vmax[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
vmax.zip
Size 3.8MB
Sample260824-e5va6acp41
SHA256 4044c51297d10946f061ddc1dfeae35c554bcd0241fb6011f00756124dbeba45
MD5 421bcec738d7aae31c3a280ec59bad37
SHA1 680aade00d22826aa2855de049e23c9bd5358714
SHA512 d4c9953564311da2d24028ad604ddf7f10f8cd9e78e508d2c2710c09015039b30d1e15a69f3a70194717c946a12a9ba18713a38ed26b889bde0643ef2ef53f87
SSDEEP 98304:c5kdIswkWnX8+ZZ4Iox1w7zpWAUTwR3Osc8lxj6mBQmoJ/:T7WX8+Y2pjUuTblxbpoJ/
TLSH
T1EA06336938AC3B630BA5805971404BE02D0EDE2DEBEF796175D10BFCB61A8AE1D017C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/vmax.exe

File Explorer

vmax.zip

.zip 3.8MB
vmax.exe

.exe 5.3MB

vmax.zip

SHA256 4044c51297d10946f061ddc1dfeae35c554bcd0241fb6011f00756124dbeba45
MD5 421bcec738d7aae31c3a280ec59bad37
SHA1 680aade00d22826aa2855de049e23c9bd5358714
SHA512 d4c9953564311da2d24028ad604ddf7f10f8cd9e78e508d2c2710c09015039b30d1e15a69f3a70194717c946a12a9ba18713a38ed26b889bde0643ef2ef53f87
SSDEEP 98304:c5kdIswkWnX8+ZZ4Iox1w7zpWAUTwR3Osc8lxj6mBQmoJ/:T7WX8+Y2pjUuTblxbpoJ/
TLSH
T1EA06336938AC3B630BA5805971404BE02D0EDE2DEBEF796175D10BFCB61A8AE1D017C7
MD5 SHA1 SHA512 SSDEEP TLSH

vmax.exe

IMPHASH eea1f153e22954527be80a2082704e4d
SHA256 d76a72916fbd71e8dce09a47aaa31ed938ae3e162406d5d0198ad758efaf6580
MD5 a9d1c1ba5707e49257bb13f7a806b22e
SHA1 940105d8923a588d3cf9205597250aee38b62e04
SHA512 cf0c7e23246160a04a189ceef6f93e592fa83c2e66718187a5daaa2a07e38858c925cdb6d3f20d872829139b751338677cc1d9ed5f69f2dd19f5a3421a2ccaed
SSDEEP 98304:GVXvxYGLeo2GBwpa5u/ot9du0nzwWbPiE3G50KvfioaBOfdP:0xYGLeo2GBwsg2du0zwWbPi6S3ioaUf5
TLSH
T19446F10673A40598D2A39238C552D733E6753C449365C2CB17F0AEA3BF636E26E7A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1387608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\ALL SOURCES\Impact Services , Vanguard\VMAX2\VMAX\VMAX\VMAX\examples\vmax\Release\vmax.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

winmm

PlaySoundA

kernel32

GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection CreateThread CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameW QueryFullProcessImageNameW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemDirectoryW SleepEx GetSystemInfo GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx Sleep OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WakeAllConditionVariable GetFileInformationByHandleEx AreFileApisANSI HeapFree GetCurrentThread SetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA GetCurrentThreadId SleepConditionVariableSRW HeapReAlloc HeapAlloc HeapDestroy AddVectoredExceptionHandler CreateFileW HeapSize LoadLibraryW GetModuleHandleW GetLastError IsDebuggerPresent GetStdHandle FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter VerSetConditionMask WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GlobalAlloc lstrcmpA LocalAlloc GetModuleHandleA GetCurrentProcessId GetCurrentProcess CreateFileA K32GetModuleFileNameExW K32EnumProcessModules K32EnumProcesses VirtualProtect GetTempPathW CreateProcessA CloseHandle TerminateProcess LocalFree GetModuleFileNameA DebugBreak WaitForSingleObject GetTickCount64 GetProcAddress OpenProcess LoadLibraryA

