30744fae9434c443b005dbda8688b0adf9bb210e519936176012191dcebc9a7f

Sharing

Copy URL Twitter E-mail

General

Target

30744fae9434c443b005dbda8688b0adf9bb210e519936176012191dcebc9a7f
Size

1.4MB
MD5

eb4be626b0f8c28329be00c0324dec5c
SHA1

8f7760e8c640c38673d7a892f5638678af564ac7
SHA256

30744fae9434c443b005dbda8688b0adf9bb210e519936176012191dcebc9a7f
SHA512

184247fb759ff53bcc5e712d3785fbff5d6f8ec367c64215a6c2772c01c3b6143c3b498323ef2b260302c69216b8a46682780fa1604a7d42d60f6a88547726eb
SSDEEP

24576:ecVeDQavUscBqEbkts6e8XDbGiJUNKm9z8+SZ8B:eSetvUjq+m/ztJUoV+w8B

Score

1^/10

Malware Config

Signatures

Files

30744fae9434c443b005dbda8688b0adf9bb210e519936176012191dcebc9a7f
.exe windows:5 windows x86 arch:x86

a726184da50465af5c2b4377e699acf1

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:e9:4c:53:07:39:33:a7:30:33:61:fa:1f:66:a7:cb
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

30/06/2023, 00:00

Not After

20/08/2026, 23:59

Subject

SERIALNUMBER=91110105306401296U,CN=北京奇元科技有限公司,OU=IT,O=北京奇元科技有限公司,ST=北京市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e69c9de998b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e58c97e4baace5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:b4:3f:67:c2:a8:b5:24:ed:37:34:bf:37:2b:e3:1c:55:65:63:2f:f6:23:df:8b:9d:59:f1:6a:50:85:55:21
Signer

Actual PE Digest

7b:b4:3f:67:c2:a8:b5:24:ed:37:34:bf:37:2b:e3:1c:55:65:63:2f:f6:23:df:8b:9d:59:f1:6a:50:85:55:21

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\765910\out\Release\PopwndTracker.pdb

Imports

kernel32

FindNextFileW
Thread32Next
SuspendThread
OpenThread
Thread32First
ResumeThread
GetExitCodeProcess
WaitForSingleObject
GetTempPathW
ReadProcessMemory
GlobalMemoryStatus
RemoveDirectoryW
SetFileAttributesW
TlsSetValue
TlsGetValue
Sleep
InterlockedCompareExchange
TlsFree
GetFileAttributesExW
SystemTimeToFileTime
FileTimeToSystemTime
GetTimeZoneInformation
GetFileAttributesW
TerminateProcess
MoveFileW
MoveFileExW
SetEnvironmentVariableW
CreateMutexA
ReleaseMutex
GetDriveTypeW
Module32NextW
Module32FirstW
ExpandEnvironmentStringsW
GetCommandLineW
GetDiskFreeSpaceExW
GetLocalTime
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
DeviceIoControl
InterlockedExchange
OpenSemaphoreW
LocalFree
ReleaseSemaphore
CompareFileTime
GetPrivateProfileSectionNamesW
GetPrivateProfileStringA
MulDiv
GetCurrentThread
GetModuleHandleExW
SetCurrentDirectoryW
SetEvent
CreateEventW
ResetEvent
OpenMutexW
TerminateThread
DisconnectNamedPipe
WaitNamedPipeW
ConnectNamedPipe
CreateNamedPipeW
CreateThread
HeapFree
HeapAlloc
GetProcessHeap
InterlockedDecrement
FindFirstFileW
ProcessIdToSessionId
HeapWalk
HeapLock
HeapUnlock
AreFileApisANSI
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
lstrcmpiA
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
GetModuleFileNameA
GetStdHandle
FatalAppExitA
HeapCreate
TlsAlloc
IsValidCodePage
GetOEMCP
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
GetStartupInfoW
ExitProcess
VirtualQuery
GetSystemInfo
VirtualProtect
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
GetSystemTimeAsFileTime
lstrcmpA
FreeResource
GetSystemWindowsDirectoryW
lstrlenA
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedIncrement
FindClose
WideCharToMultiByte
LoadLibraryA
InitializeCriticalSection
GetACP
GetLogicalDriveStringsW
QueryDosDeviceW
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
SetLastError
GetCurrentProcess
FlushInstructionCache
RaiseException
lstrcmpW
GetModuleHandleA
OutputDebugStringW
CopyFileW
GetModuleFileNameW
GetPrivateProfileStringW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
CreateProcessW
WriteFile
SetFilePointer
GetVersion
GetSystemDirectoryW
lstrcmpiW
LoadLibraryExW
MultiByteToWideChar
FreeLibrary
GetFileSizeEx
DeleteCriticalSection
GetCurrentThreadId
LoadLibraryW
GetProcAddress
GetModuleHandleW
CreateMutexW
GetLastError
GetPrivateProfileIntW
GetCurrentProcessId
WritePrivateProfileSectionW
GetWindowsDirectoryW
CreateDirectoryW
WritePrivateProfileStringW
DeleteFileW
CreateFileW
GetFileSize
ReadFile
CloseHandle
GetPrivateProfileSectionW
GetTickCount
GetVersionExW
GetLongPathNameW
LeaveCriticalSection
EnterCriticalSection
lstrlenW

user32

GetWindowRgn
EqualRect
IsIconic
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ChildWindowFromPoint
GetDC
PrintWindow
SendMessageTimeoutW
FindWindowW
SendMessageW
UnregisterClassA
SetParent
MonitorFromPoint
PostMessageW
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
DestroyWindow
ShowWindow
SetWindowLongW
CreateWindowExW
GetClassInfoExW
LoadCursorW
RegisterClassExW
CharNextW
CharLowerBuffW
WaitForInputIdle
SetForegroundWindow
GetWindowThreadProcessId
WindowFromPoint
GetSystemMetrics
SystemParametersInfoW
EnumThreadWindows
SetWindowPos
SwitchToThisWindow
BringWindowToTop
GetWindowRect
EnumDisplaySettingsW
MessageBoxW
GetParent
GetWindowLongW
CallNextHookEx
ReleaseCapture
SetCapture
UnhookWindowsHookEx
PostQuitMessage
SetCursor
mouse_event
SetWindowsHookExW
InflateRect
ClientToScreen
DrawIconEx
GetActiveWindow
LoadIconW
OffsetRect
GetDesktopWindow
GetWindowDC
ReleaseDC
InvalidateRect
IsWindowVisible
GetClassNameW
GetWindowTextW
SetLayeredWindowAttributes
IsWindow
CallWindowProcW
MoveWindow
SetWindowTextW
PtInRect
SetFocus
KillTimer
SetTimer
GetCursorPos
ScreenToClient
CopyRect
GetWindow
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
GetClientRect
EndDialog
DialogBoxParamW
SetWindowRgn

gdi32

GetDeviceCaps
SetDIBColorTable
StretchBlt
SetBrushOrgEx
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateRectRgn
BitBlt
GetObjectW
GetDIBits
DeleteObject
CreateRoundRectRgn
SetStretchBltMode
StretchDIBits
GetRgnBox
GetTextExtentPoint32W
SelectObject
DeleteDC

advapi32

RegOpenKeyExA
IsValidSid
EqualSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AdjustTokenPrivileges
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
DuplicateTokenEx
AllocateAndInitializeSid
GetLengthSid
SetTokenInformation
CreateProcessAsUserW
FreeSid
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetUserNameW
OpenThreadToken
ControlService
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
SetEntriesInAclW
RegQueryValueExA
RegEnumKeyExA
LookupPrivilegeValueW

shell32

SHGetFolderPathW
ExtractIconExW
ShellExecuteExW
CommandLineToArgvW
SHChangeNotify
ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoCreateGuid

oleaut32

VariantClear
SysStringLen
VarBstrCat
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
VariantInit
DispCallFunc
SysFreeString
SysAllocString
VarUI4FromStr
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo

shlwapi

StrToIntExW
StrTrimA
SHDeleteValueW
SHDeleteKeyW
PathGetArgsW
SHSetValueA
PathFindExtensionW
PathRemoveExtensionW
wnsprintfW
PathUnquoteSpacesW
SHGetValueA
StrStrIA
StrStrIW
PathFileExistsW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathRemoveBackslashW
SHGetValueW
SHSetValueW
PathCombineW
PathAppendW
StrCmpIW
StrCmpNIW
StrCmpNW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

imm32

ImmDisableIME

gdiplus

GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipAlloc
GdipSaveImageToFile
GdipDisposeImage
GdipFree
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCloneImage

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

ws2_32

select

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a726184da50465af5c2b4377e699acf1

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

04:e9:4c:53:07:39:33:a7:30:33:61:fa:1f:66:a7:cbCertificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

7b:b4:3f:67:c2:a8:b5:24:ed:37:34:bf:37:2b:e3:1c:55:65:63:2f:f6:23:df:8b:9d:59:f1:6a:50:85:55:21Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

imm32

gdiplus

wintrust

crypt32

ws2_32

iphlpapi

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 133KB - Virtual size: 133KB

.data Size: 18KB - Virtual size: 39KB

.rsrc Size: 64KB - Virtual size: 64KB

.reloc Size: 35KB - Virtual size: 34KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

04:e9:4c:53:07:39:33:a7:30:33:61:fa:1f:66:a7:cb
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

7b:b4:3f:67:c2:a8:b5:24:ed:37:34:bf:37:2b:e3:1c:55:65:63:2f:f6:23:df:8b:9d:59:f1:6a:50:85:55:21
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 133KB - Virtual size: 133KB

.data
Size: 18KB - Virtual size: 39KB

.rsrc
Size: 64KB - Virtual size: 64KB

.reloc
Size: 35KB - Virtual size: 34KB