valotrigger[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
valotrigger.exe
Size 11.7MB
Sample261020-qqfd8set9j
SHA256 944f5b7e9fc37beb9afc731eada623e8d3d0f3aa46ced3ec0f9745a98e1ce364
MD5 fc88dc184768d97070566ffc910cbc1d
SHA1 d8fc529e5b2b615ab27795aa3197efa8b3e53071
SHA512 286a66a1136effffd498830cb5d81c4b68357f0c3bddf9e3644310597885f9348dc5b7ecc22b835fc3fb8b174c6ba49b2849f9ff8a6fec235ae0c3d8a52ed3ef
SSDEEP 196608:ssTVLSqWJ/fyGTBmowzDDoofaRqNMOKSiPB:9VLypqGcowznoofc/PB
TLSH
T168C67BC7266D39CBC0A567BC554190ACF0DFD82DAB99D3F0CAD7FC4A45960821C42BBA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
valotrigger.exe

File Explorer

valotrigger.exe

.exe 11.7MB

valotrigger.exe

IMPHASH d225e2392ece6dda13fa5d5164968fcd
SHA256 944f5b7e9fc37beb9afc731eada623e8d3d0f3aa46ced3ec0f9745a98e1ce364
MD5 fc88dc184768d97070566ffc910cbc1d
SHA1 d8fc529e5b2b615ab27795aa3197efa8b3e53071
SHA512 286a66a1136effffd498830cb5d81c4b68357f0c3bddf9e3644310597885f9348dc5b7ecc22b835fc3fb8b174c6ba49b2849f9ff8a6fec235ae0c3d8a52ed3ef
SSDEEP 196608:ssTVLSqWJ/fyGTBmowzDDoofaRqNMOKSiPB:9VLypqGcowznoofc/PB
TLSH
T168C67BC7266D39CBC0A567BC554190ACF0DFD82DAB99D3F0CAD7FC4A45960821C42BBA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

364528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Paid things dont delete\val\valotrigger-master\x64\Release\valotrigger.pdb

kernel32

FreeLibrary QueryPerformanceCounter SetThreadDescription SetPriorityClass GetCurrentThreadId GetCurrentThread GetModuleHandleW GetConsoleWindow AllocConsole GetFileAttributesW WriteConsoleW SetEndOfFile HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc GetFileSizeEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLastError LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread DeleteFileW GetProcAddress QueryPerformanceFrequency LoadLibraryA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc IsDebuggerPresent Sleep MultiByteToWideChar WaitForSingleObject K32GetModuleFileNameExW ReadFile LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError K32EnumProcessModules CreateProcessW ExitProcess CloseHandle GetLocaleInfoW GetCurrentProcess RaiseException RtlPcToFileHeader RtlUnwindEx LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI MoveFileExW GetFileInformationByHandleEx GetStringTypeW WaitForSingleObjectEx GetExitCodeThread WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead TerminateProcess RtlUnwind

user32

ReleaseDC GetDC SetClipboardData GetClipboardData GetSystemMetrics GetAsyncKeyState SendInput MessageBoxW EmptyClipboard GetMessageW DefWindowProcW GetWindowRect DestroyWindow SetWindowPos SetWindowLongPtrW CreateWindowExW CallNextHookEx UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW UnhookWindowsHookEx SetLayeredWindowAttributes TranslateMessage SetWindowsHookExW PostThreadMessageW PostQuitMessage UpdateWindow GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard

gdi32

BitBlt DeleteDC GetBitmapBits CreateCompatibleDC SelectObject DeleteObject CreateCompatibleBitmap

shell32

ShellExecuteW SHGetFolderPathW

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

dxgi

CreateDXGIFactory1

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

Name

.text

Size

543KB

Virtual Size

543KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

148KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11.0MB

Virtual Size

11.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

valotrigger.exe

kernel32

user32

gdi32

shell32

d3d11

dxgi

imm32

d3dcompiler_47

dwmapi

generic