1625ac230aa5ca950573f3ba0b1a7bd4c7fbd3e3686f9ecd4a40f1504bf33a11[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
1625ac230aa5ca950573f3ba0b1a7bd4c7fbd3e3686f9ecd4a40f1504bf33a11.exe
Size 885KB
Sample240426-bd2z5sgf2y
SHA256 1625ac230aa5ca950573f3ba0b1a7bd4c7fbd3e3686f9ecd4a40f1504bf33a11
MD5 74143402c40ac2e61e9f040a2d7e2d00
SHA1 4053dc85bb86c47c63f96681d6a62c21cd6342a3
SHA512 4aa55b859f15be8b14c4a0ff6f3971f49b47c1c8c8427f179eb4ab0c76e321441adfd173469facb12aae1e81e25f1328fd621214b42e66f690ba4e9ee1e54cf9
SSDEEP 12288:gfPSAAUHV4fZUv/TrguVTax7hNRu18VA8JFoxMk/wYeDKDMyAmp:qPSAAUHV4fZUvfgmaxpu1F8J6xMYHMBS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1625ac230aa5ca950573f3ba0b1a7bd4c7fbd3e3686f9ecd4a40f1504bf33a11.exe

File Explorer

1625ac230aa5ca950573f3ba0b1a7bd4c7fbd3e3686f9ecd4a40f1504bf33a11.exe

.dll 885KB

1625ac230aa5ca950573f3ba0b1a7bd4c7fbd3e3686f9ecd4a40f1504bf33a11.exe

IMPHASH 908746745c485828202e3664dddf55a1
SHA256 1625ac230aa5ca950573f3ba0b1a7bd4c7fbd3e3686f9ecd4a40f1504bf33a11
MD5 74143402c40ac2e61e9f040a2d7e2d00
SHA1 4053dc85bb86c47c63f96681d6a62c21cd6342a3
SHA512 4aa55b859f15be8b14c4a0ff6f3971f49b47c1c8c8427f179eb4ab0c76e321441adfd173469facb12aae1e81e25f1328fd621214b42e66f690ba4e9ee1e54cf9
SSDEEP 12288:gfPSAAUHV4fZUv/TrguVTax7hNRu18VA8JFoxMk/wYeDKDMyAmp:qPSAAUHV4fZUvfgmaxpu1F8J6xMYHMBS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

458592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\vmagent_new\bin\joblist\574019\out\Release\360Util64.pdb

kernel32

GlobalLock GlobalSize GlobalUnlock GetFileAttributesExW GetTickCount DeviceIoControl GetCurrentProcessId GetLongPathNameW GetWindowsDirectoryW GetCurrentDirectoryW MoveFileExW SearchPathW CreateThread WaitForSingleObject GetCurrentThreadId GetVersion GetSystemDefaultUILanguage GetFileSize GetLocalTime VirtualProtect GetModuleHandleExW IsBadStringPtrW ProcessIdToSessionId OpenProcess CreateProcessW WTSGetActiveConsoleSessionId MapViewOfFile UnmapViewOfFile GetProcessId LocalAlloc LocalFree CreateFileMappingW GetFileSizeEx GlobalFree CreateToolhelp32Snapshot Process32FirstW Process32NextW ResumeThread GetSystemTimeAsFileTime ReleaseMutex GetSystemTime SystemTimeToFileTime SetFileAttributesW DeleteFileW OpenFileMappingW OpenThread GetCommandLineW OutputDebugStringW RtlPcToFileHeader FormatMessageW CreateFileA LocalFileTimeToFileTime SetFilePointerEx HeapLock HeapUnlock HeapWalk TlsAlloc TlsGetValue TlsSetValue TlsFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetFileTime GlobalAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead InterlockedFlushSList ExitProcess OpenMutexW CreateMutexW WideCharToMultiByte FindResourceExW InitializeCriticalSectionAndSpinCount GetModuleFileNameW RaiseException InitializeCriticalSection lstrcmpiW DeleteCriticalSection SetLastError CloseHandle GetLastError LoadLibraryW GetSystemDirectoryW SetFilePointer GetVersionExW GetSystemWindowsDirectoryW FindResourceW SizeofResource LoadResource LockResource FreeResource GetFileInformationByHandle CreateFileW Sleep ReadFile LeaveCriticalSection EnterCriticalSection MultiByteToWideChar LoadLibraryExW ExpandEnvironmentStringsW FreeLibrary GetCurrentProcess GetProcAddress GetModuleHandleW GetFileAttributesW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy WriteFile GetExitCodeProcess IsDebuggerPresent

user32

IsZoomed GetWindowTextW SendMessageTimeoutW SystemParametersInfoW EnumDisplayDevicesW GetLastInputInfo GetClassNameW GetShellWindow GetWindowInfo EnumWindows WindowFromPoint GetWindowRect GetDesktopWindow GetSystemMetrics GetWindow IsWindowVisible CharNextW FindWindowW IsWindow GetForegroundWindow MonitorFromWindow wsprintfW GetWindowThreadProcessId SetForegroundWindow LoadStringW GetAncestor

advapi32

RegDeleteKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserW CloseServiceHandle QueryServiceStatus StartServiceW ChangeServiceConfigW OpenServiceW OpenSCManagerW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation FreeSid GetLengthSid SetTokenInformation AllocateAndInitializeSid CreateRestrictedToken DuplicateTokenEx OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW CryptReleaseContext CryptGenRandom CryptAcquireContextW RegEnumValueW RegCreateKeyW RegQueryInfoKeyW RegSetValueExW RegDeleteValueW RegEnumKeyExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegEnumKeyW RegOpenKeyExW RegQueryValueExA

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation ord155 ord190 ord25 ord152 ShellExecuteExW ShellExecuteW ord165 SHGetSpecialFolderPathW SHGetFileInfoW SHGetDesktopFolder SHGetMalloc ord18

ole32

GetHGlobalFromStream IIDFromString StringFromGUID2 CoInitialize CreateStreamOnHGlobal CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoUninitialize

oleaut32

SysAllocStringByteLen SafeArrayPutElement VariantChangeType VariantInit SafeArrayCreate SafeArrayGetElement VariantClear SysStringByteLen SysFreeString SysAllocString VarUI4FromStr

shlwapi

PathRemoveFileSpecW PathAppendW SHSetValueW SHGetValueW PathAddBackslashW PathFileExistsW StrCmpNIW PathFindFileNameW PathIsRelativeW StrCpyNW PathIsDirectoryW StrPBrkA StrPBrkW StrStrIA StrStrIW PathFindExtensionW SHEnumValueW ord176 StrCmpIW PathCombineW StrRetToBufW

ws2_32

WSACleanup WSCDeinstallProvider WSCDeinstallProvider32 WSCUnInstallNameSpace WSAGetLastError WSAStartup ntohl htons htonl ntohs

version

VerQueryValueW

iphlpapi

GetIpAddrTable

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSQuerySessionInformationW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

psapi

GetModuleFileNameExW

msvcrt

wcstol realloc wcsspn wcscspn _mbsstr _mbsrchr _mktime64 towupper memmove memset _CxxThrowException ??0exception@@QEAA@AEBQEBD@Z ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ memcpy memcmp wcscmp _amsg_exit __getmainargs _initterm __CxxFrameHandler __DestructExceptionObject _localtime64 ___lc_codepage_func rand atoi wcspbrk __pctype_func tolower ___mb_cur_max_func strtol localeconv ___lc_handle_func abort memchr _wcstoui64 _msize _XcptFilter mbtowc strrchr iswctype srand ceil log10 _clearfp ?terminate@@YAXXZ _wtoi malloc free wcsstr wcschr wcsncmp __C_specific_handler ??_V@YAXPEAX@Z ??3@YAXPEAX@Z _wtoi64 _wcsupr _wcslwr _strlwr strchr _time64 _wcsnicmp ??2@YAPEAX_K@Z _wcsicmp wcsrchr calloc iswspace _errno ??_U@YAPEAX_K@Z sqrt

Name

.text

Size

530KB

Virtual Size

530KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

251KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

665KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

669B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

yhDm^

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_MEM_READ

generic

count=2, id=257, productName=VS2019 v16.7.0 build 29110, version=29110,

count=2, id=257, version=24225,

count=1, id=260, version=26706,

count=3, id=259, version=26706,

count=7, id=261, version=27412,

count=2, id=257, version=27032,

count=1, id=261, productName=VS2019 v16.7.1 build 29111, version=29111,

count=34, id=261, productName=VS2019 v16.7.0 build 29110, version=29110,

count=20, id=199, version=41118,

count=7, id=260, version=27034,

count=3, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=10, id=260, productName=VS2017 v15.7.5 build 26433, version=26433,

count=22, id=261, version=27034,

count=5, id=261, version=27040,

count=12, id=261, version=26706,

count=9, id=260, version=27412,

count=1, id=262, version=27412,

count=29, id=257, version=27412,

count=474, id=1, productName=Unmarked objects,

count=74, id=265, version=27045,

count=1, id=256, version=27045,

count=1, id=255, version=27045,

count=3, id=151,

count=1, id=258, version=27045,