v2ray-windows-64_V4.45.2.zip
- SHA256 1cc5065fe9a7005d52c8df8c89f54d656eec176a6c21ad55109f8c2a48dd0adc
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
v2ctl.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
v2ctl.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
v2ray.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
v2ray.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
wv2ray.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
wv2ray.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target v2ray-windows-64_V4.45.2.zip
- Size 19.6MB
- Sample261027-ls51fsszht
- SHA256 1cc5065fe9a7005d52c8df8c89f54d656eec176a6c21ad55109f8c2a48dd0adc
- MD5 11f6a6afa5a133a59cda6a513ce86b51
- SHA1 7c4f1012f3e7262f5f94e658bf4dd2f2ecb0ae7d
- SHA512 b0179d456a13062ef72953c9cee2d35d65a4cbc7f0fcab77ce261bfc123d75bcceede86f1c93cd117ebb66f1433a9bf3eeaeca8dc11052cae7d94a3cb04bd050
- SSDEEP 393216:wfajgjnc/HqPwc/IolOMmzJMPy0VGP1f0pCCB0EkIGI2Y4SQQrcXk:9ync/HqPtOJGhGFoB0aZ5Qvk
- TLSH T1D42733E855375D4D7C70C94BE3C84EAA1D6383CBB686395A3CDEA16700802FA59398FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/v2ctl.exe unpack001/v2ray.exe unpack001/wv2ray.exe
File Explorer
-
v2ray-windows-64_V4.45.2.zip.zip 19.6MB
-
config.json4KB
-
geoip-only-cn-private.dat162KB
-
geoip.dat8.8MB
-
geosite.dat1.1MB
-
v2ctl.exe.exe 11.6MB
-
v2ray.exe.exe 17.2MB
-
vpoint_socks_vmess.json391B
-
vpoint_vmess_freedom.json537B
-
wv2ray.exe.exe 17.2MB
config.json
- SHA256 1bbadc5e1dfaa49935005e8b478b3ca49c519b66d3a3aee0b099730d05589978
- MD5 e865cf65e9d4b8366c3ec1420454a190
- SHA1 8a80b09a8521f99bf23b73575714a6fdbafc4947
- SHA512 2d6edd04bfd7d1f9217805211f97858c5f9f21ee27388128a8a858fd3036af1f76142ee254ffa2de5a3c6ff90280ec6c50e61af1584e9a1570b441ac76bc14c0
- SSDEEP 48:N50SHj9WOeRGyZ0sVGE457kHCPSKTN0fqsaYqsSDwVPSBWn5bRgRFFhu8vULMQGa:N55/4nCvDslqnAjg3juZxzvrR
- TLSH T188912E0ED1B419AB1DC86474ABDE3282B728C16B8875FC1035AF539C6F4997E40B92DF
- MD5 SHA1 SHA512 SSDEEP TLSH
geoip-only-cn-private.dat
- SHA256 753076fc35bd03f1576c9115fcb83a44287ae34f4f2d70821b27e92af3defa3a
- MD5 1aa87f4d2f818cfe5d50e9ea3992da3c
- SHA1 8c230fd7a4691c085ec530edf6a2e2ecadffc8f0
- SHA512 60324320d13f7e5a161745b2035ba7f8fee75d3a968705de0f9f17e295cdde872d284e1c731c08193061e2f6d882fae0d0d9194e2a726dc207f1228d26ef7c1d
- SSDEEP 1536:dk/A0F0w/7Rpv5xh7sLHEehNtuF2tATl5dG7Rj6Nan:dz8NV5c71u9ndoRvn
- TLSH T172F3FC3BDAB25467C6BB013D196A312B6F1D3420EDA4E2A127E9010CDED4B30E5BBD5D
- MD5 SHA1 SHA512 SSDEEP TLSH
geoip.dat
- SHA256 24f5251bc26f35bc616421fb93f0e1adee6d47c653cc993e29d6dc2f910bb23e
- MD5 174fea416e3bcd1ecc93165538658034
- SHA1 67fdd6441cefa9d5797aa0e892ebe9a43753001f
- SHA512 ef5941d147e1493ed7dcb8f5af3eb64449d8e97f5662472690ad148843c126c83adaeb398d4d4fb9c2435d3e201fa7e034345927695033c3579a36f1eb565d44
- SSDEEP 49152:73MhUKqZIcfBDncOkJlajO1vUyG6KlD6dbUBNqyql99:73MQIcfBDncOkJleO1vTG6KlD6dbx9
- TLSH T17596C83BE6B650F3D6BB123D497630576E0D34B4E4E4E2B0A7E50408CE98630E5BAE5D
- MD5 SHA1 SHA512 SSDEEP TLSH
geosite.dat
- SHA256 2395ee6b43ebcfc5ff3b2826ece2de14f8738c37ecd2f6f3ae6321eb7b32ab26
- MD5 444b48254b813d9fe73826ca73721654
- SHA1 ece90af9e5aa994632cd716b57162b4ede3ca439
- SHA512 faedae16037f15b4f9893456431f384252cc1b6a5c51fce6a3491a34643c3ac67c5638a8ed4103ccd62079158ff8c5eb6db1df7c7a576e61fad0806ee28eb6fe
- SSDEEP 12288:gUsgMUgREiObxRLYttctz/QbliAY62QxF92DimvGidPYnIby+:1/Rv9lH
- TLSH T1EA45A5BB8C114652362C692CA50824CC340D93F956DCDFD1DB648AA7E7E4AB923C4BFD
- MD5 SHA1 SHA512 SSDEEP TLSH
