ventoy_vhdboot.img
- SHA256 6161d63520eb72bd1d5cb99aa9a771cc8b93ad9718de637b7d2195911dd224ef
Static task
static1
Behavioral task
behavioral1
Sample
boot/bootvhd.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
boot/etfsboot.com
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
boot/etfsboot.com
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target ventoy_vhdboot.img
- Size 2.0MB
- Sample260817-16b2vsam41
- SHA256 6161d63520eb72bd1d5cb99aa9a771cc8b93ad9718de637b7d2195911dd224ef
- MD5 32b6eb2c892c0fb31bce121a2f26d7ff
- SHA1 6f41a794d9130eac467e1c3af2b7753b91fb8a22
- SHA512 af4215a052bb4e1c1fa3edead9da9c17395da95902e3556dc7067d0307549110afbc55bfa779905c148fb0f03acca0c609c0b442f55dcb65952dd78a06bc9c56
- SSDEEP 24576:h+6P5iQdEMK4VFSTAKYc1aNUZ1ZJiuH/UH8zflxE/7A+WuKtYZj0CgkBrU:g8PEMvP4b8HW/UcJxq7A+WuKutrrU
- TLSH T16EA5BF5373F415B4E5BB8374C9365526DBB778422A30DB4F13A80A5E2F33B629A2D312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
ventoy_vhdboot.img.iso 2.0MB
-
out.iso.iso 2.0MB
-
BOOTMGR399KB
-
[BOOT]/1-Boot-NoEmul.img4KB
-
[BOOT]/2-Boot-NoEmul.img1.1MB
-
boot.catalog2KB
-
boot/BCD20KB
-
boot/bcd20KB
-
boot/bootvhd.dll.dll 97KB
-
boot/etfsboot.com4KB
-
efi.img1.1MB
-
efi/microsoft/boot/BCD20KB
-
efi/microsoft/boot/bcd20KB
out.iso
- SHA256 6161d63520eb72bd1d5cb99aa9a771cc8b93ad9718de637b7d2195911dd224ef
- MD5 32b6eb2c892c0fb31bce121a2f26d7ff
- SHA1 6f41a794d9130eac467e1c3af2b7753b91fb8a22
- SHA512 af4215a052bb4e1c1fa3edead9da9c17395da95902e3556dc7067d0307549110afbc55bfa779905c148fb0f03acca0c609c0b442f55dcb65952dd78a06bc9c56
- SSDEEP 24576:h+6P5iQdEMK4VFSTAKYc1aNUZ1ZJiuH/UH8zflxE/7A+WuKtYZj0CgkBrU:g8PEMvP4b8HW/UcJxq7A+WuKutrrU
- TLSH T16EA5BF5373F415B4E5BB8374C9365526DBB778422A30DB4F13A80A5E2F33B629A2D312
- MD5 SHA1 SHA512 SSDEEP TLSH
BOOTMGR
- SHA256 36692c6dc2bfa67927733d3878a36503a02dd9904b2d64b3508cc0de21e55fcf
- MD5 2f881f6b901dd20c92ced098c37a07b3
- SHA1 49a4001e379c8163ae5c3a923d980cb70a669508
- SHA512 d78c116dd12e4eb61b9cdcf551e512cba2f89e7d1e885437ede6fac5d23018588a7befc2df115e7f33566a02192a1f1474e2707d6a5dc97be4b692d024726406
- SSDEEP 12288:7za7/wAnH1+0zvWuKfVYVpNT308/qopFgeR:K/7A+WuKtYZj0Cgs
- TLSH T1EC9423D5BF16EB29C04C80F81F0F281DE82599576A4C2BD96B967E644F34A0CD33972E
- MD5 SHA1 SHA512 SSDEEP TLSH
[BOOT]/1-Boot-NoEmul.img
- SHA256 f425e135aac26b55e2bac655e62e2ce0b16255226c583d9ab43b2e93e8a6d932
- MD5 d4befebf3cef129ac087422b9e912788
- SHA1 62313ec73f381c052f2513ca6279cfb5107e98c0
- SHA512 3814e4682cad2ef40061d3d5e8142c964cc73a6c6dfc72ba59cbab0922dd0c7e279703450e3a1f4fcfde3498565bf6ef28a30e7de53a0eda75b3fea76d03929b
- TLSH T1D4810A160E6A711FFEEF8270CD5A118146C9FCAD6457A428A07801FB7D562B44DB330A
- MD5 SHA1 SHA512 TLSH
[BOOT]/2-Boot-NoEmul.img
- SHA256 8c15e3da20e321e47094a5df0b86b44cdb817110bf67002c4c24d9093412fba9
- MD5 c08bbbcd6cb1c2f2eba766f6df83bd39
- SHA1 87e020bd76658b5374052d13a756f472db76d3cc
- SHA512 21111295a6b2bb5859f2d4711f2121a492d1ea9145522e9575ea958303e07e1bc95eed1344254e61c755b82d495a112617647e92df81bacb578e0bdcad786345
- SSDEEP 24576:9+6P5iQdEMK4VFSTAKYc1aNUZ1ZJiuH/UH8zflx:E8PEMvP4b8HW/UcJx
- TLSH T100459E8363F415B4E5BBC774CA364516DBB378462630DB5F03A8499E2F33A729A2D312
- MD5 SHA1 SHA512 SSDEEP TLSH
boot.catalog
- SHA256 580f61b44d2cd02b36e46eeddfe07aec719dd350cdf1ad3cbf8d6cc4f804d278
- MD5 c862ff8d0b8936521bd656fdcc58e44f
- SHA1 17295664c4e0b22bfad7b38773b8b558f4acecf0
- SHA512 a54dec7d1b925a0c196308e9acd937021dd6c3146364b5f082a960e15bc107bc1c3a1c3c4ddadb43f9d13e5d917039d0b80c4b86f57211a494dc44b41f01009a
- TLSH T13041041005003314C4DC1CF1D04710541F541007350C17F45014C0541C045C43D00013
- MD5 SHA1 SHA512 TLSH
boot/BCD
- SHA256 eb1567a994d260b91f11a4c824ac7b7a357f3e8b498130d8b712b017e041c999
- MD5 bae2fdc7cebedb1f302bbc9c94d111b0
- SHA1 e631e83e1e599e36b096ece6a2c3fce488c69385
- SHA512 23ef39c04eb9264ed37f96e17ae06c5b3363665309654661da3cf915dfc4c8d8023282a4fe8a7f62a0d0aa10dde62e8c8aea9fa39aeb7879edcc42c873cbf3ed
- SSDEEP 192:O4oxGHuzAC0dNKkjaKzjPD3tHkgSb76R2N4cfEGcj:OxGHkAC0dN9vtHHSU266e
- TLSH T1AF926932BD50C089D2F9453B1C61FAE936B9BF429C814517B1C2731F9CB278EE6169B8
- MD5 SHA1 SHA512 SSDEEP TLSH
boot/bcd
- SHA256 eb1567a994d260b91f11a4c824ac7b7a357f3e8b498130d8b712b017e041c999
- MD5 bae2fdc7cebedb1f302bbc9c94d111b0
- SHA1 e631e83e1e599e36b096ece6a2c3fce488c69385
- SHA512 23ef39c04eb9264ed37f96e17ae06c5b3363665309654661da3cf915dfc4c8d8023282a4fe8a7f62a0d0aa10dde62e8c8aea9fa39aeb7879edcc42c873cbf3ed
- SSDEEP 192:O4oxGHuzAC0dNKkjaKzjPD3tHkgSb76R2N4cfEGcj:OxGHkAC0dN9vtHHSU266e
- TLSH T1AF926932BD50C089D2F9453B1C61FAE936B9BF429C814517B1C2731F9CB278EE6169B8
- MD5 SHA1 SHA512 SSDEEP TLSH
boot/bootvhd.dll
- IMPHASH cb43ae988facf616f92c64fa1a109ff1
- SHA256 632e878caa047d4c387650bdcde06cd16413fefded1ee4d9cd90131ae6562419
- MD5 2700d29c857c29d36082e1feb720e3af
- SHA1 a5dbd8649a6a611e13af4c33875e1e006d5aecb0
- SHA512 89d839bf9bf95fefeaa6967b67299ca22fc768750562d9504bff3678dabe9daffa1ee22544d04d5e95521d408ad875b424558a660e194ac64936cc789f531a69
- SSDEEP 1536:8Hn5XPtPKQeoHwqWSRvwzdasmmaMYMkx5zMwhkD1JOdLdn85pPD:8HnlPtPKBobWoozAsVU3hkD1JO3n8Lb
- TLSH T148A38D22B7C504B0C2B375314D1FBB3AE96F57A69638159E23B41D301EA1E117F4A29F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
05:c4:41:6f:cd:3e:b3:81:5e:1d:f2:83:1e:d3:4e:8e:59:f6:fa:9e:bd:14:5d:aa:98:df:97:0a:14:cc:d9:58
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 3, 2018 - Jul 26, 2019
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:00:d7:af:5a:6e:c0:aa:3d:ce:b6:00:00:00:00:00:d7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 23, 2018 - Nov 23, 2019
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bootvhd.pdb
bootlib
RtlAppendUnicodeStringToString
BlockIoGetMbrDiskSignature
_wcsicmp
BlockIoOpen
BlMmAllocateHeap
