0be5921855f2132353048a107aa1976ccf2c47d3c3c1af9f83ce548397243f70

Sharing

Copy URL Twitter E-mail

General

Target
0be5921855f2132353048a107aa1976ccf2c47d3c3c1af9f83ce548397243f70
Size 885KB
Sample240426-28jedseh71
SHA256 0be5921855f2132353048a107aa1976ccf2c47d3c3c1af9f83ce548397243f70
MD5 38a5c99b9bc3c1848d0f53054136397e
SHA1 545abb603d493156c7b24dd9dfe490a944c6e5b2
SHA512 24d679d95a5e17a6e3b896fde321dcdbf8288da1ad6868bc02e4b52428070ca2941b5ba4883e9686f52184c582938b97563830acac4dc70c2136a4693f22da16
SSDEEP 12288:1fPSAAUHV4fZUv/TrguVTax7hNRu18VA8JFo1Mk/wYeDKDMyAmp:pPSAAUHV4fZUvfgmaxpu1F8J61MYHMBS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0be5921855f2132353048a107aa1976ccf2c47d3c3c1af9f83ce548397243f70

File Explorer

0be5921855f2132353048a107aa1976ccf2c47d3c3c1af9f83ce548397243f70

.exe 885KB

0be5921855f2132353048a107aa1976ccf2c47d3c3c1af9f83ce548397243f70

IMPHASH 908746745c485828202e3664dddf55a1
SHA256 0be5921855f2132353048a107aa1976ccf2c47d3c3c1af9f83ce548397243f70
MD5 38a5c99b9bc3c1848d0f53054136397e
SHA1 545abb603d493156c7b24dd9dfe490a944c6e5b2
SHA512 24d679d95a5e17a6e3b896fde321dcdbf8288da1ad6868bc02e4b52428070ca2941b5ba4883e9686f52184c582938b97563830acac4dc70c2136a4693f22da16
SSDEEP 12288:1fPSAAUHV4fZUv/TrguVTax7hNRu18VA8JFo1Mk/wYeDKDMyAmp:pPSAAUHV4fZUvfgmaxpu1F8J61MYHMBS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

547295

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\vmagent_new\bin\joblist\574019\out\Release\360Util64.pdb

kernel32

GlobalLock GlobalSize GlobalUnlock GetFileAttributesExW GetTickCount DeviceIoControl GetCurrentProcessId GetLongPathNameW GetWindowsDirectoryW GetCurrentDirectoryW MoveFileExW SearchPathW CreateThread WaitForSingleObject GetCurrentThreadId GetVersion GetSystemDefaultUILanguage GetFileSize GetLocalTime VirtualProtect GetModuleHandleExW IsBadStringPtrW ProcessIdToSessionId OpenProcess CreateProcessW WTSGetActiveConsoleSessionId MapViewOfFile UnmapViewOfFile GetProcessId LocalAlloc LocalFree CreateFileMappingW GetFileSizeEx GlobalFree CreateToolhelp32Snapshot Process32FirstW Process32NextW ResumeThread GetSystemTimeAsFileTime ReleaseMutex GetSystemTime SystemTimeToFileTime SetFileAttributesW DeleteFileW OpenFileMappingW OpenThread GetCommandLineW OutputDebugStringW RtlPcToFileHeader FormatMessageW CreateFileA LocalFileTimeToFileTime SetFilePointerEx HeapLock HeapUnlock HeapWalk TlsAlloc TlsGetValue TlsSetValue TlsFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetFileTime GlobalAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead InterlockedFlushSList ExitProcess OpenMutexW CreateMutexW WideCharToMultiByte FindResourceExW InitializeCriticalSectionAndSpinCount GetModuleFileNameW RaiseException InitializeCriticalSection lstrcmpiW DeleteCriticalSection SetLastError CloseHandle GetLastError LoadLibraryW GetSystemDirectoryW SetFilePointer GetVersionExW GetSystemWindowsDirectoryW FindResourceW SizeofResource LoadResource LockResource FreeResource GetFileInformationByHandle CreateFileW Sleep ReadFile LeaveCriticalSection EnterCriticalSection MultiByteToWideChar LoadLibraryExW ExpandEnvironmentStringsW FreeLibrary GetCurrentProcess GetProcAddress GetModuleHandleW GetFileAttributesW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy WriteFile GetExitCodeProcess IsDebuggerPresent

