fa0ca258026d5d7c02fa15cc593b52a10f00a6f03e98fc234cb42c2b646a3e27

Sharing

Copy URL Twitter E-mail

General

Target

fa0ca258026d5d7c02fa15cc593b52a10f00a6f03e98fc234cb42c2b646a3e27
Size

2.3MB
MD5

449536b5a486efd67742fc880b976de7
SHA1

e285b3a7b329baa1fffd9323452ebe415d8f5808
SHA256

fa0ca258026d5d7c02fa15cc593b52a10f00a6f03e98fc234cb42c2b646a3e27
SHA512

b02fbd2bb51ef89bce2cbcdd49b4366fb6db150e35c2499be4c0d08addbb1ae396521b9390d9e1e5aeb15491a43c4bdb7a7af76090a5fe3e319c3b74ded3ceda
SSDEEP

49152:fNyPRv+3UVWD2U8fBOcEfV2rUld+1gqB2uKR0w8LlC08a82p4FsBKJjtTeVFbd29:fNyPRvMUVWiU8fBOccsrUlM1lEuKR8X2

Score

1^/10

Malware Config

Signatures

Files

fa0ca258026d5d7c02fa15cc593b52a10f00a6f03e98fc234cb42c2b646a3e27
.exe windows:5 windows x86 arch:x86

40e9f10c92e0c120c49a2dece19d5f40

Code Sign

30:20:cd:c2:db:9e:d0:be:86:6d:83:92:bb:5c:4d:0e
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/04/2016, 00:00

Not After

12/04/2021, 23:59

Subject

CN=ALCPU,O=ALCPU,POSTALCODE=67298,STREET=Snapir st. 1/12,L=Tel Aviv,ST=Tel Aviv,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:26

Not After

15/08/2023, 20:36

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

01/08/2030, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

99:4c:2b:b6:95:e2:57:25:2c:cf:6c:21:8a:f5:bf:9c:5a:f0:26:11:e7:45:91:da:32:27:71:8d:c1:24:17:79
Signer

Actual PE Digest

99:4c:2b:b6:95:e2:57:25:2c:cf:6c:21:8a:f5:bf:9c:5a:f0:26:11:e7:45:91:da:32:27:71:8d:c1:24:17:79

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\vmagent_new\bin\joblist\521481\out\Release\360zip.pdb

Imports

kernel32

DeviceIoControl
FileTimeToLocalFileTime
lstrcpynW
lstrcpyW
GetFileAttributesExW
GlobalSize
OutputDebugStringW
FormatMessageW
CreateMutexW
GetShortPathNameW
OpenMutexW
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
GetLongPathNameW
MoveFileW
lstrcatW
GetFileTime
GetDateFormatW
GetTimeFormatW
CompareStringW
GetPrivateProfileIntW
InterlockedExchange
GetSystemTime
SystemTimeToFileTime
CompareFileTime
FlushFileBuffers
GetSystemInfo
SetFilePointerEx
GetTempFileNameW
WaitForMultipleObjects
lstrcmpA
lstrcmpiA
GetCurrentThread
GetThreadContext
VirtualQuery
SetThreadPriority
VirtualAlloc
OpenThread
GetThreadPriority
VirtualProtect
SuspendThread
ResumeThread
SetEnvironmentVariableA
CompareStringA
GetConsoleOutputCP
GetDiskFreeSpaceW
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetModuleHandleA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
SetHandleCount
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
LCMapStringA
LCMapStringW
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
GetFileType
WriteConsoleW
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
HeapUnlock
TlsSetValue
TlsGetValue
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
CreateFileA
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetTempPathW
FileTimeToSystemTime
GetWindowsDirectoryW
GetFileAttributesW
MoveFileExW
SetEndOfFile
WideCharToMultiByte
GetCurrentProcessId
SetFilePointer
GetFileSizeEx
ResetEvent
SetEvent
CreateEventW
GetTickCount
SetLastError
GetPrivateProfileStringW
GetSystemDirectoryW
InterlockedCompareExchange
GetSystemWindowsDirectoryW
MulDiv
Sleep
CreateProcessW
GetStartupInfoW
GetCommandLineW
GetFileSize
WriteFile
GetStdHandle
MultiByteToWideChar
lstrcmpiW
LoadLibraryExW
TerminateProcess
SetFileAttributesW
RemoveDirectoryW
CreateFileW
ReadFile
CreateDirectoryW
CloseHandle
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleW
SetPriorityClass
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
LocalFree
GetLastError
WritePrivateProfileStringW
FindNextFileW
FindClose
FindFirstFileW
DeleteFileW
InterlockedDecrement
InterlockedIncrement
ExitProcess
LoadLibraryW
EnterCriticalSection
GetProcAddress
LeaveCriticalSection
FreeLibrary
GlobalAlloc
GlobalLock
GlobalUnlock
GetVersionExW
lstrlenW
GlobalFree
RaiseException
FreeResource
GetVersion
GetModuleFileNameW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
WriteConsoleA

user32

RedrawWindow
LoadMenuW
PostThreadMessageW
CreatePopupMenu
MonitorFromPoint
ScreenToClient
MoveWindow
UpdateWindow
IsWindowEnabled
ClientToScreen
SetWindowRgn
WindowFromPoint
ReleaseDC
UnregisterClassA
GetDC
GetClientRect
SendMessageW
GetParent
InvalidateRect
PostMessageW
SetWindowLongW
EndDialog
GetWindowLongW
KillTimer
MapWindowPoints
GetCursorPos
SetTimer
LoadCursorW
SetWindowTextW
LoadIconW
SetWindowPos
SetCursor
LoadImageW
FillRect
ReleaseCapture
SetCapture
GetCapture
PtInRect
EndPaint
BeginPaint
DeleteMenu
GetMenuItemInfoW
SetMenuItemInfoW
InsertMenuW
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindow
InflateRect
GetSysColor
GetWindowDC
GetSystemMetrics
GetAncestor
GetKeyState
IsDialogMessageW
SetRect
LockWindowUpdate
SetParent
MessageBeep
IsClipboardFormatAvailable
GetMenuState
RegisterClipboardFormatW
GetClipboardData
IsIconic
EnableMenuItem
CheckMenuItem
wvsprintfW
SetRectEmpty
AppendMenuW
InsertMenuItemW
GetMessagePos
DrawEdge
SystemParametersInfoW
GetDlgItemInt
SetDlgItemInt
SetMenuDefaultItem
DialogBoxParamW
CreateDialogParamW
GetClassInfoExW
RegisterClassExW
CharNextW
FindWindowW
GetClassInfoW
RegisterClassW
GetActiveWindow
GetMenuItemCount
DestroyIcon
MessageBoxW
DefWindowProcW
GetWindowTextW
GetClassNameW
GetDlgItem
ShowWindow
PostQuitMessage
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
SetActiveWindow
SetForegroundWindow
SetDlgItemTextW
SetFocus
BringWindowToTop
GetWindowTextLengthW
EnableWindow
IsDlgButtonChecked
GetComboBoxInfo
CallWindowProcW
DestroyMenu
GetSubMenu
ModifyMenuW
GetMenuItemID
GetMenuStringW
IsMenu
CreateWindowExW
MsgWaitForMultipleObjects
GetIconInfo
CharLowerBuffW
DrawTextW
GetCaretPos
CopyRect
LoadBitmapW
TrackPopupMenu
GetDlgCtrlID
FrameRect
AdjustWindowRectEx
UpdateLayeredWindow
IsRectEmpty
GetSysColorBrush
PeekMessageW
IsWindowUnicode
GetMessageW
GetMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
DestroyWindow
IsWindow
RegisterWindowMessageW

gdi32

GetTextMetricsW
DPtoLP
CreateDCW
GetTextColor
CreateRectRgnIndirect
GetClipBox
GetTextExtentPointA
GetTextMetricsA
CreatePenIndirect
RoundRect
GetCurrentObject
CreateSolidBrush
SetViewportOrgEx
CombineRgn
CreateRectRgn
GetPixel
SetTextColor
SetBkMode
SetStretchBltMode
RestoreDC
SaveDC
CreateDIBSection
CreatePatternBrush
CreateBitmap
PatBlt
CreatePolygonRgn
ExtTextOutW
SetBkColor
StretchBlt
BitBlt
GetTextExtentPoint32W
CreateRoundRectRgn
CreateFontW
GetDeviceCaps
CreateCompatibleBitmap
DeleteDC
CreateCompatibleDC
DeleteObject
GetObjectW
GetStockObject
GetBkColor
CreateFontIndirectW
SelectObject

comdlg32

ChooseColorW
ChooseFontW
GetSaveFileNameW
GetOpenFileNameW

advapi32

RegQueryValueExA
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
ConvertSidToStringSidW
LookupAccountNameW
OpenProcessToken
GetTokenInformation

shell32

Shell_NotifyIconW
ShellExecuteW
ord18
ord190
SHBrowseForFolderW
ord23
ord680
ord153
ord4
ord155
DragQueryPoint
DragQueryFileW
ord21
SHFileOperationW
SHGetFileInfoW
SHChangeNotify
SHGetDesktopFolder
ShellExecuteExW
CommandLineToArgvW
ord165
SHGetFolderPathW
SHGetPathFromIDListW
ord17
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
ord71
ord16
ord2
DragAcceptFiles
ord152

ole32

StgCreateDocfile
CreateStreamOnHGlobal
DoDragDrop
CoUninitialize
CoInitialize
OleInitialize
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VariantClear
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SysAllocString
SafeArrayCreateVector
SysStringLen
SysAllocStringLen
OleTranslateColor
VariantInit
VarUI4FromStr

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shlwapi

PathRemoveFileSpecW
PathCombineW
SHDeleteKeyW
PathAppendW
PathFileExistsW
PathIsRelativeW
PathFindExtensionW
PathRemoveExtensionW
StrCmpIW
ord437
PathFindFileNameW
PathAddExtensionW
PathCompactPathExW
PathIsDirectoryW
PathIsUNCW
PathRemoveBackslashW
PathSearchAndQualifyW
StrRStrIW
StrStrIW
PathRenameExtensionW
SHSetValueW
SHGetValueA
SHGetValueW

comctl32

InitCommonControlsEx
ImageList_Draw
ImageList_Create
ImageList_Destroy
ImageList_Remove
ImageList_SetImageCount
ImageList_Replace

msimg32

AlphaBlend

gdiplus

GdipCreateBitmapFromFile
GdipDeleteGraphics
GdipCreateHBITMAPFromBitmap
GdipDrawImageRectI
GdipSetInterpolationMode
GdipGraphicsClear
GdipGetImageGraphicsContext
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipBitmapSetResolution
GdipBitmapSetPixel
GdipGetImagePixelFormat
GdipBitmapLockBits
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromScan0
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromStream
GdipBitmapGetPixel
GdipBitmapUnlockBits

oleacc

AccessibleObjectFromPoint

secur32

GetUserNameExW

netapi32

Netbios

rpcrt4

NdrClientCall2
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingFree

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 181KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 934KB - Virtual size: 934KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40e9f10c92e0c120c49a2dece19d5f40

Code Sign

30:20:cd:c2:db:9e:d0:be:86:6d:83:92:bb:5c:4d:0eCertificate

Extended Key Usages

Key Usages

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35Certificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

99:4c:2b:b6:95:e2:57:25:2c:cf:6c:21:8a:f5:bf:9c:5a:f0:26:11:e7:45:91:da:32:27:71:8d:c1:24:17:79Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

version

shlwapi

comctl32

msimg32

gdiplus

oleacc

secur32

netapi32

rpcrt4

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 164KB - Virtual size: 164KB

.data Size: 181KB - Virtual size: 200KB

.rsrc Size: 934KB - Virtual size: 934KB

30:20:cd:c2:db:9e:d0:be:86:6d:83:92:bb:5c:4d:0e
Certificate

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

99:4c:2b:b6:95:e2:57:25:2c:cf:6c:21:8a:f5:bf:9c:5a:f0:26:11:e7:45:91:da:32:27:71:8d:c1:24:17:79
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 164KB - Virtual size: 164KB

.data
Size: 181KB - Virtual size: 200KB

.rsrc
Size: 934KB - Virtual size: 934KB