velext_v1[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
velext_v1.exe
Size 4.9MB
Sample260930-j85zaasakf
SHA256 0a78225ff73d6c93f41b2eebc747c701610ce26c10962ac94de58eb02d29f94c
MD5 bcf33da3b7b868f9a1c05d88f657d04b
SHA1 ab79397c4eb2de7235c89eea0fcf4c35194c16a8
SHA512 b3860da1bd876da0b8cbacbd9d64d08018a6b754ab5f7034549a18ce1e5944fe4d1a70419723356aaac73de0b7358d755326b0eaeebcb8b3ae7f8e3597074c07
SSDEEP 49152:IfLTiLLwVSArgI+MM/daUFgTiejvJe4ZjnN+DdnqZl9enc0amCyO3/XGP:ArgtbapTZQj3
TLSH
T11D36AD17B79811ADD93B943C8BD68787E379B851036583EF12E85A115FA32E01FFA360
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
velext_v1.exe

File Explorer

velext_v1.exe

.exe 4.9MB

velext_v1.exe

IMPHASH 1b3a34aa0fcb7f2df91c64ba979743c8
SHA256 0a78225ff73d6c93f41b2eebc747c701610ce26c10962ac94de58eb02d29f94c
MD5 bcf33da3b7b868f9a1c05d88f657d04b
SHA1 ab79397c4eb2de7235c89eea0fcf4c35194c16a8
SHA512 b3860da1bd876da0b8cbacbd9d64d08018a6b754ab5f7034549a18ce1e5944fe4d1a70419723356aaac73de0b7358d755326b0eaeebcb8b3ae7f8e3597074c07
SSDEEP 49152:IfLTiLLwVSArgI+MM/daUFgTiejvJe4ZjnN+DdnqZl9enc0amCyO3/XGP:ArgtbapTZQj3
TLSH
T11D36AD17B79811ADD93B943C8BD68787E379B851036583EF12E85A115FA32E01FFA360
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2410408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpReadData

wininet

HttpQueryInfoA HttpOpenRequestA InternetCrackUrlA InternetSetOptionA HttpAddRequestHeadersA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA InternetReadFile

shell32

ShellExecuteA ShellExecuteW

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

CreateFileW FindClose RtlCaptureContext WakeAllConditionVariable GetFileInformationByHandleEx MoveFileExW GetSystemTimeAsFileTime InitializeSListHead GetSystemFirmwareTable GetVolumeInformationW SizeofResource GetModuleFileNameW LockResource LoadResource FindResourceW GetModuleHandleW WideCharToMultiByte SetWaitableTimer CreateMutexA WaitForSingleObject GetLastError CloseHandle GetConsoleWindow SetConsoleOutputCP CreateWaitableTimerExW MultiByteToWideChar Sleep EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetCurrentThreadId RtlVirtualUnwind GetTickCount64 GetEnvironmentVariableA SetThreadPriority GetCurrentThread K32GetModuleFileNameExW GetDiskFreeSpaceExW RtlLookupFunctionEntry OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent CreateDirectoryW IsDebuggerPresent GetLocaleInfoEx FormatMessageA LocalFree SleepConditionVariableSRW GetCurrentProcessId ReleaseSRWLockExclusive AcquireSRWLockExclusive GetFileAttributesA

user32

SendMessageW FillRect SetWindowLongPtrW GetPropW IsWindowVisible GetWindowRect CallWindowProcW DefWindowProcW EndDialog GetMessageExtraInfo GetCapture GetKeyboardLayout SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData RemovePropW GetKeyNameTextW GetWindowLongPtrW ShowWindow mouse_event DestroyWindow OffsetRect SetWindowPos CreateWindowExW ScreenToClient UnregisterClassW RegisterClassExW IsWindow PeekMessageW SetLayeredWindowAttributes LoadCursorW PostQuitMessage GetCursorPos GetWindowThreadProcessId GetWindow ClientToScreen EnumWindows GetMessageW GetKeyState CallNextHookEx GetKeyboardState DispatchMessageW UnhookWindowsHookEx TranslateMessage SetWindowsHookExW SetTimer MapVirtualKeyW SetDlgItemTextW TrackMouseEvent FrameRect GetDlgItemTextW SendDlgItemMessageW GetForegroundWindow DialogBoxIndirectParamW RedrawWindow ToUnicode wsprintfA GetWindowTextW ReleaseDC IsIconic InvalidateRect EnumDisplaySettingsW KillTimer DrawTextW GetDlgItem GetClientRect GetWindowDC SetPropW SetFocus PostThreadMessageW

gdi32

SetBkMode SetBkColor DeleteObject CreateSolidBrush SetTextColor

advapi32

RegOpenKeyExA RegCreateKeyExA RegSetValueExA RegDeleteValueA RegQueryValueExA RegCloseKey

msvcp140

?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z _Thrd_detach ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??1_Lockit@std@@QEAA@XZ _Cnd_signal ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??Bios_base@std@@QEBA_NXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?good@ios_base@std@@QEBA_NXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??0_Lockit@std@@QEAA@H@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Xtime_get_ticks _Thrd_join _Mtx_lock _Mtx_unlock _Cnd_broadcast ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?uncaught_exceptions@std@@YAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

msvcp140_atomic_wait

__std_atomic_notify_all_direct __std_atomic_wait_direct

iphlpapi

GetAdaptersInfo

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler_noexcept _CxxThrowException __current_exception memcmp memchr memset memmove memcpy strchr strrchr __C_specific_handler _purecall __std_terminate __std_exception_copy __std_exception_destroy __current_exception_context

api-ms-win-crt-heap-l1-1-0

free realloc malloc _callnewh _set_new_mode

api-ms-win-crt-time-l1-1-0

_difftime64 strftime _localtime64_s _mkgmtime64 clock _gmtime64_s _time64

api-ms-win-crt-runtime-l1-1-0

__p___wargv _initterm_e _exit __p___argc _crt_atexit _cexit _c_exit _get_initial_wide_environment _initialize_wide_environment _register_onexit_function _initialize_onexit_table _configure_wide_argv _set_app_type _seh_filter_exe _register_thread_local_exe_atexit_callback _invoke_watson _beginthreadex abort exit terminate _errno _initterm

api-ms-win-crt-string-l1-1-0

toupper strcmp isalnum isspace strspn islower ispunct iscntrl isxdigit isupper isgraph strpbrk tolower isdigit strncmp strncat strcspn strncpy isalpha _strnicmp

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsprintf __stdio_common_vfprintf fflush __stdio_common_vsnprintf_s ftell putchar fseek _wfopen __acrt_iob_func fputc fclose fgetc fwrite fgetpos setvbuf _fseeki64 ungetc fread _set_fmode __stdio_common_vsscanf fsetpos _get_stream_buffer_pointers

api-ms-win-crt-convert-l1-1-0

strtoul atof atoi strtof strtoull strtod strtoll

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

ceilf floorf atanf atan2f atan2 atan asinf asin acosf acos _fdclass cos _dclass fmod cosf fmodf log log10 lroundf log2 logf pow powf sin sinf cosh frexp modf _dsign sinh round ldexp sqrt exp sqrtf tan expf tanf __setusermatherr floor ceil tanh

api-ms-win-crt-utility-l1-1-0

qsort