vesta[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
vesta.exe
Size 7.6MB
Sample260923-xtfmqsad89
SHA256 f05c7d3188d810d3366603a9cefd9d10841537f6e56ad95b8f6b3fc9e8010df4
MD5 c012371aa17daa43f5d3840552e84a9b
SHA1 db176c17a20e126281e72dc29725005b61f7faa5
SHA512 7328ba77bbd770658e81e3588941daf8c95c4aaa6d2d63bd7b742d145ea3c7528078536726cf67755f729fe86547546a4f28c7fa99ed8978b5955820634dea0b
SSDEEP 49152:Qi6ojbc54VBuTiYunz1wTdjRsV40gBNy8YqozjYEaxW6h6nc8hYiVjEOXspca0lM:16Jerci2oVN3Yh6n5XsL0lO94HE9o
TLSH
T1E986AD12A29C029CE026B138CA5B8643E3F27C495735DFDB3AE85D971F6B5E07A3D211
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vesta.exe

File Explorer

vesta.exe

.exe 7.6MB

vesta.exe

IMPHASH 5a79ddc58a242a712b43d5c49c6ea92e
SHA256 f05c7d3188d810d3366603a9cefd9d10841537f6e56ad95b8f6b3fc9e8010df4
MD5 c012371aa17daa43f5d3840552e84a9b
SHA1 db176c17a20e126281e72dc29725005b61f7faa5
SHA512 7328ba77bbd770658e81e3588941daf8c95c4aaa6d2d63bd7b742d145ea3c7528078536726cf67755f729fe86547546a4f28c7fa99ed8978b5955820634dea0b
SSDEEP 49152:Qi6ojbc54VBuTiYunz1wTdjRsV40gBNy8YqozjYEaxW6h6nc8hYiVjEOXspca0lM:16Jerci2oVN3Yh6n5XsL0lO94HE9o
TLSH
T1E986AD12A29C029CE026B138CA5B8643E3F27C495735DFDB3AE85D971F6B5E07A3D211
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5974212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

vesta.pdb

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

ole32

CoUninitialize CoInitializeEx CoCreateInstance

dwmapi

DwmGetWindowAttribute DwmExtendFrameIntoClientArea

dcomp

DCompositionCreateDevice

winmm

timeEndPeriod timeBeginPeriod

ntdll

RtlCaptureContext RtlUnwind RtlPcToFileHeader RtlVirtualUnwind RtlLookupFunctionEntry RtlUnwindEx

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

SetThreadToken RegOpenKeyExW RegGetValueW RegCloseKey RegQueryValueExA RegOpenKeyExA LookupPrivilegeValueW OpenProcessToken PrivilegeCheck GetTokenInformation DuplicateTokenEx RegQueryValueExW CreateProcessAsUserW RevertToSelf SetTokenInformation

shell32

ShellExecuteExW

kernel32

GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW GetExitCodeProcess CreatePipe GetTimeZoneInformation DeleteFileW FlsFree CreateMutexW GetLastError CloseHandle WaitForSingleObject ExitProcess SetThreadPriority GetCurrentThread SwitchToThread SetWaitableTimer Sleep SetThreadInformation CreateWaitableTimerExW CreateWaitableTimerW MoveFileExW CreateToolhelp32Snapshot Process32FirstW OpenProcess QueryFullProcessImageNameW Process32NextW MultiByteToWideChar CompareStringOrdinal ReadProcessMemory Module32FirstW Module32NextW VirtualQueryEx SetEvent CreateEventW WaitForMultipleObjects LoadLibraryExA GetProcAddress WideCharToMultiByte FreeLibrary SetEnvironmentVariableW LoadLibraryExW GetTickCount64 GetSystemInfo GetProcessTimes GetCurrentProcess GetSystemTimeAsFileTime GetModuleHandleW GetCurrentThreadId SetLastError OutputDebugStringW GetModuleFileNameW lstrcmpiW GetCommandLineW lstrcmpW CreateProcessW GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA IsValidCodePage FormatMessageA CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA FlsSetValue FlsGetValue FlsAlloc GetCommandLineA WriteFile GetStdHandle DuplicateHandle FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetStartupInfoW IsDebuggerPresent InitializeSListHead GetCurrentProcessId TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualProtect InitializeCriticalSectionEx GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize IsProcessorFeaturePresent RaiseException WakeConditionVariable GetLocaleInfoEx LocalFree GetFileInformationByHandleEx CopyFileW AreFileApisANSI GetTempPathW SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW EnumSystemLocalesW GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize SetEndOfFile GetModuleFileNameA WriteConsoleW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW

user32

CallNextHookEx GetClipboardData SetClipboardData CloseClipboard EmptyClipboard OpenClipboard UnhookWinEvent SetWinEventHook IntersectRect GetWindowPlacement IsWindowVisible IsIconic SetWindowPos MonitorFromRect EnumWindows GetClassNameW GetWindow PostQuitMessage LoadCursorA SetCursor DefWindowProcW GetDpiForWindow EnumThreadWindows SetWindowLongPtrW GetWindowLongPtrW GetCursorInfo SetWindowsHookExW ToUnicodeEx GetKeyboardState WindowFromPoint EnumDisplaySettingsW GetMonitorInfoW MonitorFromWindow UnregisterClassW DestroyWindow ShowWindow SetWindowDisplayAffinity PostMessageW MsgWaitForMultipleObjectsEx DispatchMessageW TranslateMessage PeekMessageW RegisterClassExW GetClassInfoExW SetLayeredWindowAttributes CreateWindowExW ScreenToClient GetKeyNameTextW MapVirtualKeyW GetWindowThreadProcessId GetForegroundWindow GetCursorPos FindWindowW IsWindow SetCursorPos ClientToScreen GetAncestor GetGUIThreadInfo GetClientRect GetAsyncKeyState SetProcessDpiAwarenessContext PostThreadMessageW ClipCursor UnhookWindowsHookEx GetKeyboardLayout GetMessageW GetParent

imm32

ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow ImmReleaseContext

Name

.text

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1016KB

Virtual Size

1015KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

516KB

Virtual Size

650KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

vesta.exe

d3d11

d3dcompiler_47

ole32

dwmapi

dcomp

winmm

ntdll

comdlg32

advapi32

shell32

kernel32

user32

imm32

generic