Vanix Fivem[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Vanix Fivem.exe
Size 4.2MB
Sample260809-2bgvasen2t
SHA256 0d6520baae9d70c8c5a6d930dd8af9dfcba492e9998eca1ba4401b4987ec2963
MD5 0014fcfecf915112d15357a5222ca1cb
SHA1 983b4b882f526111c4dd3acca4430189708c2eaa
SHA512 c19baaf9e68cdc9a8ed8c20dc6f2ba008b764d4863779c3bcce452a342631b6d61cefa827543d35e7f7364377dcef645c8413f2df64e62e405665a228210bfbb
SSDEEP 49152:MJqbuVN0ztY69FpZxg5hl4yYhJVT44y3VkT8+HE1uxuMvAKrTZrNyA+2dWhT8p5Y:Mnf0hY8p12jVmxdAGTZ3bhZhSH
TLSH
T10D16E046E2A742A8CF63973985479323D2B17CC503B097D76ADD8A746F63AF46A3D300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Vanix Fivem.exe

File Explorer

Vanix Fivem.exe

.exe 4.2MB

Vanix Fivem.exe

IMPHASH 789a898c12366a6df2f75fde1178bffe
SHA256 0d6520baae9d70c8c5a6d930dd8af9dfcba492e9998eca1ba4401b4987ec2963
MD5 0014fcfecf915112d15357a5222ca1cb
SHA1 983b4b882f526111c4dd3acca4430189708c2eaa
SHA512 c19baaf9e68cdc9a8ed8c20dc6f2ba008b764d4863779c3bcce452a342631b6d61cefa827543d35e7f7364377dcef645c8413f2df64e62e405665a228210bfbb
SSDEEP 49152:MJqbuVN0ztY69FpZxg5hl4yYhJVT44y3VkT8+HE1uxuMvAKrTZrNyA+2dWhT8p5Y:Mnf0hY8p12jVmxdAGTZ3bhZhSH
TLSH
T10D16E046E2A742A8CF63973985479323D2B17CC503B097D76ADD8A746F63AF46A3D300
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1283156

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Tonyn\Desktop\Vanix FiveM Source Code\x64\Release\NienTeen.pdb

d3dx9_43

D3DXVec3Transform D3DXMatrixTranspose D3DXVec3Normalize

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

SetUnhandledExceptionFilter SleepConditionVariableSRW LocalFree GetLocaleInfoEx CreateFileW FindClose FindFirstFileW AcquireSRWLockExclusive GetFileAttributesExW ReleaseSRWLockExclusive FormatMessageA SetLastError WaitForMultipleObjects SetPriorityClass GetModuleHandleW GetFileInformationByHandleEx RtlCaptureContext RtlLookupFunctionEntry PeekNamedPipe GetFileType RtlVirtualUnwind UnhandledExceptionFilter GetEnvironmentVariableA WaitForSingleObjectEx IsProcessorFeaturePresent MoveFileExA WakeAllConditionVariable VerifyVersionInfoA GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetTickCount QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetLastError GetModuleHandleA GetCurrentProcess Beep ReadProcessMemory VirtualProtectEx CloseHandle UnmapViewOfFile CreateToolhelp32Snapshot OpenProcess Module32First Module32Next VirtualFreeEx CreateFileMappingA EnterCriticalSection LeaveCriticalSection GetCurrentProcessId Sleep GetStdHandle TerminateProcess InitializeCriticalSectionEx DeleteCriticalSection MapViewOfFile VirtualAllocEx GetCurrentThreadId HeapFree SleepEx HeapAlloc ReadFile GetSystemDirectoryA GetFileSizeEx CreateFileA AreFileApisANSI

user32

GetForegroundWindow GetAsyncKeyState mouse_event SetWindowDisplayAffinity UpdateWindow FindWindowA PostQuitMessage PeekMessageA TranslateMessage SetLayeredWindowAttributes DefWindowProcA MoveWindow GetMonitorInfoA SetWindowLongA ShowWindow RegisterClassExW UnregisterClassW CreateWindowExW EnumDisplayMonitors DestroyWindow DispatchMessageA MonitorFromPoint SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture GetWindowRect GetWindowThreadProcessId GetWindowLongPtrA GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient

advapi32

CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt GetTokenInformation OpenProcessToken AdjustTokenPrivileges RegQueryValueExW RegOpenKeyExW RegCloseKey CryptAcquireContextA

msvcp140

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$collate@_W@std@@2V0locale@2@A ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A _Wcsxfrm ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Random_device@std@@YAIXZ _Mtx_unlock _Query_perf_counter _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z

ws2_32

listen ioctlsocket __WSAFDIsSet WSACleanup accept WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs getsockopt getsockname getpeername gethostname connect WSAGetLastError send recv closesocket ntohl htonl htons select getaddrinfo freeaddrinfo recvfrom bind sendto

normaliz

IdnToAscii

crypt32

CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindCertificateInStore PFXImportCertStore CryptStringToBinaryA

wldap32

ord60 ord46 ord50 ord41 ord22 ord45 ord211 ord143 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord217

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp _CxxThrowException __C_specific_handler memcmp memchr __current_exception_context memset memmove memcpy longjmp strrchr __std_exception_destroy strchr strstr __std_terminate __std_exception_copy __current_exception

api-ms-win-crt-heap-l1-1-0

calloc free malloc _callnewh _set_new_mode realloc

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate exit _errno strerror _invoke_watson _getpid __sys_nerr abort _register_thread_local_exe_atexit_callback _c_exit _configure_narrow_argv _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment

api-ms-win-crt-string-l1-1-0

strncpy strncmp toupper strcmp tolower isdigit strcspn strspn isupper _strdup strpbrk

api-ms-win-crt-convert-l1-1-0

strtoll strtoul strtoull strtol atoi atof strtod wcstol

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode fputc _read fflush fclose _write _lseeki64 fgetc fgets fwrite _close feof __stdio_common_vsprintf fputs fopen fgetpos fgetwc ungetwc setvbuf ungetc __stdio_common_vsscanf _wfopen fsetpos fread __stdio_common_vfprintf fseek __acrt_iob_func ftell _get_stream_buffer_pointers _fseeki64 _open fputwc

api-ms-win-crt-filesystem-l1-1-0

_access _lock_file _unlock_file _stat64 _unlink _fstat64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64

api-ms-win-crt-math-l1-1-0

ceilf sqrtf cosf fmodf atan2f acosf powf _hypotf __setusermatherr sinf _dclass