vesta.zip
- SHA256 93b531358d645030be0f2aee6e8d98219da1795061b1aea7619f513846a3b411
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cheat/vesta.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
cheat/vesta.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
lua/Web Radar.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
lua/Web Radar.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target vesta.zip
- Size 4.4MB
- Sample261009-1jsfbst1d1
- SHA256 93b531358d645030be0f2aee6e8d98219da1795061b1aea7619f513846a3b411
- MD5 a5a2db359edcf46a839305849d3ab74d
- SHA1 dc1cce14c249b9d142a3fa2409d25f60f4d1f6be
- SHA512 2036d674374d0b8dadf2bc54fabab23af064b40787e03efefb20283b8def02c08d3e9ab151109e6180ed824b7b119d0445e0cea942ccd0d2318f8d2dc68b8570
- SSDEEP 98304:SijZMBF6IS3ZkgS66AYMfq87M+cNGUtm7aeTSRJ6dF6A1ZN4w15fT9qoGGd7+orl:nNMz6d3ZvoAYiONGUtm7PTS+dF6A1ZR9
- TLSH T10D26335BBD697707B0D3A2FE46DE88F32A44BA5C631704ACB058EC34000B1F75BB9A95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cheat/vesta.exe
File Explorer
-
vesta.zip.zip 4.4MB
-
cfg/full-legit.cfg50KB
-
cfg/legit.cfg50KB
-
cfg/semi-rage.cfg50KB
-
cfg/unknowncheats.cfg56KB
-
cheat/vesta.exe.exe 4.7MB
-
cheat/vesta.pdb10.3MB
-
lua/Web Radar.lua.ps1 64KB
cfg/full-legit.cfg
- SHA256 02bd108c2ad4b16d77810f315d9d86e7cd8082b1acb15eab500c004c14029f03
- MD5 9e5b83337ea5e2d127f364cec4652586
- SHA1 da78fc5cafeea38d322941ed197ac1809511fb5c
- SHA512 4330cb96c83185cd798c134c232c5716fe1eacb9c188d151c21489ce6159b891c5c92a9b57669470bef4624db82d4a6e35cd9cb957787895c2aec828c6321225
- SSDEEP 384:bzb0Z0V2Eonz2EyTYdx2IyTYdx2IyTYdx2IyTYdx2IyTYdx2IyTYdx27CAyls0zJ:bESUm8Dm8Dm8Dm8Dm8Dm87DrH
- TLSH T120334A16CA310DF6759A6839487D234213A0625B5CF77C34B88C9A8C0F4F66FB5F6AD2
- MD5 SHA1 SHA512 SSDEEP TLSH
cfg/legit.cfg
- SHA256 794670fc980bcc99a810f43bc11afceca70b86145273a251d8ae7a862552ed69
- MD5 22bf93a108491463e1c9252621ed3888
- SHA1 f35437a4fd6b3df47dfb4c4ffa91d640727b0114
- SHA512 c611facbf14ecb63f025395488bf88d7634ff964259f35fd8f9524b4f0d9547f65c8fb0128c17abb6fe060adf0a665d9d6146b6d59c616799f53861575ba4c30
- SSDEEP 384:bzb0Z0VJEon42EyTYdx2IyTYdx2IyTYdx2IyTYdx2IyTYdx2IyTYdx27CVyls0ze:bESMm8Dm8Dm8Dm8Dm8Dm8sD6H
- TLSH T1E6334A16CA310DF6759A6839487D234213A0625B5CF77C34B88C9A8C0F4F66FB5F6AD2
- MD5 SHA1 SHA512 SSDEEP TLSH
cfg/semi-rage.cfg
- SHA256 e7fad5ce76c78313fe96181812a61a974ec64abf3755b285f16afe36d5b85747
- MD5 0ee4a869fa261bb2e4c28aed99f71deb
- SHA1 5e6e71efbee5c254b796fb46fc7d25173642bc9f
- SHA512 c80cc98f19e5e15747e4e4aa65896e4a62f6b129072e014553cbfb3e54b7d97c7da1c681b0b92431d36c4735429a753e0a3b877af8f2e29750cb41c7e76edf10
- SSDEEP 384:bzb0Z0VJEoni2CyTYdx2IyTYdx2IyTYdx2IyTYdx2IyTYdx2IyTYdx27CVyls0ze:bESgm8Dm8Dm8Dm8Dm8Dm8sD6H
- TLSH T142335A16CA310DF6759A6839487D234213A0625B5CF77C34B88C9A8C0F4F66FB5F6AD2
- MD5 SHA1 SHA512 SSDEEP TLSH
cfg/unknowncheats.cfg
- SHA256 1a4e2d9ed6d19be33f33e463d59c687aef54c28adfadf3a996709eba099b5528
- MD5 32571c58930ef221833a34e14123319b
- SHA1 6373d546e1478140229f61fc5eeb0ab9a049aa1e
- SHA512 4597d90a76e344e1c2fbf05d812f52a8e7aaa08d55350293e091f758bf026f7ca59a433fab59a4868f958cebd75e1b1e060b280b42f43ef9c260713836dea433
- SSDEEP 768:2NiIfZqTRty4/ZXgjty4/ZXgQty4/ZXgjty4/ZXgQty4/ZXgQty4/ZXgE5ne:p5e
