bd3a3714ee9a071ebeb59ac91d9ebb5a[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
bd3a3714ee9a071ebeb59ac91d9ebb5a.bin
Size 395KB
Sample240428-b8ajdadh41
SHA256 6c85aec38d9e407aa674d9ba3ec5fb7589f4a92abd3d9708540b8f0856feacb9
MD5 e749ce1e9bae624ecc19d1c308e9af9e
SHA1 79777828e74d60f4736d45331fd1d2e697672257
SHA512 92ea64d81afad0fbde5d4b2007e723f300eb3a6a3f11970642d212a325d4a00d3a494f07bb537703223159185ad0ea8de425b55dc4f3a0c2474372430969fc03
SSDEEP 12288:U44vmgGEcuF0Mzwk8tMqnOwtMjShqG8To/4dEY:T4vm66M38u+k+h8s/IEY
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4cf2b612939359977df51a32d2f63e2cb0c6c601e114b8e4812bd548d1db85fe.exe

File Explorer

bd3a3714ee9a071ebeb59ac91d9ebb5a.bin

.zip 395KB
4cf2b612939359977df51a32d2f63e2cb0c6c601e114b8e4812bd548d1db85fe.exe

.dll 885KB

bd3a3714ee9a071ebeb59ac91d9ebb5a.bin

SHA256 6c85aec38d9e407aa674d9ba3ec5fb7589f4a92abd3d9708540b8f0856feacb9
MD5 e749ce1e9bae624ecc19d1c308e9af9e
SHA1 79777828e74d60f4736d45331fd1d2e697672257
SHA512 92ea64d81afad0fbde5d4b2007e723f300eb3a6a3f11970642d212a325d4a00d3a494f07bb537703223159185ad0ea8de425b55dc4f3a0c2474372430969fc03
SSDEEP 12288:U44vmgGEcuF0Mzwk8tMqnOwtMjShqG8To/4dEY:T4vm66M38u+k+h8s/IEY
MD5 SHA1 SHA512 SSDEEP

Password

infected

4cf2b612939359977df51a32d2f63e2cb0c6c601e114b8e4812bd548d1db85fe.exe

IMPHASH 908746745c485828202e3664dddf55a1
SHA256 4cf2b612939359977df51a32d2f63e2cb0c6c601e114b8e4812bd548d1db85fe
MD5 bd3a3714ee9a071ebeb59ac91d9ebb5a
SHA1 55110a221f20a4ceec34c58d0179fa31f8c102e9
SHA512 7244220f29057339c99a22c20268187ba6f6681251f4ce4f305ad22dc030f6078b4f298ef10ad392dc5d036c41c7b8c28c2bd997ea39ef7ab023cb9b5c946dc8
SSDEEP 12288:WfPSAAUHV4fZUv/TrguVTax7hNRu18VAyJFoxMk/wYeDKDMyPDi:MPSAAUHV4fZUvfgmaxpu1FyJ6xMYHMke
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

458592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\vmagent_new\bin\joblist\574019\out\Release\360Util64.pdb

kernel32

GlobalLock GlobalSize GlobalUnlock GetFileAttributesExW GetTickCount DeviceIoControl GetCurrentProcessId GetLongPathNameW GetWindowsDirectoryW GetCurrentDirectoryW MoveFileExW SearchPathW CreateThread WaitForSingleObject GetCurrentThreadId GetVersion GetSystemDefaultUILanguage GetFileSize GetLocalTime VirtualProtect GetModuleHandleExW IsBadStringPtrW ProcessIdToSessionId OpenProcess CreateProcessW WTSGetActiveConsoleSessionId MapViewOfFile UnmapViewOfFile GetProcessId LocalAlloc LocalFree CreateFileMappingW GetFileSizeEx GlobalFree CreateToolhelp32Snapshot Process32FirstW Process32NextW ResumeThread GetSystemTimeAsFileTime ReleaseMutex GetSystemTime SystemTimeToFileTime SetFileAttributesW DeleteFileW OpenFileMappingW OpenThread GetCommandLineW OutputDebugStringW RtlPcToFileHeader FormatMessageW CreateFileA LocalFileTimeToFileTime SetFilePointerEx HeapLock HeapUnlock HeapWalk TlsAlloc TlsGetValue TlsSetValue TlsFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetFileTime GlobalAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead InterlockedFlushSList ExitProcess OpenMutexW CreateMutexW WideCharToMultiByte FindResourceExW InitializeCriticalSectionAndSpinCount GetModuleFileNameW RaiseException InitializeCriticalSection lstrcmpiW DeleteCriticalSection SetLastError CloseHandle GetLastError LoadLibraryW GetSystemDirectoryW SetFilePointer GetVersionExW GetSystemWindowsDirectoryW FindResourceW SizeofResource LoadResource LockResource FreeResource GetFileInformationByHandle CreateFileW Sleep ReadFile LeaveCriticalSection EnterCriticalSection MultiByteToWideChar LoadLibraryExW ExpandEnvironmentStringsW FreeLibrary GetCurrentProcess GetProcAddress GetModuleHandleW GetFileAttributesW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy WriteFile GetExitCodeProcess IsDebuggerPresent

user32

IsZoomed GetWindowTextW SendMessageTimeoutW SystemParametersInfoW EnumDisplayDevicesW GetLastInputInfo GetClassNameW GetShellWindow GetWindowInfo EnumWindows WindowFromPoint GetWindowRect GetDesktopWindow GetSystemMetrics GetWindow IsWindowVisible CharNextW FindWindowW IsWindow GetForegroundWindow MonitorFromWindow wsprintfW GetWindowThreadProcessId SetForegroundWindow LoadStringW GetAncestor

advapi32

RegDeleteKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserW CloseServiceHandle QueryServiceStatus StartServiceW ChangeServiceConfigW OpenServiceW OpenSCManagerW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation FreeSid GetLengthSid SetTokenInformation AllocateAndInitializeSid CreateRestrictedToken DuplicateTokenEx OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW CryptReleaseContext CryptGenRandom CryptAcquireContextW RegEnumValueW RegCreateKeyW RegQueryInfoKeyW RegSetValueExW RegDeleteValueW RegEnumKeyExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegEnumKeyW RegOpenKeyExW RegQueryValueExA

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation ord155 ord190 ord25 ord152 ShellExecuteExW ShellExecuteW ord165 SHGetSpecialFolderPathW SHGetFileInfoW SHGetDesktopFolder SHGetMalloc ord18

ole32

GetHGlobalFromStream IIDFromString StringFromGUID2 CoInitialize CreateStreamOnHGlobal CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoUninitialize

oleaut32

SysAllocStringByteLen SafeArrayPutElement VariantChangeType VariantInit SafeArrayCreate SafeArrayGetElement VariantClear SysStringByteLen SysFreeString SysAllocString VarUI4FromStr

shlwapi

PathRemoveFileSpecW PathAppendW SHSetValueW SHGetValueW PathAddBackslashW PathFileExistsW StrCmpNIW PathFindFileNameW PathIsRelativeW StrCpyNW PathIsDirectoryW StrPBrkA StrPBrkW StrStrIA StrStrIW PathFindExtensionW SHEnumValueW ord176 StrCmpIW PathCombineW StrRetToBufW

ws2_32

WSACleanup WSCDeinstallProvider WSCDeinstallProvider32 WSCUnInstallNameSpace WSAGetLastError WSAStartup ntohl htons htonl ntohs

version

VerQueryValueW

iphlpapi

GetIpAddrTable

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSQuerySessionInformationW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

psapi

GetModuleFileNameExW

msvcrt

wcstol realloc wcsspn wcscspn _mbsstr _mbsrchr _mktime64 towupper memmove memset _CxxThrowException ??0exception@@QEAA@AEBQEBD@Z ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ memcpy memcmp wcscmp _amsg_exit __getmainargs _initterm __CxxFrameHandler __DestructExceptionObject _localtime64 ___lc_codepage_func rand atoi wcspbrk __pctype_func tolower ___mb_cur_max_func strtol localeconv ___lc_handle_func abort memchr _wcstoui64 _msize _XcptFilter mbtowc strrchr iswctype srand ceil log10 _clearfp ?terminate@@YAXXZ _wtoi malloc free wcsstr wcschr wcsncmp __C_specific_handler ??_V@YAXPEAX@Z ??3@YAXPEAX@Z _wtoi64 _wcsupr _wcslwr _strlwr strchr _time64 _wcsnicmp ??2@YAPEAX_K@Z _wcsicmp wcsrchr calloc iswspace _errno ??_U@YAPEAX_K@Z sqrt

Name

.text

Size

530KB

Virtual Size

530KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

251KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

665KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

669B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

wsgi2

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_MEM_READ

generic

count=2, id=257, productName=VS2019 v16.7.0 build 29110, version=29110,

count=2, id=257, version=24225,

count=1, id=260, version=26706,

count=3, id=259, version=26706,

count=7, id=261, version=27412,

count=2, id=257, version=27032,

count=1, id=261, productName=VS2019 v16.7.1 build 29111, version=29111,

count=34, id=261, productName=VS2019 v16.7.0 build 29110, version=29110,

count=20, id=199, version=41118,

count=7, id=260, version=27034,

count=3, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=10, id=260, productName=VS2017 v15.7.5 build 26433, version=26433,

count=22, id=261, version=27034,

count=5, id=261, version=27040,

count=12, id=261, version=26706,

count=9, id=260, version=27412,

count=1, id=262, version=27412,

count=29, id=257, version=27412,

count=474, id=1, productName=Unmarked objects,

count=74, id=265, version=27045,

count=1, id=256, version=27045,

count=1, id=255, version=27045,

count=3, id=151,

count=1, id=258, version=27045,