Volterra[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Volterra.exe
Size 1.1MB
Sample261101-2cbdxadw41
SHA256 7744f19bcf95e8a64bcafc8a298d22ec6e20563e3d1afece351d83843576e9d8
MD5 1feba445f1b5ce9091578e56015d48ea
SHA1 281cb18fb66191a9b9a0e899d64425a353acebb6
SHA512 ac76a613131e8047be9dbef91ae522c17f915b567947a24c06436182d625f6868d07447077fcf1461135ad0d3e2ad50f25ff1112380318f4ec27a001f412b458
SSDEEP 24576:mTKDHEjHoQmR0zI5B2gElvJ9CykBwJi+yz0KPnhBx:RDHAHoQmR0LhJki4Bn
TLSH
T14C45AE16F3E545F9C46AA6348A52D31BFB3278801F2086CF33D51A981FA76E05E7B352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Volterra.exe

File Explorer

Volterra.exe

.exe 1.1MB

Volterra.exe

IMPHASH 4a0aa05ac7f48eac2a11a40b8da4f5a0
SHA256 7744f19bcf95e8a64bcafc8a298d22ec6e20563e3d1afece351d83843576e9d8
MD5 1feba445f1b5ce9091578e56015d48ea
SHA1 281cb18fb66191a9b9a0e899d64425a353acebb6
SHA512 ac76a613131e8047be9dbef91ae522c17f915b567947a24c06436182d625f6868d07447077fcf1461135ad0d3e2ad50f25ff1112380318f4ec27a001f412b458
SSDEEP 24576:mTKDHEjHoQmR0zI5B2gElvJ9CykBwJi+yz0KPnhBx:RDHAHoQmR0LhJki4Bn
TLSH
T14C45AE16F3E545F9C46AA6348A52D31BFB3278801F2086CF33D51A981FA76E05E7B352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

460100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\nopei\Downloads\Volterra_elevate\build\Release\Volterra.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dxgi

CreateDXGIFactory1

dwmapi

DwmSetWindowAttribute DwmFlush DwmExtendFrameIntoClientArea

iphlpapi

GetAdaptersInfo

setupapi

SetupDiOpenDevRegKey SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiSetClassInstallParamsW SetupDiEnumDeviceInfo SetupDiCallClassInstaller

bcrypt

BCryptGenRandom

kernel32

GetTickCount64 GetLastError QueryPerformanceFrequency CloseHandle SwitchToThread GetProcAddress ExitProcess GetModuleHandleW QueryPerformanceCounter OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA IsDBCSLeadByte FreeLibrary GetSystemFirmwareTable GetVolumeInformationW VirtualProtect DeviceIoControl CreateFileW GetComputerNameW GetFirmwareType GetFileSizeEx GetConsoleOutputCP FlushFileBuffers ReadConsoleW GetConsoleMode SetFilePointerEx LCMapStringW CompareStringW GetModuleFileNameW GetDateFormatW Sleep FlsSetValue FlsGetValue FlsAlloc GetTimeZoneInformation GetFileType HeapAlloc HeapFree WriteFile GetStdHandle ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId GetStartupInfoW GetCurrentProcess FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FlsFree GetEnvironmentVariableW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext HeapSize HeapReAlloc WriteConsoleW SetEndOfFile GetTimeFormatW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime WakeAllConditionVariable

user32

ScreenToClient GetCapture TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowRect GetCursorPos GetWindow DestroyWindow GetMessageExtraInfo IsWindowVisible SetWindowPos MessageBoxW SetWindowLongPtrW SetWindowRgn GetKeyState GetSystemMetrics UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow IsWindow GetAsyncKeyState DispatchMessageW ClientToScreen PeekMessageW SetLayeredWindowAttributes TranslateMessage GetClientRect PostQuitMessage SetProcessDPIAware UpdateWindow IsIconic ReleaseDC GetDC DefWindowProcW CreateWindowExW

gdi32

CreateRectRgn DeleteObject CombineRgn GetDeviceCaps GetStockObject CreatePolygonRgn

advapi32

RegCloseKey GetTokenInformation RegQueryValueExW RegOpenKeyExW OpenProcessToken RegEnumKeyExW RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges RegEnumKeyW RegCreateKeyExW RegSetValueExW

shell32

ShellExecuteW ShellExecuteExW SHGetFolderPathW

ole32

CoCreateInstance CoInitializeEx CoUninitialize

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

638KB

Virtual Size

637KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

486KB

Virtual Size

486KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Volterra.exe

d3d11

d3dcompiler_47

dxgi

dwmapi

iphlpapi

setupapi

bcrypt

kernel32

user32

gdi32

advapi32

shell32

ole32

imm32

generic