aimwhereloader[.]exe

General

Target
aimwhereloader.exe
Size 3.4MB
Sample260813-qca8csbb53
SHA256 f432910b309b296e4cf2e662092657060f0e24222ccf1239a67c69b9db8daf68
MD5 a198d2e7ddac7c3d381da9b2e5446142
SHA1 61aff012de5ac9eb5247f182320b1df434a22c93
SHA512 6e661c2c46ea0f57dc0dafe0e01bc32258d740d9938bec27b7558ae020ff51cdfd41351df52b06da86f25dc59c318fa37660b7da51ad34dd69b0f8bcbcb6b44a
SSDEEP 98304:ZBvIB2CVEqzsJGwUv6Fvx6KW2wBBJIdnjjgI8D:ZekJGwUi1WMjjW
TLSH
T173F5333311C7710CDF3CACF81EADAD9B92E6F19865EF1E54CA384D990BD12687688436
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
aimwhereloader.exe

File Explorer

aimwhereloader.exe

.exe 3.4MB

aimwhereloader.exe

IMPHASH 30a890deb74dfea6fb2ec51da051c744
SHA256 f432910b309b296e4cf2e662092657060f0e24222ccf1239a67c69b9db8daf68
MD5 a198d2e7ddac7c3d381da9b2e5446142
SHA1 61aff012de5ac9eb5247f182320b1df434a22c93
SHA512 6e661c2c46ea0f57dc0dafe0e01bc32258d740d9938bec27b7558ae020ff51cdfd41351df52b06da86f25dc59c318fa37660b7da51ad34dd69b0f8bcbcb6b44a
SSDEEP 98304:ZBvIB2CVEqzsJGwUv6Fvx6KW2wBBJIdnjjgI8D:ZekJGwUi1WMjjW
TLSH
T173F5333311C7710CDF3CACF81EADAD9B92E6F19865EF1E54CA384D990BD12687688436
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3b:fb:97:9d:7d:aa:10:78:a3:96:11:80:80:25:20:65:6c:c6:c6:8f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=CHE-270.160.868,CN=NETSHARK Sagl,O=NETSHARK Sagl,L=Lugano,ST=Ticino,C=CH,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1306546963696e6f,1.3.6.1.4.1.311.60.2.1.3=#13024348

Chains

Sep 25, 2020

SERIALNUMBER=CHE-270.160.868,CN=NETSHARK Sagl,O=NETSHARK Sagl,L=Lugano,ST=Ticino,C=CH,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1306546963696e6f,1.3.6.1.4.1.311.60.2.1.3=#13024348

Subject

SERIALNUMBER=CHE-270.160.868,CN=NETSHARK Sagl,O=NETSHARK Sagl,L=Lugano,ST=Ticino,C=CH,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1306546963696e6f,1.3.6.1.4.1.311.60.2.1.3=#13024348

Serial Number

02:7a:73:ca:8b:e3:9a:13:d7:2e:96:34:20:53:d2:1a

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 24, 2019 - Jan 6, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

0

Major OS version

6

Entry point

7474245

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

aimwhereloader.exe

PE Signature issue

d3d9

ntdll

ws2_32

wininet

kernel32

user32

gdi32

advapi32

shell32

psapi

dwmapi

wtsapi32

generic

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

aimwhereloader.exe

PE Signature issue

d3d9

ntdll

ws2_32

wininet

kernel32

user32

gdi32

advapi32

shell32

psapi

dwmapi

wtsapi32

generic