613d620d7d8c50465b05146b31e1e5139db23fecf164ee482c130f23ad9a15ba

Sharing

Copy URL

Twitter E-mail

General

Target

613d620d7d8c50465b05146b31e1e5139db23fecf164ee482c130f23ad9a15ba
Size

1.9MB
MD5

84025a1bd23886baa112be5c05f9b73b
SHA1

59aae2aea80a5d3a6287b5aabe46e701c9a0569c
SHA256

613d620d7d8c50465b05146b31e1e5139db23fecf164ee482c130f23ad9a15ba
SHA512

3c7705c90cbe782d2e242f3ce041d15d463da158099de6fdb8f64d537014eecc522efb10dff3401f5b4bf7e753f8ce9c0dc0002e2eb3df5e0a21e55d74b4b299
SSDEEP

49152:7NyPF3UVWD2U8fBOcEfV2rUld+1gqB2uKR0w8jDEuNDmn87mbS4ElDOCRccZX1qC:7NyPdUVWiU8fBOccsrUlM1lEuKRkd

Score

1^/10

Malware Config

Signatures

Files

613d620d7d8c50465b05146b31e1e5139db23fecf164ee482c130f23ad9a15ba
.exe windows:5 windows x86 arch:x86

40e9f10c92e0c120c49a2dece19d5f40

Code Sign

30:20:cd:c2:db:9e:d0:be:86:6d:83:92:bb:5c:4d:0e
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-04-2016 00:00

Not After

12-04-2021 23:59

Subject

CN=ALCPU,O=ALCPU,POSTALCODE=67298,STREET=Snapir st. 1/12,L=Tel Aviv,ST=Tel Aviv,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-08-2013 20:26

Not After

15-08-2023 20:36

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-05-2019 00:00

Not After

01-08-2030 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d4:9a:75:88:e4:2c:1c:a5:3f:c2:cc:fb:8c:30:ea:6b:3c:20:db:a5:34:27:42:71:52:0d:50:f5:24:af:4b:7f
Signer

Actual PE Digest

d4:9a:75:88:e4:2c:1c:a5:3f:c2:cc:fb:8c:30:ea:6b:3c:20:db:a5:34:27:42:71:52:0d:50:f5:24:af:4b:7f

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\vmagent_new\bin\joblist\521481\out\Release\360zip.pdb

Imports

kernel32

DeviceIoControl
FileTimeToLocalFileTime
lstrcpynW
lstrcpyW
GetFileAttributesExW
GlobalSize
OutputDebugStringW
FormatMessageW
CreateMutexW
GetShortPathNameW
OpenMutexW
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
GetLongPathNameW
MoveFileW
lstrcatW
GetFileTime
GetDateFormatW
GetTimeFormatW
CompareStringW
GetPrivateProfileIntW
InterlockedExchange
GetSystemTime
SystemTimeToFileTime
CompareFileTime
FlushFileBuffers
GetSystemInfo
SetFilePointerEx
GetTempFileNameW
WaitForMultipleObjects
lstrcmpA
lstrcmpiA
GetCurrentThread
GetThreadContext
VirtualQuery
SetThreadPriority
VirtualAlloc
OpenThread
GetThreadPriority
VirtualProtect
SuspendThread
ResumeThread
SetEnvironmentVariableA
CompareStringA
GetConsoleOutputCP
GetDiskFreeSpaceW
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetModuleHandleA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
SetHandleCount
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
LCMapStringA
LCMapStringW
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
GetFileType
WriteConsoleW
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
HeapUnlock
TlsSetValue
TlsGetValue
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
CreateFileA
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetTempPathW
FileTimeToSystemTime
GetWindowsDirectoryW
GetFileAttributesW
MoveFileExW
SetEndOfFile
WideCharToMultiByte
GetCurrentProcessId
SetFilePointer
GetFileSizeEx
ResetEvent
SetEvent
CreateEventW
GetTickCount
SetLastError
GetPrivateProfileStringW
GetSystemDirectoryW
InterlockedCompareExchange
GetSystemWindowsDirectoryW
MulDiv
Sleep
CreateProcessW
GetStartupInfoW
GetCommandLineW
GetFileSize
WriteFile
GetStdHandle
MultiByteToWideChar
lstrcmpiW
LoadLibraryExW
TerminateProcess
SetFileAttributesW
RemoveDirectoryW
CreateFileW
ReadFile
CreateDirectoryW
CloseHandle
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleW
SetPriorityClass
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
LocalFree
GetLastError
WritePrivateProfileStringW
FindNextFileW
FindClose
FindFirstFileW
DeleteFileW
InterlockedDecrement
InterlockedIncrement
ExitProcess
LoadLibraryW
EnterCriticalSection
GetProcAddress
LeaveCriticalSection
FreeLibrary
GlobalAlloc
GlobalLock
GlobalUnlock
GetVersionExW
lstrlenW
GlobalFree
RaiseException
FreeResource
GetVersion
GetModuleFileNameW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
WriteConsoleA

user32

RedrawWindow
LoadMenuW
PostThreadMessageW
CreatePopupMenu
MonitorFromPoint
ScreenToClient
MoveWindow
UpdateWindow
IsWindowEnabled
ClientToScreen
SetWindowRgn
WindowFromPoint
ReleaseDC
UnregisterClassA
GetDC
GetClientRect
SendMessageW
GetParent
InvalidateRect
PostMessageW
SetWindowLongW
EndDialog
GetWindowLongW
KillTimer
MapWindowPoints
GetCursorPos
SetTimer
LoadCursorW
SetWindowTextW
LoadIconW
SetWindowPos
SetCursor
LoadImageW
FillRect
ReleaseCapture
SetCapture
GetCapture
PtInRect
EndPaint
BeginPaint
DeleteMenu
GetMenuItemInfoW
SetMenuItemInfoW
InsertMenuW
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindow
InflateRect
GetSysColor
GetWindowDC
GetSystemMetrics
GetAncestor
GetKeyState
IsDialogMessageW
SetRect
LockWindowUpdate
SetParent
MessageBeep
IsClipboardFormatAvailable
GetMenuState
RegisterClipboardFormatW
GetClipboardData
IsIconic
EnableMenuItem
CheckMenuItem
wvsprintfW
SetRectEmpty
AppendMenuW
InsertMenuItemW
GetMessagePos
DrawEdge
SystemParametersInfoW
GetDlgItemInt
SetDlgItemInt
SetMenuDefaultItem
DialogBoxParamW
CreateDialogParamW
GetClassInfoExW
RegisterClassExW
CharNextW
FindWindowW
GetClassInfoW
RegisterClassW
GetActiveWindow
GetMenuItemCount
DestroyIcon
MessageBoxW
DefWindowProcW
GetWindowTextW
GetClassNameW
GetDlgItem
ShowWindow
PostQuitMessage
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
SetActiveWindow
SetForegroundWindow
SetDlgItemTextW
SetFocus
BringWindowToTop
GetWindowTextLengthW
EnableWindow
IsDlgButtonChecked
GetComboBoxInfo
CallWindowProcW
DestroyMenu
GetSubMenu
ModifyMenuW
GetMenuItemID
GetMenuStringW
IsMenu
CreateWindowExW
MsgWaitForMultipleObjects
GetIconInfo
CharLowerBuffW
DrawTextW
GetCaretPos
CopyRect
LoadBitmapW
TrackPopupMenu
GetDlgCtrlID
FrameRect
AdjustWindowRectEx
UpdateLayeredWindow
IsRectEmpty
GetSysColorBrush
PeekMessageW
IsWindowUnicode
GetMessageW
GetMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
DestroyWindow
IsWindow
RegisterWindowMessageW

gdi32

GetTextMetricsW
DPtoLP
CreateDCW
GetTextColor
CreateRectRgnIndirect
GetClipBox
GetTextExtentPointA
GetTextMetricsA
CreatePenIndirect
RoundRect
GetCurrentObject
CreateSolidBrush
SetViewportOrgEx
CombineRgn
CreateRectRgn
GetPixel
SetTextColor
SetBkMode
SetStretchBltMode
RestoreDC
SaveDC
CreateDIBSection
CreatePatternBrush
CreateBitmap
PatBlt
CreatePolygonRgn
ExtTextOutW
SetBkColor
StretchBlt
BitBlt
GetTextExtentPoint32W
CreateRoundRectRgn
CreateFontW
GetDeviceCaps
CreateCompatibleBitmap
DeleteDC
CreateCompatibleDC
DeleteObject
GetObjectW
GetStockObject
GetBkColor
CreateFontIndirectW
SelectObject

