Venus[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Venus.exe
Size 677KB
Sample260916-v8deta11ft
SHA256 ac11975ccd433e55530293932920de2d8e2aff6384d1695a2dc660bb778a6a17
MD5 64e51d1e71b370f987fac06e17d0113d
SHA1 ceff90cd8bd9aa7a29b4707c76a698e51d9667be
SHA512 d857c866a6ed5e9fe1ffb986d952319ca6a72c9978ad827e60e7e8361b5f16ecc7f0eb4c38e8c5f4f14523cd84e16fa8a51bcfc39fbbe9c9f9b6ee291a679bd4
SSDEEP 12288:z4P638T8oUT1UJ8bFAvcinmD6w8yUAiAngohcHM:1sT8PaibFAUim2zoiAnNcHM
TLSH
T1F2E48D51F1A401FCD03BE0399687B92BFB76344417215ADB73E449982FA77E4ABBA301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Venus.exe

File Explorer

Venus.exe

.exe 677KB

Venus.exe

IMPHASH 71dbf64b98214ff75db1416bcb9fc402
SHA256 ac11975ccd433e55530293932920de2d8e2aff6384d1695a2dc660bb778a6a17
MD5 64e51d1e71b370f987fac06e17d0113d
SHA1 ceff90cd8bd9aa7a29b4707c76a698e51d9667be
SHA512 d857c866a6ed5e9fe1ffb986d952319ca6a72c9978ad827e60e7e8361b5f16ecc7f0eb4c38e8c5f4f14523cd84e16fa8a51bcfc39fbbe9c9f9b6ee291a679bd4
SSDEEP 12288:z4P638T8oUT1UJ8bFAvcinmD6w8yUAiAngohcHM:1sT8PaibFAUim2zoiAnNcHM
TLSH
T1F2E48D51F1A401FCD03BE0399687B92BFB76344417215ADB73E449982FA77E4ABBA301
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

549408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Roblox Data\RbxExt\ExternalBase\Venus\build\Venus.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

QueryPerformanceCounter Sleep GetModuleFileNameA FindFirstFileA FindNextFileA FindClose GetFileAttributesA DeleteFileA CreateDirectoryA GetCurrentProcess RtlCaptureStackBackTrace GetModuleHandleExA GetTickCount64 K32GetModuleBaseNameA K32GetModuleInformation GetLocalTime AddVectoredExceptionHandler GetConsoleScreenBufferInfo SetConsoleScreenBufferSize GetStdHandle SetCurrentConsoleFontEx SetConsoleWindowInfo GetConsoleMode WriteConsoleW GetModuleHandleA VerSetConditionMask SetConsoleOutputCP Process32First Module32Next GetProcessId Module32First OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle GetWindowsDirectoryA GlobalUnlock InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetModuleHandleW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetConsoleWindow WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc GetLocaleInfoA MultiByteToWideChar SetConsoleCP

user32

SetClipboardData EmptyClipboard MonitorFromPoint DispatchMessageA GetWindowRect DestroyWindow SetWindowLongA MessageBoxA DefWindowProcA CreateWindowExA SetLayeredWindowAttributes SetCapture TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow ShowWindow GetSystemMetrics GetAsyncKeyState SendInput FindWindowA GetKeyState GetMessageExtraInfo LoadCursorA GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetClipboardData GetForegroundWindow GetKeyboardLayout SetCursor GetClientRect CloseClipboard IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCursorPos OpenClipboard

gdi32

GetDeviceCaps

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

ShellExecuteW

ole32

CoCreateInstance

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

msvcp140

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ _Mtx_lock _Query_perf_counter _Mtx_unlock ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

dwmapi

DwmExtendFrameIntoClientArea

dbghelp

SymInitialize SymSetOptions SymFromAddr

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr __std_terminate __std_exception_copy strrchr __C_specific_handler __current_exception __current_exception_context _CxxThrowException memchr memcmp memcpy memmove memset __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

_fseeki64 _get_stream_buffer_pointers fflush fsetpos ungetc fclose fseek setvbuf fgetpos fgetc _set_fmode fputc __stdio_common_vfprintf __acrt_iob_func fwrite fopen_s _wfopen __stdio_common_vsprintf fread __p__commode __stdio_common_vsscanf ftell

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode _callnewh

api-ms-win-crt-string-l1-1-0

tolower strncpy_s strncpy _stricmp wcscpy_s strcmp wcslen strncmp strlen

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _exit terminate _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _c_exit _seh_filter_exe _set_app_type __p___argv _get_initial_narrow_environment _initterm _initterm_e exit system __p___argc

api-ms-win-crt-convert-l1-1-0

atoi atof

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

sinf powf sqrtf ceilf roundf expf atan2f acosf floorf cosf fmodf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale