vortex.zip
- SHA256 3f32fc7668eab7dc09898ff8684204a73bedde8c6cb48069eed399c8a9ef37f2
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Vortex/Vortex-Bootstrapper.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
Vortex/Vortex-Bootstrapper.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target vortex.zip
- Size 13.3MB
- Sample260822-e91zhaeq8v
- SHA256 3f32fc7668eab7dc09898ff8684204a73bedde8c6cb48069eed399c8a9ef37f2
- MD5 efeac026893cf8607431edb7c1277b5a
- SHA1 91a71cd5f84de6f93141c72ea7f8614fe0ce18ed
- SHA512 88b277fb783a5927b1bbf837db9096519b486bcdfd94de0aa78d395d3dd67891f4207840a962cf146cf87be4e679fe49f6513f322021c95bf44c4a40b4d11ece
- SSDEEP 393216:z4T4psLDAwlrLcZijgBOrGvHzVcQzc3dsbCY3kVJ/St:k5vAwhKmgBbTVcQzcds3kK
- TLSH T1B0E633F2B59DE1AD8590A306A907D808043CF56097E0C9C548B68FA64E5B7CF9E1BF1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Vortex/Vortex-Bootstrapper.exe
File Explorer
-
vortex.zip.zip 13.3MB
-
Vortex/Vortex-Bootstrapper.exe.exe 14.6MB
Vortex/Vortex-Bootstrapper.exe
- IMPHASH 28ff686eec65a4f95a2e359e58776d36
- SHA256 4ac1c40118de6166bece58b04ec937c4b9975a5541e4ea96eba9d7ba87a48d33
- MD5 b098024d0c8dbba834f76bb49c62e2b0
- SHA1 1b01ec9117032f9a37c46d130e988304467595f5
- SHA512 b8fa33248851d4262acb14868faeff569d77c37f05f1d739a1b8b42f9865679b6b585a1c14b69cfcc9a40bee17332ff7b86064ad4b9ff6f80e5bd6249a7757e1
- SSDEEP 393216:WJsYIdRMOzHN+jg9yD4ty9TPRuUrzQLOW/Ki/8lZG3:6udRMOxQGyDtDRuUrzUChlQ3
- TLSH T182F623C3A1DE87EDD48396156A4712CAA4C5B056DAFA17143ECE0D0EFE06C4907CBBB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
26960026
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
FindClose
advapi32
RegGetValueW
oleaut32
SysStringLen
bcryptprimitives
ProcessPrng
ntdll
NtCancelIoFileEx
user32
RemoveMenu
gdi32
CreateDIBSection
dwmapi
DwmSetWindowAttribute
ole32
CoUninitialize
comctl32
DefSubclassProc
api-ms-win-core-synch-l1-2-0
WaitOnAddress
shlwapi
SHCreateMemStream
shell32
ShellExecuteW
ws2_32
WSACleanup
secur32
DecryptMessage
crypt32
CertOpenStore
pdh
PdhRemoveCounter
powrprof
CallNtPowerInformation
psapi
GetProcessMemoryInfo
api-ms-win-crt-math-l1-1-0
round
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstol
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
Virtual Size
7.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
421KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.I`k
Size
Virtual Size
7.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.<@y
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.)4+
Size
14.6MB
Virtual Size
14.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