vtun-windows-amd64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
vtun-windows-amd64.zip
Size 6.2MB
Sample261027-egalvaat4y
SHA256 0accb1fc00aca7efbcbd7fa9c1b87242a1b32e91fb5924f85f363279555dc424
MD5 7c18427d6d95bb9c44f896cde21e56bd
SHA1 7f36212282a9195ed932d4b919ba65a4b239b9d7
SHA512 861487f1b0d48254c3713406ef43903748a07592b6c63dff798ce6b096fd4219a382697469d34b3d139fc758c08fa359b8bf8510944b754826662e86e5c120d3
SSDEEP 196608:BSknmb0AD4AIkTclZDEOGMLqH0tZQvQ5VLAR:MvPUA4ZDEvMlnVkR
TLSH
T1C3663377E3229581DCCCBB4618B04EF76863DD311FC87637269022199AA1B32CAFD749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/vtun-windows-amd64.exe

File Explorer

vtun-windows-amd64.zip

.zip 6.2MB
vtun-windows-amd64.exe

.exe 17.3MB

vtun-windows-amd64.zip

SHA256 0accb1fc00aca7efbcbd7fa9c1b87242a1b32e91fb5924f85f363279555dc424
MD5 7c18427d6d95bb9c44f896cde21e56bd
SHA1 7f36212282a9195ed932d4b919ba65a4b239b9d7
SHA512 861487f1b0d48254c3713406ef43903748a07592b6c63dff798ce6b096fd4219a382697469d34b3d139fc758c08fa359b8bf8510944b754826662e86e5c120d3
SSDEEP 196608:BSknmb0AD4AIkTclZDEOGMLqH0tZQvQ5VLAR:MvPUA4ZDEvMlnVkR
TLSH
T1C3663377E3229581DCCCBB4618B04EF76863DD311FC87637269022199AA1B32CAFD749
MD5 SHA1 SHA512 SSDEEP TLSH

vtun-windows-amd64.exe

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 78f0cb66ab6e844ec438a5620c5c9cd64cb3e8ec9b3dd6b80ab56960845863f1
MD5 9ee9b4a00c287caeaa9abe3ed05e8b44
SHA1 f8ab5e4d0db83bea210456607c6400f8e5320c27
SHA512 90bcb2da723b8ce59270362d957489bb948a085557c0e066adae0ead7af07fa9262251e37c5bc0e477b2b0ede5a25b03b8ef1ca11c6315d9acaf68d9591868b5
SSDEEP 98304:kgAg6hqWjhmFXlrq62IPYatZgfVc2hv80n3vzmyVTzJRxBlPx1duvzX4F2BwBZkR:kgZGUFXE62IQaXg990mDuvkcrifneM7
TLSH
T18E075B47F8A105E8C1ADD274C662A223BB717C445B3127D76F60F6642F32BD0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

529440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

7.9MB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

772KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

190KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

vtun-windows-amd64.zip

vtun-windows-amd64.exe

kernel32

generic