VixenCleanerV3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
VixenCleanerV3.exe
Size 1.1MB
Sample261104-ynbl9sft8l
SHA256 f514040f57487de6eb6a06d42f860ceacc63b43fea4433313b478df1ca5892ba
MD5 c65c4fe88aad8013b04af1b781eaed01
SHA1 b1b639f44c7ad1aa7e56be9f95bd0cede6e0fe14
SHA512 b3e817c83247cc4d12d2acf027f673daa9269f720026b8eb4295ccbe5cafd7bda33003caa7a0f723cc58bb285f811f64f934044cb16733ca9878539ef654fcef
SSDEEP 12288:fK0jHoKBnXQ+ckNS8liXV57kIU5x4znRulqfa+JHnr6l52Al:fjHxN5QY4znRulqfBJHne7
TLSH
T17C356B0AB7A902E5D077D0B9C9925A19FAB1789A4330A7C747E09B5B1F277F05E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VixenCleanerV3.exe

File Explorer

VixenCleanerV3.exe

.exe 1.1MB

VixenCleanerV3.exe

IMPHASH a9c4f9b2f80ab0702e12a66aefdd1524
SHA256 f514040f57487de6eb6a06d42f860ceacc63b43fea4433313b478df1ca5892ba
MD5 c65c4fe88aad8013b04af1b781eaed01
SHA1 b1b639f44c7ad1aa7e56be9f95bd0cede6e0fe14
SHA512 b3e817c83247cc4d12d2acf027f673daa9269f720026b8eb4295ccbe5cafd7bda33003caa7a0f723cc58bb285f811f64f934044cb16733ca9878539ef654fcef
SSDEEP 12288:fK0jHoKBnXQ+ckNS8liXV57kIU5x4znRulqfa+JHnr6l52Al:fjHxN5QY4znRulqfBJHne7
TLSH
T17C356B0AB7A902E5D077D0B9C9925A19FAB1789A4330A7C747E09B5B1F277F05E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

390644

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\cons\source\repos\VixenCleanerV2\x64\Release\VixenCleanerV3.pdb

kernel32

LocalFree CloseHandle SetEndOfFile Process32FirstW CreateFileA Process32NextW GetLastError GetConsoleMode Sleep CreateToolhelp32Snapshot OpenProcess CreateFileW LocalAlloc SetFilePointer SetFileTime DeviceIoControl SetConsoleMode WriteFile GetStdHandle GetCurrentProcess SetConsoleTitleA VirtualProtect GetSystemTimeAsFileTime ReadFile WriteConsoleW HeapSize MultiByteToWideChar FormatMessageA GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileAttributesW SetFileInformationByHandle GetTempPathW AreFileApisANSI GetModuleHandleW GetProcAddress CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSectionEx InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId InitializeSListHead TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetCurrentThread GetFileType HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP ReadConsoleW SetConsoleCtrlHandler HeapReAlloc GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap OutputDebugStringW SetStdHandle RtlUnwind

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegDeleteKeyW SetEntriesInAclW CreateWellKnownSid RegFlushKey RegCreateKeyExW CopySid RegEnumKeyExW RegSetValueExW OpenProcessToken RegOpenKeyExW SetSecurityInfo RegDeleteValueW GetLengthSid GetUserNameW RegOpenKeyW RegQueryValueExW GetTokenInformation

ntdll

NtTerminateProcess

Name

.text

Size

853KB

Virtual Size

852KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

172KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

VixenCleanerV3.exe

kernel32

advapi32

ntdll

generic