af07955be21783195b8777d9160460dafd56d1d3e5e89dedbe97e3d120fed7ff

Sharing

Copy URL Twitter E-mail

General

Target

af07955be21783195b8777d9160460dafd56d1d3e5e89dedbe97e3d120fed7ff
Size

1.1MB
MD5

32c4bfe737a1beaff9f3188b24b1d396
SHA1

57ab8e0b9e96e3cdf244c5440dd6ae6f6ce6dd40
SHA256

af07955be21783195b8777d9160460dafd56d1d3e5e89dedbe97e3d120fed7ff
SHA512

819a2265f5389d9ddef5a0ccdf9b8345465eac8692d0af806b96bffa4be61e532c14066b093e289ec35464afbda56caaea2942809be22508a8a3dbab63679f58
SSDEEP

24576:J/a9AxJchxOKJJch+w1NFTD+PMc9Q90sPz6XJ+6Alwr:lMIOcmuoWvTAMn0sPWXI/G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af07955be21783195b8777d9160460dafd56d1d3e5e89dedbe97e3d120fed7ff

Files

af07955be21783195b8777d9160460dafd56d1d3e5e89dedbe97e3d120fed7ff
.exe windows:5 windows x86 arch:x86

c7c4a642887339f4b1b0954162960cd8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\740944\out\Release\360AntiTrack.pdb

Imports

kernel32

LocalAlloc
LocalFree
lstrcmpiW
SystemTimeToFileTime
GetUserDefaultUILanguage
lstrcmpiA
GetCurrentDirectoryW
CreateDirectoryW
GetFileType
DuplicateHandle
DosDateTimeToFileTime
MapViewOfFile
lstrlenW
RaiseException
FlushInstructionCache
MulDiv
GetTempFileNameW
GetTempPathW
GlobalAlloc
GlobalFree
SetErrorMode
SetCurrentDirectoryW
GetStartupInfoW
CreateRemoteThread
GetSystemTimeAsFileTime
Sleep
CreateEventW
OpenMutexW
CreateMutexW
ReleaseMutex
ExitProcess
LoadLibraryA
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
CreateSemaphoreW
ReleaseSemaphore
GetModuleHandleExW
FreeLibraryAndExitThread
GetThreadTimes
GetCurrentThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
lstrcmpA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
OpenThread
HeapWalk
HeapUnlock
HeapLock
SetFilePointerEx
GetFileSizeEx
LocalFileTimeToFileTime
CreateFileA
LCMapStringW
GetStringTypeW
FormatMessageW
TryEnterCriticalSection
QueryPerformanceCounter
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
OutputDebugStringW
IsDebuggerPresent
GetModuleHandleA
FreeResource
UnmapViewOfFile
RtlUnwind
LoadLibraryExW
CreateFileMappingW
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
DeviceIoControl
SetLastError
GetLastError
WriteFile
SetFileTime
GetShortPathNameW
GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetTickCount
GetSystemInfo
OpenProcess
ProcessIdToSessionId
CreateProcessW
CreateThread
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
VirtualProtect
GetCurrentProcess
GetFileSize
GetFileAttributesW
DeleteFileW
GetPrivateProfileStringW
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
SetFilePointer
ReadFile
CreateFileW
GetModuleHandleW
GetVersionExW
GetVersion
GetModuleFileNameW
GetLocalTime
GetCurrentThreadId
WaitForSingleObject
CloseHandle
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryW
GetProcAddress
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy

user32

RegisterWindowMessageW
PostMessageW
SetCursor
GetWindowPlacement
GetMessagePos
GetForegroundWindow
WaitForInputIdle
AttachThreadInput
InvalidateRect
LockSetForegroundWindow
SetForegroundWindow
CharNextW
BringWindowToTop
IsIconic
PeekMessageW
MonitorFromRect
GetWindowDC
GetMonitorInfoW
MonitorFromWindow
IsDialogMessageW
LoadCursorW
GetWindow
FindWindowW
GetParent
SetWindowLongW
GetWindowLongW
IsRectEmpty
OffsetRect
CopyRect
DrawTextW
MapWindowPoints
GetWindowRect
GetClientRect
SetWindowTextW
ReleaseDC
GetDC
KillTimer
SetTimer
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
LoadStringW
DefWindowProcW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetWindowThreadProcessId
GetSystemMetrics
IsWindowVisible
ScreenToClient
SetRect
SetRectEmpty
PtInRect
GetClassLongW
SetClassLongW
FindWindowExW
EnableWindow
IsWindowEnabled
PostQuitMessage
LoadImageW
GetCursorPos
SendMessageTimeoutW
IsWindow

gdi32

GetTextExtentPoint32W
GetStockObject
GetPixel
CreateFontW
GetTextMetricsW
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetDeviceCaps
GetObjectA
GetObjectW
SelectObject
SetViewportOrgEx

advapi32

RegOpenKeyExA
RegSetValueExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyW
GetTokenInformation
GetSidSubAuthority
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyW
RegQueryValueExA
RegEnumKeyExA
RegCreateKeyA

shell32

CommandLineToArgvW
SHGetFolderPathW
SHGetSpecialFolderPathW
ord680

ole32

CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoUninitialize
CoInitialize
CreateStreamOnHGlobal

oleaut32

VarBstrCmp
SysAllocStringByteLen
SysStringByteLen
VarUI4FromStr
DispCallFunc
VariantCopy
SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayCreate
VariantClear
VariantInit
SysFreeString
SysAllocString

shlwapi

ord437
PathIsRelativeW
PathCompactPathW
ColorHLSToRGB
UrlGetPartW
UrlGetPartA
PathCombineW
PathFileExistsW
SHGetValueW
SHEnumValueW
PathAppendW
PathFindFileNameW
PathRemoveFileSpecW
StrChrW
StrCmpNIW
StrStrIA
StrStrIW
StrCmpIW
wnsprintfW
SHDeleteKeyW
SHDeleteValueW
SHGetValueA
SHSetValueW
SHSetValueA
ColorRGBToHLS

gdiplus

GdipNewPrivateFontCollection
GdipDeletePrivateFontCollection
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipGetFontHeight
GdipCreateStringFormat
GdipDeleteFontFamily
GdipResetClip
GdipSetClipRectI
GdipDeleteFont
GdipCreateFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipCloneFontFamily
GdipDeleteStringFormat
GdipMeasureString
GdipDrawString
GdipPrivateAddMemoryFont
GdipGetFontCollectionFamilyList
GdipFillRectangle
GdipDrawEllipseI
GdipDrawRectangleI
GdipDrawLineI
GdipDrawLine
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipSetTextRenderingHint
GdipGetPixelOffsetMode
GdipGetSmoothingMode
GdipCreateFromHWND
GdipCreateFromHDC
GdipBitmapSetPixel
GdipBitmapGetPixel
GdipSetPenDashOffset
GdipSetPenDashStyle
GdipSetPenWidth
GdipCreatePen1
GdipSetLinePresetBlend
GdipCreateLineBrushFromRectI
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipAddPathArcI
GdipAddPathLineI
GdipClosePathFigure
GdipResetPath
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdipDrawImageRectI
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipSetInterpolationMode
GdipSetPixelOffsetMode
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdipDeletePen
GdipCreatePen2
GdipSetSmoothingMode
GdipSetPathGradientGammaCorrection
GdipGetPathGradientPointCount
GdipSetPathGradientCenterPoint
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterColor
GdipCreatePathGradientFromPath
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipGetPathWorldBoundsI
GdipAddPathPie
GdipAddPathArc
GdipAddPathLine2
GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdipFree
GdipAlloc
GdipCreateLineBrushFromRect

ntdll

RtlDllShutdownInProgress

psapi

GetModuleFileNameExW

imm32

ImmDisableIME

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

userenv

GetUserProfileDirectoryW

msvcrt

frexp
ldexp
setlocale
localeconv
_CIpow
memchr
strncpy
_gmtime64
_CIcos
_CIsin
_CIsqrt
floor
_wtoi
__p___argc
__p___wargv
__RTDynamicCast
wcstoul
_mbscspn
_mbsspn
modf
??0exception@@QAE@XZ
__uncaught_exception
_wfsopen
___mb_cur_max_func
__pctype_func
___lc_codepage_func
___lc_handle_func
realloc
memcmp
_amsg_exit
__wgetmainargs
__setusermatherr
_initterm
__p__commode
_tzset
_strlwr
strncat
isprint
_CIexp
__CxxFrameHandler
__DestructExceptionObject
__doserrno
_wfindfirst64
_wfindnext64
_lseeki64
_unlock
_iob
iswctype
_wcslwr
_wcsupr
_wcstoui64
fwrite
_msize
__set_app_type
_wcmdln
_control87
_XcptFilter
_fmode
_isatty
_fileno
mbtowc
strrchr
strcspn
_CIlog10
ceil
_clearfp
?terminate@@YAXXZ
fseek
wcscspn
wcschr
strchr
tolower
isspace
isdigit
towlower
strtol
strtod
wcstol
malloc
??_U@YAPAXI@Z
wcsncpy
wcsncmp
wcsstr
wcsrchr
_findclose
wcstok
_lock
wcsspn
ungetc
setvbuf
fsetpos
fread
fgetpos
fgetc
fflush
fclose
atoi
free
??_V@YAXPAX@Z
_mktime64
_beginthreadex
_wcsnicmp
_wcsicmp
??3@YAXPAX@Z
memset
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
_time64
abort
_errno
??2@YAPAXI@Z
fputc
calloc

msvcp60

_Toupper
_Getctype
_Tolower
_Wcrtomb
_Mbrtowc

Sections

.text
Size: 833KB - Virtual size: 833KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c7c4a642887339f4b1b0954162960cd8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

ntdll

psapi

imm32

version

userenv

msvcrt

msvcp60

Sections

.text Size: 833KB - Virtual size: 833KB

.rdata Size: 170KB - Virtual size: 170KB

.data Size: 21KB - Virtual size: 290KB

.rsrc Size: 38KB - Virtual size: 37KB

.reloc Size: 41KB - Virtual size: 40KB

.text
Size: 833KB - Virtual size: 833KB

.rdata
Size: 170KB - Virtual size: 170KB

.data
Size: 21KB - Virtual size: 290KB

.rsrc
Size: 38KB - Virtual size: 37KB

.reloc
Size: 41KB - Virtual size: 40KB