cf7fdb47d40d37d764095417ee39a284d95e9228d9592def8d2dc4c97b6baf8d

Sharing

Copy URL Twitter E-mail

General

Target

cf7fdb47d40d37d764095417ee39a284d95e9228d9592def8d2dc4c97b6baf8d
Size

1.3MB
MD5

97cacaa7d243a113163ec263c0f0ef7e
SHA1

ff5b5e374c97af302b769b8b43a44991c1301a6a
SHA256

cf7fdb47d40d37d764095417ee39a284d95e9228d9592def8d2dc4c97b6baf8d
SHA512

53a7b9f02edbc595001d1d0b5f14b9b13a3da8af41c902a251bd9fc6a24903c9a5457cbfbcdf2fc93c4e9a8e890776dcff71af20e902bfb4e77e5f31b6439c7d
SSDEEP

24576:5wRoKuw201W4t21QYCg9Q8gaZt6RMtWSbndStZlGsRKRhhZdUtmOwmSZq1cnMeU8:hXZ8GtWTxwPZq1cM9TNsc/q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf7fdb47d40d37d764095417ee39a284d95e9228d9592def8d2dc4c97b6baf8d

Files

cf7fdb47d40d37d764095417ee39a284d95e9228d9592def8d2dc4c97b6baf8d
.exe windows:5 windows x86 arch:x86

0a15cc499aba32a7fba2418422e63a51

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\683688\out\Release\SDIS.pdb

Imports

kernel32

GetCurrentDirectoryW
SetCurrentDirectoryW
GetLocalTime
SetFileAttributesW
GetDiskFreeSpaceExW
CreateDirectoryW
SetFileTime
CreateFileMappingW
ExitProcess
VirtualQueryEx
ReadProcessMemory
VirtualProtectEx
VirtualAllocEx
WriteProcessMemory
ResumeThread
VirtualQuery
VirtualProtect
DeviceIoControl
Thread32First
Thread32Next
OpenThread
RemoveDirectoryW
GetLongPathNameW
GetWindowsDirectoryW
GetDriveTypeW
GetLogicalDriveStringsW
GetVolumeInformationW
MapViewOfFileEx
InterlockedCompareExchange
GetVersionExW
GetSystemDirectoryW
SystemTimeToFileTime
GetModuleHandleA
SetFilePointerEx
GetThreadLocale
SetThreadLocale
GetNativeSystemInfo
ReleaseMutex
GetCurrentThreadId
GetQueuedCompletionStatus
GetExitCodeProcess
OpenFileMappingW
SetEnvironmentVariableA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetLocaleInfoW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
GetDateFormatA
GetTimeFormatA
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
GetTimeZoneInformation
CompareStringA
CompareStringW
LCMapStringW
LCMapStringA
GetCPInfo
GetStringTypeW
RtlUnwind
GetFileAttributesW
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsAlloc
HeapWalk
HeapLock
HeapUnlock
TlsSetValue
TlsGetValue
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
PostQueuedCompletionStatus
GetSystemInfo
TerminateThread
SetErrorMode
CreateIoCompletionPort
MapViewOfFile
SetEndOfFile
UnmapViewOfFile
FlushViewOfFile
OpenMutexW
GetProcessId
GetCurrentProcess
TerminateProcess
HeapFree
GetProcessHeap
HeapAlloc
GlobalSize
GlobalReAlloc
CreateWaitableTimerW
ResetEvent
SetWaitableTimer
GlobalUnlock
GlobalLock
CreateThread
GetFileSizeEx
LocalFree
lstrcpynW
ReadFile
GetFileSize
InterlockedExchange
FlushInstructionCache
MoveFileW
FreeResource
CopyFileW
GetExitCodeThread
GlobalFree
GlobalAlloc
MoveFileExW
GetFileAttributesExW
DeleteFileW
lstrlenA
SetEvent
CreateEventW
OpenProcess
Process32NextW
InitializeCriticalSection
Process32FirstW
CreateToolhelp32Snapshot
MulDiv
FindClose
FindNextFileW
LoadLibraryExW
RaiseException
lstrcmpiW
lstrlenW
CreateProcessW
GetStartupInfoW
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
WaitForSingleObject
SetLastError
OutputDebugStringA
WideCharToMultiByte
GetTempPathW
Sleep
GetPrivateProfileIntW
GetPrivateProfileStringW
CreateFileW
SetFilePointer
OutputDebugStringW
WriteFile
GetTickCount
GetModuleFileNameW
GetCurrentProcessId
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
FreeLibrary
GetProcAddress
LoadLibraryW
CreateMutexW
GetLastError
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FindFirstFileW

user32

DefWindowProcW
FindWindowExW
GetClassNameW
GetWindowThreadProcessId
IsWindow
SendMessageTimeoutW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
RegisterClassExW
CreateWindowExW
SetWindowLongW
GetWindowLongW
ShowWindow
PostThreadMessageW
CharNextW
GetDC
ReleaseDC
CloseDesktop
GetThreadDesktop
SendMessageW
GetUserObjectInformationW
CreateDesktopW
GetProcessWindowStation
EnumDesktopWindows
SetTimer
PostMessageW
KillTimer
FindWindowW
WaitForInputIdle
IsWindowVisible
SetWindowPos
SetForegroundWindow
SetActiveWindow
SetThreadDesktop
DialogBoxParamW
EnumThreadWindows
GetGUIThreadInfo
GetClientRect
GetWindowTextW
PrintWindow
UnregisterClassA
DestroyWindow
GetWindowRect
GetForegroundWindow
AttachThreadInput
BringWindowToTop
SetCursorPos
GetWindow
GetDlgCtrlID
GetParent
IsWindowEnabled
SetRectEmpty
PtInRect
SetCursor
LoadCursorW
SetRect
PostQuitMessage
GetClassInfoExW
GetLastInputInfo
GetCursorPos
SystemParametersInfoW
EndDialog
GetActiveWindow
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
CopyRect
CallWindowProcW

gdi32

CreateHalftonePalette
GetPaletteEntries
GdiFlush
CreatePalette
CreateDIBSection
GetDIBits
RealizePalette
SelectPalette
GetStockObject
CreateDCW
DeleteDC
BitBlt
GetObjectW
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectW
DPtoLP
GetDeviceCaps
DeleteObject
SetBitmapBits
SetDIBColorTable

advapi32

GetSecurityInfo
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
SetNamedSecurityInfoW
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA

shell32

ord165
SHGetFolderPathW
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHCreateDirectoryExW

ole32

CoLoadLibrary
CoTaskMemRealloc
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree

oleaut32

SysAllocString
SysStringLen
LoadRegTypeLi
VarUI4FromStr
SysStringByteLen
DispCallFunc
VariantClear
VariantInit
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringByteLen
SysAllocStringLen
LoadTypeLi
SysFreeString

shlwapi

PathBuildRootW
PathGetDriveNumberW
PathFileExistsW
PathAppendW
PathCombineW
PathFindFileNameW
PathAddBackslashW
StrCmpNIW
StrCmpIW
PathFindExtensionW
PathRenameExtensionW
PathMatchSpecW
PathIsDirectoryW
PathQuoteSpacesW
StrStrW
SHGetValueW
StrCmpW
SHSetValueW
PathCanonicalizeA
PathFindNextComponentA
StrStrIW
StrFormatByteSizeW
SHGetValueA
StrRChrW
PathIsRootW
PathCanonicalizeW
PathRemoveBackslashW
PathIsPrefixW
PathRemoveFileSpecW
StrCpyNW
StrChrW

gdiplus

GdipCloneImage
GdiplusShutdown
GdipFree
GdipAlloc
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCreateBitmapFromFile
GdipDisposeImage
GdiplusStartup

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

imm32

ImmDisableIME

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

psapi

GetModuleFileNameExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 892KB - Virtual size: 891KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 25KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0a15cc499aba32a7fba2418422e63a51

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

crypt32

imm32

wtsapi32

psapi

version

Sections

.text Size: 892KB - Virtual size: 891KB

.rdata Size: 174KB - Virtual size: 174KB

.data Size: 25KB - Virtual size: 43KB

.rsrc Size: 51KB - Virtual size: 51KB

.reloc Size: 132KB - Virtual size: 132KB

.text
Size: 892KB - Virtual size: 891KB

.rdata
Size: 174KB - Virtual size: 174KB

.data
Size: 25KB - Virtual size: 43KB

.rsrc
Size: 51KB - Virtual size: 51KB

.reloc
Size: 132KB - Virtual size: 132KB