a408c73b9d32d72bf67a69d695fad719614e55e75f51be7703599c678050db05

Sharing

Copy URL Twitter E-mail

General

Target

a408c73b9d32d72bf67a69d695fad719614e55e75f51be7703599c678050db05
Size

1.1MB
MD5

ac1531e9446af8c8b5c9a84ccf10f61a
SHA1

89f1f4fb4cd9063de0c5f940ade84751eb293a13
SHA256

a408c73b9d32d72bf67a69d695fad719614e55e75f51be7703599c678050db05
SHA512

77083a76de9cc28ec09ff34e58bf52e7152935f725c91c4ba4a057ae3809436a41573c1ee5e5074d4e97b35e31f7a502dfe75d48f1da7b04fdb029719e4e65f6
SSDEEP

24576:wHTI171IO1q8XwZTCT0X4L3ZQbGDJM+6e/r2w5:3hIWqTqubGDBt/rj5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a408c73b9d32d72bf67a69d695fad719614e55e75f51be7703599c678050db05

Files

a408c73b9d32d72bf67a69d695fad719614e55e75f51be7703599c678050db05
.exe windows:5 windows x86 arch:x86

ea441859b101f9af1f9c9a854d95243f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\740609\out\Release\TraceClean.pdb

Imports

kernel32

GetVersion
WritePrivateProfileStringW
HeapFree
HeapAlloc
GetProcessHeap
GetTickCount
lstrcmpiW
WaitForMultipleObjects
CreateEventW
GetWindowsDirectoryW
CreateProcessW
SetFileTime
SystemTimeToFileTime
GetUserDefaultUILanguage
CreateThread
RaiseException
FlushInstructionCache
GetSystemTimeAsFileTime
CreateRemoteThread
CreateDirectoryW
MulDiv
SetCurrentDirectoryW
GetCurrentDirectoryW
InterlockedIncrement
ReleaseSemaphore
GetTempPathW
GlobalFree
GetTimeZoneInformation
GlobalAlloc
GlobalUnlock
GlobalLock
GetTempFileNameW
GetCommandLineW
SetErrorMode
GetEnvironmentVariableW
GetFullPathNameW
CreateSemaphoreW
lstrcmpW
GetACP
FormatMessageW
GetFileType
DuplicateHandle
DosDateTimeToFileTime
MapViewOfFile
UnmapViewOfFile
GetFileSize
lstrcmpiA
lstrcmpA
HeapWalk
HeapLock
OpenThread
HeapUnlock
OutputDebugStringW
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
QueryPerformanceCounter
InterlockedDecrement
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
GetStartupInfoA
SetHandleCount
GetStringTypeA
HeapCreate
GetModuleFileNameA
GetStdHandle
IsValidCodePage
GetOEMCP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStringTypeW
LCMapStringW
LCMapStringA
GetStartupInfoW
ExitProcess
ExitThread
GetCPInfo
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
lstrlenA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapSize
HeapReAlloc
HeapDestroy
TerminateProcess
OpenProcess
GetShortPathNameW
InterlockedCompareExchange
GetCurrentThreadId
SetLastError
CreateFileMappingW
SetEndOfFile
FlushFileBuffers
WriteFile
GetCurrentProcess
Sleep
ResetEvent
LoadLibraryExW
ProcessIdToSessionId
LoadLibraryA
GetSystemDirectoryW
DeviceIoControl
DeleteFileW
GetFileAttributesW
GetPrivateProfileStringW
MultiByteToWideChar
FindFirstFileW
FindClose
SetEvent
WaitForSingleObject
lstrlenW
GetLastError
DeleteCriticalSection
InitializeCriticalSection
GetVersionExW
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
EnterCriticalSection
WideCharToMultiByte
FreeResource
InterlockedExchange
GetModuleHandleA
GetSystemInfo
LocalAlloc
LocalFree
GetCurrentProcessId
CreateMutexW
ReleaseMutex
OpenMutexW
GetEnvironmentStringsW
LeaveCriticalSection
GetProcAddress
FreeLibrary
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
CreateFileW
SetFilePointer
ReadFile
CloseHandle
GetSystemWindowsDirectoryW

