VITTLOADER[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VITTLOADER.exe
Size 13.1MB
Sample260908-y26dssxthy
SHA256 e7607d5a8a3c1cd812e00532b6e91bb1e25b450e1e404306c92b6d73bd8ec6c6
MD5 eaaadf55cf92e4be36f1991490482236
SHA1 56cce90f5775a1a2e26b6d3ebf38f627cee79d7d
SHA512 c0539556d8e844cb65dd586326fe60d8488e3e27e6f864903fd39e5958a906624e8dde47490d4a6427555be9bd42fb0ced88e4295763df074219ba0e59377765
SSDEEP 98304:buu1ywRDIBdlLpiH/Zl1IcUlbjI7+PJrw82g7+uZ+N0jWwDKpUdLY:bu6pRMBD1iH/3uhl3IKhk8uoWfpU9
TLSH
T15BD68BB18A8C9F0DF066B179C1875627A7F2BC0D6325DF8BA9C0ADB7481F584F15A20D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VITTLOADER.exe

File Explorer

VITTLOADER.exe

.exe 13.1MB

VITTLOADER.exe

IMPHASH 8c354d68467ec04e94b4770ceaae6da3
SHA256 e7607d5a8a3c1cd812e00532b6e91bb1e25b450e1e404306c92b6d73bd8ec6c6
MD5 eaaadf55cf92e4be36f1991490482236
SHA1 56cce90f5775a1a2e26b6d3ebf38f627cee79d7d
SHA512 c0539556d8e844cb65dd586326fe60d8488e3e27e6f864903fd39e5958a906624e8dde47490d4a6427555be9bd42fb0ced88e4295763df074219ba0e59377765
SSDEEP 98304:buu1ywRDIBdlLpiH/Zl1IcUlbjI7+PJrw82g7+uZ+N0jWwDKpUdLY:bu6pRMBD1iH/3uhl3IKhk8uoWfpU9
TLSH
T15BD68BB18A8C9F0DF066B179C1875627A7F2BC0D6325DF8BA9C0ADB7481F584F15A20D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13500416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\VITT\Downloads\VITTLOADER\thirdparty\imgui\examples\VITTLOADER\Release\VITTLOADER.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

winhttp

WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen

kernel32

AreFileApisANSI HeapFree GetCurrentThreadId GetModuleHandleA GetCurrentThread HeapAlloc GetCurrentProcessId GetProcessHeap GetSystemTimeAsFileTime QueryPerformanceCounter MultiByteToWideChar GetLastError GetTempPathA GetTickCount64 CloseHandle CreateProcessA WriteProcessMemory TerminateProcess WaitForSingleObject OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep Process32NextW Process32FirstW GetProcAddress VirtualAllocEx CreateRemoteThread VirtualFreeEx GetProcessTimes GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency AcquireSRWLockExclusive GetFileInformationByHandleEx GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleFileNameA GetFileAttributesA GetModuleHandleW CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree CreateFileMappingA UnmapViewOfFile MapViewOfFile ReadFile GetFileSizeEx CreateFileA SleepConditionVariableSRW WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead ReleaseSRWLockExclusive GlobalAlloc FreeLibrary

user32

DestroyWindow DefWindowProcW GetKeyboardLayout CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW SetWindowPos GetForegroundWindow ClientToScreen LoadCursorW GetCapture SetCapture DispatchMessageW PeekMessageW SetLayeredWindowAttributes TranslateMessage PostQuitMessage SetCursor UpdateWindow OpenClipboard ScreenToClient GetClientRect GetMessageExtraInfo IsWindowUnicode GetKeyState ReleaseCapture SetCursorPos CloseClipboard GetCursorPos GetWindowRect MoveWindow wsprintfA TrackMouseEvent PostMessageA FindWindowA SendMessageW ShowWindow SetClipboardData GetClipboardData EmptyClipboard

shell32

ShellExecuteA

msvcp140

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Mtx_unlock ?_Xbad_function_call@std@@YAXXZ _Query_perf_frequency ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?uncaught_exceptions@std@@YAHXZ

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dx11_43

D3DX11CreateShaderResourceViewFromFileA D3DX11CreateShaderResourceViewFromMemory

vcruntime140_1

__CxxFrameHandler4

vcruntime140

longjmp __C_specific_handler __std_exception_destroy __std_exception_copy __std_terminate strstr _CxxThrowException __current_exception_context __current_exception memcmp memchr memset memmove memcpy __intrinsic_setjmp strrchr

api-ms-win-crt-math-l1-1-0

acosf sinf ceilf powf roundf fmodf cosf sqrtf __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _set_app_type _get_narrow_winmain_command_line _initterm _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv abort _exit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _wassert _beginthreadex terminate

api-ms-win-crt-stdio-l1-1-0

fseek fflush __acrt_iob_func ftell _set_fmode __p__commode _wfopen __stdio_common_vsprintf fopen_s fwrite __stdio_common_vsnprintf_s fclose fread __stdio_common_vsscanf __stdio_common_vfprintf

api-ms-win-crt-convert-l1-1-0

_wcstoui64 strtol

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh _set_new_mode

api-ms-win-crt-string-l1-1-0

strncpy strcpy_s _wcsicmp strcmp strncmp strlen

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

Name

.text

Size

11.3MB

Virtual Size

11.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

260KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ptext

Size

255KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

VITTLOADER.exe

d3d11

d3dcompiler_43

winhttp

kernel32

user32

shell32

msvcp140

dwmapi

imm32

d3dx11_43

vcruntime140_1

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic