9b9f605d8a90c3ebef2073013a0
SHA1 c5797361034cfb5ab6921d5fdf93d3f0ac3ed95c
SHA512 29ef78710ba19cc48facb0abc922996d2d29a37c817a7c2cca6c5757c1b6bfd50f6e3f76f8710049f853c8c0f409734e44e779451f17a700d49fcf9218fdc64b
SSDEEP 12288:3/fWqlx5uxF3DrzW5C1pTNix+s+BPukpo5RghnoUu2k:PMPHzN1GxY0kpKRghno
TLSH
T143159E56E2A800F5D0B7D039C5A66607EAB13846077086DF23E44A6A3FA77E05FBF711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

351044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vyron\Downloads\Virtual.gg External\Virtual.gg External\x64\Release\Virtual.gg External.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

ntdll

NtLoadDriver RtlLookupFunctionEntry NtQuerySystemInformation RtlAdjustPrivilege RtlInitUnicodeString RtlCaptureContext RtlVirtualUnwind RtlUnwindEx NtUnloadDriver RtlPcToFileHeader RtlUnwind

kernel32

Process32NextW CreateFileA Process32FirstW CloseHandle GetProcAddress MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter VirtualFree DeviceIoControl VirtualAlloc CreateFileW GetCurrentThreadId GetCurrentProcessId GetModuleFileNameW GetTempPathW GetConsoleOutputCP FlushFileBuffers ReadConsoleW GetConsoleMode SetFilePointerEx GetFileAttributesExW CreateProcessW GetExitCodeProcess WaitForSingleObject GetFileType EnumSystemLocalesW Sleep IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteFile GetStdHandle DeleteFileW ReadFile GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError CreateToolhelp32Snapshot GetModuleHandleA FindNextFileW IsValidCodePage SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW GetACP FreeEnvironmentStringsW GetOEMCP GetEnvironmentStringsW GetUserDefaultLCID SetEndOfFile GetLastError FindFirstFileExW FindClose HeapReAlloc GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead RaiseException GetFileSizeEx

user32

GetKeyState LoadCursorW SetCursor SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId GetWindow SetWindowPos ScreenToClient GetSystemMetrics ShowWindow IsWindow GetAsyncKeyState DispatchMessageW ClientToScreen PeekMessageW GetForegroundWindow EnumWindows SetLayeredWindowAttributes TranslateMessage GetClientRect GetWindowLongPtrA SetWindowLongPtrA FindWindowA UpdateWindow GetCursorPos

advapi32

RegCreateKeyW RegDeleteTreeW RegSetKeyValueW RegOpenKeyW RegCloseKey

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

553KB

Virtual Size

552KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

260KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Virtual.gg External.exe

d3d11

dwmapi

ntdll

kernel32

user32

advapi32

imm32

d3dcompiler_47

generic