Vape.v4.04.zip
- SHA256 5c7bf06dfebdafb874aaf390f230e926277102f08dec3b2b876a411885750a61
Behavioral task
behavioral1
Sample
Client.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Server.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Server.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target Vape.v4.04.zip
- Size 56.2MB
- Sample261027-wemxtseb82
- SHA256 5c7bf06dfebdafb874aaf390f230e926277102f08dec3b2b876a411885750a61
- MD5 94b7df646b7cfe0cfacbd1d990ca91ab
- SHA1 4075b47fa3fd1cf533c6ef5f2c87fee222cb69d5
- SHA512 699e9eea0ae0d1efc807cbd2d11d9e1b389d05920405220cc4366d6ef5463158887627847a48db241d57b95e00563d447f57a076c2eaf9da66515afd4a732741
- SSDEEP 1572864:RrfydyNMHa5HfEasaww9zBIWPcRTl1BFhRazkFsn8XZASv7:RKyssfssbEDRaYFsnkD
- TLSH T193D7334A73F2E13788E4F012725277988FE1EB4A55A0151CB2AFC742CB61EDB8EE4355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 2 IoCs
resource yara_rule static1/unpack001/Client.exe pyinstaller static1/unpack001/Server.exe pyinstaller - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Client.exe unpack001/Server.exe
File Explorer
-
Vape.v4.04.zip.zip 56.2MB
-
Client.exe.exe 15.5MB
-
run.pyc294B
-
Server.exe.exe 66.9MB
-
server.pyc19KB
Client.exe
- IMPHASH 88381b84da56810b869e897e6d45bd58
- SHA256 0a8aa182cda50a9be584926927a3a1432bac28b8f1972de764663977fb3f6194
- MD5 dbc263826aeb0c1cd504b04ff73f9d01
- SHA1 9bbfe90f1ef2394e0ced2bc8ab26aa584283a6d3
- SHA512 d2899bb0a58e71a4f6e52985fdecb42200a1e25c0fd6a171007997be8ee36f34b763eadd6826d447ab8e09858ecc622d2e8b1a0097fedf2edc83b0c3e5708bdb
- SSDEEP 393216:lnZr0/G25eDk8YHdYRpI2dQOlXrAZYCuPJODgeg2I:lnLoeg8Y9V2dQVJuxKgzX
- TLSH T1DBF6E007ABB540E5C5BBC039D563A22BFAB1749647709BDB725C465A0F23BE0AD3E700
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
45008
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
EnumChildWindows
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.bxpck
Size
7.6MB
Virtual Size
7.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.main
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=259, version=30795,
count=191, id=261, version=30795,
count=10, id=260, version=30795,
count=4, id=253, version=31616,
count=40, id=261, version=31616,
count=17, id=260, version=31616,
count=9, id=259, version=31616,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=20, id=260, version=31630,
count=1, id=258, version=31630,
run.pyc
- SHA256 2b9a4a203249cc2490f2b61c35b48949cd2cbc0b890c6b66ff865646f3e0f6f3
- MD5 cd45aaa2a0abaa1a05fa4a022e7f17c3
- SHA1 3bc02065c7a5dd657b5f9593f0d26a872e183ec1
- SHA512 4546fa2b153c572b5dc5e3ee75105263822bd47bb817e57f43fcb97b52b61460ace95468a88975f25cdd9b69257a9a897e03d652f5217c81f6cbeac846e5779b
- TLSH T1F9E02B4B400B21E1C36496379A95962135EA4C27434A61176F0DF2722D4AA52B65064B
- MD5 SHA1 SHA512 TLSH
Server.exe
- IMPHASH 88381b84da56810b869e897e6d45bd58
- SHA256 69ad944900232a07ad37dbb9a31ae7727c181d0c34ea65d6b54ad03676f420c9
- MD5 7f559c6fec19ac71ae9bea5dfd4041bd
- SHA1 eeadcfa61e9fac2bcf2609d70e82b8fcc568a864
- SHA512 b2dd0591518779e5b9e24c0666684eeb2d72eaf20d0bd2942e5100c38b25f7f526581a0e9b77fbca97c404eee8bab985b5b53e7e5c7b6ce7651a4d199322a87f
- SSDEEP 1572864:j7RTW5JzDBWIStE585HZRGsVAmMRuwBrWsv:j7hYn0ISjVu02Rue
- TLSH T172F75D63F4EB6EF378EAFBC344608951EA30D33BAB49A7CD76715D15AACC8C81181164
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
41824
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
EnumChildWindows
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.bxpck
Size
29.2MB
Virtual Size
29.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.main
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=259, version=30795,
count=190, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=31616,
count=40, id=261, version=31616,
count=17, id=260, version=31616,
count=9, id=259, version=31616,
count=5, id=257, version=30795,
count=117, id=1, productName=Unmarked objects,
count=20, id=260, version=31630,
count=1, id=258, version=31630,
server.pyc
- SHA256 dc25142276ab088f6c392627a1ec95beb4c4f7f7e64581d1c90dd567114c7030
- MD5 f3324f11307dc3721a5ea615c629d040
- SHA1 e0cb0a07acf04855690972594d56960210d91705
- SHA512 a0deaedc3ec20703126107ddc8e16b0d34e8392d9a84a86ae74bd74f4b10239e008e4bcb051efc198f23d32fc98f9cda12f5593a7de5abecd0cef95207c30f26
- SSDEEP 384:5U1dqbVD6BLRDSqDJlMC0XpZXMkHnUgx9VYIXup671hKrkIk+tYCcN:5UPM14MCFkHhWmup6Bh/oYCw
- TLSH T1039229956279AE6DFC7BF33DC48543044231ABAA9B46B166C149C89B7CC73ED0F1A188
- MD5 SHA1 SHA512 SSDEEP TLSH