613d620d7d8c50465b05146b31e1e5139db23fecf164ee482c130f23ad9a15ba

Sharing

Copy URL Twitter E-mail

General

Target
613d620d7d8c50465b05146b31e1e5139db23fecf164ee482c130f23ad9a15ba
Size 1.9MB
Sample240425-28hsvsgb83
SHA256 613d620d7d8c50465b05146b31e1e5139db23fecf164ee482c130f23ad9a15ba
MD5 84025a1bd23886baa112be5c05f9b73b
SHA1 59aae2aea80a5d3a6287b5aabe46e701c9a0569c
SHA512 3c7705c90cbe782d2e242f3ce041d15d463da158099de6fdb8f64d537014eecc522efb10dff3401f5b4bf7e753f8ce9c0dc0002e2eb3df5e0a21e55d74b4b299
SSDEEP 49152:7NyPF3UVWD2U8fBOcEfV2rUld+1gqB2uKR0w8jDEuNDmn87mbS4ElDOCRccZX1qC:7NyPdUVWiU8fBOccsrUlM1lEuKRkd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

613d620d7d8c50465b05146b31e1e5139db23fecf164ee482c130f23ad9a15ba

.exe 1.9MB

613d620d7d8c50465b05146b31e1e5139db23fecf164ee482c130f23ad9a15ba

IMPHASH 40e9f10c92e0c120c49a2dece19d5f40
SHA256 613d620d7d8c50465b05146b31e1e5139db23fecf164ee482c130f23ad9a15ba
MD5 84025a1bd23886baa112be5c05f9b73b
SHA1 59aae2aea80a5d3a6287b5aabe46e701c9a0569c
SHA512 3c7705c90cbe782d2e242f3ce041d15d463da158099de6fdb8f64d537014eecc522efb10dff3401f5b4bf7e753f8ce9c0dc0002e2eb3df5e0a21e55d74b4b299
SSDEEP 49152:7NyPF3UVWD2U8fBOcEfV2rUld+1gqB2uKR0w8jDEuNDmn87mbS4ElDOCRccZX1qC:7NyPdUVWiU8fBOccsrUlM1lEuKRkd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

d4:9a:75:88:e4:2c:1c:a5:3f:c2:cc:fb:8c:30:ea:6b:3c:20:db:a5:34:27:42:71:52:0d:50:f5:24:af:4b:7f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ALCPU,O=ALCPU,POSTALCODE=67298,STREET=Snapir st. 1/12,L=Tel Aviv,ST=Tel Aviv,C=IL

Chains

Jun 29, 2020

CN=ALCPU,O=ALCPU,POSTALCODE=67298,STREET=Snapir st. 1/12,L=Tel Aviv,ST=Tel Aviv,C=IL

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=ALCPU,O=ALCPU,POSTALCODE=67298,STREET=Snapir st. 1/12,L=Tel Aviv,ST=Tel Aviv,C=IL

Serial Number

30:20:cd:c2:db:9e:d0:be:86:6d:83:92:bb:5c:4d:0e

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 12, 2016 - Apr 12, 2021

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 15, 2013 - Aug 15, 2023

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

952974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\vmagent_new\bin\joblist\521481\out\Release\360zip.pdb

kernel32

DeviceIoControl FileTimeToLocalFileTime lstrcpynW lstrcpyW GetFileAttributesExW GlobalSize OutputDebugStringW FormatMessageW CreateMutexW GetShortPathNameW OpenMutexW GetLogicalDrives GetDriveTypeW GetVolumeInformationW GetLongPathNameW MoveFileW lstrcatW GetFileTime GetDateFormatW GetTimeFormatW CompareStringW GetPrivateProfileIntW InterlockedExchange GetSystemTime SystemTimeToFileTime CompareFileTime FlushFileBuffers GetSystemInfo SetFilePointerEx GetTempFileNameW WaitForMultipleObjects lstrcmpA lstrcmpiA GetCurrentThread GetThreadContext VirtualQuery SetThreadPriority VirtualAlloc OpenThread GetThreadPriority VirtualProtect SuspendThread ResumeThread SetEnvironmentVariableA CompareStringA GetConsoleOutputCP GetDiskFreeSpaceW SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA GetModuleHandleA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoA SetHandleCount GetConsoleMode GetConsoleCP GetTimeZoneInformation LCMapStringA LCMapStringW InitializeCriticalSectionAndSpinCount GetModuleFileNameA HeapCreate IsValidCodePage GetOEMCP GetACP GetCPInfo RtlUnwind GetFileType WriteConsoleW CreateThread ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TlsFree TlsAlloc ReleaseMutex HeapWalk HeapLock HeapUnlock TlsSetValue TlsGetValue LocalFileTimeToFileTime GetSystemTimeAsFileTime CreateFileA VirtualFree IsProcessorFeaturePresent LoadLibraryA GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetTempPathW FileTimeToSystemTime GetWindowsDirectoryW GetFileAttributesW MoveFileExW SetEndOfFile WideCharToMultiByte GetCurrentProcessId SetFilePointer GetFileSizeEx ResetEvent SetEvent CreateEventW GetTickCount SetLastError GetPrivateProfileStringW GetSystemDirectoryW InterlockedCompareExchange GetSystemWindowsDirectoryW MulDiv Sleep CreateProcessW GetStartupInfoW GetCommandLineW GetFileSize WriteFile GetStdHandle MultiByteToWideChar lstrcmpiW LoadLibraryExW TerminateProcess SetFileAttributesW RemoveDirectoryW CreateFileW ReadFile CreateDirectoryW CloseHandle WaitForSingleObject DeleteCriticalSection InitializeCriticalSection GetModuleHandleW SetPriorityClass GetCurrentThreadId FlushInstructionCache GetCurrentProcess LocalFree GetLastError WritePrivateProfileStringW FindNextFileW FindClose FindFirstFileW DeleteFileW InterlockedDecrement InterlockedIncrement ExitProcess LoadLibraryW EnterCriticalSection GetProcAddress LeaveCriticalSection FreeLibrary GlobalAlloc GlobalLock GlobalUnlock GetVersionExW lstrlenW GlobalFree RaiseException FreeResource GetVersion GetModuleFileNameW FindResourceExW FindResourceW LoadResource LockResource SizeofResource WriteConsoleA

user32

RedrawWindow LoadMenuW PostThreadMessageW CreatePopupMenu MonitorFromPoint ScreenToClient MoveWindow UpdateWindow IsWindowEnabled ClientToScreen SetWindowRgn WindowFromPoint ReleaseDC UnregisterClassA GetDC GetClientRect SendMessageW GetParent InvalidateRect PostMessageW SetWindowLongW EndDialog GetWindowLongW KillTimer MapWindowPoints GetCursorPos SetTimer LoadCursorW SetWindowTextW LoadIconW SetWindowPos SetCursor LoadImageW FillRect ReleaseCapture SetCapture GetCapture PtInRect EndPaint BeginPaint DeleteMenu GetMenuItemInfoW SetMenuItemInfoW InsertMenuW GetWindowRect GetMonitorInfoW MonitorFromWindow GetWindow InflateRect GetSysColor GetWindowDC GetSystemMetrics GetAncestor GetKeyState IsDialogMessageW SetRect LockWindowUpdate SetParent MessageBeep IsClipboardFormatAvailable GetMenuState RegisterClipboardFormatW GetClipboardData IsIconic EnableMenuItem CheckMenuItem wvsprintfW SetRectEmpty AppendMenuW InsertMenuItemW GetMessagePos DrawEdge SystemParametersInfoW GetDlgItemInt SetDlgItemInt SetMenuDefaultItem DialogBoxParamW CreateDialogParamW GetClassInfoExW RegisterClassExW CharNextW FindWindowW GetClassInfoW RegisterClassW GetActiveWindow GetMenuItemCount DestroyIcon MessageBoxW DefWindowProcW GetWindowTextW GetClassNameW GetDlgItem ShowWindow PostQuitMessage OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible SetActiveWindow SetForegroundWindow SetDlgItemTextW SetFocus BringWindowToTop GetWindowTextLengthW EnableWindow IsDlgButtonChecked GetComboBoxInfo CallWindowProcW DestroyMenu GetSubMenu ModifyMenuW GetMenuItemID GetMenuStringW IsMenu CreateWindowExW MsgWaitForMultipleObjects GetIconInfo CharLowerBuffW DrawTextW GetCaretPos CopyRect LoadBitmapW TrackPopupMenu GetDlgCtrlID FrameRect AdjustWindowRectEx UpdateLayeredWindow IsRectEmpty GetSysColorBrush PeekMessageW IsWindowUnicode GetMessageW GetMessageA TranslateMessage DispatchMessageW DispatchMessageA DestroyWindow IsWindow RegisterWindowMessageW

gdi32

GetTextMetricsW DPtoLP CreateDCW GetTextColor CreateRectRgnIndirect GetClipBox GetTextExtentPointA GetTextMetricsA CreatePenIndirect RoundRect GetCurrentObject CreateSolidBrush SetViewportOrgEx CombineRgn CreateRectRgn GetPixel SetTextColor SetBkMode SetStretchBltMode RestoreDC SaveDC CreateDIBSection CreatePatternBrush CreateBitmap PatBlt CreatePolygonRgn ExtTextOutW SetBkColor StretchBlt BitBlt GetTextExtentPoint32W CreateRoundRectRgn CreateFontW GetDeviceCaps CreateCompatibleBitmap DeleteDC CreateCompatibleDC DeleteObject GetObjectW GetStockObject GetBkColor CreateFontIndirectW SelectObject

comdlg32

ChooseColorW ChooseFontW GetSaveFileNameW GetOpenFileNameW

advapi32

RegQueryValueExA RegCloseKey RegSetValueExW RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegDeleteKeyW RegQueryInfoKeyW RegEnumKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW GetNamedSecurityInfoW BuildExplicitAccessWithNameW SetEntriesInAclW SetNamedSecurityInfoW ConvertSidToStringSidW LookupAccountNameW OpenProcessToken GetTokenInformation

shell32

Shell_NotifyIconW ShellExecuteW ord18 ord190 SHBrowseForFolderW ord23 ord680 ord153 ord4 ord155 DragQueryPoint DragQueryFileW ord21 SHFileOperationW SHGetFileInfoW SHChangeNotify SHGetDesktopFolder ShellExecuteExW CommandLineToArgvW ord165 SHGetFolderPathW SHGetPathFromIDListW ord17 SHGetSpecialFolderLocation SHGetSpecialFolderPathW ord71 ord16 ord2 DragAcceptFiles ord152

ole32

StgCreateDocfile CreateStreamOnHGlobal DoDragDrop CoUninitialize CoInitialize OleInitialize CoTaskMemRealloc CoCreateInstance CoTaskMemAlloc CoTaskMemFree

oleaut32

VariantClear SysAllocStringByteLen SysStringByteLen SysFreeString SysAllocString SafeArrayCreateVector SysStringLen SysAllocStringLen OleTranslateColor VariantInit VarUI4FromStr

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

shlwapi

PathRemoveFileSpecW PathCombineW SHDeleteKeyW PathAppendW PathFileExistsW PathIsRelativeW PathFindExtensionW PathRemoveExtensionW StrCmpIW ord437 PathFindFileNameW PathAddExtensionW PathCompactPathExW PathIsDirectoryW PathIsUNCW PathRemoveBackslashW PathSearchAndQualifyW StrRStrIW StrStrIW PathRenameExtensionW SHSetValueW SHGetValueA SHGetValueW

comctl32

InitCommonControlsEx ImageList_Draw ImageList_Create ImageList_Destroy ImageList_Remove ImageList_SetImageCount ImageList_Replace

msimg32

AlphaBlend

gdiplus

GdipCreateBitmapFromFile GdipDeleteGraphics GdipCreateHBITMAPFromBitmap GdipDrawImageRectI GdipSetInterpolationMode GdipGraphicsClear GdipGetImageGraphicsContext GdipGetImageHorizontalResolution GdipGetImageVerticalResolution GdipBitmapSetResolution GdipBitmapSetPixel GdipGetImagePixelFormat GdipBitmapLockBits GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipCloneImage GdipCreateBitmapFromScan0 GdipFree GdipAlloc GdiplusShutdown GdiplusStartup GdipCreateBitmapFromStream GdipBitmapGetPixel GdipBitmapUnlockBits

oleacc

AccessibleObjectFromPoint

secur32

GetUserNameExW

netapi32

Netbios

rpcrt4

NdrClientCall2 RpcStringBindingComposeW RpcBindingFromStringBindingW RpcStringFreeW RpcBindingFree

Sharing

General

Malware Config

Signatures

File Explorer

613d620d7d8c50465b05146b31e1e5139db23fecf164ee482c130f23ad9a15ba

PE Signature issue

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

version

shlwapi

comctl32

msimg32

gdiplus

oleacc

secur32

netapi32

rpcrt4

generic