vain free[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
vain free.exe
Size 5.5MB
Sample260826-e1rdpssbqg
SHA256 d88c9e515a613ab5a4400dce52603ff4f5e57464d2d7fae2606eea4f8ac0f570
MD5 1b903b9fca5f26540783f9f0dc720252
SHA1 df3bc2cd8c5fe11bf99a5c8b37e65af32cde56ba
SHA512 13dead77aa26ea66ed4df3fcc71ee19ba0452b4ef47448716dfc445974ff95cf0097e5701d340a49d73210f4e2fb4918ff168c8dd412f6db7d0371503e544664
SSDEEP 98304:0r8s7oO7X5jVcxdiGTZnDoayeePZ2GkwYouU:S5XhVYdiGxDoahgcG
TLSH
T1B546F142A29606A8CFA3973C858A9323D3B17CC90370D7D75ADD4E656F63AF46A3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vain free.exe

File Explorer

vain free.exe

.exe 5.5MB

vain free.exe

IMPHASH f8bda905f862877267eb1e233721b2e2
SHA256 d88c9e515a613ab5a4400dce52603ff4f5e57464d2d7fae2606eea4f8ac0f570
MD5 1b903b9fca5f26540783f9f0dc720252
SHA1 df3bc2cd8c5fe11bf99a5c8b37e65af32cde56ba
SHA512 13dead77aa26ea66ed4df3fcc71ee19ba0452b4ef47448716dfc445974ff95cf0097e5701d340a49d73210f4e2fb4918ff168c8dd412f6db7d0371503e544664
SSDEEP 98304:0r8s7oO7X5jVcxdiGTZnDoayeePZ2GkwYouU:S5XhVYdiGxDoahgcG
TLSH
T1B546F142A29606A8CFA3973C858A9323D3B17CC90370D7D75ADD4E656F63AF46A3D700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1546376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\free ch33t\vain gotowe1\nex1\x64\Release\vain bp.pdb

d3dx9_43

D3DXVec3Transform D3DXMatrixTranspose

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpReadData WinHttpCloseHandle WinHttpOpenRequest

kernel32

LoadLibraryW Module32FirstW GetStartupInfoA GetModuleHandleW FreeLibrary Module32NextW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency VerSetConditionMask QueryPerformanceCounter VirtualProtect HeapFree SetPriorityClass OutputDebugStringA VirtualAlloc TerminateProcess Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread GetFileAttributesA GetCurrentThread GetSystemDirectoryA GetSystemInfo CreateThread HeapAlloc K32EnumProcesses AddVectoredExceptionHandler GetThreadContext GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx GetConsoleWindow SetThreadContext GetTickCount OpenThread IsDebuggerPresent CheckRemoteDebuggerPresent Process32NextW GetLastError GetFileSizeEx ReadFile MapViewOfFile UnmapViewOfFile CreateFileMappingA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetTickCount64 VerifyVersionInfoA MoveFileExA WaitForSingleObjectEx GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects SetLastError FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive LocalFree GetLocaleInfoEx FindClose FindFirstFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead CloseHandle Sleep GetFileAttributesW CreateFileW GetTempPathW GetModuleFileNameW WriteFile CreateDirectoryW GetCommandLineA GetProcessId GetCurrentProcess ReadProcessMemory VirtualProtectEx Process32Next GetEnvironmentVariableA CreateToolhelp32Snapshot Module32First Module32Next Process32First VirtualFreeEx GetProcAddress LoadLibraryA CreateFileA OpenProcess GetModuleHandleA VirtualAllocEx FreeConsole MoveFileW Process32FirstW CreateProcessW ExitProcess SleepEx

