Vape Lite[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Vape Lite.zip
Size 6.5MB
Sample260808-t9jsjs1bkh
SHA256 ff7fa0ce5b11ca5fd96b0f176a298702de373de8a11a9070fe5d2aebe6787a7b
MD5 8dbdb8cbc7dfd04b7cbfacae08567c4d
SHA1 f1d00dfec4e5e1eba1f1aab1e37816919ba6567b
SHA512 433e34d16f16afdc4edc2b1259c6c530559ca4a71392a6f3857e496964eba70ae7a5b9b2cc4eff33e4b01b4491975de6fd737a372d9ce5e94a7768f3a1aaa5ab
SSDEEP 196608:9WByvouIX3QaAV8T6pSO6FDijgl2MOJ2QzDz3GD:0NRAa+pR6ArMQzPWD
TLSH
T1426633411F761EEA831E8FD978AE90600581875A73A73B38D2A8B37D06FC2DF5C54A53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/Vape_Lite.exe	themida

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Kangaroo Patcher.exe
unpack001/Kangaroo.dll
unpack001/Vape_Lite.exe

File Explorer

Vape Lite.zip

.zip 6.5MB
Kangaroo Patcher.exe

.exe 11KB
Kangaroo.dll

.dll 37KB
Vape_Lite.exe

.exe 6.6MB

Vape Lite.zip

SHA256 ff7fa0ce5b11ca5fd96b0f176a298702de373de8a11a9070fe5d2aebe6787a7b
MD5 8dbdb8cbc7dfd04b7cbfacae08567c4d
SHA1 f1d00dfec4e5e1eba1f1aab1e37816919ba6567b
SHA512 433e34d16f16afdc4edc2b1259c6c530559ca4a71392a6f3857e496964eba70ae7a5b9b2cc4eff33e4b01b4491975de6fd737a372d9ce5e94a7768f3a1aaa5ab
SSDEEP 196608:9WByvouIX3QaAV8T6pSO6FDijgl2MOJ2QzDz3GD:0NRAa+pR6ArMQzPWD
TLSH
T1426633411F761EEA831E8FD978AE90600581875A73A73B38D2A8B37D06FC2DF5C54A53
MD5 SHA1 SHA512 SSDEEP TLSH

Kangaroo Patcher.exe

IMPHASH 67a310fbaf312beb92b18448f0a7f56f
SHA256 2a22fe56bc686e4e518318fdd4634f76b6d230baa4b820b4978bda236e4fd500
MD5 bf28450278273ab1c3ebdd4c98bc9222
SHA1 4eb8db0a3816a4d6a627a4fa9367b46c787968fe
SHA512 6c888383fa7816eb0d904f914e6525827c43f0ef068ab55300ea2506d24722ec06fbdabbbb5de0452322fc0697d9089981ba08e75e9d5bf67d1a91b16650b573
SSDEEP 192:XRdsxj+V2qTo8OvXcHGMbMJo05GMje3Q5tfWlQskD:XRdsxj42quX0NbMJRNa32su
TLSH
T1CC322A0AF6D609FADA294274C63F4A4EF175B910636177CB27E8C6252F923F0702664E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5332

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Kangaroo.dll

IMPHASH 7d226bb099de7142bef97f5b7d4f7689
SHA256 5223fc529531a32c6111ef6e93e33d134961490831b6711db1ed87b3f93574bd
MD5 0202563145fb353f35c915cdbe5474f8
SHA1 01b1ea50745a3824e68330b0339a44e27c9068e9
SHA512 8d972347f6e87fb0639033e22df9687a30363423a650cc872d6746582eb03274c673727c2287d9ba12df0cd68e4deecfcbb3d11c130e122022b57c6088c6309d
SSDEEP 768:yPGh18G4BxUz6jPypNKLf7wtGHBpc/HO27:S+1YUWrypNKPbBp8u27
TLSH
T19303390AE3B240E9E479A13485772639F6B27849C379E3DF67D4831A1FA23D0653E784
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

WriteProcessMemory GetCurrentProcess GetModuleHandleA LoadLibraryA AllocConsole CloseHandle HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree Sleep GetCurrentProcessId GetCurrentThreadId OpenThread SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect GetModuleHandleW GetProcAddress CreateToolhelp32Snapshot Thread32First Thread32Next GetSystemInfo VirtualAlloc VirtualFree VirtualQuery RaiseException MultiByteToWideChar IsDebuggerPresent FreeLibrary WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead GetLastError GetProcessHeap

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__std_type_info_destroy_list _CxxThrowException __C_specific_handler_noexcept memset memcpy __std_exception_copy __std_exception_destroy __vcrt_GetModuleFileNameW __C_specific_handler __vcrt_LoadLibraryExW memmove

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _cexit _invalid_parameter_noinfo_noreturn _initterm_e _initterm

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh

api-ms-win-crt-string-l1-1-0

strcat_s strcpy_s

Vape_Lite.exe

SHA256 9c85d76526d585038392e1af504886580d096e9646de2907b73feab521920944
MD5 3459f3a3d65fa445d1eb52611ac55f6c
SHA1 135c835edfeec60e41bc1b24f1a10ad7a86c9a00
SHA512 1dbf42476304cefd859754f1d8219c0b37cc5b2885527f874245a37df5e1145dbcc1ff1ce34bdf0fa47df8a503e37244ff07a37bb92e8f2514533d8a89926d8b
SSDEEP 98304:MsRRwjPcDZ3IFTbWJ6tWUQSPZyq2XOD6gwosVvC8pQ6TYupGFBUMnEB:MsRKjkNcyDVSROtgwJVvHjTrUIMni
TLSH
T1B066331913763EF2D57A43FA2E26200406169F642FDB2A3EB51F436A4A749CCCFB514B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12566616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

1.4MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

376KB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

136KB

Virtual Size

489KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

120KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

28KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

8KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

generic

count=22, id=259, version=26213,

count=203, id=261, version=26213,

count=6, id=261, productName=VS2017 v15.9.1 build 27023, version=27023,

count=2, id=199, version=41118,

count=11, id=259, version=26706,

count=131, id=261, version=26706,

count=39, id=260, version=26706,

count=28, id=260, version=26213,

count=2, id=123, version=2207,

count=26, id=260, version=25830,

count=1, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=33, id=261, productName=VS2017 v15.3 build 25506, version=25506,

count=1, id=259, productName=VS2017 v15.3 build 25506, version=25506,

count=480, id=260, version=24231,

count=20, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,

count=33, id=257, version=26213,

count=466, id=1, productName=Unmarked objects,

count=135, id=265, version=27026,

count=1, id=255, productName=VS2017 v15.9.5 build 27026, version=27026,

count=1, id=258, productName=VS2017 v15.9.5 build 27026, version=27026,

Vape Lite.zip

Kangaroo Patcher.exe

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic

Kangaroo.dll

kernel32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

generic

Vape_Lite.exe

generic