57_vH_Hack_V1.4.rar
- SHA256 a428454b6091e13548adfc55fd227b7d45e2069ed69c10324f1bca598e9f1e71
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
vH.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
vH.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
vH.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
vH.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 57_vH_Hack_V1.4.rar
- Size 307KB
- Sample260910-prf7gsw1dz
- SHA256 a428454b6091e13548adfc55fd227b7d45e2069ed69c10324f1bca598e9f1e71
- MD5 ad0be562e9145497a314c70973307d3e
- SHA1 c0c72f895f61f4effd57a0466d9984826193b47a
- SHA512 dffe6bcea7bbdd868c55164a38d9c7d4868dbbe9b498b8cfaec89cc0a5868efad93bc7940ef6fd4c16ce67bee504c3cd414b3c204413e2a877800ba9da0f5e34
- SSDEEP 6144:PnIQ7E04uytCsbLWG0Tmo8fwc24m780jcuR8HqRQtFtqh5YypyV4xYk/pp:AQ75ytM3mN4c24I8z+8taPYyMq/pp
- TLSH T1B36423CD1ECAC99FE4B2A236C0815B98C554B8FDB039F5C0262D9369DFE6895C2031EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/vH.dll unpack001/vH.exe
File Explorer
-
57_vH_Hack_V1.4.rar.rar 307KB
-
menu/clock.vmt96B
-
menu/clock.vtf85KB
-
menu/menu.vmt95B
-
menu/menu.vtf1.3MB
-
settings.ini969B
-
vH.dll.dll 251KB
-
vH.exe.exe 428KB
-
visitor2.ttf36KB
menu/clock.vmt
- SHA256 242d65d20ad0e765cb3b41b1e884bfe450b8e33288b368dc157ee45da051e43a
- MD5 f188c678386150196caf71b5e3a3b617
- SHA1 c48713ea1bd5a15cadfc9bcec0977537948e61e1
- SHA512 2aa9f3c0072636f4d8576334883f6d0632800252485b6b2a1c82a7fcb9a7de23d43951d0a4eeae53e7078c2675928aadc9b6f1db5e4a66eeac364bd551553082
- TLSH T199B012013CDC661DDB1F0F02D73244CC0904CD911D1404B5F7447D46D43080C3383004
- MD5 SHA1 SHA512 TLSH
menu/clock.vtf
- SHA256 febc4e921526eb535b5d2bf281a08a653a99e10d411e8f60689dc09235981372
- MD5 de65ec2214e2bd38628e96f19da25d7b
- SHA1 d3b24fb40823c6ce7881e8b6a0e4124f7b12602a
- SHA512 c16202566ca1168cf49cefd3e2d601daba48cd6f1c25947114c14de480a0f2374670e6e19fd5937e033d93670d01ef67644fdcac3dc2b6f4caf80eaeb0ba35d3
- SSDEEP 384:XiZC6IeE/KWdCW20EW1nnPmcZh328GhVttpxSDocSZz1r/aiRGhYuCvK0Du6:IC6B3WdIHWMc33IrrQSZz1r/aishYZ9
- TLSH T1148385A41954CAE16249F4F0F4531CF4A2F90CA4EDD1206BD5B6FE367ABDB06268F01E
- MD5 SHA1 SHA512 SSDEEP TLSH
menu/menu.vmt
- SHA256 385577a527dbb39f8da628d2ba5d2db36c8801546834a92f92e93d8bacef9dc6
- MD5 d5845addc9070d45a608594cadd4a746
- SHA1 a8993b64f7e709a219dda73ee91a7fea122deea6
- SHA512 70ce292f974188575f66479ba87b6c8ef5a741c2affa8ee7867923af52e4a06dae49c2566be837ea43d76a2c000e17f8970b63ee4e41a34eb712bf5630e8f19c
- TLSH T16CB012013CCC651D9B1F0F01D33244CC0945CD821C1404F9F7443D46D02280C13C7000
- MD5 SHA1 SHA512 TLSH
menu/menu.vtf
- SHA256 0447694d2f815c07425736ee194024dbdb1a6af41e8ae9b0e284afe714799e56
- MD5 10b2becfec4b850e92b24cb57357e01c
- SHA1 f7e3c68ea0f6ef858aa313d7fd0222c0aac46b61
- SHA512 69195ccfa5bcc4fdb9cd3fccaee76af36c9c3c91df7d130d3cb52b9cef1e23e0f8b2928251f7a99b6169321ec3b36ffd08a64093e2f19e820793542aed9ef5d0
- SSDEEP 3072:M9IOScxEsIIAS2WCZ60Pp1uw8S+YivT3DjPZ+MCjdP:MW+jISCZph1Z+YiL3DjPZxCZ
- TLSH T16D55A3A26BACE659F53A67B4F966E0FD79000CF0DD42022F60C5FE7B3431A89085E59D
- MD5 SHA1 SHA512 SSDEEP TLSH
settings.ini
- SHA256 903a2af2f148858737c3a38870b0dd4996c40d1c48baa92184118905098335b8
- MD5 a3f17cf1aa5d2cc90405b3ca820683e6
- SHA1 4356057b61b6660bc3071484b2e5cc9aae5b5099
- SHA512 165a770298e99fe48ec52843cfa1877b99982a44f2999c396670c6fe735215ac97ff4e4b00c8e21a8ddb0f499fc8f7d89e61aaeee580c6e03f242fd3bf86e2b0
- TLSH T13211CB02808E518F1ADD3AD1C43446672BF185F20DE034A3E6B30EA96F2842B4CD6336
- MD5 SHA1 SHA512 TLSH
vH.dll
- IMPHASH 8082e3377759f6ce96fe00c7d32f5934
- SHA256 be9ab7de3c0bb2278d5939fc7e308fadf1454c90e5bc4692cdae1f7d0f306c8c
- MD5 d3215f69ff6bd90ff5224f5b534be0ac
- SHA1 03ef580645f02df5552b5812674de06588374eb6
- SHA512 6545c41190c5de36ffc29c3b94026ef9c222b9c0f473a397dc232eac5a47b37cbcd9fefa724490306a2ccca17a9e5dd8e6e608b4b6143b1bc73310dc5c6c0e76
- SSDEEP 3072:Qsbyszv9HC1TQfaZCkx1+p1ytsXsxBNOX3ycBNdsAg0Fu5+5qx6feYuaS8:QMb9HCCaZJvtusXwrvsAO5Fx6/zR
- TLSH T11744C02179B7CC36C4AD453C8420AB784AFE572257B8C8E77FE90E6E6D302D046BB255
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
88680
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualProtect
GetModuleHandleA
Sleep
GetProcAddress
CreateThread
DisableThreadLibraryCalls
SetConsoleTitleA
SetConsoleTextAttribute
GetStdHandle
AllocConsole
AttachConsole
WriteConsoleA
GetCurrentProcess
GetModuleFileNameA
IsBadReadPtr
LoadLibraryA
GetTickCount
WritePrivateProfileStringA
GetPrivateProfileStringA
VirtualQuery
HeapAlloc
GetProcessHeap
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
RtlUnwind
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetLocalTime
GetCurrentThreadId
GetCommandLineA
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
WideCharToMultiByte
GetTimeZoneInformation
CloseHandle
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
WriteFile
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
CreateFileA
SetFilePointer
GetLocaleInfoA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
SetCursorPos
GetAsyncKeyState
PeekMessageA
GetForegroundWindow
GetCursorPos
ScreenToClient
tier0
g_pMemAlloc
GetCPUInformation
vstdlib
RandomSeed
RandomFloat
Name
.text
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=2, id=29, version=9254,
count=53, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=134, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=106, id=1, productName=Unmarked objects,
count=62, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
vH.exe
- IMPHASH 5099413ffe76c313622508fe829f86d7
- SHA256 62692b35f930ec6e3d94cb67a59acaed85aec3554045fde9e2b98d01176a34b5
- MD5 19efc9703a0251ac6ba6820266351064
- SHA1 2163e9cd1c093ba8b6b2c1509771e1f364b9b4c9
- SHA512 7a77099faa5892d466b7b72c8564cd162a1609f6c8a21427a7613820cb115a6b5b44f4f0fc172094d6ac49d9724edd94deab3348bd32678c66685e26beab8732
- SSDEEP 3072:wHOq9jA+lnJTVl3tmkdw2EJjsDEf0VO+bI:dqZ5VrwjsE00+b
- TLSH T14794830BF325CE62F05A4A3CC1BA8BF593055C96C672075362D0BD157CB66F12BA22ED
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6443
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Documents and Settings\Andrew\Desktop\loader\SkyH4x's VIP Private Hook v5.2.3\Loader Source Code\Release\marauder loader.pdb
kernel32
CloseHandle
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
GetProcAddress
WriteProcessMemory
VirtualAllocEx
OpenProcess
lstrlenW
lstrlenA
GetCurrentProcess
ExitProcess
CreateThread
CreateMutexA
VirtualProtect
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
ReadFile
SetEndOfFile
SetFilePointer
Sleep
GetModuleHandleA
GetLastError
GetModuleFileNameA
TerminateProcess
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
InterlockedExchange
VirtualQuery
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
CreateFileA
HeapSize
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
GetSystemInfo
user32
CreateDialogParamA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfW
FindWindowA
GetWindowThreadProcessId
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
Name
.text
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
388KB
Virtual Size
387KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=59, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=13, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=5, id=93, version=2179,
count=79, id=1, productName=Unmarked objects,
count=5, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
visitor2.ttf
- SHA256 48ccd009dfe6a07223cc3571dc906acea1a255e67c72a121ced1b5071fbb06bb
- MD5 3307527b2e40cd7d2e60451145dc3282
- SHA1 a73d09d416e838df358ad5457ed27ec6342b6e29
- SHA512 7ef4b560a4c1b8ac960b8ccec64f130e27930bf6ac36b2dc627f35d9a3cf4e58e39363aedd86ae06de6334974fd20613ee910e745dd4fb4ea6272ac57d6072a8
- SSDEEP 768:8XYQkVLhe1Ebwfc3rnVGLhyroTdL33RDH5:8jWe6bc5NTJ
- TLSH T177F27F1AF35FB41EC8148735229D42EEE15E43BC46230A5F7D9862A4D8B12918E3DFB7
- MD5 SHA1 SHA512 SSDEEP TLSH