valx[.]exe | Triage™

General

Target
valx.exe
Size 39.3MB
Sample260815-y2maxstvfx
SHA256 659e899d1d9228f4cb3a850832c8627fa68afe39c74f07fa0d50b97ffb82781e
MD5 fee489e78afe9c41081cc569eee8e05a
SHA1 9ae33c589964d442e753dd72103c818911352d02
SHA512 55494fc1d8bf5f20056f616e19cbaddcdefbf00fbfda7a5771f23fb135f6834083630598cbe95340a20d5a5320e467bd802ee194dcdebb657aaa4799d30acbf9
SSDEEP 786432:bsGOHzeMKVxzx5rQj7/ITv9rDc3BOaUI7d4arB2dsDW849crmr7ac2:bsGOHzDCd5rQj7ATv9nc30CpB2dmWt9w
TLSH
T1B29733A1D13105DBF88DC33AA691CBE471B1B9424A3CE64B9B2D40B256CB5FE7D353A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
valx.exe

File Explorer

valx.exe

.exe 39.3MB
fxcklite.pyc

98KB

valx.exe

IMPHASH ba5546933531fafa869b1f86a4e2a959
SHA256 659e899d1d9228f4cb3a850832c8627fa68afe39c74f07fa0d50b97ffb82781e
MD5 fee489e78afe9c41081cc569eee8e05a
SHA1 9ae33c589964d442e753dd72103c818911352d02
SHA512 55494fc1d8bf5f20056f616e19cbaddcdefbf00fbfda7a5771f23fb135f6834083630598cbe95340a20d5a5320e467bd802ee194dcdebb657aaa4799d30acbf9
SSDEEP 786432:bsGOHzeMKVxzx5rQj7/ITv9rDc3BOaUI7d4arB2dsDW849crmr7ac2:bsGOHzDCd5rQj7ATv9nc30CpB2dmWt9w
TLSH
T1B29733A1D13105DBF88DC33AA691CBE471B1B9424A3CE64B9B2D40B256CB5FE7D353A0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

42656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW GetTempPathW WaitForSingleObject Sleep GetExitCodeProcess CreateProcessW GetStartupInfoW LoadLibraryExW SetConsoleCtrlHandler FindClose FindFirstFileExW CloseHandle GetCurrentProcess LocalFree FormatMessageW MultiByteToWideChar WideCharToMultiByte WriteConsoleW GetProcAddress GetModuleFileNameW SetDllDirectoryW FreeLibrary GetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameW RemoveDirectoryW FindNextFileW SetStdHandle DeleteFileW ReadFile GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetCurrentDirectoryW FlushFileBuffers HeapReAlloc GetFileAttributesExW GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize SetEndOfFile

advapi32

ConvertSidToStringSidW GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW

Name

.text

Size

162KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

valx.exe

kernel32

advapi32

generic

fxcklite.pyc