VelocityExecutor[.]exe

General

Target
VelocityExecutor.exe
Size 197.3MB
Sample260805-ec181axflc
SHA256 4b3d9b4be0a11d0a7456db98e7dc63c3f740c02cf326f670817027c7ff06dd2d
MD5 f8f52f42bfaf60e85709862ebe9c3ddb
SHA1 f958c0de15a3361ea128f9b1c94d1cebddc4cb6e
SHA512 36a2f26e8759f932db57c6c70464488444ed21a825734f966f56912d055960375584115acb613f1d89aaaf0387c4a43d37f541d7c9b8083765bd247b22b4eac8
SSDEEP 6291456:srAoI8Rtpw4S0dGkog58Y503MVjYCQbNWuk6ck:srtRtpPo7/cV0CQbcL6P
TLSH
T1F2A83394005B9287D4D2F9238C3FF7526A75630D690E31CC892E76BA3F528C55ABD2E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VelocityExecutor.exe

File Explorer

VelocityExecutor.exe

.exe 197.3MB

VelocityExecutor.exe

IMPHASH d54f4ce7166adf987d04345af91ff939
SHA256 4b3d9b4be0a11d0a7456db98e7dc63c3f740c02cf326f670817027c7ff06dd2d
MD5 f8f52f42bfaf60e85709862ebe9c3ddb
SHA1 f958c0de15a3361ea128f9b1c94d1cebddc4cb6e
SHA512 36a2f26e8759f932db57c6c70464488444ed21a825734f966f56912d055960375584115acb613f1d89aaaf0387c4a43d37f541d7c9b8083765bd247b22b4eac8
SSDEEP 6291456:srAoI8Rtpw4S0dGkog58Y503MVjYCQbNWuk6ck:srtRtpPo7/cV0CQbcL6P
TLSH
T1F2A83394005B9287D4D2F9238C3FF7526A75630D690E31CC892E76BA3F528C55ABD2E3
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

15652

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cabinet

ord43 ord45 ord40

user32

EnumDisplaySettingsA EnumDisplayDevicesA

kernel32

WriteConsoleW SetFilePointerEx CreateDirectoryW CreateFileW GetFileSize ReadFile SetFilePointer WriteFile GetTempPathW CloseHandle HeapAlloc HeapFree GetProcessHeap CreateProcessW EnumSystemFirmwareTables GetSystemFirmwareTable GetModuleFileNameW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer GetStdHandle ExitProcess GetModuleHandleExW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

VelocityExecutor.exe

cabinet

user32

kernel32

generic