user32

SetWindowLongW
IsWindow
PostMessageW
LoadStringW
GetWindowThreadProcessId
UnregisterClassA
IsWindowVisible
GetSystemMetrics
DrawTextW
SetCursor
SetClassLongW
GetClassLongW
LoadImageW
PostQuitMessage
MoveWindow
SetParent
FindWindowExW
BringWindowToTop
IsIconic
PeekMessageW
CharNextW
GetSysColor
ClientToScreen
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetDlgItem
GetClassNameW
ReleaseCapture
FillRect
EndPaint
BeginPaint
DestroyAcceleratorTable
PtInRect
KillTimer
GetClassInfoExW
LoadCursorW
DestroyWindow
DefWindowProcW
RegisterClassExW
CreateWindowExW
SendMessageTimeoutW
FindWindowW
GetWindowLongW
CallWindowProcW
ShowWindow
GetWindowPlacement
EnableWindow
SetWindowPos
SendMessageW
GetParent
SetFocus
IsWindowEnabled
SetRectEmpty
RegisterWindowMessageW
ReleaseDC
GetDC
CopyRect
GetClientRect
GetMonitorInfoW
SetForegroundWindow
MonitorFromRect
GetWindowRect
InvalidateRect
WaitForInputIdle
MessageBoxW
GetActiveWindow
GetDesktopWindow
IsRectEmpty
OffsetRect
IsDialogMessageW
MapWindowPoints
MonitorFromWindow
GetWindow
DispatchMessageW
TranslateMessage
GetMessageW
SetWindowTextW
ScreenToClient
GetMessagePos
GetFocus
CreateAcceleratorTableW
LockSetForegroundWindow
GetWindowTextW
GetWindowTextLengthW
SetTimer

gdi32

SetViewportOrgEx
CreateFontW
DeleteDC
GetObjectA
CreateCompatibleBitmap
CreateCompatibleDC
GetPixel
BitBlt
DeleteObject
GetTextMetricsW
GetObjectW
SelectObject
GetTextExtentPoint32W
GetDeviceCaps
GetStockObject
CreateSolidBrush

advapi32

RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetTokenInformation
OpenProcessToken
GetSidSubAuthority
RegDeleteValueW
RegDeleteKeyW
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegSetValueExW

shell32

SHGetFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetSpecialFolderPathW
CommandLineToArgvW
ord165
ShellExecuteW
ord680

ole32

OleUninitialize
OleInitialize
CLSIDFromString
CoGetClassObject
OleLockRunning
StringFromGUID2
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
CoTaskMemFree
CoInitialize
CoUninitialize
CLSIDFromProgID
CoCreateInstance

oleaut32

LoadTypeLi
DispCallFunc
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
SysAllocString
SysFreeString
VarBstrCmp
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocStringLen
VarUI4FromStr
OleCreateFontIndirect
LoadRegTypeLi

shlwapi

SHGetValueW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
StrStrIW
wnsprintfW
StrCmpIW
SHGetValueA
PathFindFileNameW
StrStrIA
SHSetValueA
PathStripPathW
ord437
PathCompactPathW
ColorHLSToRGB
ColorRGBToHLS
PathCombineW

comctl32

InitCommonControlsEx

gdiplus

GdipSetInterpolationMode
GdipGetFontHeight
GdipCreateFont
GdipCreateFontFromLogfontA
GdipDrawImageRectI
GdipMeasureString
GdipDrawString
GdipFillRectangle
GdipCreateBitmapFromStream
GdipDrawEllipseI
GdipDrawRectangleI
GdipCreateFontFromDC
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipResetClip
GdipSetClipRectI
GdipDrawLineI
GdipDrawLine
GdipSetPixelOffsetMode
GdipGetPixelOffsetMode
GdipSetTextRenderingHint
GdipGetImageGraphicsContext
GdipCreateFromHWNDICM
GdipCreateFromHWND
GdipCreatePathGradientFromPath
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipAddPathLineI
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetPenDashOffset
GdipSetPenDashStyle
GdipSetPenWidth
GdipCreateLineBrushFromRect
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipDeleteFont
GdipDeleteFontFamily
GdipPrivateAddMemoryFont
GdipDeletePrivateFontCollection
GdipNewPrivateFontCollection
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientCenterColor
GdipDeleteStringFormat
GdipCreatePen2
GdipSetLinePresetBlend
GdipCloneBrush
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipAddPathArcI
GdipClosePathFigure
GdipResetPath
GdipCreateLineBrushFromRectI
GdipCreateSolidFill
GdipDeletePath
GdipCreatePath
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectRectI
GdipCloneImage
GdipBitmapSetPixel
GdipBitmapGetPixel
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipAlloc
GdipFree
GdipCreateStringFormat

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

psapi

GetModuleFileNameExW

wininet

DeleteUrlCacheEntryW
InternetReadFile
HttpQueryInfoW
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
InternetSetOptionW

userenv

GetUserProfileDirectoryW

Sections

.text
Size: 765KB - Virtual size: 764KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea441859b101f9af1f9c9a854d95243f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

version

psapi

wininet

userenv

Sections

.text Size: 765KB - Virtual size: 764KB

.rdata Size: 181KB - Virtual size: 180KB

.data Size: 25KB - Virtual size: 44KB

.rsrc Size: 40KB - Virtual size: 39KB

.reloc Size: 89KB - Virtual size: 88KB

.text
Size: 765KB - Virtual size: 764KB

.rdata
Size: 181KB - Virtual size: 180KB

.data
Size: 25KB - Virtual size: 44KB

.rsrc
Size: 40KB - Virtual size: 39KB

.reloc
Size: 89KB - Virtual size: 88KB