340ff499e66d47f9de01812fb7adbdcf87d67cd80fd58cdfe0a1bf2e0838bdbc

Sharing

Copy URL Twitter E-mail

General

Target

340ff499e66d47f9de01812fb7adbdcf87d67cd80fd58cdfe0a1bf2e0838bdbc
Size

1.4MB
MD5

0127cb4525eee4594244a568cbecce2b
SHA1

859637c63aa040bb603edf134b6bafdafe39b9d4
SHA256

340ff499e66d47f9de01812fb7adbdcf87d67cd80fd58cdfe0a1bf2e0838bdbc
SHA512

63b9e162746c1963b452978edf66f14e89b2d48b0b1543bdbec835cfba8e7242a38466f71e6af87cabd5bfb192e027286d3498cbddcb3cd0cdca21bd6bf0ebb5
SSDEEP

24576:t+tVLlZJ9Me3PqPm7tfz0Ku4Po6qQUyP3JrXuqIMI2YPjTtlJPhSyEPGVKbzd9/:tG/qE931j3JTcJbTxhSyEPpD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
340ff499e66d47f9de01812fb7adbdcf87d67cd80fd58cdfe0a1bf2e0838bdbc

Files

340ff499e66d47f9de01812fb7adbdcf87d67cd80fd58cdfe0a1bf2e0838bdbc
.exe windows:5 windows x86 arch:x86

6cc9e14f1cc1618e6e680f2d815d6036

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\700102\out\Release\safesvr.pdb

Imports

kernel32

GetModuleHandleA
GlobalMemoryStatusEx
GlobalAlloc
GlobalFree
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
MoveFileExW
SetFileAttributesW
HeapAlloc
GetProcessHeap
OpenProcess
HeapFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ExpandEnvironmentStringsA
GlobalLock
GlobalUnlock
GetModuleFileNameA
CreateFileA
OutputDebugStringA
GetThreadLocale
SetThreadLocale
SetFilePointerEx
TerminateProcess
lstrcmpA
OpenThread
SuspendThread
ResumeThread
GetUserDefaultLangID
GetSystemDefaultLangID
GetSystemDirectoryA
MoveFileA
GetFileTime
GetFileAttributesA
FindFirstFileA
FindNextFileA
CopyFileW
GetSystemTimes
GetLogicalDriveStringsA
GetDiskFreeSpaceExA
GetDriveTypeA
lstrcmpiA
LoadLibraryA
GetPrivateProfileStringA
WritePrivateProfileStringA
EnumResourceNamesW
FreeResource
BeginUpdateResourceA
UpdateResourceW
EndUpdateResourceW
LoadLibraryExA
FindResourceExA
GetLocalTime
GetNativeSystemInfo
SystemTimeToFileTime
CreateIoCompletionPort
GetExitCodeThread
TerminateThread
PostQueuedCompletionStatus
GetQueuedCompletionStatus
GetWindowsDirectoryA
GetCurrentThread
QueryPerformanceCounter
GetStartupInfoW
RemoveDirectoryA
DeleteFileA
CreateEventA
OpenEventA
OpenMutexW
ReleaseMutex
DuplicateHandle
SetThreadPriority
SetEnvironmentVariableA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FlushFileBuffers
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
HeapCreate
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetACP
CompareStringA
CompareStringW
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwind
GetDateFormatA
GetTimeFormatA
ExitProcess
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsAlloc
HeapWalk
HeapLock
HeapUnlock
TlsSetValue
TlsGetValue
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapSize
HeapReAlloc
HeapDestroy
GetSystemInfo
GetVersionExW
MapViewOfFileEx
GetFileSize
DeviceIoControl
ResetEvent
CreateProcessW
CreateFileMappingW
GetTempPathW
GetFileSizeEx
GetFileAttributesExW
GetTickCount
WideCharToMultiByte
GetCurrentProcess
InterlockedCompareExchange
SetEvent
InterlockedExchange
WaitForSingleObject
CreateEventW
LoadLibraryW
MulDiv
GetCommandLineW
GetCurrentThreadId
SetErrorMode
Sleep
LoadLibraryExW
SetEndOfFile
FlushViewOfFile
ExpandEnvironmentStringsW
GetLongPathNameW
GetTempFileNameW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateThread
FlushInstructionCache
SetLastError
lstrlenA
SetThreadAffinityMask
CreateDirectoryW
MultiByteToWideChar
RaiseException
lstrcmpiW
lstrlenW
ReadFile
InterlockedDecrement
InterlockedIncrement
CreateMutexW
GetLastError
GetCurrentProcessId
GetProcAddress
FreeLibrary
GetModuleHandleW
WriteFile
OutputDebugStringW
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
CloseHandle
SetFilePointer
CreateFileW
GetPrivateProfileStringW
GetPrivateProfileIntW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleFileNameW
DeleteCriticalSection
UpdateResourceA

