VI[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VI.exe
Size 218KB
Sample261018-tybb2aey5q
SHA256 11f8c9f38cc0878a0188e938cafa4c57b54f21065bad870eaf722d5d073a8fd2
MD5 155e5cc8d007793645726422c0b37611
SHA1 c9594cbeb4547b9a6c7008f54e99bcc30a4a9464
SHA512 8dac237acdbef2984c830d64c322039e69e82490382391ae068d7b109489b9df1f8b10882652ee48123681b9332cbc76e6fa0a423a055b9052de640559511ec4
SSDEEP 6144:lnIZhYjbao9KBt5WAp04mde7doS+pMe5QEzs/Xy:NJna7nNdAMYDzsq
TLSH
T11924C01D5A280C7EC676D1B9CED35802FB31788A4766EADF63404EE10F176E49E3E642
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VI.exe

File Explorer

VI.exe

.exe 218KB

VI.exe

IMPHASH a79463312b18b65a42b8399c8465ca96
SHA256 11f8c9f38cc0878a0188e938cafa4c57b54f21065bad870eaf722d5d073a8fd2
MD5 155e5cc8d007793645726422c0b37611
SHA1 c9594cbeb4547b9a6c7008f54e99bcc30a4a9464
SHA512 8dac237acdbef2984c830d64c322039e69e82490382391ae068d7b109489b9df1f8b10882652ee48123681b9332cbc76e6fa0a423a055b9052de640559511ec4
SSDEEP 6144:lnIZhYjbao9KBt5WAp04mde7doS+pMe5QEzs/Xy:NJna7nNdAMYDzsq
TLSH
T11924C01D5A280C7EC676D1B9CED35802FB31788A4766EADF63404EE10F176E49E3E642
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

60016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\fonse\Downloads\VI\x64\Release\VI.pdb

kernel32

WideCharToMultiByte MultiByteToWideChar GetFileInformationByHandleEx GetComputerNameA GetModuleHandleW GetLastError AreFileApisANSI CreateFile2 AllocConsole GetConsoleWindow CloseHandle Process32FirstW Process32NextW CreateToolhelp32Snapshot GetTempPathA GetCurrentThreadId GetStdHandle GetCurrentProcess SetConsoleTextAttribute GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree Sleep QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter

user32

ReleaseDC TranslateMessage BringWindowToTop SystemParametersInfoA SetWindowsHookExW SetForegroundWindow GetWindowThreadProcessId GetMessageW GetDC UnhookWindowsHookEx GetForegroundWindow AttachThreadInput ExitWindowsEx DispatchMessageW GetAsyncKeyState ShowWindow GetSystemMetrics SetWindowPos CallNextHookEx

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteDC DeleteObject BitBlt

advapi32

LookupPrivilegeValueA GetUserNameA OpenProcessToken AdjustTokenPrivileges

shell32

ShellExecuteA

msvcp140

??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Thrd_detach _Query_perf_counter ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency _Cnd_do_broadcast_at_thread_exit

ws2_32

gethostbyname inet_ntoa WSAStartup gethostname

wininet

InternetConnectA HttpSendRequestA HttpOpenRequestA InternetOpenA InternetCloseHandle

gdiplus

GdipSaveImageToFile GdiplusStartup GdiplusShutdown GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImageEncodersSize

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception _CxxThrowException __C_specific_handler __std_exception_copy __std_exception_destroy memcpy __current_exception_context __std_terminate memmove memset

api-ms-win-crt-stdio-l1-1-0

fwrite ungetc fsetpos fread fgetc _fseeki64 fgetpos fflush _set_fmode __acrt_iob_func freopen_s fputc __p__commode fclose _get_stream_buffer_pointers setvbuf

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen strlen

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _register_onexit_function _set_app_type _seh_filter_exe _c_exit abort _initialize_onexit_table _cexit __p___argv __p___argc _exit _beginthreadex terminate exit _initterm_e _initterm system

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr