Velocity Exploit_74764841[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Velocity Exploit_74764841.exe
Size 702KB
Sample260930-gmd8bsysds
SHA256 74b57e66864831c686f2a1bb445c7ba2a4bd5d985aa9879e67bb8a7c847e04f5
MD5 77f8a77ae73b41044db787aecfbee35d
SHA1 5e5e23441a6259befbc0b1e6b7755e61937ac186
SHA512 8be8f024b8abf7dee02e3782d37046f0cdb152b5c9bc1f74eda1fd489d89c90ff85f945c659fa50c6caf8ebac8e2814845600c22a4702710cdf61a188288941a
SSDEEP 12288:4nZsx0v39rYke42Kn/ECCNRgf9dGcA8QCkeJ2P:VO95Pn/EbK9dGUQBKw
TLSH
T1E5E47D26B66801FCE0A7D1B9C9924913F7F1B847177197CF03A04A66AF2B6E05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Velocity Exploit_74764841.exe

File Explorer

Velocity Exploit_74764841.exe

.exe 702KB

Velocity Exploit_74764841.exe

IMPHASH ff4e7752f06f00f9ce77f26b38b1f57c
SHA256 74b57e66864831c686f2a1bb445c7ba2a4bd5d985aa9879e67bb8a7c847e04f5
MD5 77f8a77ae73b41044db787aecfbee35d
SHA1 5e5e23441a6259befbc0b1e6b7755e61937ac186
SHA512 8be8f024b8abf7dee02e3782d37046f0cdb152b5c9bc1f74eda1fd489d89c90ff85f945c659fa50c6caf8ebac8e2814845600c22a4702710cdf61a188288941a
SSDEEP 12288:4nZsx0v39rYke42Kn/ECCNRgf9dGcA8QCkeJ2P:VO95Pn/EbK9dGUQBKw
TLSH
T1E5E47D26B66801FCE0A7D1B9C9924913F7F1B847177197CF03A04A66AF2B6E05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Password

qiwueqiew

PE Signature issue

Digest

a1:62:48:05:b6:d3:e0:d6:11:b9:c6:aa:1d:d7:99:8c:c5:54:ab:30:f5:be:97:0e:f9:16:86:35:e7:2a:b5:75

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=AN Soft,O=AN Soft,L=Bergen op Zoom,ST=North Brabant,C=NL

Chains

Jan 1, 0001

Subject

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1c:cf:9d:67:cd:e2:19:ff:12:d9:9a:ff:36:82:e5:a7

Issuer

CN=SSL.com Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 7, 2019 - Mar 3, 2034

Subject

CN=AN Soft,O=AN Soft,L=Bergen op Zoom,ST=North Brabant,C=NL

Serial Number

77:37:bb:9f:e3:4b:0f:1b:d5:af:da:23:3e:ea:b2:95

Issuer

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2026 - Jun 11, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Minor OS version

Major OS version

Entry point

351472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Samim\Desktop\Installer\x64\Release\Installer.pdb

comctl32

ord410 ord413 InitCommonControlsEx

kernel32

SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetFileAttributesW HeapReAlloc ReadConsoleW ReadFile GetFileAttributesExW GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetFileType SetFilePointerEx GetModuleHandleW GetTempPathW CreateProcessW CreateThread CloseHandle GetLastError Sleep GetTimeZoneInformation WaitForSingleObject GetModuleFileNameW CreateDirectoryW MultiByteToWideChar FindClose GetFileSizeEx HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapAlloc WriteFile GetStdHandle GetProcAddress TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlLookupFunctionEntry QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetStringTypeW WideCharToMultiByte GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetLocaleInfoEx LCMapStringEx WakeAllConditionVariable CompareStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead

user32

MessageBoxW SetWindowPos DestroyWindow PostMessageW DefWindowProcW CreateWindowExW GetWindowTextW EnableWindow EndPaint BeginPaint InvalidateRect SendMessageW PostQuitMessage DrawTextW GetClientRect SetWindowLongW LoadCursorW TranslateMessage FrameRect TrackMouseEvent DispatchMessageW ShowWindow RegisterClassExW GetWindowLongPtrW SetClassLongPtrW FillRect GetSystemMetrics UpdateWindow GetWindow GetMessageW GetWindowTextLengthW GetWindowLongW GetDC RegisterClassW ReleaseDC SetWindowTextW

gdi32

GetTextExtentPoint32W SelectObject CreateFontW GetStockObject SetTextColor SetBkMode LineTo CreatePen MoveToEx SetBkColor DeleteObject CreateSolidBrush RoundRect

advapi32

RegGetValueW RegSetValueExW RegCloseKey RegCreateKeyExW

shell32

SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

ole32

CoTaskMemFree

urlmon

URLDownloadToFileW URLOpenBlockingStreamA

gdiplus

GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipCloneImage GdipAlloc GdipLoadImageFromStream GdipGetImageWidth GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipDisposeImage GdipDrawImageRectI

wininet

HttpOpenRequestA InternetCrackUrlA InternetOpenUrlA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA InternetReadFile InternetOpenW InternetOpenUrlW

Name

.text

Size

525KB

Virtual Size

524KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

130KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Velocity Exploit_74764841.exe

PE Signature issue

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

urlmon

gdiplus

wininet

generic