xxxx[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
xxxx.zip
Size 72KB
Sample260807-egynnszwfy
SHA256 8d85de1707b52922b08e931f874e57201dbb717801425a046bcecb6e08e231a7
MD5 c34aa493f60f78c7306d43df732f6c29
SHA1 c5fe78bdd0c0d6fca9538f6ab0174c09e8746579
SHA512 a2a1864f7ca5640366c9a4817afa0f7434ec8d71266dac4fe11187067e0e4e5e0351c30d1317501913bbaa8c4f27ac205fd2664325475fa1bf2a994fbca553b0
SSDEEP 1536:44kGDrAGOCagtRKG44CrR8Xj7miZSTx/4b6Dztb6iK2U:4yrAGlUKX3miaxwuPxcV
TLSH
T12B73021B91CC6223D29A6C7C8D86578C91D45FBAF93C14525229FDE22C01FCFCCA2999
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Vixen.Free.Temp/xtra/spoof.sys
unpack001/Vixen.Free.Temp/xtra/y.exe

File Explorer

xxxx.zip

.zip 72KB
Vixen.Free.Temp/spoof.bat

.bat .vbs 1KB
Vixen.Free.Temp/xtra/spoof.sys

.sys 13KB
Vixen.Free.Temp/xtra/y.exe

.exe 147KB

xxxx.zip

SHA256 8d85de1707b52922b08e931f874e57201dbb717801425a046bcecb6e08e231a7
MD5 c34aa493f60f78c7306d43df732f6c29
SHA1 c5fe78bdd0c0d6fca9538f6ab0174c09e8746579
SHA512 a2a1864f7ca5640366c9a4817afa0f7434ec8d71266dac4fe11187067e0e4e5e0351c30d1317501913bbaa8c4f27ac205fd2664325475fa1bf2a994fbca553b0
SSDEEP 1536:44kGDrAGOCagtRKG44CrR8Xj7miZSTx/4b6Dztb6iK2U:4yrAGlUKX3miaxwuPxcV
TLSH
T12B73021B91CC6223D29A6C7C8D86578C91D45FBAF93C14525229FDE22C01FCFCCA2999
MD5 SHA1 SHA512 SSDEEP TLSH

Vixen.Free.Temp/xtra/spoof.sys

IMPHASH 4dadd71bbf7efc91b6e42c18159125b4
SHA256 57e7df3f98bcf95885d8b6a1dd007c842f949be018cbf2d807c28df1b0d29a2e
MD5 18618bad050352ade088baccac516cb6
SHA1 81715bf5b749748a4a1b030b49d4a01e55ce1ca3
SHA512 f8d6beb0e8deb0c5d706839d14afdfe35fcb8a3c1d193437af83d68e6b86b889a9548a4b25bd01781c7edf369b842567e2b47a4be621fe963d9fbc8bb795566b
SSDEEP 192:YOzu830PlOQ7OlpAVtgt2sMmVcgYcHHSCX51cmC3FIhXP:YH0WOwCtdMmVcg5DPC3FIh
TLSH
T153521A8B922414EEE36E407AF5209D26E1F2F0850391D6DF5766C63E0B63BE0757B781
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5564

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\conspiracy\Downloads\realwoofa\cat\x64\Release\cat\VixenSMBIOS.pdb

Vixen.Free.Temp/xtra/y.exe

IMPHASH f98f9c16ac6c013dc22d37c379d00ee0
SHA256 da3b80cb01f8d568553355d45d11ccf445010c6817becc08d2ef5726609bb07c
MD5 3c5657b526c9a310e4ed479c3d7b3d41
SHA1 1704f48aa80ee471a3f58c4aad9a02f34ec3aee7
SHA512 708e161050030282bd36c5969d693278ce3aaaa17fd76ac511f549a2ac634b26c5b857fcbef855daaeb1dda732bc972605c9d244a94c5eb77ef57bd57bfe0826
SSDEEP 3072:h72o4BCdZJBuL2+kwjmJTQSaMm5/6NQzl4:h72LBoZJB3TWl6K
TLSH
T109E33C5797A51069E2B7DABCDA720902EBB27C454B74D2CF135048B90F62BD0AF3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

62872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\conspiracy\kdmapper\x64\Release\kdmapper_Release.pdb

kernel32

CloseHandle GetProcAddress GetCurrentProcessId CreateToolhelp32Snapshot Process32NextW Process32FirstW GetModuleHandleA GetTempPathW FormatMessageA GetLocaleInfoEx GetCurrentThreadId CreateFileW VirtualAlloc DeviceIoControl SetUnhandledExceptionFilter VirtualFree FindClose FindFirstFileW GetFileAttributesExW AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent LocalFree

user32

GetWindowThreadProcessId GetShellWindow

advapi32

RegCloseKey RegDeleteTreeW RegCreateKeyW RegOpenKeyW RegSetKeyValueW

msvcp140

??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z

ntdll

NtQuerySystemInformation RtlInitUnicodeString

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset memcpy memcmp __C_specific_handler __std_terminate wcsstr __std_exception_copy _CxxThrowException __current_exception __current_exception_context __std_exception_destroy memmove

api-ms-win-crt-stdio-l1-1-0

_set_fmode _fseeki64 fread fsetpos _get_stream_buffer_pointers __p__commode fputc setvbuf fgetpos fwrite ungetc fflush fgetc fclose

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-filesystem-l1-1-0

_lock_file _wremove _unlock_file

api-ms-win-crt-string-l1-1-0

_wcsicmp _stricmp

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function __p___wargv __p___argc _crt_atexit _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe terminate abort _invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback _c_exit _cexit

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr