50baccdde79e54add5d1ad4f6b3067eef5d428bde15b32e94093b3ad2db77272

Sharing

Copy URL Twitter E-mail

General

Target

50baccdde79e54add5d1ad4f6b3067eef5d428bde15b32e94093b3ad2db77272
Size

1.3MB
MD5

6c460e30472820f66e7670cb1f300026
SHA1

00bf2dc72a59b95dfaf1f85d17022a5725091122
SHA256

50baccdde79e54add5d1ad4f6b3067eef5d428bde15b32e94093b3ad2db77272
SHA512

7c378c1760eb716f3d4a7a0cc4d6dbddbbdcd64ae95e9ca817f63523d1602f96f19782078707c13d97fe0f2324bbb5590cd137dd4ea2de9affe881ddec9cd3e6
SSDEEP

24576:eImwbMlPqFnSVn1Kg8Yez70USKnKjBD4gerkoYI9Yw2QaXV/pNTf6mR3yF/b9/:1oljKg2zIUIx4P6Ck/3TSmRCFZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
50baccdde79e54add5d1ad4f6b3067eef5d428bde15b32e94093b3ad2db77272

Files

50baccdde79e54add5d1ad4f6b3067eef5d428bde15b32e94093b3ad2db77272
.exe windows:5 windows x86 arch:x86

7414581e8d6ec35aad6fdd8b3433d3f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\531319\out\Release\360DrvUpdateTip.pdb

Imports

kernel32

Process32FirstW
CreateToolhelp32Snapshot
DeleteCriticalSection
WriteFile
CreateFileW
MoveFileW
GetFileSizeEx
GetLocalTime
SetFilePointer
GetFileSize
WideCharToMultiByte
HeapFree
HeapAlloc
GetProcessHeap
MultiByteToWideChar
GetVersion
DeviceIoControl
SetFileAttributesW
GetFileAttributesExW
GetModuleFileNameA
OpenMutexW
SetLastError
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
LocalAlloc
lstrlenA
RaiseException
FlushInstructionCache
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
lstrcmpiW
GetTempFileNameW
GetTempPathW
CreateDirectoryW
WaitForMultipleObjects
ReadFile
SystemTimeToFileTime
CreateFileA
DeleteFileA
GetACP
FormatMessageW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
MoveFileExW
GetWindowsDirectoryW
GetEnvironmentVariableW
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
SetCurrentDirectoryW
SetEnvironmentVariableW
GetExitCodeProcess
GetVersionExW
Process32NextW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetShortPathNameW
GetCurrentDirectoryW
SetVolumeLabelW
InterlockedCompareExchange
SetFileTime
GetFileAttributesW
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
FindClose
GetUserDefaultLCID
GetStringTypeA
GetLocaleInfoA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
FlushFileBuffers
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
HeapCreate
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
FatalAppExitA
GetStdHandle
IsValidCodePage
GetOEMCP
GetCurrentThread
GetStringTypeW
GetCPInfo
LCMapStringW
LCMapStringA
GetDateFormatA
GetTimeFormatA
CreateThread
ExitThread
RtlUnwind
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
lstrcmpiA
lstrcmpA
GetSystemDirectoryW
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
OpenThread
GetLastError
CreateMutexW
QueryDosDeviceW
InitializeCriticalSection
GetLongPathNameW
GetCurrentProcess
GetDiskFreeSpaceExW
GetStartupInfoW
CreateProcessW
FindFirstFileW
OpenProcess
FindNextFileW
Sleep
GetCommandLineW
InterlockedExchange
LocalFree
lstrlenW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleHandleA
GetSystemInfo
DeleteFileW
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
CloseHandle
LoadLibraryW
GetModuleFileNameW
HeapUnlock
TlsSetValue
OutputDebugStringW
TlsGetValue
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
EnumSystemLocalesA
GetCurrentProcessId
WaitForSingleObject
GetDriveTypeW
FindNextFileA

user32

LoadMenuW
MessageBoxW
GetActiveWindow
PostQuitMessage
DispatchMessageW
MsgWaitForMultipleObjects
TranslateMessage
PeekMessageW
FindWindowW
UnregisterClassA
RegisterWindowMessageW
PostMessageW
GetWindowThreadProcessId
FindWindowExW
ExitWindowsEx
GetShellWindow
WaitForInputIdle
RegisterClassW
GetClassInfoW
SetWindowLongW
GetMessageW
CharNextW
DestroyWindow
CreateDialogParamW
DefWindowProcW
CreateWindowExW
RegisterClassExW
GetClassInfoExW
SendMessageTimeoutW
IsWindow
GetDC
GetWindowRect
ModifyMenuW
DestroyMenu
GetMonitorInfoW
UpdateLayeredWindow
ReleaseDC
EndPaint
BeginPaint
CallWindowProcW
LoadCursorW
SetWindowRgn
IsWindowVisible
LoadImageW
MoveWindow
SetWindowTextW
SystemParametersInfoW
BringWindowToTop
FillRect
GetClientRect
ClientToScreen
GetSystemMetrics
GetForegroundWindow
AttachThreadInput
SetForegroundWindow
GetSubMenu
TrackPopupMenu
GetLastInputInfo
CopyRect
GetWindowLongW
IsDialogMessageW
SendMessageW
GetDlgItem
KillTimer
SetTimer
ShowWindow
UpdateWindow
SetWindowPos
IsIconic
MonitorFromPoint

gdi32

DeleteDC
CreateCompatibleBitmap
SetViewportOrgEx
SelectObject
CreateCompatibleDC
CombineRgn
CreateRectRgn
DeleteObject
CreateSolidBrush
GetDeviceCaps
BitBlt

advapi32

RegEnumKeyExW
RegEnumKeyExA
RegCreateKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteKeyW
DuplicateTokenEx
RegSetValueExW
RegDeleteValueW
GetAclInformation
GetAce
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

shell32

SHCreateDirectoryExW
SHGetFolderPathW
ShellExecuteExW
SHGetSpecialFolderPathW
ord165
CommandLineToArgvW
ShellExecuteW
SHFileOperationW

ole32

CoInitializeEx
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree
StringFromCLSID
CoTaskMemAlloc
CoTaskMemRealloc
CoInitializeSecurity
CreateStreamOnHGlobal

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocStringByteLen
SysStringByteLen
VarUI4FromStr
CreateErrorInfo
SetErrorInfo
VariantChangeType
GetErrorInfo
SysStringLen
SysAllocString

shlwapi

SHGetValueA
SHSetValueA
StrToIntExW
PathAppendW
PathFileExistsW
PathCombineW
StrCmpIW
PathFileExistsA
StrStrIA
StrFormatByteSizeW
PathRemoveExtensionW
PathRemoveBackslashW
PathIsRelativeW
SHGetValueW
StrStrW
StrStrA
AssocQueryStringW
PathIsDirectoryW
PathIsRootW
SHDeleteKeyW
PathRemoveFileSpecA
SHSetValueW
SHDeleteValueW
StrStrIW
PathStripPathW
PathRemoveFileSpecW

comctl32

InitCommonControlsEx

gdiplus

GdipGetImageHeight
GdipDisposeImage
GdipCreateFromHDC
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipCloneImage
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdipLoadImageFromStream
GdipGetImageWidth
GdipLoadImageFromStreamICM

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueA

psapi

GetProcessImageFileNameW
GetModuleFileNameExW

setupapi

SetupIterateCabinetW
SetupDiOpenDevRegKey
SetupDiDestroyDeviceInfoList
CM_Get_DevNode_Status
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW

dbghelp

MiniDumpWriteDump

ws2_32

closesocket
socket
connect
WSAStartup
htons
gethostbyname
shutdown
WSAGetLastError

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

Sections

.text
Size: 1005KB - Virtual size: 1005KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 18KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7414581e8d6ec35aad6fdd8b3433d3f8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

version

psapi

setupapi

dbghelp

ws2_32

wintrust

crypt32

Sections

.text Size: 1005KB - Virtual size: 1005KB

.rdata Size: 162KB - Virtual size: 162KB

.data Size: 18KB - Virtual size: 32KB

.rsrc Size: 24KB - Virtual size: 24KB

.reloc Size: 108KB - Virtual size: 112KB

.text
Size: 1005KB - Virtual size: 1005KB

.rdata
Size: 162KB - Virtual size: 162KB

.data
Size: 18KB - Virtual size: 32KB

.rsrc
Size: 24KB - Virtual size: 24KB

.reloc
Size: 108KB - Virtual size: 112KB