vALİhhRa[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
vALİhhRa.exe
Size 23.9MB
Sample260809-1vblyscf76
SHA256 5d4ad3e19d7bd5da58e294dff1e4c5f47fa65bfb208581a96537e87db967cccd
MD5 0fd0605f9162d6533f46de40058e74f5
SHA1 a6cfba819ec10f845454eac303d64046d82d83d2
SHA512 086f0ba43f7b698e163df29f64a75a796dfb3f3023626ac9b0275377c72e8293414482c8d30b219a9c001e4f5faf14cb809e0bf050a8d28c1503345f3f1da55f
SSDEEP 393216:PAyfmlwjFA4oZm1Ftz7hdSw1aMDOoJ+MRQls5WmlFWGE:bfmlSHoZsh9dSkpOATlFWG
TLSH
T13947E1D7F6B321E5D8B6C1349247732AB8B174654338DBDB76844A164B33BE0A93EB04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vALİhhRa.exe

File Explorer

vALİhhRa.exe

.exe 23.9MB

vALİhhRa.exe

IMPHASH ad8375c8e406f82c84d01a8f8e369870
SHA256 5d4ad3e19d7bd5da58e294dff1e4c5f47fa65bfb208581a96537e87db967cccd
MD5 0fd0605f9162d6533f46de40058e74f5
SHA1 a6cfba819ec10f845454eac303d64046d82d83d2
SHA512 086f0ba43f7b698e163df29f64a75a796dfb3f3023626ac9b0275377c72e8293414482c8d30b219a9c001e4f5faf14cb809e0bf050a8d28c1503345f3f1da55f
SSDEEP 393216:PAyfmlwjFA4oZm1Ftz7hdSw1aMDOoJ+MRQls5WmlFWGE:bfmlSHoZsh9dSkpOATlFWG
TLSH
T13947E1D7F6B321E5D8B6C1349247732AB8B174654338DBDB76844A164B33BE0A93EB04
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

557352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

setupapi

SetupDiGetClassDevsW SetupDiSetClassInstallParamsW SetupDiCallClassInstaller SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiOpenDevRegKey

shell32

ShellExecuteA ShellExecuteExW ShellExecuteW CommandLineToArgvW

winmm

PlaySoundA

kernel32

CloseHandle SetFileAttributesA RemoveDirectoryA GetCurrentProcessId CreateProcessA CreateDirectoryA GetTickCount GetExitCodeProcess FindFirstFileW FindNextFileW GetCurrentProcess RemoveDirectoryW GetDriveTypeA GetModuleFileNameW GetTempPathW GetVolumeInformationA SetFileAttributesW MultiByteToWideChar Sleep DeleteFileW LoadLibraryW GetLocalTime GetWindowsDirectoryW GetProcAddress GetModuleHandleW FreeLibrary WideCharToMultiByte GetLogicalDrives ReadFile SetHandleInformation GetProcessId CreatePipe PeekNamedPipe GetEnvironmentVariableA GetWindowsDirectoryA GetCurrentThreadId SetEvent CreateFileW GetFileSize GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte QueryPerformanceCounter VirtualProtect FindClose FlsSetValue FlsGetValue FlsAlloc OutputDebugStringW HeapReAlloc ReadConsoleW GetConsoleMode SetFilePointerEx DeleteFileA HeapFree ExitProcess FreeLibraryAndExitThread ExitThread CreateThread WriteConsoleW GetModuleHandleExW GetFileType GetStdHandle LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo SetStdHandle FindNextFileA TerminateProcess WriteFile FindFirstFileA GetFileSizeEx LocalFree GetCommandLineW GetStringTypeW HeapSize LCMapStringW FlushFileBuffers GetConsoleOutputCP FindFirstFileExW IsValidCodePage GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA CreateFileA GetFileAttributesA GetLastError GetTempPathA HeapAlloc WaitForSingleObject GetACP GetOEMCP SetEndOfFile FlsFree ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime

user32

GetClipboardData SetClipboardData ScreenToClient IsChild GetForegroundWindow LoadCursorW SetCursor GetClientRect PtInRect MessageBoxW wsprintfW PostThreadMessageW PostMessageW ExitWindowsEx DefWindowProcW GetWindowRect DestroyWindow CloseClipboard SetWindowRgn CreateWindowExW SendMessageW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetCapture DispatchMessageW SetTimer PeekMessageW ValidateRect TranslateMessage LoadIconW SetCapture KillTimer PostQuitMessage UpdateWindow ReleaseCapture GetCursorPos BeginPaint EndPaint TrackMouseEvent EmptyClipboard OpenClipboard SetCursorPos GetKeyboardLayout IsWindowUnicode ClientToScreen GetMessageExtraInfo SetWindowPos GetKeyState

gdi32

GetStockObject CreateRoundRectRgn

advapi32

LookupPrivilegeValueW RegGetValueW RegOpenKeyExW OpenProcessToken RegCloseKey AdjustTokenPrivileges RegSetValueExW GetTokenInformation RegDeleteValueW RegEnumKeyExW RegCreateKeyExW RegQueryValueExW

dwmapi

DwmSetWindowAttribute

iphlpapi

IpRenewAddress GetAdaptersInfo GetIpNetTable IpReleaseAddress DeleteIpNetEntry

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

710KB

Virtual Size

709KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20.5MB

Virtual Size

20.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

vALİhhRa.exe

d3d11

d3dcompiler_47

setupapi

shell32

winmm

kernel32

user32

gdi32

advapi32

dwmapi

iphlpapi

imm32

generic