Venom[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Venom.exe
Size 164.3MB
Sample260804-swcxeahm6s
SHA256 19731111b43050bcd65762d1454b34eeb0ba58804c6a4d1d7c2922d8e784ac15
MD5 f47375a97a41bdba3198e8fda6a0a65a
SHA1 19819f13394461542f05278993ef046deb94e00b
SHA512 e1f54c638469df20b334cedc4b584a4d7d4bd865fe9cf9a40e78c211b41e21567ffcb871edf9b3fba95132f377a21fc34a21b5b75091d92f771103487bed60e4
SSDEEP 3145728:zQpBIjJbQrYfxW4pk9bX5XTte935wfrYbCsBbV4i2wgAoEvvDRna52dNrYP86jH3:zQpBIjVN5W4pk9JXTgl6i2GoenZxYP8m
TLSH
T1DB8833568639EEF8E2AE507C81B84143F1487C1543899EF3901B7A4A1F7E7D15E3A38E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Venom.exe

File Explorer

Venom.exe

.exe 164.3MB

Venom.exe

IMPHASH b92ada96af34cee22066c5afa48da1cb
SHA256 19731111b43050bcd65762d1454b34eeb0ba58804c6a4d1d7c2922d8e784ac15
MD5 f47375a97a41bdba3198e8fda6a0a65a
SHA1 19819f13394461542f05278993ef046deb94e00b
SHA512 e1f54c638469df20b334cedc4b584a4d7d4bd865fe9cf9a40e78c211b41e21567ffcb871edf9b3fba95132f377a21fc34a21b5b75091d92f771103487bed60e4
SSDEEP 3145728:zQpBIjJbQrYfxW4pk9bX5XTte935wfrYbCsBbV4i2wgAoEvvDRna52dNrYP86jH3:zQpBIjVN5W4pk9JXTgl6i2GoenZxYP8m
TLSH
T1DB8833568639EEF8E2AE507C81B84143F1487C1543899EF3901B7A4A1F7E7D15E3A38E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

444288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

lstrlenW WideCharToMultiByte SetEnvironmentVariableW FreeLibrary GetModuleFileNameW lstrcatW LoadLibraryW GetTickCount GetProcessHeap HeapReAlloc HeapAlloc SetLastError HeapFree GetUserDefaultUILanguage FindResourceExA SetEvent GetCurrentProcessId CloseHandle WaitForSingleObject CompareStringA GetLastError GetEnvironmentVariableA CompareStringW FormatMessageA lstrcpyW FindFirstFileW FindClose GetSystemTimeAsFileTime WriteFile SetFileTime CreateFileA ReadFile IsBadReadPtr CreateEventA GetModuleFileNameA SetFilePointer GetCurrentProcess GetWindowsDirectoryA GetVolumeInformationA GetFileAttributesExA GetFullPathNameA FindFirstFileExA FindNextFileA IsWow64Process FlushInstructionCache WriteConsoleW GetConsoleOutputCP lstrcmpiW FlushFileBuffers SetStdHandle GetLocaleInfoW GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID QueryPerformanceCounter GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount IsValidCodePage GetOEMCP GetTimeZoneInformation RtlVirtualUnwind HeapCreate HeapSetInformation GetStdHandle FlsAlloc TlsSetValue GetCurrentThreadId FlsFree TlsFree FlsSetValue FlsGetValue GetCPInfo LCMapStringW LCMapStringA RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader GetStartupInfoW RtlCaptureContext IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess CreateThread ResumeThread ExitThread GetSystemInfo VirtualAlloc GetThreadLocale GetLocaleInfoA GetACP HeapSize HeapDestroy GetVersionExA RaiseException SetEnvironmentVariableA IsBadWritePtr VirtualProtect VirtualQuery lstrcmpiA lstrcpyA ExitProcess lstrcmpA LoadLibraryA GetProcAddress DeleteCriticalSection InitializeCriticalSection MultiByteToWideChar Sleep WaitForMultipleObjects lstrlenA GetModuleHandleA LeaveCriticalSection EnterCriticalSection GlobalFree GlobalUnlock GlobalLock GlobalAlloc LockResource LoadResource SizeofResource FindResourceA WriteConsoleA

user32

UnregisterClassA DestroyWindow EndDialog LoadStringA FillRect GetClientRect ReleaseDC SetClassLongA PtInRect SetCursor GetWindowRect LoadCursorA GetWindowLongA SetWindowLongA GetSystemMetrics GetCursorPos GetParent MapWindowPoints GetDesktopWindow SendMessageA SetWindowPos ReleaseCapture SetForegroundWindow PostMessageA BeginPaint GetMessageA TranslateMessage DrawIcon MessageBoxW GetDC DispatchMessageA LoadIconA CreateDialogIndirectParamA SetTimer EndPaint KillTimer CallWindowProcA GetWindowTextA SetCapture DrawEdge InvalidateRect GetClassNameA GetWindowLongPtrA PostQuitMessage TrackMouseEvent SetActiveWindow IsDialogMessageA OffsetRect LoadImageA SetWindowLongPtrA EnableWindow ScreenToClient GetActiveWindow GetWindowTextLengthA UpdateWindow SetWindowTextA AdjustWindowRectEx CreateWindowExA RegisterClassExA DefWindowProcA ShowWindow TranslateAcceleratorA SetFocus DrawFocusRect DrawTextA MessageBoxA wsprintfA

gdi32

CreateSolidBrush CreateCompatibleDC LineTo DeleteDC MoveToEx CreatePen CreateCompatibleBitmap BitBlt SelectObject GetDIBColorTable StretchBlt DeleteObject CreateDIBSection TextOutA GetTextExtentPointA SetBkMode SetTextColor CreateFontIndirectA SetDIBColorTable GetObjectA GetStockObject

advapi32

RegCreateKeyExA RegCloseKey RegSetValueExA RegQueryValueExA RegDeleteValueA

shell32

SHGetFolderPathA

ole32

CoSetProxyBlanket CoUninitialize CoInitializeEx CreateStreamOnHGlobal CoCreateInstance

oleaut32

SafeArrayGetUBound GetErrorInfo SafeArrayPutElement SafeArrayDestroy SafeArrayGetElement SafeArrayGetLBound VariantTimeToSystemTime SystemTimeToVariantTime SysFreeString SysStringLen SysAllocString SafeArrayCreateVector SafeArrayAccessData SafeArrayUnaccessData VariantInit VariantClear VariantChangeType SysAllocStringLen

gdiplus

GdiplusShutdown GdipDrawImageI GdipDisposeImage GdipAlloc GdiplusStartup GdipFree GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipDeleteGraphics GdipGetImagePalette GdipGetImageGraphicsContext GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipCreateBitmapFromStream GdipGetImagePaletteSize

msimg32

AlphaBlend TransparentBlt

iphlpapi

GetAdaptersInfo

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA