Vega X Windows_25262697[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Vega X Windows_25262697.exe
Size 702KB
Sample260820-xq149shn21
SHA256 a7e46a07ee091890b151fb81160181638ad384c4eb58d4524db676b127de88b2
MD5 2e37c309f75f00ffc64d4eff21fa0427
SHA1 d147d40b5ab42843db1401a5ddfe662282432a27
SHA512 595c3b42fa3ee8e4d72a25df83a7e407645b013dfeb840e869cbd1881bf70ed926e8a044d3cc9912146b4360e8b242600a53dcccd4149bc156c5cebf8fc6fefe
SSDEEP 12288:AtflJ50c6GeHR6Kjx288tG6rmC0tzeIiZ4nFZ:At9J6MB8gGaUtze74nT
TLSH
T1F9E48D16B6A801FCE1B7D179C9524912F7B1B847437297CF03A05A66AF2BAE05F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Vega X Windows_25262697.exe

File Explorer

Vega X Windows_25262697.exe

.exe 702KB

Vega X Windows_25262697.exe

IMPHASH 966c188c514fade5059c2900c0f4da1a
SHA256 a7e46a07ee091890b151fb81160181638ad384c4eb58d4524db676b127de88b2
MD5 2e37c309f75f00ffc64d4eff21fa0427
SHA1 d147d40b5ab42843db1401a5ddfe662282432a27
SHA512 595c3b42fa3ee8e4d72a25df83a7e407645b013dfeb840e869cbd1881bf70ed926e8a044d3cc9912146b4360e8b242600a53dcccd4149bc156c5cebf8fc6fefe
SSDEEP 12288:AtflJ50c6GeHR6Kjx288tG6rmC0tzeIiZ4nFZ:At9J6MB8gGaUtze74nT
TLSH
T1F9E48D16B6A801FCE1B7D179C9524912F7B1B847437297CF03A05A66AF2BAE05F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

89:99:5d:c3:fb:8f:84:fe:47:a2:d5:34:13:eb:0d:41:7a:cc:5d:93:a9:c8:58:f8:f0:78:d7:c2:c5:52:50:db

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=AN Soft,O=AN Soft,L=Bergen op Zoom,ST=North Brabant,C=NL

Chains

Jan 1, 0001

Subject

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1c:cf:9d:67:cd:e2:19:ff:12:d9:9a:ff:36:82:e5:a7

Issuer

CN=SSL.com Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 7, 2019 - Mar 3, 2034

Subject

CN=AN Soft,O=AN Soft,L=Bergen op Zoom,ST=North Brabant,C=NL

Serial Number

77:37:bb:9f:e3:4b:0f:1b:d5:af:da:23:3e:ea:b2:95

Issuer

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2026 - Jun 11, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

350848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Samim\Desktop\Installer\x64\Release\Installer.pdb

comctl32

ord410 ord413 InitCommonControlsEx

kernel32

SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW GetFileAttributesW FindClose HeapReAlloc ReadConsoleW ReadFile GetFileAttributesExW GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetFileType GetModuleHandleW GetTempPathW CreateProcessW CreateThread CloseHandle GetLastError Sleep GetTimeZoneInformation WaitForSingleObject GetModuleFileNameW CreateDirectoryW MultiByteToWideChar FindFirstFileExW SetFilePointerEx GetFileSizeEx HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapAlloc WriteFile GetStdHandle GetProcAddress TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwind RtlUnwindEx QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetStringTypeW WideCharToMultiByte GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetLocaleInfoEx LCMapStringEx WakeAllConditionVariable CompareStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry

user32

SetWindowPos DestroyWindow PostMessageW DefWindowProcW GetMessageW FillRect GetWindowTextW EnableWindow EndPaint BeginPaint InvalidateRect CreateWindowExW PostQuitMessage DrawTextW GetClientRect SetWindowLongW LoadCursorW TranslateMessage TrackMouseEvent DispatchMessageW ShowWindow RegisterClassExW GetWindowLongPtrW SetClassLongPtrW SetWindowTextW MessageBoxW SendMessageW UpdateWindow GetWindow GetWindowLongW GetWindowTextLengthW ReleaseDC GetDC RegisterClassW GetSystemMetrics

gdi32

GetTextExtentPoint32W SelectObject CreateFontW GetStockObject SetTextColor SetBkMode LineTo CreatePen MoveToEx SetBkColor DeleteObject CreateSolidBrush RoundRect

advapi32

RegGetValueW RegSetValueExW RegCloseKey RegCreateKeyExW

shell32

SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

ole32

CoTaskMemFree

urlmon

URLDownloadToFileW URLOpenBlockingStreamA

gdiplus

GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipCloneImage GdipAlloc GdipLoadImageFromStream GdipGetImageWidth GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipDisposeImage GdipDrawImageRectI

wininet

HttpOpenRequestA InternetCrackUrlA InternetOpenUrlA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA InternetReadFile InternetOpenUrlW InternetOpenW

Name

.text

Size

524KB

Virtual Size

523KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Vega X Windows_25262697.exe

PE Signature issue

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

urlmon

gdiplus

wininet

generic