- TLSH T1C2431718CA210DFE76BE623D587C5346D390631B14D25C2BBAFC588D0FB3A63B485E99
- MD5 SHA1 SHA512 SSDEEP TLSH
cheat/vesta.exe
- IMPHASH 2428a5bfafba7790c4743854ab8f7421
- SHA256 9b9bb4416631666372cf343f2a92b94f06a4a3f00cf1f6db30917e2e6f6a978e
- MD5 43df62faec84e53e9b5e2f7e0f939cc8
- SHA1 0311d0067183da37ae8c8760068485bbe93b385c
- SHA512 bf12265f020264629b6a4620251dffda5d4b76c9bbcb9c1347a21d4d40b09dc110d3cbe9bcea4a529a4b4a5bb98f34c138c3f478bc1dccd8805237073b5ab1e4
- SSDEEP 49152:WhTKPypxi2Li0mPiJI7BZVKO7WyVnN2PbsFyi7p9lXDMKw4nD6YHNThy0TeAOo1w:WhOCLO7KbsFH19lVeAOo7/u
- TLSH T14F36AE07A2A502E8D037C178CABADA03F775385547705BEF36AC4A6A1F636E01E7B711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2807492
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
vesta.pdb
d3d11
D3D11CreateDevice
d3dcompiler_47
D3DCompile
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
dxgi
CreateDXGIFactory1
dwmapi
DwmGetWindowAttribute
DwmExtendFrameIntoClientArea
dcomp
DCompositionCreateDevice
winmm
timeBeginPeriod
timeEndPeriod
ntdll
RtlPcToFileHeader
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwind
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
SetTokenInformation
RegQueryValueExA
RegOpenKeyExA
OpenProcessToken
GetTokenInformation
LookupPrivilegeValueW
PrivilegeCheck
DuplicateTokenEx
SetThreadToken
RegCloseKey
CreateProcessAsUserW
RevertToSelf
shell32
ShellExecuteExW
kernel32
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
GetExitCodeProcess
CreatePipe
GetTimeZoneInformation
DeleteFileW
FlsSetValue
FlsGetValue
CreateMutexW
GetLastError
CloseHandle
WaitForSingleObject
ExitProcess
SetThreadPriority
GetCurrentThread
SwitchToThread
SetWaitableTimer
Sleep
SetThreadInformation
CreateWaitableTimerExW
CreateWaitableTimerW
GetTempPathW
CreateDirectoryW
CreateFileW
GetFileSizeEx
SetFilePointer
SetEndOfFile
GetCurrentProcessId
GetTickCount64
WriteFile
MoveFileExW
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
QueryFullProcessImageNameW
Process32NextW
MultiByteToWideChar
CompareStringOrdinal
ReadProcessMemory
Module32FirstW
Module32NextW
VirtualQueryEx
LoadLibraryExA
GetProcAddress
WideCharToMultiByte
GetModuleHandleW
GetCurrentThreadId
SetLastError
OutputDebugStringW
GetSystemInfo
GetProcessTimes
GetCurrentProcess
GetSystemTimeAsFileTime
lstrcmpW
CreateProcessW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetLocaleInfoA
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryA
FreeLibrary
GetModuleFileNameW
lstrcmpiW
IsValidCodePage
GetModuleFileNameA
FormatMessageA
CreateFileA
ReadFile
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
FlsAlloc
GetCommandLineA
GetStdHandle
DuplicateHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
LCMapStringEx
FlsFree
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
GetModuleHandleExW
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
InitOnceComplete
InitOnceBeginInitialize
IsProcessorFeaturePresent
RaiseException
GetLocaleInfoEx
LocalFree
GetFileInformationByHandleEx
CopyFileW
AreFileApisANSI
SetFileInformationByHandle
GetFinalPathNameByHandleW
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
WakeConditionVariable
AcquireSRWLockShared
IsValidLocale
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
