32b5b1f200edc53e83cddf633891a8c2c14ff1522fc5d05151b10aac8526b5ac

Sharing

Copy URL Twitter E-mail

General

Target

32b5b1f200edc53e83cddf633891a8c2c14ff1522fc5d05151b10aac8526b5ac
Size

2.9MB
MD5

4e389292f72067c5c9ff87aa12b2eb72
SHA1

be5f3b15afdab974c8da2d7c0424f79b7935d008
SHA256

32b5b1f200edc53e83cddf633891a8c2c14ff1522fc5d05151b10aac8526b5ac
SHA512

91b99a51545ab9b26ac8373bacb663db03f7637731f4076f036fa8c43d2d46db8e067ce9d3359d5fe2e976787756a6aa9dd64b3f40ca21e64110c5d25a54b305
SSDEEP

24576:op5X20t9uu3l+DPX1AGzUSw4vqWBqf89qb93iQAjSK/8/9iZs1lVSkLLerlMj9h4:o5lGy4vqKIzrYZ/8F2sESywPTgG5uS2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
32b5b1f200edc53e83cddf633891a8c2c14ff1522fc5d05151b10aac8526b5ac

Files

32b5b1f200edc53e83cddf633891a8c2c14ff1522fc5d05151b10aac8526b5ac
.exe windows:5 windows x64 arch:x64

bdccc0a7877bd072b2c54170061b4eed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\vmagent_new\bin\joblist\735025\src\c\channel_packet\build_sln\src-app\rotate\Release\qrotate.pdb

Imports

kernel32

WaitForMultipleObjects
WriteFile
SetEndOfFile
SetFilePointer
SetFileTime
SystemTimeToFileTime
TlsAlloc
TlsSetValue
TlsFree
CreateWaitableTimerW
SetWaitableTimer
CancelWaitableTimer
GetDiskFreeSpaceExW
IsBadReadPtr
IsBadWritePtr
TerminateThread
SuspendThread
GetModuleHandleA
GetCurrentThread
DuplicateHandle
ResetEvent
WideCharToMultiByte
GetVersionExW
GetFileAttributesW
CreateFileW
CreateDirectoryW
GetTempFileNameW
GetTempPathW
GetCommandLineW
LoadLibraryW
SetUnhandledExceptionFilter
GetCurrentProcessId
VirtualQuery
VirtualFree
VirtualAlloc
OpenMutexW
CreateMutexW
ReleaseMutex
OpenProcess
DeleteFileW
CreateProcessW
CreatePipe
GetTickCount
SetHandleInformation
ReadFile
GetStdHandle
Sleep
InitializeCriticalSection
ResumeThread
SetLastError
SetThreadPriority
GetExitCodeProcess
CreateEventW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetStdHandle
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
WriteConsoleW
PeekNamedPipe
GetFileType
GetFullPathNameW
GetConsoleMode
GetConsoleCP
ExitThread
RtlUnwindEx
RtlPcToFileHeader
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
WaitForSingleObject
SetEvent
CreateThread
LockResource
FreeResource
MultiByteToWideChar
FindResourceW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
lstrcmpiW
CloseHandle
SizeofResource
LoadResource
LeaveCriticalSection
EnterCriticalSection
VirtualProtect
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetProcAddress
FreeLibrary
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
DecodePointer
RtlCaptureContext
LoadLibraryExA
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
OutputDebugStringW
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
WaitForSingleObjectEx
GetPrivateProfileStringA
CreateEventA
GetFileAttributesA
GetTimeZoneInformation
GetDriveTypeW
lstrcpyW
SetFileAttributesW
lstrlenA
ExitProcess
FindResourceExW
MulDiv
GetWindowsDirectoryW
GetSystemDirectoryW
UnregisterWaitEx
RegisterWaitForSingleObject
SetFilePointerEx
FlushFileBuffers
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
TlsGetValue
GetModuleHandleExW
lstrlenW
GetUserDefaultLangID
lstrcmpiA
lstrcmpA
DeviceIoControl
TryEnterCriticalSection
ReplaceFileW
MoveFileExW
MoveFileW
FindNextFileW
FindFirstFileW
GetFileAttributesExW
RemoveDirectoryW
GetCurrentDirectoryW
FindClose
GetFileSize
GetLongPathNameW
AssignProcessToJobObject
GetModuleHandleExA
GetSystemInfo
QueryPerformanceFrequency
QueryPerformanceCounter
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
IsDebuggerPresent
OutputDebugStringA
FormatMessageA
GetNativeSystemInfo
LocalFree

user32

EndPaint
SetWindowPos
IsWindowVisible
SetCursor
GetMessageExtraInfo
RegisterWindowMessageW
GetMessageW
GetKeyState
MapWindowPoints
ScreenToClient
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
SetForegroundWindow
ShowWindow
GetForegroundWindow
SetActiveWindow
GetSystemMetrics
IsZoomed
BeginPaint
UpdateLayeredWindow
UpdateWindow
SetCapture
GetCapture
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
ReleaseCapture
TrackMouseEvent
AdjustWindowRectEx
InvalidateRect
GetFocus
InvalidateRgn
DrawIconEx
GetIconInfo
WindowFromDC
MsgWaitForMultipleObjectsEx
GetQueueStatus
CallMsgFilterW
WaitMessage
PeekMessageW
DispatchMessageW
TranslateMessage
FindWindowExW
MessageBoxW
InflateRect
PtInRect
GetWindowLongW
SetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
GetDesktopWindow
GetParent
GetWindowThreadProcessId
GetWindow
LoadCursorW
UnregisterClassW
DestroyWindow
CharNextW
PostQuitMessage
IsWindow
SetTimer
KillTimer
GetCursorPos
CopyRect
DefWindowProcW
AttachThreadInput
IntersectRect
SendMessageW
PostMessageW
IsIconic
GetLastActivePopup
SetWindowRgn
IsWindowEnabled
EnableWindow
SetFocus
EndDialog
DialogBoxParamW
FindWindowW
OffsetRect
SubtractRect
FillRect
ReleaseDC
GetDC
DrawTextW
AllowSetForegroundWindow
ReplyMessage
SendMessageTimeoutW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW

gdi32

DeleteObject
DeleteDC
CreateFontIndirectW
CreateCompatibleDC
SetViewportOrgEx
GetDeviceCaps
GetRandomRgn
GdiAlphaBlend
GetLayout
SetLayout
GetCurrentObject
SetBkMode
LPtoDP
SetGraphicsMode
SetWorldTransform
CreateDIBSection
GetTextExtentPoint32W
SetWindowOrgEx
RectVisible
CreateRectRgnIndirect
SelectClipRgn
GetRgnBox
OffsetRgn
CombineRgn
CreateRectRgn
GetDIBits
GetStockObject
IntersectClipRect
RestoreDC
SaveDC
SelectObject
GetObjectW
BitBlt
ModifyWorldTransform
GetObjectType

shell32

SHGetFolderPathW
SHFileOperationW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ShellExecuteW
SHAppBarMessage
SHGetSpecialFolderPathW
DragQueryFileW
SHGetDesktopFolder
CommandLineToArgvW

ole32

ReleaseStgMedium
OleInitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
RegisterDragDrop
RevokeDragDrop
DoDragDrop

oleaut32

CreateStdDispatch
SysFreeString
VarUI4FromStr
CreateDispTypeInfo
VarCmp
VariantClear
VariantChangeType
VariantCopy
SysAllocString
VariantInit

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
CreateProcessAsUserW

wininet

InternetOpenW
InternetCloseHandle
InternetConnectW
InternetReadFile
InternetCrackUrlW
InternetWriteFile
InternetQueryOptionW
InternetSetOptionA
InternetSetOptionW
InternetGetLastResponseInfoW
InternetSetStatusCallbackW
FtpOpenFileW
InternetReadFileExA
FtpCommandW
HttpOpenRequestW
HttpSendRequestExW
HttpEndRequestW
HttpQueryInfoW
InternetOpenUrlW
HttpAddRequestHeadersA
HttpAddRequestHeadersW
HttpSendRequestW
HttpQueryInfoA
InternetErrorDlg
FtpGetFileSize

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

shlwapi

SHGetValueW
PathRemoveFileSpecW
PathFileExistsW
PathFindFileNameA
PathFindFileNameW
StrStrIW
PathGetDriveNumberW
SHGetValueA
PathFileExistsA
PathIsRootW
PathIsDirectoryW
PathAddBackslashW

gdiplus

GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesWrapMode
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRectI
GdipDrawImagePointRectI

winmm

timeEndPeriod
timeBeginPeriod
timeGetTime

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

netapi32

Netbios

libmlt-6

mlt_factory_init
mlt_frame_get_image
mlt_log_set_level
mlt_log_set_callback
mlt_properties_get
mlt_log_get_level
mlt_service_cache_set_size
mlt_events_fire
mlt_frame_close
mlt_properties_set
mlt_properties_set_int
mlt_properties_inc_ref
mlt_properties_get_double
mlt_properties_close
mlt_properties_set_double
mlt_properties_get_int
mlt_producer_seek
mlt_producer_get_in
mlt_producer_set_speed
mlt_producer_get_length
mlt_producer_position
mlt_producer_get_speed
mlt_producer_close
mlt_producer_service
mlt_producer_get_out
mlt_factory_producer
mlt_service_properties
mlt_service_close
mlt_service_filter_count
mlt_service_attach
mlt_service_get_frame
mlt_service_connect_producer
mlt_service_filter
mlt_profile_init
mlt_profile_close
mlt_profile_fps
mlt_profile_from_producer
mlt_filter_close
mlt_filter_set_in_and_out
mlt_filter_get_length
mlt_filter_service
mlt_factory_filter
mlt_consumer_is_stopped
mlt_consumer_stop
mlt_consumer_position
mlt_consumer_start
mlt_consumer_close
mlt_factory_consumer
mlt_consumer_service
mlt_consumer_purge
mlt_frame_properties

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 814KB - Virtual size: 813KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 121KB - Virtual size: 556KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 29B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdccc0a7877bd072b2c54170061b4eed

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

comdlg32

advapi32

wininet

version

shlwapi

gdiplus

winmm

userenv

netapi32

libmlt-6

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 814KB - Virtual size: 813KB

.data Size: 121KB - Virtual size: 556KB

.pdata Size: 87KB - Virtual size: 86KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 29B

.rsrc Size: 165KB - Virtual size: 165KB

.reloc Size: 37KB - Virtual size: 36KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 814KB - Virtual size: 813KB

.data
Size: 121KB - Virtual size: 556KB

.pdata
Size: 87KB - Virtual size: 86KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 29B

.rsrc
Size: 165KB - Virtual size: 165KB

.reloc
Size: 37KB - Virtual size: 36KB