user32

ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect CreateWindowExW GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture PostQuitMessage UnregisterClassW SetLayeredWindowAttributes MoveWindow GetSystemMetrics UpdateWindow GetWindowRect SetWindowLongW LoadIconW MessageBoxA TranslateMessage DestroyWindow DispatchMessageW PeekMessageW RegisterClassExW LoadCursorW ScreenToClient GetCapture GetKeyState TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData CloseClipboard DefWindowProcW SendMessageW FindWindowA GetWindowThreadProcessId FindWindowExA GetWindowLongW ShowWindow SetWindowLongA OpenClipboard

advapi32

RegDeleteKeyA RegOpenKeyExA RegQueryValueExA OpenProcessToken GetTokenInformation ConvertSidToStringSidA RegOpenKeyExW RegQueryValueExW AddAccessAllowedAce GetLengthSid InitializeAcl IsValidSid RegCreateKeyExA SetSecurityInfo CopySid CryptAcquireContextW CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext RegCloseKey

shell32

ShellExecuteA

ole32

CoSetProxyBlanket CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

VariantClear SysStringLen SysFreeString SysAllocString

msvcp140

_Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ??Bid@locale@std@@QEAA_KXZ ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?uncaught_exceptions@std@@YAHXZ _Thrd_detach ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z _Thrd_id ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Random_device@std@@YAIXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?id@?$ctype@_W@std@@2V0locale@2@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Xinvalid_argument@std@@YAXPEBD@Z _Xtime_get_ticks ??7ios_base@std@@QEBA_NXZ _Query_perf_counter ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Thrd_join ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z _Query_perf_frequency

shlwapi

StrStrW PathFindFileNameW

ws2_32

ioctlsocket sendto gethostname htons recv recvfrom freeaddrinfo setsockopt socket WSAIoctl __WSAFDIsSet select accept htonl listen getsockname getpeername connect bind inet_ntop WSASetLastError ntohs inet_pton WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt WSACleanup WSAStartup getaddrinfo

crypt32

CertGetCertificateChain CryptDecodeObjectEx CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertAddCertificateContextToStore PFXImportCertStore CertFreeCertificateChain CertFreeCertificateContext CertFindCertificateInStore CertGetNameStringW CertFindExtension CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptStringToBinaryW

mpr

WNetGetProviderNameA

imm32

ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140

__current_exception __C_specific_handler wcschr strrchr __std_terminate _purecall strchr memset memcmp _CxxThrowException __std_exception_destroy __std_exception_copy strstr memmove __current_exception_context memchr memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

wcslen strncmp tolower strcpy_s _strdup strlen _wcsdup strcspn wcspbrk strspn wcsncmp strpbrk wcsncpy toupper strncpy strcmp

api-ms-win-crt-heap-l1-1-0

calloc realloc _callnewh free malloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_set_app_type _errno exit system __sys_errlist __sys_nerr terminate _register_thread_local_exe_atexit_callback _c_exit abort _invalid_parameter_noinfo __p___argv _resetstkoflw _beginthreadex __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment _wassert _seh_filter_exe _cexit _invalid_parameter_noinfo_noreturn _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

fgetpos _wfopen _lseeki64 fclose fflush fputc fsetpos _wopen fread _get_stream_buffer_pointers fseek _fseeki64 feof fputs _set_fmode ftell setvbuf fwrite ungetc fgets __stdio_common_vsprintf __p__commode __stdio_common_vsscanf _read _write __acrt_iob_func _fileno _close _popen fgetc __stdio_common_vfprintf _pclose

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file _unlink _wstat64 _fstat64 remove

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-math-l1-1-0

sqrtf acosf __setusermatherr floorf sinf fmodf cosf ceilf fabs _dsign _ldsign _fdsign _dtest _ldtest _fdtest _fdopen powf

api-ms-win-crt-convert-l1-1-0

wcstombs strtod atoi strtol strtoll strtoul strtoull

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 _gmtime64 strftime

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

getenv