AgentService[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

AgentService.exe
Size

1.2MB
MD5

13773ab7f2d31751c6f31c2a2b140c29
SHA1

4a9ab6825dd1b2041af97944353caa3e6d9c7158
SHA256

2ca4599932145f20a506f69e5adb7dfdafde25249cdd99b0ce8f251f616b042b
SHA512

8b94e5bb793395f13e8e1f53a27461d3605a9582df2627572700078349f3bc030861340d9af815cd69e40d75b9db3e13ad5c062570114176b2eecae5eb444287
SSDEEP

24576:zFdVFRbdlMwjCiwBj+HRjLDopbZ28R6bVUDnH63qNoHX3s8zuNrq:zzVFLlMw2iwQH3ns8zuN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AgentService.exe

Files

AgentService.exe
.exe windows x64

ab84f8ef4f5eda5e091b3e44e5319d38

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

EventSetInformation
RegisterServiceCtrlHandlerW
SetServiceStatus
EventRegister
EventWriteTransfer
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
DuplicateTokenEx
CreateProcessAsUserW
OpenProcessToken
SetTokenInformation
GetTokenInformation
RegQueryValueExW
EventUnregister
GetSidSubAuthority
GetSidSubAuthorityCount
AdjustTokenPrivileges
LookupPrivilegeValueW
RegDeleteKeyExW
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteTreeW
RegSetKeyValueW
GetNamedSecurityInfoW
CreateWellKnownSid
EqualSid
ConvertSidToStringSidW
StartServiceCtrlDispatcherW

kernel32

GetShortPathNameW
QueryFullProcessImageNameW
lstrcmpiW
GetSystemWindowsDirectoryW
GetCurrentProcessId
SleepConditionVariableSRW
WakeAllConditionVariable
CloseHandle
Sleep
ProcessIdToSessionId
TlsGetValue
TlsAlloc
TlsSetValue
ResetEvent
OpenEventA
FormatMessageA
AreFileApisANSI
GetCurrentDirectoryW
OpenProcess
DeviceIoControl
CreateDirectoryW
LocalAlloc
GetProcessMitigationPolicy
GetModuleFileNameW
lstrlenA
SystemTimeToFileTime
GetCurrentProcess
FindNextFileW
FindFirstFileW
LoadLibraryExW
FreeLibrary
AcquireSRWLockShared
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
AcquireSRWLockExclusive
CloseThreadpoolTimer
ReleaseSRWLockExclusive
WaitForThreadpoolTimerCallbacks
GetFileTime
GetFileSize
DeleteFileW
SetEvent
SetFileAttributesW
GetComputerNameExW
GetFileAttributesW
CreateFileW
ExpandEnvironmentStringsW
WriteFile
CreateEventA
ReadFile
GetLocalTime
IsDebuggerPresent
DebugBreak
GetProcessHeap
CreateMutexExW
GetProcAddress
HeapAlloc
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
TerminateProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
CreateIoCompletionPort
CreateThread
GetSystemInfo
GetQueuedCompletionStatus
FindClose
WaitForSingleObject
LocalUnlock
LocalFree
FormatMessageW
LocalLock
OutputDebugStringW
GetLastError
IsWow64Process
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
InitializeCriticalSectionEx
GetLocaleInfoW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter

msvcrt

__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
isdigit
isalnum
memcmp
___lc_collate_cp_func
memchr
tolower
isspace
_Strftime
_Gettnames
__mb_cur_max
_Wcsftime
_W_Gettnames
_W_Getmonths
_W_Getdays
_Getmonths
_Getdays
memcpy_s
memset
ldexp
realloc
abort
_wsetlocale
__crtLCMapStringA
__crtLCMapStringW
__crtCompareStringA
__crtCompareStringW
??8type_info@@QEBAHAEBV0@@Z
_wcsdup
__uncaught_exception
islower
_ismbblead
___mb_cur_max_func
calloc
___lc_codepage_func
___lc_handle_func
isupper
__pctype_func
setlocale
_unlock
exit
_errno
memmove
memcpy
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
malloc
sprintf_s
localeconv
?name@type_info@@QEBAPEBDXZ
??0exception@@QEAA@XZ
strcspn
free
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
_vsnwprintf
_vsnprintf_s
fputc
fflush
fclose
fgetc
fwrite
fgetpos
setvbuf
ungetc
fsetpos
_fseeki64
_wcsicmp
_wtoi
strchr
memmove_s
ldiv
time
_wcsnicmp
_stricmp
strerror
fseek
_wfsopen
mbstowcs_s
__CxxFrameHandler3
??_V@YAXPEAX@Z
_purecall
swprintf_s
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
__dllonexit
_onexit
??1type_info@@UEAA@XZ
??3@YAXPEAX@Z
_lock
?what@exception@@UEBAPEBDXZ
??0bad_cast@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
wcscmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

ole32

CoInitializeEx
CoTaskMemFree
CLSIDFromProgID
OleRun
CoUninitialize
CoCreateInstance
CLSIDFromString

oleaut32

SysStringLen
SysFreeString
SysAllocString
SysAllocStringByteLen
VariantClear

wintrust

WinVerifyTrust

fltlib

FilterReplyMessage
FilterGetMessage
FilterConnectCommunicationPort

shell32

SHGetKnownFolderPath

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

activeds

ord3

Sections

.text
Size: 816KB - Virtual size: 815KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 308KB - Virtual size: 307KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab84f8ef4f5eda5e091b3e44e5319d38

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

ole32

oleaut32

wintrust

fltlib

shell32

version

activeds

Sections

.text Size: 816KB - Virtual size: 815KB

.rdata Size: 308KB - Virtual size: 307KB

.data Size: 29KB - Virtual size: 34KB

.pdata Size: 31KB - Virtual size: 31KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 816KB - Virtual size: 815KB

.rdata
Size: 308KB - Virtual size: 307KB

.data
Size: 29KB - Virtual size: 34KB

.pdata
Size: 31KB - Virtual size: 31KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB