847042a1dbfe2bbe81a4edd81bd710f156af4260dddd1289e6a41e9416360934

Sharing

Copy URL Twitter E-mail

General

Target
847042a1dbfe2bbe81a4edd81bd710f156af4260dddd1289e6a41e9416360934
Size 894KB
Sample240410-1114ssfh2s
SHA256 847042a1dbfe2bbe81a4edd81bd710f156af4260dddd1289e6a41e9416360934
MD5 9903b3ebdce4ecac9244afaf372ed9d3
SHA1 4ab99db5d551c58790774d6c5c19344bfa6aab26
SHA512 2b1fdd157e154738272346ee9046be334a4a8638fe9bf7d465ca78f7080d3b977ff7bbdd6cf8e91c331bc403952c52e366541758fbb3aa7a0cb2c45aa6b3b05a
SSDEEP 12288:dfPSAADHVGfZUv/TrguVTax7hNRu18VACJFoxMk/wYeDKWMyg:hPSAADHVGfZUvfgmaxpu1FCJ6xMYaMF
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
847042a1dbfe2bbe81a4edd81bd710f156af4260dddd1289e6a41e9416360934

File Explorer

847042a1dbfe2bbe81a4edd81bd710f156af4260dddd1289e6a41e9416360934

.dll 894KB

847042a1dbfe2bbe81a4edd81bd710f156af4260dddd1289e6a41e9416360934

IMPHASH 908746745c485828202e3664dddf55a1
SHA256 847042a1dbfe2bbe81a4edd81bd710f156af4260dddd1289e6a41e9416360934
MD5 9903b3ebdce4ecac9244afaf372ed9d3
SHA1 4ab99db5d551c58790774d6c5c19344bfa6aab26
SHA512 2b1fdd157e154738272346ee9046be334a4a8638fe9bf7d465ca78f7080d3b977ff7bbdd6cf8e91c331bc403952c52e366541758fbb3aa7a0cb2c45aa6b3b05a
SSDEEP 12288:dfPSAADHVGfZUv/TrguVTax7hNRu18VACJFoxMk/wYeDKWMyg:hPSAADHVGfZUvfgmaxpu1FCJ6xMYaMF
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

458592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\vmagent_new\bin\joblist\574019\out\Release\360Util64.pdb

kernel32

GlobalLock GlobalSize GlobalUnlock GetFileAttributesExW GetTickCount DeviceIoControl GetCurrentProcessId GetLongPathNameW GetWindowsDirectoryW GetCurrentDirectoryW MoveFileExW SearchPathW CreateThread WaitForSingleObject GetCurrentThreadId GetVersion GetSystemDefaultUILanguage GetFileSize GetLocalTime VirtualProtect GetModuleHandleExW IsBadStringPtrW ProcessIdToSessionId OpenProcess CreateProcessW WTSGetActiveConsoleSessionId MapViewOfFile UnmapViewOfFile GetProcessId LocalAlloc LocalFree CreateFileMappingW GetFileSizeEx GlobalFree CreateToolhelp32Snapshot Process32FirstW Process32NextW ResumeThread GetSystemTimeAsFileTime ReleaseMutex GetSystemTime SystemTimeToFileTime SetFileAttributesW DeleteFileW OpenFileMappingW OpenThread GetCommandLineW OutputDebugStringW RtlPcToFileHeader FormatMessageW CreateFileA LocalFileTimeToFileTime SetFilePointerEx HeapLock HeapUnlock HeapWalk TlsAlloc TlsGetValue TlsSetValue TlsFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetFileTime GlobalAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead InterlockedFlushSList ExitProcess OpenMutexW CreateMutexW WideCharToMultiByte FindResourceExW InitializeCriticalSectionAndSpinCount GetModuleFileNameW RaiseException InitializeCriticalSection lstrcmpiW DeleteCriticalSection SetLastError CloseHandle GetLastError LoadLibraryW GetSystemDirectoryW SetFilePointer GetVersionExW GetSystemWindowsDirectoryW FindResourceW SizeofResource LoadResource LockResource FreeResource GetFileInformationByHandle CreateFileW Sleep ReadFile LeaveCriticalSection EnterCriticalSection MultiByteToWideChar LoadLibraryExW ExpandEnvironmentStringsW FreeLibrary GetCurrentProcess GetProcAddress GetModuleHandleW GetFileAttributesW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy WriteFile GetExitCodeProcess IsDebuggerPresent

