VyronLoader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VyronLoader.exe
Size 8.8MB
Sample260831-xtfbzaydpg
SHA256 170351e874f16b0c671842ecc2be731b5050fe2b7cd0b0f9bbaa736f2b431125
MD5 3a8feb7fc9489f1855e3579bae53b7da
SHA1 7843263a943e774fe6f57331804f216707a869d0
SHA512 09bcddbae9f416a3fa934d050c3e6bd0d3da6e68fcf3ca290edbf19320ea8212539d9736ac1c0ebc4b1418c1f6046d2d9e865625258021f14ea3bc749500dae7
SSDEEP 196608:wh5fXKL+vM7SZdAz+pVhkbfoxam8CrlgXui:wTXKL+v2KIhygX
TLSH
T1069612A3E267439DC29A1C3486929741AEB27C4D1F02C2D773F836264AF75E0CD7A6D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VyronLoader.exe

File Explorer

VyronLoader.exe

.exe 8.8MB

VyronLoader.exe

IMPHASH ce59daab13f4bfb474bb04ee3754da5b
SHA256 170351e874f16b0c671842ecc2be731b5050fe2b7cd0b0f9bbaa736f2b431125
MD5 3a8feb7fc9489f1855e3579bae53b7da
SHA1 7843263a943e774fe6f57331804f216707a869d0
SHA512 09bcddbae9f416a3fa934d050c3e6bd0d3da6e68fcf3ca290edbf19320ea8212539d9736ac1c0ebc4b1418c1f6046d2d9e865625258021f14ea3bc749500dae7
SSDEEP 196608:wh5fXKL+vM7SZdAz+pVhkbfoxam8CrlgXui:wTXKL+v2KIhygX
TLSH
T1069612A3E267439DC29A1C3486929741AEB27C4D1F02C2D773F836264AF75E0CD7A6D1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

265664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

GetUserNameA

user32

DispatchMessageA PeekMessageA DefWindowProcA PostQuitMessage TranslateMessage RegisterClassExW CreateWindowExW DestroyWindow ShowWindow UnregisterClassW SetCapture SetLayeredWindowAttributes MoveWindow GetSystemMetrics UpdateWindow SetWindowRgn GetWindowRect ShowCursor GetCursorPos ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode GetWindowLongA ReleaseCapture GetCapture GetKeyState TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetProcessDPIAware LoadIconA LoadCursorA SetWindowLongA

gdi32

CreateRoundRectRgn

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

shlwapi

PathFileExistsA

ole32

CoInitialize CoCreateInstance PropVariantClear

winhttp

WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReceiveResponse

kernel32

GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx SetFilePointerEx GetConsoleOutputCP FlushFileBuffers LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapAlloc ReadConsoleW GetConsoleMode GetFileType HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetCommandLineW GetCommandLineA TerminateProcess GetModuleFileNameW GetStdHandle IsProcessorFeaturePresent ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree GetStringTypeW FlsGetValue FlsAlloc CreateFileA WriteFile GetTempPathA IsDebuggerPresent CloseHandle GetCurrentProcess ExitProcess GetCurrentThread CreateProcessA GetLocalTime GetTickCount GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource FindResourceA CopyFileA GetComputerNameA GetConsoleWindow CreateToolhelp32Snapshot Process32First Process32Next GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLastError GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW SetLastError GetProcessHeap CreateFileW HeapSize SetEndOfFile HeapReAlloc WriteConsoleW FlsSetValue RtlPcToFileHeader RaiseException RtlUnwindEx RtlLookupFunctionEntry RtlUnwind

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

406KB

Virtual Size

405KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

630KB

Virtual Size

637KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7.6MB

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

VyronLoader.exe

advapi32

user32

gdi32

d3d11

dwmapi

shlwapi

ole32

winhttp

kernel32

imm32

d3dcompiler_47

generic