Veyro rebrands[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Veyro rebrands.exe
Size 941KB
Sample261012-ss397ats9j
SHA256 66b0f818d4de663035f01df7678239b02fc94be8a51a7158ae198c573883e1ac
MD5 3141cf03718b982df4cd721fda848c70
SHA1 e19b81e9f10b69a1fd4883faf466baae6664a8eb
SHA512 77f17310003b141df164b6b11d924ffe2e01f1ab0d6a652bbd2a4c52de32ca8577045ccf64aa41f45ce07e84df07211e8df8ca74fe50efed3fe798c74394f482
SSDEEP 24576:mjGSxVZiYVsCV+zDWZ1mVPtDdbzSpxOPzVv7WI/2e9:YxxVZBWWA5dbzSpxOPzVv7WI/2
TLSH
T1BE259E5FA7A401F8C5BBD17CC6578617E6B27049032096DB07E0CAA52F13BE16B3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Veyro rebrands.exe

File Explorer

Veyro rebrands.exe

.exe 941KB

Veyro rebrands.exe

IMPHASH 9eb9ea7b920ab65c5c0cb996523d8987
SHA256 66b0f818d4de663035f01df7678239b02fc94be8a51a7158ae198c573883e1ac
MD5 3141cf03718b982df4cd721fda848c70
SHA1 e19b81e9f10b69a1fd4883faf466baae6664a8eb
SHA512 77f17310003b141df164b6b11d924ffe2e01f1ab0d6a652bbd2a4c52de32ca8577045ccf64aa41f45ce07e84df07211e8df8ca74fe50efed3fe798c74394f482
SSDEEP 24576:mjGSxVZiYVsCV+zDWZ1mVPtDdbzSpxOPzVv7WI/2e9:YxxVZBWWA5dbzSpxOPzVv7WI/2
TLSH
T1BE259E5FA7A401F8C5BBD17CC6578617E6B27049032096DB07E0CAA52F13BE16B3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

Major OS version

Entry point

715936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a orqur soure code\protection\Auto updater (reseller only)\x64\Release\Auto updater.pdb

kernel32

AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA GetFileSizeEx CreateFileW VerifyVersionInfoW VerSetConditionMask WaitForMultipleObjects PeekNamedPipe ReadFile GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW WideCharToMultiByte MultiByteToWideChar GetTickCount QueryPerformanceCounter GetSystemInfo SleepEx LoadLibraryW GetProcAddress GetModuleHandleW FreeLibrary GetSystemDirectoryW QueryPerformanceFrequency LocalFree LeaveCriticalSection EnterCriticalSection InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageW SetLastError GetModuleHandleA GetModuleFileNameW GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetModuleFileNameA DeleteCriticalSection InitializeCriticalSectionEx GetLastError GetCurrentProcess GetFileInformationByHandleEx GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW GetConsoleWindow CloseHandle Sleep GetCurrentProcessId

user32

ShowWindow MessageBoxA

advapi32

CryptEncrypt RegDeleteKeyA CryptImportKey CryptDestroyKey SystemFunction036 GetTokenInformation OpenProcessToken CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW

shell32

ShellExecuteA

msvcp140

_Xtime_get_ticks _Query_perf_counter _Query_perf_frequency _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ??Bid@locale@std@@QEAA_KXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Xbad_function_call@std@@YAXXZ ?_Random_device@std@@YAIXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1_Lockit@std@@QEAA@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?uncaught_exception@std@@YA_NXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertOpenStore

ws2_32

inet_ntop WSAStartup WSACleanup bind connect getpeername getsockname htons gethostname ioctlsocket sendto recvfrom freeaddrinfo ntohs getaddrinfo listen htonl accept select getsockopt send WSACloseEvent WSACreateEvent __WSAFDIsSet WSAEnumNetworkEvents WSAEventSelect WSAIoctl WSAResetEvent WSAWaitForMultipleEvents socket closesocket WSAGetLastError recv inet_pton setsockopt WSASetLastError

shlwapi

PathFindFileNameW

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset wcschr memmove __C_specific_handler __current_exception __current_exception_context strstr memcmp memchr _CxxThrowException __std_terminate strchr __std_exception_destroy memcpy strrchr __std_exception_copy

api-ms-win-crt-stdio-l1-1-0

fflush fputc fread _close _fileno _write _read _fseeki64 __p__commode _set_fmode _get_stream_buffer_pointers _lseeki64 fgets _pclose fclose _wfopen _wopen _popen __stdio_common_vsscanf __stdio_common_vsprintf fsetpos ftell fseek feof fgetc fputs ungetc setvbuf fwrite __acrt_iob_func fgetpos

api-ms-win-crt-heap-l1-1-0

free calloc _set_new_mode realloc _callnewh malloc

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _errno _cexit exit _seh_filter_exe _set_app_type _configure_narrow_argv _initterm _initterm_e _exit system __p___argc __p___argv _c_exit terminate _register_thread_local_exe_atexit_callback _beginthreadex _initialize_onexit_table __sys_errlist _get_initial_narrow_environment abort __sys_nerr _invoke_watson _register_onexit_function _initialize_narrow_environment _invalid_parameter_noinfo_noreturn

api-ms-win-crt-filesystem-l1-1-0

_unlink _lock_file _unlock_file _wstat64 _fstat64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-string-l1-1-0

strcspn strncmp strspn strcmp wcsncmp strpbrk tolower wcsncpy _strdup _wcsdup wcspbrk

api-ms-win-crt-math-l1-1-0

_dsign __setusermatherr _fdopen

api-ms-win-crt-convert-l1-1-0

strtod strtol strtoll strtoull wcstombs atoi strtoul

api-ms-win-crt-time-l1-1-0

_time64 strftime _localtime64 _gmtime64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-utility-l1-1-0

qsort