BlockIopFreeAllocations
BlockIoAddDevice
BlGetFilePath
BlMmFreeHeap
BlockIoGetGPTDiskSignature
BlockIoGetDiskType
BlockIoInitializeFunctionTable
BlockIoClose
BlFileClose
BlFileWriteAtOffset
RtlFreeUnicodeString
BlFileReadAtOffsetEx
RtlInitUnicodeString
BlFileOpen
RtlInitializeBitMap
BlFileGetInformation
RtlCompareMemory
RtlRandom
BlUtlCheckSum
RtlRbInsertNodeEx
RtlRbRemoveNode
RtlDuplicateUnicodeString
RtlEqualUnicodeString
qsort
RtlAreBitsSet
RtlClearBits
RtlSetBits
RtlAreBitsClear
RtlFindSetBits
RtlSetAllBits
RtlClearAllBits
memcpy
_alldiv
_alldvrm
_allmul
_allrem
_allshl
_aulldiv
_aulldvrm
_aullrem
_aullshr
memcmp
memset
VhdFileDeviceOpen
Name
.text
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
25B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=26213,
count=48, id=1, productName=Unmarked objects,
count=30, id=264, version=26213,
count=1, id=256, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
boot/etfsboot.com
- SHA256 f425e135aac26b55e2bac655e62e2ce0b16255226c583d9ab43b2e93e8a6d932
- MD5 d4befebf3cef129ac087422b9e912788
- SHA1 62313ec73f381c052f2513ca6279cfb5107e98c0
- SHA512 3814e4682cad2ef40061d3d5e8142c964cc73a6c6dfc72ba59cbab0922dd0c7e279703450e3a1f4fcfde3498565bf6ef28a30e7de53a0eda75b3fea76d03929b
- TLSH T1D4810A160E6A711FFEEF8270CD5A118146C9FCAD6457A428A07801FB7D562B44DB330A
- MD5 SHA1 SHA512 TLSH
efi.img
- SHA256 8c15e3da20e321e47094a5df0b86b44cdb817110bf67002c4c24d9093412fba9
- MD5 c08bbbcd6cb1c2f2eba766f6df83bd39
- SHA1 87e020bd76658b5374052d13a756f472db76d3cc
- SHA512 21111295a6b2bb5859f2d4711f2121a492d1ea9145522e9575ea958303e07e1bc95eed1344254e61c755b82d495a112617647e92df81bacb578e0bdcad786345
- SSDEEP 24576:9+6P5iQdEMK4VFSTAKYc1aNUZ1ZJiuH/UH8zflx:E8PEMvP4b8HW/UcJx
- TLSH T100459E8363F415B4E5BBC774CA364516DBB378462630DB5F03A8499E2F33A729A2D312
- MD5 SHA1 SHA512 SSDEEP TLSH
efi/microsoft/boot/BCD
- SHA256 eb1567a994d260b91f11a4c824ac7b7a357f3e8b498130d8b712b017e041c999
- MD5 bae2fdc7cebedb1f302bbc9c94d111b0
- SHA1 e631e83e1e599e36b096ece6a2c3fce488c69385
- SHA512 23ef39c04eb9264ed37f96e17ae06c5b3363665309654661da3cf915dfc4c8d8023282a4fe8a7f62a0d0aa10dde62e8c8aea9fa39aeb7879edcc42c873cbf3ed
- SSDEEP 192:O4oxGHuzAC0dNKkjaKzjPD3tHkgSb76R2N4cfEGcj:OxGHkAC0dN9vtHHSU266e
- TLSH T1AF926932BD50C089D2F9453B1C61FAE936B9BF429C814517B1C2731F9CB278EE6169B8
- MD5 SHA1 SHA512 SSDEEP TLSH
efi/microsoft/boot/bcd
- SHA256 eb1567a994d260b91f11a4c824ac7b7a357f3e8b498130d8b712b017e041c999
- MD5 bae2fdc7cebedb1f302bbc9c94d111b0
- SHA1 e631e83e1e599e36b096ece6a2c3fce488c69385
- SHA512 23ef39c04eb9264ed37f96e17ae06c5b3363665309654661da3cf915dfc4c8d8023282a4fe8a7f62a0d0aa10dde62e8c8aea9fa39aeb7879edcc42c873cbf3ed
- SSDEEP 192:O4oxGHuzAC0dNKkjaKzjPD3tHkgSb76R2N4cfEGcj:OxGHkAC0dN9vtHHSU266e
- TLSH T1AF926932BD50C089D2F9453B1C61FAE936B9BF429C814517B1C2731F9CB278EE6169B8
- MD5 SHA1 SHA512 SSDEEP TLSH