comdlg32

ChooseColorW
ChooseFontW
GetSaveFileNameW
GetOpenFileNameW

advapi32

RegQueryValueExA
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
ConvertSidToStringSidW
LookupAccountNameW
OpenProcessToken
GetTokenInformation

shell32

Shell_NotifyIconW
ShellExecuteW
ord18
ord190
SHBrowseForFolderW
ord23
ord680
ord153
ord4
ord155
DragQueryPoint
DragQueryFileW
ord21
SHFileOperationW
SHGetFileInfoW
SHChangeNotify
SHGetDesktopFolder
ShellExecuteExW
CommandLineToArgvW
ord165
SHGetFolderPathW
SHGetPathFromIDListW
ord17
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
ord71
ord16
ord2
DragAcceptFiles
ord152

ole32

StgCreateDocfile
CreateStreamOnHGlobal
DoDragDrop
CoUninitialize
CoInitialize
OleInitialize
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VariantClear
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SysAllocString
SafeArrayCreateVector
SysStringLen
SysAllocStringLen
OleTranslateColor
VariantInit
VarUI4FromStr

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shlwapi

PathRemoveFileSpecW
PathCombineW
SHDeleteKeyW
PathAppendW
PathFileExistsW
PathIsRelativeW
PathFindExtensionW
PathRemoveExtensionW
StrCmpIW
ord437
PathFindFileNameW
PathAddExtensionW
PathCompactPathExW
PathIsDirectoryW
PathIsUNCW
PathRemoveBackslashW
PathSearchAndQualifyW
StrRStrIW
StrStrIW
PathRenameExtensionW
SHSetValueW
SHGetValueA
SHGetValueW

comctl32

InitCommonControlsEx
ImageList_Draw
ImageList_Create
ImageList_Destroy
ImageList_Remove
ImageList_SetImageCount
ImageList_Replace

msimg32

AlphaBlend

gdiplus

GdipCreateBitmapFromFile
GdipDeleteGraphics
GdipCreateHBITMAPFromBitmap
GdipDrawImageRectI
GdipSetInterpolationMode
GdipGraphicsClear
GdipGetImageGraphicsContext
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipBitmapSetResolution
GdipBitmapSetPixel
GdipGetImagePixelFormat
GdipBitmapLockBits
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromScan0
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromStream
GdipBitmapGetPixel
GdipBitmapUnlockBits

oleacc

AccessibleObjectFromPoint

secur32

GetUserNameExW

netapi32

Netbios

rpcrt4

NdrClientCall2
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingFree

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 181KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 513KB - Virtual size: 512KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40e9f10c92e0c120c49a2dece19d5f40

Code Sign

30:20:cd:c2:db:9e:d0:be:86:6d:83:92:bb:5c:4d:0eCertificate

Extended Key Usages

Key Usages

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35Certificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

d4:9a:75:88:e4:2c:1c:a5:3f:c2:cc:fb:8c:30:ea:6b:3c:20:db:a5:34:27:42:71:52:0d:50:f5:24:af:4b:7fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

version

shlwapi

comctl32

msimg32

gdiplus

oleacc

secur32

netapi32

rpcrt4

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 164KB - Virtual size: 164KB

.data Size: 181KB - Virtual size: 200KB

.rsrc Size: 513KB - Virtual size: 512KB

30:20:cd:c2:db:9e:d0:be:86:6d:83:92:bb:5c:4d:0e
Certificate

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

d4:9a:75:88:e4:2c:1c:a5:3f:c2:cc:fb:8c:30:ea:6b:3c:20:db:a5:34:27:42:71:52:0d:50:f5:24:af:4b:7f
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 164KB - Virtual size: 164KB

.data
Size: 181KB - Virtual size: 200KB

.rsrc
Size: 513KB - Virtual size: 512KB