HeapSize
GetCommandLineW
WriteConsoleW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
VirtualProtect
WaitForSingleObjectEx
GetExitCodeThread
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
user32
CallNextHookEx
SendInput
GetClassNameA
GetClipboardData
SetClipboardData
CloseClipboard
EmptyClipboard
OpenClipboard
UnhookWinEvent
SetWinEventHook
IntersectRect
GetWindowPlacement
IsWindowVisible
IsIconic
SetWindowPos
MonitorFromRect
EnumWindows
GetClassNameW
PostQuitMessage
LoadCursorA
SetCursor
DefWindowProcW
GetDpiForWindow
EnumThreadWindows
GetParent
SetWindowLongPtrW
GetCursorInfo
GetKeyboardLayout
SetWindowsHookExW
ScreenToClient
GetMonitorInfoW
MonitorFromWindow
UnregisterClassW
DestroyWindow
ShowWindow
SetWindowDisplayAffinity
PostMessageW
MsgWaitForMultipleObjectsEx
DispatchMessageW
TranslateMessage
PeekMessageW
RegisterClassExW
GetClassInfoExW
SetLayeredWindowAttributes
CreateWindowExW
GetWindow
IsWindowEnabled
GetWindowLongPtrW
WindowFromPoint
EnumDisplaySettingsW
GetKeyNameTextW
MapVirtualKeyW
GetWindowThreadProcessId
GetForegroundWindow
GetCursorPos
FindWindowW
IsWindow
SetCursorPos
ClientToScreen
GetAncestor
GetGUIThreadInfo
GetClientRect
GetAsyncKeyState
MessageBoxW
SetProcessDpiAwarenessContext
PostThreadMessageW
ClipCursor
UnhookWindowsHookEx
ToUnicodeEx
GetMessageW
GetKeyboardState
imm32
ImmSetCandidateWindow
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
Name
.text
Size
3.0MB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1021KB
Virtual Size
1020KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
568KB
Virtual Size
689KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
122KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=57, id=260, version=33145,
count=35, id=259, version=33145,
count=1, id=253, version=35207,
count=19, id=260, version=35207,
count=14, id=259, version=35207,
count=107, id=261, version=35207,
count=2, id=261, version=35229,
count=67, id=260, version=35229,
count=217, id=261, version=33145,
count=31, id=257, version=33145,
count=320, id=1, productName=Unmarked objects,
count=97, id=265, version=35229,
count=1, id=255, version=35229,
count=1, id=258, version=35229,
cheat/vesta.pdb
- SHA256 06920d11c73eb88bd04b7e2f70e09cb10d50ff514ba1f8f3a558059ca5106cc0
- MD5 e86ad3e1e3bde8cf133e26cb1806f87d
- SHA1 7aea172147a61de3ba2ca0a8a1537e7b943fc7a1
- SHA512 fb906402c19446c37152dab1ee5a49e512da2f9020c20089a6c660888d4e61a9fe3663fbf9d0a506e2606a125541c0155b388fa2d9b81cd52efe0f8f5a7f8290
- SSDEEP 49152:1hh5UmPDfpH0PZVVY20e3DdE8P7qiOnSjMkckkSZdccQb5vqBGNCJv+lSh9i5PCl:fh5UmPL2PTINtn
- TLSH T15AB67C13B70B9DA3C41F237560D7072DF3F4EA82578B6A8B9985B3950DC6348EF5A980
- MD5 SHA1 SHA512 SSDEEP TLSH
lua/Web Radar.lua
- SHA256 207b08e8d300a80d1161ec336c18693167cd69ce0e1096ea34bb91cefe6968cc
- MD5 8b4cfb64c5f06f35004929cea921a61d
- SHA1 0a3661cc33d970778133950da878492a4007d633
- SHA512 f666582777162da7fcd3abce2dccf762558248cf5fc290e9681b8e7b4c66584081aa5220c38f29c0dc28b7adce846b754290aa046f3d3c213a1dd7afc37e22b7
- SSDEEP 768:rHgvMr9HS3F44TYY99HtorqrQA2rigwFwBr5i2sdWpUqwSI2uVOxICv4AwRpLhxK:80r9y3jhcI2svKLcOxIKwnLheZDn
- TLSH T148534BA966A21134415392D86D9B8B0477A86003510EDDB472FE814C6FE8BBCD2F7FDE
- MD5 SHA1 SHA512 SSDEEP TLSH