user32

ShowWindow MoveWindow RegisterClassExW DefWindowProcA UnregisterClassW SetLayeredWindowAttributes CreateWindowExW EnumDisplayMonitors SetFocus TranslateMessage keybd_event ClipCursor SetWindowPos GetClientRect IsWindowVisible DestroyWindow GetWindowRect DispatchMessageA SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard IsWindow ClientToScreen MessageBoxA PeekMessageA GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetWindowLongPtrA SetCursor SetCapture GetKeyboardLayout TrackMouseEvent GetCapture ScreenToClient LoadCursorA GetMessageExtraInfo GetKeyState EnableWindow PostQuitMessage EnumWindows EnumDisplaySettingsA FindWindowA UpdateWindow SetForegroundWindow GetSystemMetrics GetWindowTextA SetWindowLongA GetWindowThreadProcessId SetWindowDisplayAffinity RegisterClassExA GetForegroundWindow mouse_event DispatchMessageW PeekMessageW CreateWindowExA GetAsyncKeyState UnregisterClassA GetMonitorInfoA

advapi32

RegOpenKeyExW CryptImportKey RegQueryValueExA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RevertToSelf CreateProcessAsUserA RegCloseKey PrivilegeCheck SetTokenInformation LookupPrivilegeValueA SetThreadToken CryptEncrypt DuplicateTokenEx RegQueryValueExW GetUserNameA AdjustTokenPrivileges OpenProcessToken GetTokenInformation CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA

ole32

CoInitializeEx CreateStreamOnHGlobal CoCreateInstance

msvcp140

?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ?_Random_device@std@@YAIXZ _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Xinvalid_argument@std@@YAXPEBD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??Bios_base@std@@QEBA_NXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$collate@_W@std@@2V0locale@2@A ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A _Wcsxfrm ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0_Lockit@std@@QEAA@H@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Lockit@std@@QEAA@XZ ?uncaught_exceptions@std@@YAHXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z

ws2_32

send recv closesocket ntohl gethostname sendto recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen WSAGetLastError accept WSACleanup WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind htonl

normaliz

IdnToAscii

wldap32

ord217 ord143 ord211 ord301 ord200 ord30 ord79 ord46 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord35

ntdll

RtlCaptureContext RtlLookupFunctionEntry ZwWriteVirtualMemory RtlVirtualUnwind ZwReadVirtualMemory

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate strstr strchr __C_specific_handler __std_exception_copy longjmp memcpy memmove memset memchr memcmp __current_exception __current_exception_context __intrinsic_setjmp _CxxThrowException strrchr __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

fsetpos _read _write fread _close _fseeki64 fclose _open _lseeki64 fgetc fgets _get_stream_buffer_pointers __p__commode feof fputs fopen __stdio_common_vsprintf_s fwrite fgetwc ungetwc fputwc fgetpos __stdio_common_vsscanf _wfopen fputc fflush __stdio_common_vfprintf fseek __acrt_iob_func ftell ungetc _set_fmode __stdio_common_vsprintf setvbuf

api-ms-win-crt-heap-l1-1-0

calloc realloc malloc _callnewh free _set_new_mode

api-ms-win-crt-math-l1-1-0

asinf atan2f sqrtf __setusermatherr acosf pow ceilf floorf powf sinf sqrt fmodf _dsign _hypotf cosf

api-ms-win-crt-convert-l1-1-0

atoi strtod strtoull strtoll wcstol strtoul atof strtol

api-ms-win-crt-filesystem-l1-1-0

_stat64 _fstat64 _access _lock_file _unlock_file _unlink

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv

api-ms-win-crt-runtime-l1-1-0

strerror _beginthreadex _errno _getpid _invalid_parameter_noinfo_noreturn __sys_nerr abort _configure_narrow_argv _initialize_narrow_environment _register_thread_local_exe_atexit_callback _c_exit _initialize_onexit_table _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function terminate

api-ms-win-crt-string-l1-1-0

_wcsicmp isdigit strncpy strncmp toupper tolower strpbrk strcspn strspn isupper _strdup strcmp towlower

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

crypt32

CertOpenStore CertFreeCertificateChain CertFindExtension CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFreeCertificateChainEngine CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertGetCertificateChain