VantaAim[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VantaAim.exe
Size 916KB
Sample261024-2lwffaxvew
SHA256 9da98670398e41b824771de0630831a67c07eb374973e4c93b2d7ccbcd0dc984
MD5 17fd93dfeadbef3764bbdb776205344d
SHA1 491d8cafa737b90fd35c881695bdea5c5eb4ca5f
SHA512 2f1cedd1800aa92b3ff89459369414eabca3878e4e4c0deb528828732513e264187f396500b6c0e592e9df948c6f2cd97f494325ed10237512f26f4231c4ed6f
SSDEEP 12288:lj1NQjF6JlLDjQlFVB2fh5goxgTi/bg5qCx7+g3tmAZq6ADLeHjYYVbzbtWnMEVz:e6JjQlbEfh5goxgTcbg5jnIL6iN
TLSH
T15A159E29E6A801F9D07BC1B8CA969512E77274160331A6DF13918B6E3F276E44E3FF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VantaAim.exe

File Explorer

VantaAim.exe

.exe 916KB

VantaAim.exe

IMPHASH 5b126321d69c4515d57c6957dac86c89
SHA256 9da98670398e41b824771de0630831a67c07eb374973e4c93b2d7ccbcd0dc984
MD5 17fd93dfeadbef3764bbdb776205344d
SHA1 491d8cafa737b90fd35c881695bdea5c5eb4ca5f
SHA512 2f1cedd1800aa92b3ff89459369414eabca3878e4e4c0deb528828732513e264187f396500b6c0e592e9df948c6f2cd97f494325ed10237512f26f4231c4ed6f
SSDEEP 12288:lj1NQjF6JlLDjQlFVB2fh5goxgTi/bg5qCx7+g3tmAZq6ADLeHjYYVbzbtWnMEVz:e6JjQlbEfh5goxgTcbg5jnIL6iN
TLSH
T15A159E29E6A801F9D07BC1B8CA969512E77274160331A6DF13918B6E3F276E44E3FF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

441456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetWindowThreadProcessId EnumWindows SetWindowLongPtrW GetWindowLongPtrW ClientToScreen MessageBoxW LoadCursorW GetClientRect GetAncestor GetDC GetForegroundWindow SetTimer ReleaseCapture MapVirtualKeyW GetWindow AdjustWindowRectEx TranslateMessage DispatchMessageW PostMessageW DefWindowProcW SetProcessDpiAwarenessContext ReleaseDC PostQuitMessage RegisterClassW UnregisterClassW CreateWindowExW GetMessageW IsWindow IsChild DestroyWindow ShowWindow UpdateLayeredWindow IsWindowVisible IsZoomed GetAsyncKeyState GetKeyNameTextW SendInput

gdi32

SelectObject DeleteObject DeleteDC CreateSolidBrush CreateCompatibleDC CreateDIBSection

gdiplus

GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipCloneImage GdipDisposeImage GdipCreateBitmapFromScan0 GdipDeleteGraphics GdipSetCompositingMode GdipSetSmoothingMode GdipSetTextRenderingHint GdipDrawLine GdipDrawRectangle GdipDrawEllipse GdipGraphicsClear GdipFillRectangle GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFont GdipDeleteFont GdipDrawString GdipSetStringFormatAlign GdipCreateStringFormat GdipDeleteStringFormat GdipGetImageGraphicsContext

shell32

CommandLineToArgvW

ole32

CoInitializeEx CoTaskMemFree CoUninitialize

shlwapi

ord12

advapi32

RegQueryValueExW EventUnregister EventWriteTransfer EventSetInformation EventRegister RegCloseKey RegOpenKeyExW RegGetValueW

comdlg32

GetSaveFileNameW GetOpenFileNameW

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpQueryHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen

crypt32

CryptProtectData CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom

kernel32

GetLocaleInfoW LCMapStringW VirtualProtect IsValidLocale HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapReAlloc ReadFile TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread GetFileSizeEx GetModuleHandleExW GetFileType GetStdHandle FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader SetFilePointerEx ReadConsoleW IsValidCodePage GetACP InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW LCMapStringEx GetCPInfo CompareStringEx DecodePointer EncodePointer WakeAllConditionVariable GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx HeapSize SetEndOfFile WriteConsoleW GetModuleFileNameW AreFileApisANSI CreateFile2 SetFileInformationByHandle GetCommandLineW GetEnvironmentVariableW CloseHandle OpenProcess ReadProcessMemory LoadResource LockResource SizeofResource FindResourceW LocalFree QueryFullProcessImageNameW MoveFileExW MultiByteToWideChar WideCharToMultiByte K32EnumProcessModules CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileAttributesW CreateFileW OutputDebugStringA OutputDebugStringW RtlUnwind GetLastError GetProcAddress GetProcessHeap HeapFree GetModuleHandleW LoadLibraryExW LoadLibraryW FreeLibrary QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW

Name

.text

Size

620KB

Virtual Size

619KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

185KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

VantaAim.exe

user32

gdi32

gdiplus

shell32

ole32

shlwapi

advapi32

comdlg32

winhttp

crypt32

bcrypt

kernel32

generic