v2ctl.exe
- IMPHASH 9cbefe68f395e67356e2a5d8d1b285c0
- SHA256 d269b40d802ded86df1a1fd15f3f76c6a768c91fa84665cd674ab55d8e1c799a
- MD5 53a7b8d218b8f954fb1f3544534e80b3
- SHA1 01871bb249d2e49d39a860cb6df05ede72945983
- SHA512 98cd9fbb50794c462c9194ee92e913242769dba0e9d242783191e2360b53cc59266b970aed3cb5681ba265e9116cee59796efba27065dc20489b7217569e763a
- SSDEEP 98304:3vjteCnHhXRLdTfCxFEbEQziEA/DdB+dYHjDiILFQRHp8KBbY:fxNFRqFoEQzvAbdB+dYHj+ISE
- TLSH T18FC62903F89185A8C1EDD170C66682A6BB707C844B7473D36B60FBBA2B72BD45B79350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
413600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
5.4MB
Virtual Size
5.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5.7MB
Virtual Size
5.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
401KB
Virtual Size
831KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
113KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
v2ray.exe
- IMPHASH 9cbefe68f395e67356e2a5d8d1b285c0
- SHA256 28a3c3c773a3aa41b51c0a1ffccbb0c8fe54f972c081bfc81c827bfc4d9dc0e6
- MD5 618bf2291b182d1022cc8014797d9227
- SHA1 39c6b5daff75d953d97ce11b18c067a8913cb869
- SHA512 d1710b97204d81fe301a7d109837997669fa4743d3896d48432c591fb6f0c246d0c8e5998557936985a23f307484a9caaa09e41e5c876bcd78224d7760718565
- SSDEEP 196608:NitFMvGhPtU6ptkAN3xqCB+dYHjjdITyk:TvGFdtkO3x5dIm
- TLSH T1EB073A47F89141E8C5EDC170C5268262BB707C845F3063D36B60BB7A6B76BD89BBA350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
417440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
8.0MB
Virtual Size
8.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8.5MB
Virtual Size
8.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
461KB
Virtual Size
899KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
vpoint_socks_vmess.json
- SHA256 c4039e03c04831ae3686dad2cb5f19c29f5cfdb14a64ae6cd0d636367d161618
- MD5 8d8bdbe29e02cb7b2e61f4b73ccf9293
- SHA1 7172302eeec1eaaf5586d0f2b4e8b9c983eb26ff
- SHA512 9914fd3da02511b716951e521ca22006a6e8ad66e64d32cc7dd7dc3544a754174b37e35df6108ca217130f02763265d74f8bc56c4e52b262bdd48dcdb5310eb5
- TLSH T1B8E0D834D0B40CFB41C961B008BE5102F514C013489C3C2471AC539C8F1EA2D0EF95A9
- MD5 SHA1 SHA512 TLSH
vpoint_vmess_freedom.json
- SHA256 6c696e8854daa27b8d11e6cd2e7bbd1b6bc679aa3af24c6d47d64949afefb5ed
- MD5 b36cd97b23a809c27f8f165fd1eb2d6e
- SHA1 b64bc9f68bea7d1328ddf1b5eedf80c632116ce5
- SHA512 532f66fe19196de0cc43df1812d6f32cbca7bbcacaa0cd4141bd80b3121b17eb8b23e0464765cf05a97b11e0213fb688eade83e393e36b3e7ebded6f0925de97
- TLSH T150F02E15D0B50DFF21C0217559686142B52C82138CD43C1576EC92ED4F0E42E9AB915B
- MD5 SHA1 SHA512 TLSH
wv2ray.exe
- IMPHASH 9cbefe68f395e67356e2a5d8d1b285c0
- SHA256 2ec4dfd4008f13f77ee9f3e5e403cfe0d5d14198933f0d4f90e489d22b46d29c
- MD5 228c2769167bc65b19b6aab338514c9d
- SHA1 44c7104a216d1c51fd9d10100199bd7a0cc4f6f6
- SHA512 f1eaeae2c85c769fdebde6f7d2c7488b126c237d90bbfb07a17647cca78244bcebce1e4836c5c05daa10dcee73c1cc902ac2adb0f155b53a325acaf5d3da6b62
- SSDEEP 98304:lxnjXA+t1wyqMZfAL30a1+56SKLOCIiiLhP6Ev7CB+dYHjOQdIT4bwj5:lxnDxYL3u6SKq/hPnDCB+dYHjjdITyw
- TLSH T1DF073A47F89141E8C5EDC170C5268262BB707C845F3063D36B60BB7A6B76BD89BBA350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
417440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
8.0MB
Virtual Size
8.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8.5MB
Virtual Size
8.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
461KB
Virtual Size
899KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