a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c

General

Target
a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c
Size 1.8MB
Sample261002-j8tk9adf92
SHA256 a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c
MD5 888196ca73a1bd8b1f019d6d8bf8443f
SHA1 82ddeceec36f07625890793a704d86e044dd4643
SHA512 d2df3f86fd2d461a7620ab48f8e6e4a8cc0a67e5af42f44ad6113ec28c042b074ad09b1d1e4166718228c796e49e9254b7cb8b398344741cc4a4a1fa9c1d31b5
SSDEEP 24576:1el3++0DvfeUYqcZQCGm4YagXe4i7ojhsP5Lgrk1TWb4AN5:E3ovfe41Yde30jaNf1TWbdz
TLSH
T19485E111F840E432D19201B0E6A5CBF3592CADA1EB1558C7F3D0BDB67A349E1A73DB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c

File Explorer

a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c

.exe 1.8MB

a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c

IMPHASH 1df7cfa71495a8d5833182c6005b7af9
SHA256 a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c
MD5 888196ca73a1bd8b1f019d6d8bf8443f
SHA1 82ddeceec36f07625890793a704d86e044dd4643
SHA512 d2df3f86fd2d461a7620ab48f8e6e4a8cc0a67e5af42f44ad6113ec28c042b074ad09b1d1e4166718228c796e49e9254b7cb8b398344741cc4a4a1fa9c1d31b5
SSDEEP 24576:1el3++0DvfeUYqcZQCGm4YagXe4i7ojhsP5Lgrk1TWb4AN5:E3ovfe41Yde30jaNf1TWbdz
TLSH
T19485E111F840E432D19201B0E6A5CBF3592CADA1EB1558C7F3D0BDB67A349E1A73DB1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

147630

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\Ventoy\Plugson\vs\VentoyPlugson\Release\VentoyPlugson.pdb

kernel32

GetLogicalDrives CreateMutexA WaitForSingleObject ReleaseMutex DeleteFileA CloseHandle ReadFile GetFileInformationByHandleEx WriteFile DeviceIoControl GetUserDefaultUILanguage GetVolumeInformationA CreateFileW GetFileAttributesW MultiByteToWideChar CopyFileA GetLastError GetFileAttributesA CreateFileA SetEvent CreateThread SetFilePointerEx GetFileSize WideCharToMultiByte CreateEventA FlushFileBuffers CreateDirectoryW FindFirstFileW SetHandleInformation TlsSetValue SetLastError EnterCriticalSection FindNextFileW GetLongPathNameW GetCurrentProcess TerminateProcess SetThreadPriority LeaveCriticalSection InitializeCriticalSection GetFullPathNameA FindClose GetCurrentThreadId DuplicateHandle GetVersion Sleep GetFileAttributesExW GetCurrentThread TlsAlloc QueryPerformanceFrequency DeleteFileW RaiseException LoadLibraryW GetProcAddress DeleteCriticalSection FreeLibrary TlsGetValue CreateProcessA GetSystemTimeAsFileTime TlsFree QueryPerformanceCounter MoveFileA LoadLibraryExA GetModuleFileNameW GetCurrentDirectoryA SetCurrentDirectoryA SetDllDirectoryA GetCurrentDirectoryW SetCurrentDirectoryW CreateDirectoryA WriteConsoleW SetEndOfFile HeapSize GetProcessHeap GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFullPathNameW DecodePointer GetExitCodeProcess HeapReAlloc GetConsoleOutputCP RemoveDirectoryW GetFileSizeEx LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetTimeZoneInformation HeapAlloc HeapFree GetSystemInfo VirtualProtect VirtualQuery GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InitializeCriticalSectionAndSpinCount LoadLibraryExW SetStdHandle GetFileType ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetConsoleMode ReadConsoleW CreateProcessW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreatePipe GetCommandLineA GetCommandLineW GetStdHandle ExitProcess

user32

GetDlgItem LoadIconA SendMessageA DialogBoxParamA SetWindowTextW EndDialog MessageBoxW EnableWindow

ws2_32

WSAStartup getsockname send socket ntohs shutdown htons ioctlsocket getnameinfo setsockopt listen ntohl select closesocket bind accept __WSAFDIsSet WSACleanup recv htonl

Sharing

General

Malware Config

Signatures

File Explorer

a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c

kernel32

user32

ws2_32

generic