user32

PeekMessageW
PostThreadMessageW
ReleaseDC
GetDC
DestroyWindow
DefWindowProcW
SendMessageTimeoutW
WaitForInputIdle
FindWindowW
CharNextW
UnregisterClassA
GetWindowTextW
EnumWindows
CreateIconIndirect
LoadStringA
GetCursorInfo
SetCursorPos
ShowCursor
GetAsyncKeyState
mouse_event
TranslateMessage
DispatchMessageW
IsWindow
SendMessageW
MessageBoxW
IsWindowVisible
PostQuitMessage
SetTimer
GetLastInputInfo
GetCursorPos
GetWindowRect
PtInRect
PostMessageW
KillTimer
GetPropW
CallWindowProcW
DestroyIcon
MoveWindow
SetWindowPos
SetWindowLongW
GetWindowLongW
ShowWindow
LoadCursorW
GetWindowTextA
SetWindowTextW
SystemParametersInfoW
MapWindowPoints
GetClientRect
GetParent
GetMonitorInfoW
MonitorFromWindow
GetWindow
SetPropW
CopyRect
OffsetRect
ClientToScreen
GetWindowThreadProcessId
GetClassNameW
FindWindowExW
GetClassNameA
FindWindowA
IsChild
WindowFromPoint
MessageBoxA
SetForegroundWindow
SetActiveWindow
DestroyMenu
LoadImageW
GetSystemMetrics
UpdateLayeredWindow
MonitorFromPoint
AppendMenuW
ScreenToClient
BeginPaint
EndPaint
RegisterClassExW
GetClassInfoExW
CreateWindowExW
CreatePopupMenu
TrackPopupMenu
keybd_event
RegisterWindowMessageW
GetDlgItem
MsgWaitForMultipleObjects
GetMessageW

gdi32

DeleteDC
CreateFontIndirectW
CreateCompatibleDC
GetDeviceCaps
DeleteObject
CreateDIBSection
SelectObject
CreateCompatibleBitmap
BitBlt
SetBkColor
ExtTextOutW
DPtoLP
CreateBitmap

advapi32

RegQueryValueExA
RegOpenKeyExA
RegDeleteValueW
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumValueA
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext

shell32

SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
SHCreateDirectoryExA
SHGetFolderPathW
ord165
ShellExecuteExW
ShellExecuteW
SHCreateDirectoryExW

ole32

PropVariantClear
CoLoadLibrary
CoInitializeEx
CoTaskMemFree
CreateStreamOnHGlobal
CoSetProxyBlanket
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc

oleaut32

SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SafeArrayCreate
DispCallFunc
SafeArrayGetUBound
SafeArrayGetLBound
VariantInit
VariantCopy
SafeArrayCopy
SafeArrayGetVartype
VariantClear
LoadTypeLi
LoadRegTypeLi
SysStringLen
VarUI4FromStr
SysFreeString
SysAllocString

shlwapi

PathIsPrefixW
PathRemoveBackslashW
StrCmpNIA
StrRStrIA
PathIsDirectoryA
StrFormatByteSizeA
PathAddBackslashA
ord12
StrStrA
PathIsRelativeA
StrStrIA
PathFindFileNameA
PathRemoveExtensionA
ord176
PathFindFileNameW
PathCombineW
PathAppendW
PathFileExistsW
PathAddBackslashW
StrCmpNIW
SHGetValueW
StrCmpIW
PathRemoveFileSpecW
SHSetValueW
StrCpyNW
PathFileExistsA
PathRemoveFileSpecA
StrRChrW
StrRStrIW
StrStrIW
StrToInt64ExA
SHStrDupW
PathFindExtensionW
PathIsRelativeW
PathCanonicalizeW
PathIsDirectoryW
SHGetValueA
PathAppendA
PathIsRootW
SHSetValueA

gdiplus

GdiplusStartup
GdiplusShutdown
GdipFree
GdipDisposeImage
GdipAlloc
GdipCreateHBITMAPFromBitmap
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImageGraphicsContext
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipSaveImageToFile
GdipDrawImageRectRect
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDrawImagePointRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipCloneBitmapAreaI
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
GdipCreateBitmapFromFile
GdipImageRotateFlip
GdipCloneImage
GdipGetImagePixelFormat

comctl32

InitCommonControlsEx

crypt32

CryptStringToBinaryA
CryptBinaryToStringA
CertGetNameStringW
CryptStringToBinaryW

imm32

ImmDisableIME

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

mixerGetLineInfoW
mixerGetLineControlsW
mixerGetNumDevs
mixerGetControlDetailsW
mixerSetControlDetails
mixerOpen

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

netapi32

Netbios

setupapi

SetupIterateCabinetW

psapi

GetModuleFileNameExW

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 28KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6cc9e14f1cc1618e6e680f2d815d6036

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

comctl32

crypt32

imm32

version

winmm

wintrust

netapi32

setupapi

psapi

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 229KB - Virtual size: 229KB

.data Size: 28KB - Virtual size: 44KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 144KB - Virtual size: 144KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 229KB - Virtual size: 229KB

.data
Size: 28KB - Virtual size: 44KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 144KB - Virtual size: 144KB