Vanix[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Vanix.exe
Size 8.8MB
Sample261001-shh69stdjb
SHA256 d4e53686d8f83fee42636604f3587fb09419a81cf648be48e3ad71dae3e70c82
MD5 bc2d523cc3bcbb3169e4f1f6d8e3ba0c
SHA1 41bcc4a765ce97f1f80ca7fec7efdf7ead266bca
SHA512 c4b8b66c22abc4e07002eed7af0655e413aa790c1d72d9a1bd91fd7e40356f1b88bdc2e5693246e61d5cf9cdb68d9573c4c718c86b87c7e06b04d1682e50c0c6
SSDEEP 196608:p1anP2JQz1wTvgh3D5uVCATDMLbUDXQcaEMkE:SNzMgpluV1f4UDcETE
TLSH
T112960243F260416FD0AE60345293D717D2323C427325EBCBAB9266766BA77F0BE35A41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Vanix.exe

File Explorer

Vanix.exe

.exe 8.8MB

Vanix.exe

IMPHASH 65b5d3d360bd0b933b796b5bf1514093
SHA256 d4e53686d8f83fee42636604f3587fb09419a81cf648be48e3ad71dae3e70c82
MD5 bc2d523cc3bcbb3169e4f1f6d8e3ba0c
SHA1 41bcc4a765ce97f1f80ca7fec7efdf7ead266bca
SHA512 c4b8b66c22abc4e07002eed7af0655e413aa790c1d72d9a1bd91fd7e40356f1b88bdc2e5693246e61d5cf9cdb68d9573c4c718c86b87c7e06b04d1682e50c0c6
SSDEEP 196608:p1anP2JQz1wTvgh3D5uVCATDMLbUDXQcaEMkE:SNzMgpluV1f4UDcETE
TLSH
T112960243F260416FD0AE60345293D717D2323C427325EBCBAB9266766BA77F0BE35A41
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1098876

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

winhttp

WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpReceiveResponse WinHttpSetTimeouts WinHttpSendRequest WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpReadData

ntdll

ZwReadVirtualMemory

kernel32

SetConsoleTitleA GetCurrentProcess GetStdHandle Module32Next ExpandEnvironmentStringsA WaitForSingleObject Module32First OpenProcess CreateToolhelp32Snapshot Sleep QueryFullProcessImageNameA GetCurrentThread Process32Next CloseHandle FreeConsole CreateThread GetLocalTime VirtualProtectEx ExitProcess ReadProcessMemory WriteProcessMemory GetConsoleWindow CreateProcessA SetConsoleOutputCP CreateDirectoryA GetTickCount AllocConsole IsDebuggerPresent CheckRemoteDebuggerPresent GetExitCodeProcess CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA GetSystemTimeAsFileTime ReleaseSRWLockExclusive GetCurrentProcessId GetModuleHandleW SetConsoleTextAttribute Process32First GetModuleFileNameA SetConsoleCP QueryPerformanceCounter FreeLibrary GetStartupInfoW SetUnhandledExceptionFilter WakeAllConditionVariable GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive GetTickCount64 MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock InitializeSListHead WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress

user32

DefWindowProcW GetMessageA CallWindowProcW DispatchMessageA GetWindowRect DestroyWindow SetWindowPos SetWindowLongPtrW FillRect CreateWindowExW SendMessageW GetSystemMetrics UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow IsWindow SetTimer DrawTextA SetWindowLongA GetWindowTextA SetWindowDisplayAffinity DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage SendMessageA mouse_event PeekMessageA GetWindowLongPtrA DrawTextW UnregisterClassA KillTimer PostQuitMessage GetDesktopWindow SetWindowLongPtrA GetClipboardData RegisterClassExA UpdateWindow InvalidateRect BeginPaint EndPaint GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture FindWindowA SetClipboardData GetAsyncKeyState SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard

gdi32

BitBlt CreateCompatibleBitmap CreateFontA SelectObject CreateDIBSection GetTextExtentPoint32A CreateCompatibleDC GetStockObject DeleteDC TextOutW GetTextExtentPoint32W SetTextColor TextOutA SetBkMode LineTo CreatePen MoveToEx SetBkColor SetStretchBltMode CreateSolidBrush GetTextMetricsA RoundRect DeleteObject

msvcp140

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Xtime_get_ticks _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

winmm

timeBeginPeriod

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

msimg32

AlphaBlend

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception memcmp __intrinsic_setjmp _CxxThrowException memchr __std_exception_destroy __std_exception_copy __std_terminate strstr __C_specific_handler strrchr longjmp memcpy memmove memset

api-ms-win-crt-string-l1-1-0

strlen wcslen tolower isdigit toupper strncmp strcmp strncpy

api-ms-win-crt-stdio-l1-1-0

fgetc fwrite ftell _get_stream_buffer_pointers _fseeki64 __stdio_common_vsprintf_s __acrt_iob_func fsetpos feof ungetc fflush _set_fmode fclose fopen_s _wfopen __stdio_common_vsprintf __p__commode fread setvbuf __stdio_common_vsscanf ferror fputc freopen fseek __stdio_common_vfprintf fgetpos

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free realloc _callnewh

api-ms-win-crt-convert-l1-1-0

strtol strtoul atof

api-ms-win-crt-locale-l1-1-0

setlocale _configthreadlocale

api-ms-win-crt-time-l1-1-0

_time64 strftime _mktime64 _localtime64_s _difftime64

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _register_thread_local_exe_atexit_callback _c_exit _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _errno _register_onexit_function terminate _crt_atexit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

acosf powf atan2f ceilf __setusermatherr sinf sqrtf cosf fmodf ldexp