user32

IsZoomed GetWindowTextW SendMessageTimeoutW SystemParametersInfoW EnumDisplayDevicesW GetLastInputInfo GetClassNameW GetShellWindow GetWindowInfo EnumWindows WindowFromPoint GetWindowRect GetDesktopWindow GetSystemMetrics GetWindow IsWindowVisible CharNextW FindWindowW IsWindow GetForegroundWindow MonitorFromWindow wsprintfW GetWindowThreadProcessId SetForegroundWindow LoadStringW GetAncestor

advapi32

RegDeleteKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserW CloseServiceHandle QueryServiceStatus StartServiceW ChangeServiceConfigW OpenServiceW OpenSCManagerW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation FreeSid GetLengthSid SetTokenInformation AllocateAndInitializeSid CreateRestrictedToken DuplicateTokenEx OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW CryptReleaseContext CryptGenRandom CryptAcquireContextW RegEnumValueW RegCreateKeyW RegQueryInfoKeyW RegSetValueExW RegDeleteValueW RegEnumKeyExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegEnumKeyW RegOpenKeyExW RegQueryValueExA

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation ord155 ord190 ord25 ord152 ShellExecuteExW ShellExecuteW ord165 SHGetSpecialFolderPathW SHGetFileInfoW SHGetDesktopFolder SHGetMalloc ord18

ole32

GetHGlobalFromStream IIDFromString StringFromGUID2 CoInitialize CreateStreamOnHGlobal CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoUninitialize

oleaut32

SysAllocStringByteLen SafeArrayPutElement VariantChangeType VariantInit SafeArrayCreate SafeArrayGetElement VariantClear SysStringByteLen SysFreeString SysAllocString VarUI4FromStr

shlwapi

PathRemoveFileSpecW PathAppendW SHSetValueW SHGetValueW PathAddBackslashW PathFileExistsW StrCmpNIW PathFindFileNameW PathIsRelativeW StrCpyNW PathIsDirectoryW StrPBrkA StrPBrkW StrStrIA StrStrIW PathFindExtensionW SHEnumValueW ord176 StrCmpIW PathCombineW StrRetToBufW

ws2_32

WSACleanup WSCDeinstallProvider WSCDeinstallProvider32 WSCUnInstallNameSpace WSAGetLastError WSAStartup ntohl htons htonl ntohs

version

VerQueryValueW

iphlpapi

GetIpAddrTable

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSQuerySessionInformationW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

psapi

GetModuleFileNameExW

msvcrt

wcstol realloc wcsspn wcscspn _mbsstr _mbsrchr _mktime64 towupper memmove memset _CxxThrowException ??0exception@@QEAA@AEBQEBD@Z ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ memcpy memcmp wcscmp _amsg_exit __getmainargs _initterm __CxxFrameHandler __DestructExceptionObject _localtime64 ___lc_codepage_func rand atoi wcspbrk __pctype_func tolower ___mb_cur_max_func strtol localeconv ___lc_handle_func abort memchr _wcstoui64 _msize _XcptFilter mbtowc strrchr iswctype srand ceil log10 _clearfp ?terminate@@YAXXZ _wtoi malloc free wcsstr wcschr wcsncmp __C_specific_handler ??_V@YAXPEAX@Z ??3@YAXPEAX@Z _wtoi64 _wcsupr _wcslwr _strlwr strchr _time64 _wcsnicmp ??2@YAPEAX_K@Z _wcsicmp wcsrchr calloc iswspace _errno ??_U@YAPEAX_K@Z sqrt

Name

.text

Size

530KB

Virtual Size

530KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

251KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

665KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

669B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

yhDm^

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_MEM_READ

generic

count=2, id=257, productName=VS2019 v16.7.0 build 29110, version=29110,

count=2, id=257, version=24225,

count=1, id=260, version=26706,

count=3, id=259, version=26706,

count=7, id=261, version=27412,

count=2, id=257, version=27032,

count=1, id=261, productName=VS2019 v16.7.1 build 29111, version=29111,

count=34, id=261, productName=VS2019 v16.7.0 build 29110, version=29110,

count=20, id=199, version=41118,

count=7, id=260, version=27034,

count=3, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=10, id=260, productName=VS2017 v15.7.5 build 26433, version=26433,

count=22, id=261, version=27034,

count=5, id=261, version=27040,

count=12, id=261, version=26706,

count=9, id=260, version=27412,

count=1, id=262, version=27412,

count=29, id=257, version=27412,

count=474, id=1, productName=Unmarked objects,

count=74, id=265, version=27045,

count=1, id=256, version=27045,

count=1, id=255, version=27045,

count=3, id=151,

count=1, id=258, version=27045,