venzashit_crackedbymarte[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
venzashit_crackedbymarte.exe
Size 151KB
Sample261107-166apsgs6q
SHA256 fb2fb90708bea151aa46554215be3a9751cc2c6894b92d466571c0f2c61aa026
MD5 2e006e68bc30b3f036c3888a6ddc2fbe
SHA1 6c9a53a3622f4eb92bcded922e9a897a7cea6759
SHA512 b8914ba5bfcc0d1f251cdb5f205c261b034dd4cd07dc069bbd3d02646d64d04da976058a9dfec6aaf6a8a353d5efa3c7803dd9d93b15ac1c708d92880a25b247
SSDEEP 3072:c0ae1mxf9wIFqb5aHc1NZAdnw7z+rw9sBZ+5neKGq:c0acmxKIFn6Nydnw7z+rw7zG
TLSH
T1CFE33B27766501BCC1ABE37DA69B5D42F33A784603568ADF03E081B22F552D0AE7F760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
venzashit_crackedbymarte.exe

File Explorer

venzashit_crackedbymarte.exe

.exe 151KB

venzashit_crackedbymarte.exe

IMPHASH fbde847d1c4975c37847aa2f5622edea
SHA256 fb2fb90708bea151aa46554215be3a9751cc2c6894b92d466571c0f2c61aa026
MD5 2e006e68bc30b3f036c3888a6ddc2fbe
SHA1 6c9a53a3622f4eb92bcded922e9a897a7cea6759
SHA512 b8914ba5bfcc0d1f251cdb5f205c261b034dd4cd07dc069bbd3d02646d64d04da976058a9dfec6aaf6a8a353d5efa3c7803dd9d93b15ac1c708d92880a25b247
SSDEEP 3072:c0ae1mxf9wIFqb5aHc1NZAdnw7z+rw9sBZ+5neKGq:c0acmxKIFn6Nydnw7z+rw7zG
TLSH
T1CFE33B27766501BCC1ABE37DA69B5D42F33A784603568ADF03E081B22F552D0AE7F760
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

110828

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\hunter\Downloads\fort_int - retrac\fort_int - retrac\loader\x64\Release\OxalicLoader.pdb

kernel32

GetCurrentProcess GetStdHandle WriteFile SetConsoleMode SetCurrentConsoleFontEx GetModuleFileNameW SetFilePointer GetEnvironmentVariableA WaitForSingleObject CreateFileW OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetExitCodeThread GetPrivateProfileStringW Sleep GetConsoleMode GetLastError GetFileAttributesExW Process32NextW DeleteFileA GetFullPathNameW Process32FirstW CloseHandle GetCurrentConsoleFontEx GetProcAddress VirtualAllocEx LocalFree MoveFileExW SetConsoleCP SystemTimeToFileTime CreateProcessW GetModuleHandleW CopyFileW CreateRemoteThread SetConsoleOutputCP GetSystemTimeAsFileTime CreateDirectoryA VirtualFreeEx SetConsoleTitleW GetComputerNameA GetExitCodeProcess AcquireSRWLockExclusive GetConsoleScreenBufferInfo WriteProcessMemory GetFileSizeEx DeleteFileW ReadFile IsDebuggerPresent WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead ReleaseSRWLockExclusive

advapi32

LookupAccountNameA OpenProcessToken GetTokenInformation ConvertSidToStringSidA

shell32

ShellExecuteExW

msvcp140

?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_Xbad_alloc@std@@YAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ

shlwapi

PathRemoveFileSpecW PathFileExistsW

winhttp

WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpReceiveResponse WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen

bcrypt

BCryptOpenAlgorithmProvider BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptGetProperty

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp memcpy memmove memchr _CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler __current_exception __current_exception_context memset

api-ms-win-crt-stdio-l1-1-0

_set_fmode fflush _get_stream_buffer_pointers _fseeki64 __stdio_common_vsscanf fread fsetpos fclose getchar _kbhit fputc ungetc setvbuf __p__commode fputs fgetpos __stdio_common_vsprintf fwrite putchar fgetc __stdio_common_vfprintf puts __acrt_iob_func

api-ms-win-crt-string-l1-1-0

isspace wcsncpy_s _wcsicmp tolower isxdigit

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _initialize_onexit_table _errno _seh_filter_exe _set_app_type _register_onexit_function _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit terminate __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_wide_argv _crt_atexit

api-ms-win-crt-convert-l1-1-0

strtol strtoull _wcstoui64

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale