vesta[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
vesta.exe
Size 4.9MB
Sample261024-sld2qaaw5s
SHA256 ca06b2b18b51e75877a176a829da4229de6752946768aba5772b804e504caeaf
MD5 71b1adebc14054946409fdf0aef2e565
SHA1 3e944a3eaf2f109af98256d354618febaae914d0
SHA512 1f877ae7323d62f5db1cc7f43b6a9837b15ad4c5d74edef2f3a5c28270db931ebb62a177eb0a53bd6801da91cb62d298a2d1d168d0996eb791e1c5ae530ce168
SSDEEP 49152:vPI2P0zDNGgTsPfD6wC9bn8D/o3mwVFd2kldZs/+5vn/Pi8ThgKKlCOrX26Km6Qm:U7IdgBJ/qM7+rKm6cp8KWd6Lo/S8
TLSH
T15C36BE57A2E801EDD037C139CAAADA13E775745643701BEF36AC4A6A1F736E01E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vesta.exe

File Explorer

vesta.exe

.exe 4.9MB

vesta.exe

IMPHASH 096f135fa47ba0062903a9b8a066b84d
SHA256 ca06b2b18b51e75877a176a829da4229de6752946768aba5772b804e504caeaf
MD5 71b1adebc14054946409fdf0aef2e565
SHA1 3e944a3eaf2f109af98256d354618febaae914d0
SHA512 1f877ae7323d62f5db1cc7f43b6a9837b15ad4c5d74edef2f3a5c28270db931ebb62a177eb0a53bd6801da91cb62d298a2d1d168d0996eb791e1c5ae530ce168
SSDEEP 49152:vPI2P0zDNGgTsPfD6wC9bn8D/o3mwVFd2kldZs/+5vn/Pi8ThgKKlCOrX26Km6Qm:U7IdgBJ/qM7+rKm6cp8KWd6Lo/S8
TLSH
T15C36BE57A2E801EDD037C139CAAADA13E775745643701BEF36AC4A6A1F736E01E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3024584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

vesta.pdb

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

ole32

CoCreateInstance CoTaskMemFree CoUninitialize CoInitializeEx

dxgi

CreateDXGIFactory1

dwmapi

DwmExtendFrameIntoClientArea DwmGetWindowAttribute

dcomp

DCompositionCreateDevice

winmm

timeBeginPeriod timeEndPeriod

ntdll

RtlPcToFileHeader RtlUnwind RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx

comdlg32

GetOpenFileNameW

advapi32

RegGetValueW RegOpenKeyExA RegQueryValueExA RegCloseKey RegCreateKeyExW RegSetValueExW

shell32

SHFileOperationW SHGetKnownFolderPath

bcrypt

BCryptGenRandom BCryptHash

kernel32

CompareStringW GetTimeFormatW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode ReadConsoleW GetTimeZoneInformation GetExitCodeProcess CreatePipe DuplicateHandle GetFileType SetStdHandle GetDateFormatW VirtualProtect CreateMutexW GetLastError CloseHandle SetDefaultDllDirectories SetEvent CreateEventW WaitForMultipleObjects CreateWaitableTimerExW CreateWaitableTimerW SwitchToThread SetWaitableTimer Sleep SetThreadPriority GetCurrentThread SetThreadInformation WaitForSingleObject CreateToolhelp32Snapshot Process32FirstW OpenProcess QueryFullProcessImageNameW Process32NextW MultiByteToWideChar CompareStringOrdinal ReadProcessMemory Module32FirstW Module32NextW VirtualQueryEx LoadLibraryExA GetProcAddress WideCharToMultiByte GetModuleHandleW GetFileAttributesW GetWindowsDirectoryW CreateProcessW QueryPerformanceFrequency QueryPerformanceCounter GetTickCount64 GetCurrentThreadId SetLastError GetProcessTimes GetCurrentProcess GetSystemTimeAsFileTime GetSystemInfo OutputDebugStringA lstrcmpW GlobalAlloc GlobalLock GlobalUnlock GlobalFree MoveFileExW GetLocaleInfoA LoadLibraryA FreeLibrary CreateFileW GetFileSizeEx SetFilePointerEx WriteFile ReleaseMutex SetEndOfFile SetUnhandledExceptionFilter GetModuleFileNameW GetModuleHandleExW GetTempPathW GetFileInformationByHandle ReadFile DeleteFileW GetCurrentProcessId GetModuleFileNameA FormatMessageA CreateFileA HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetStartupInfoW IsDebuggerPresent InitializeSListHead TerminateProcess UnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx ExitProcess DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection DecodePointer EncodePointer CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RaiseException InitOnceComplete InitOnceBeginInitialize GetFileInformationByHandleEx CopyFileW AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFinalPathNameByHandleW GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW AcquireSRWLockShared ReleaseSRWLockShared WakeConditionVariable GetLocaleInfoEx LocalFree SleepConditionVariableSRW WakeAllConditionVariable GetExitCodeThread WaitForSingleObjectEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive FlsFree IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize FlushFileBuffers WriteConsoleW FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA GetStdHandle ReleaseSRWLockExclusive

user32

SendInput GetClipboardData SetClipboardData CloseClipboard EmptyClipboard OpenClipboard PtInRect GetWindowRect UnhookWinEvent SetWinEventHook IntersectRect GetWindowPlacement IsWindowVisible IsIconic SetWindowPos MonitorFromRect EnumWindows GetClassNameW GetWindow CreateWindowExW PostQuitMessage LoadCursorA SetCursor DefWindowProcW GetDpiForWindow EnumThreadWindows GetParent SetWindowsHookExW GetWindowLongPtrW GetCursorInfo GetKeyboardLayout ToUnicodeEx GetKeyboardState WindowFromPoint ScreenToClient GetMonitorInfoW MonitorFromWindow UnregisterClassW DestroyWindow ShowWindow SetWindowDisplayAffinity PostMessageW MsgWaitForMultipleObjectsEx DispatchMessageW TranslateMessage PeekMessageW RegisterClassExW GetClassInfoExW SetLayeredWindowAttributes GetKeyNameTextW MapVirtualKeyW GetWindowThreadProcessId GetForegroundWindow GetCursorPos FindWindowW IsWindow SetCursorPos ClientToScreen GetAncestor GetGUIThreadInfo GetClientRect GetAsyncKeyState ClipCursor PostThreadMessageW SetProcessDpiAwarenessContext MessageBoxW UnhookWindowsHookEx CallNextHookEx SetWindowLongPtrW GetMessageW EnumDisplaySettingsW

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

570KB

Virtual Size

715KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

vesta.exe

d3d11

d3dcompiler_47

ole32

dxgi

dwmapi

dcomp

winmm

ntdll

comdlg32

advapi32

shell32

bcrypt

kernel32

user32

imm32

generic