user32

IsZoomed GetWindowTextW SendMessageTimeoutW SystemParametersInfoW EnumDisplayDevicesW GetLastInputInfo GetClassNameW GetShellWindow GetWindowInfo EnumWindows WindowFromPoint GetWindowRect GetDesktopWindow GetSystemMetrics GetWindow IsWindowVisible CharNextW FindWindowW IsWindow GetForegroundWindow MonitorFromWindow wsprintfW GetWindowThreadProcessId SetForegroundWindow LoadStringW GetAncestor

advapi32

RegDeleteKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserW CloseServiceHandle QueryServiceStatus StartServiceW ChangeServiceConfigW OpenServiceW OpenSCManagerW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation FreeSid GetLengthSid SetTokenInformation AllocateAndInitializeSid CreateRestrictedToken DuplicateTokenEx OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW CryptReleaseContext CryptGenRandom CryptAcquireContextW RegEnumValueW RegCreateKeyW RegQueryInfoKeyW RegSetValueExW RegDeleteValueW RegEnumKeyExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegEnumKeyW RegOpenKeyExW RegQueryValueExA

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation ord155 ord190 ord25 ord152 ShellExecuteExW ShellExecuteW ord165 SHGetSpecialFolderPathW SHGetFileInfoW SHGetDesktopFolder SHGetMalloc ord18

ole32

GetHGlobalFromStream IIDFromString StringFromGUID2 CoInitialize CreateStreamOnHGlobal CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoUninitialize

oleaut32

SysAllocStringByteLen SafeArrayPutElement VariantChangeType VariantInit SafeArrayCreate SafeArrayGetElement VariantClear SysStringByteLen SysFreeString SysAllocString VarUI4FromStr

shlwapi

PathRemoveFileSpecW PathAppendW SHSetValueW SHGetValueW PathAddBackslashW PathFileExistsW StrCmpNIW PathFindFileNameW PathIsRelativeW StrCpyNW PathIsDirectoryW StrPBrkA StrPBrkW StrStrIA StrStrIW PathFindExtensionW SHEnumValueW ord176 StrCmpIW PathCombineW StrRetToBufW

ws2_32

WSACleanup WSCDeinstallProvider WSCDeinstallProvider32 WSCUnInstallNameSpace WSAGetLastError WSAStartup ntohl htons htonl ntohs

version

VerQueryValueW

iphlpapi

GetIpAddrTable

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSQuerySessionInformationW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

psapi

GetModuleFileNameExW

msvcrt

wcstol realloc wcsspn wcscspn _mbsstr _mbsrchr _mktime64 towupper memmove memset _CxxThrowException ??0exception@@QEAA@AEBQEBD@Z ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ memcpy memcmp wcscmp _amsg_exit __getmainargs _initterm __CxxFrameHandler __DestructExceptionObject _localtime64 ___lc_codepage_func rand atoi wcspbrk __pctype_func tolower ___mb_cur_max_func strtol localeconv ___lc_handle_func abort memchr _wcstoui64 _msize _XcptFilter mbtowc strrchr iswctype srand ceil log10 _clearfp ?terminate@@YAXXZ _wtoi malloc free wcsstr wcschr wcsncmp __C_specific_handler ??_V@YAXPEAX@Z ??3@YAXPEAX@Z _wtoi64 _wcsupr _wcslwr _strlwr strchr _time64 _wcsnicmp ??2@YAPEAX_K@Z _wcsicmp wcsrchr calloc iswspace _errno ??_U@YAPEAX_K@Z sqrt

Name

.text

Size

530KB

Virtual Size

530KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

251KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

665KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=257, productName=VS2019 v16.7.0 build 29110, version=29110,

count=2, id=257, version=24225,

count=1, id=260, version=26706,

count=3, id=259, version=26706,

count=7, id=261, version=27412,

count=2, id=257, version=27032,

count=1, id=261, productName=VS2019 v16.7.1 build 29111, version=29111,

count=34, id=261, productName=VS2019 v16.7.0 build 29110, version=29110,

count=20, id=199, version=41118,

count=7, id=260, version=27034,

count=3, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=10, id=260, productName=VS2017 v15.7.5 build 26433, version=26433,

count=22, id=261, version=27034,

count=5, id=261, version=27040,

count=12, id=261, version=26706,

count=9, id=260, version=27412,

count=1, id=262, version=27412,

count=29, id=257, version=27412,

count=474, id=1, productName=Unmarked objects,

count=74, id=265, version=27045,

count=1, id=256, version=27045,

count=1, id=255, version=27045,

count=3, id=151,

count=1, id=258, version=27045,