vesta[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
vesta.exe
Size 4.8MB
Sample261009-yc9d6adx21
SHA256 52b8c3add2e0be23614d1ce2472e0e110c7f9e9c76e697b6cf57f0dd956882da
MD5 33f07c8b8f50c100ab64505eab196735
SHA1 2d76f17ec96e1087cf5470d10390be047ccb7e07
SHA512 9c58acfa4d3916dda6d726324f23466c25fa6f7617ceef86524d61966f787fdce21a0b81beb25491917e0bf73d506c5eabe913bfabde610e51d964d2d67dea0d
SSDEEP 49152:55kTBgTSRmoYZutqDr7w10og+56Ge8ub5QsLV4+coc9MqT01yggMvihHluGnu6vO:5OiHfZ6RuNQsLIvhWZ6veo2Q
TLSH
T1EE36BF03A3A401ECD436C178CA6ADA03E7B6785547346EEB325C5A2B1F636E46E7F710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vesta.exe

File Explorer

vesta.exe

.exe 4.8MB

vesta.exe

IMPHASH fb19ff42707a37434eab31c8567f651c
SHA256 52b8c3add2e0be23614d1ce2472e0e110c7f9e9c76e697b6cf57f0dd956882da
MD5 33f07c8b8f50c100ab64505eab196735
SHA1 2d76f17ec96e1087cf5470d10390be047ccb7e07
SHA512 9c58acfa4d3916dda6d726324f23466c25fa6f7617ceef86524d61966f787fdce21a0b81beb25491917e0bf73d506c5eabe913bfabde610e51d964d2d67dea0d
SSDEEP 49152:55kTBgTSRmoYZutqDr7w10og+56Ge8ub5QsLV4+coc9MqT01yggMvihHluGnu6vO:5OiHfZ6RuNQsLIvhWZ6veo2Q
TLSH
T1EE36BF03A3A401ECD436C178CA6ADA03E7B6785547346EEB325C5A2B1F636E46E7F710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2917712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

vesta.pdb

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

ole32

CoInitializeEx CoCreateInstance CoUninitialize

dxgi

CreateDXGIFactory1

dwmapi

DwmGetWindowAttribute DwmExtendFrameIntoClientArea

dcomp

DCompositionCreateDevice

winmm

timeBeginPeriod timeEndPeriod

ntdll

RtlUnwind RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlCaptureContext RtlVirtualUnwind

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

SetTokenInformation RegQueryValueExA RegOpenKeyExA OpenProcessToken GetTokenInformation LookupPrivilegeValueW PrivilegeCheck DuplicateTokenEx SetThreadToken RegCloseKey CreateProcessAsUserW RevertToSelf

shell32

ShellExecuteExW

kernel32

EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW GetExitCodeProcess CreatePipe GetTimeZoneInformation DeleteFileW GetStdHandle IsProcessorFeaturePresent CreateMutexW GetLastError CloseHandle WaitForSingleObject ExitProcess SetThreadPriority GetCurrentThread SwitchToThread SetWaitableTimer Sleep SetThreadInformation CreateWaitableTimerExW CreateWaitableTimerW GetTempPathW CreateDirectoryW CreateFileW GetFileSizeEx SetFilePointer SetEndOfFile GetCurrentProcessId GetTickCount64 WriteFile MoveFileExW CreateToolhelp32Snapshot Process32FirstW OpenProcess QueryFullProcessImageNameW Process32NextW MultiByteToWideChar CompareStringOrdinal ReadProcessMemory Module32FirstW Module32NextW VirtualQueryEx GetModuleFileNameW LoadLibraryExA GetProcAddress WideCharToMultiByte GetModuleHandleW GetCurrentThreadId SetLastError OutputDebugStringW GetSystemInfo GetProcessTimes GetCurrentProcess GetSystemTimeAsFileTime lstrcmpW CreateProcessW GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA FreeLibrary lstrcmpiW IsValidCodePage GetModuleFileNameA FormatMessageA CreateFileA ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA TerminateProcess DuplicateHandle FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetCPInfo GetStringTypeW LCMapStringEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection DecodePointer EncodePointer GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns RaiseException GetCommandLineA GetLocaleInfoEx LocalFree GetFileInformationByHandleEx CopyFile2 AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW FindClose WakeConditionVariable AcquireSRWLockShared ReleaseSRWLockShared InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread WaitForSingleObjectEx IsDebuggerPresent UnhandledExceptionFilter VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW GetUserDefaultLCID GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize GetCommandLineW WriteConsoleW IsValidLocale

user32

CallNextHookEx SendInput GetClassNameA GetClipboardData SetClipboardData CloseClipboard EmptyClipboard OpenClipboard UnhookWinEvent SetWinEventHook IntersectRect GetWindowPlacement IsWindowVisible IsIconic SetWindowPos MonitorFromRect EnumWindows GetClassNameW PostQuitMessage LoadCursorA SetCursor DefWindowProcW GetDpiForWindow EnumThreadWindows GetParent SetWindowLongPtrW GetCursorInfo GetKeyboardLayout SetWindowsHookExW GetKeyboardState ScreenToClient GetMonitorInfoW MonitorFromWindow UnregisterClassW DestroyWindow ShowWindow SetWindowDisplayAffinity MsgWaitForMultipleObjectsEx DispatchMessageW TranslateMessage PeekMessageW RegisterClassExW GetClassInfoExW SetLayeredWindowAttributes CreateWindowExW GetWindow IsWindowEnabled GetWindowLongPtrW WindowFromPoint EnumDisplaySettingsW GetKeyNameTextW MapVirtualKeyW GetWindowThreadProcessId GetForegroundWindow GetCursorPos FindWindowW IsWindow SetCursorPos ClientToScreen GetAncestor GetGUIThreadInfo GetClientRect GetAsyncKeyState MessageBoxW SetProcessDpiAwarenessContext PostThreadMessageW ClipCursor UnhookWindowsHookEx ToUnicodeEx GetMessageW PostMessageW

imm32

ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow ImmReleaseContext

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

569KB

Virtual Size

672KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

vesta.exe

d3d11

d3dcompiler_47

ole32

dxgi

dwmapi

dcomp

winmm

ntdll

comdlg32

advapi32

shell32

kernel32

user32

imm32

api-ms-win-core-synch-l1-2-0

generic