vape_v4_rewrite[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
vape_v4_rewrite.exe
Size 257KB
Sample260804-2ff4kasamg
SHA256 804587cabf06f7670294d5913ab8837dd8c65adca719ea8bf8eea2f43775ac1c
MD5 35074dd1f12902d905eb453a6a5f3633
SHA1 004302f9b2fa7ef8b43971a265efff0e2c7edd32
SHA512 0728fd113855c9669ad906070b49519a3d657b8d6498c1793d56d8d996434e59a4abc0189bb1b45436b3a7883199b3037dabc816f8442c0a62e50d8a4aed7c2b
SSDEEP 6144:CqvqNRJsH0pAg2ke9JFvF4Bu+Um9aus8nIz91f36bGRwNt:/XBpJFSL9ps8nKv32Kw7
TLSH
T13A449E1AB265022DD367D978DA626705FB73FC4B0B25A7EF43801CB20E126E85F7A741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vape_v4_rewrite.exe

File Explorer

vape_v4_rewrite.exe

.exe 257KB

vape_v4_rewrite.exe

IMPHASH cad7c450f2ef34afd8ddfb6a58334b61
SHA256 804587cabf06f7670294d5913ab8837dd8c65adca719ea8bf8eea2f43775ac1c
MD5 35074dd1f12902d905eb453a6a5f3633
SHA1 004302f9b2fa7ef8b43971a265efff0e2c7edd32
SHA512 0728fd113855c9669ad906070b49519a3d657b8d6498c1793d56d8d996434e59a4abc0189bb1b45436b3a7883199b3037dabc816f8442c0a62e50d8a4aed7c2b
SSDEEP 6144:CqvqNRJsH0pAg2ke9JFvF4Bu+Um9aus8nIz91f36bGRwNt:/XBpJFSL9ps8nKv32Kw7
TLSH
T13A449E1AB265022DD367D978DA626705FB73FC4B0B25A7EF43801CB20E126E85F7A741
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

91840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipGetFontCollectionFamilyList GdipGetGenericFontFamilySansSerif GdipPrivateAddMemoryFont GdipDrawString GdipCreateStringFormat GdipGetFamilyName GdipDeleteFontFamily GdipGetClip GdipSetClipRegion GdipSetClipPath GdipDrawImageRectRect GdipDrawImageRect GdipFillPath GdipFillRectangle GdipDrawPath GdipDeleteGraphics GdipScaleWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipDeleteStringFormat GdipSetStringFormatFlags GdipCreateFont GdipSetSmoothingMode GdipCloneImage GdipDisposeImage GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCreateFromHDC GdipDeletePrivateFontCollection GdipNewPrivateFontCollection GdipSetStringFormatAlign GdipDeleteFont GdipCloneFontFamily GdipSetStringFormatLineAlign GdipFree GdipDrawLine GdipLoadImageFromStream GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDeleteRegion GdipCreateRegion GdipAddPathArc GdipClosePathFigure GdipDeletePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipAlloc

winhttp

WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpQueryHeaders WinHttpReadData

shell32

ShellExecuteW

shlwapi

ord12

ws2_32

closesocket WSACleanup WSAStartup accept bind socket getsockname htonl listen ntohs recv send shutdown

kernel32

Sleep GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetProcAddress GetModuleHandleW UnmapViewOfFile VirtualFreeEx MapViewOfFile CreateFileMappingW WriteProcessMemory VirtualAllocEx OpenProcess CreateRemoteThread GetCurrentProcess CreateEventW WaitForSingleObject GetLastError GetFileAttributesW GetEnvironmentVariableA MulDiv GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindResourceW SizeofResource LockResource LoadResource Process32NextW Process32FirstW CreateToolhelp32Snapshot WideCharToMultiByte GetModuleFileNameW CloseHandle GetVolumeInformationW CreateDirectoryW GetEnvironmentVariableW GetStartupInfoW

user32

AdjustWindowRectExForDpi GetWindowLongPtrW SetWindowLongPtrW LoadCursorW LoadIconW GetDpiForSystem GetClientRect KillTimer SetTimer GetKeyState SetFocus EmptyClipboard GetClipboardData SetClipboardData CloseClipboard InvalidateRect SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW DispatchMessageW TranslateMessage GetMessageW TrackMouseEvent GetWindowThreadProcessId EnumWindows GetWindowTextLengthW GetWindowTextW IsWindowVisible PostMessageW EndPaint BeginPaint OpenClipboard UpdateWindow

gdi32

SelectObject DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

msvcp140

??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Mtx_unlock _Mtx_lock _Thrd_id _Thrd_join _Query_perf_frequency _Query_perf_counter ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Xbad_alloc@std@@YAXXZ ?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ

vcruntime140

__std_exception_destroy _CxxThrowException __current_exception __C_specific_handler memset memmove memcpy memcmp __std_exception_copy __current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen strlen

api-ms-win-crt-stdio-l1-1-0

fputwc ungetwc __stdio_common_vswprintf_s fclose fflush fgetc fgetpos fsetpos _fseeki64 fwrite setvbuf ungetc fgetwc __p__commode _set_fmode

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _crt_atexit _set_app_type _seh_filter_exe _exit _beginthreadex terminate

api-ms-win-crt-math-l1-1-0

ceilf __setusermatherr exp

api-ms-win-crt-convert-l1-1-0

strtoul atoi

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _callnewh

api-ms-win-crt-locale-l1-1-0

_configthreadlocale