app[.]com | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
app.com
Size 1.5MB
Sample240508-wcl8hsfg21
SHA256 ca066896a28840f4eccb9150adf86170d83337650d28b128cb584e7d8b178695
MD5 bd3231011448b2d6a335032d11c12cad
SHA1 b14bdeccca499668fac5049890bb7f3e5bef9537
SHA512 4fdf90883f5fde3aeb02b2ddc46c5e3cd421fe98697aca0d31b1aaea39598d2624c3339ab75a96997287c611a7d4dd8459b1c3341fe972cf049885d22c31f3de
SSDEEP 24576:U7fGyyeUW7jK9ijzqPoKQ+2L7uUgtAsjxy5U2dTfUpHkKBdsQM+WAM7W:OfFU2m9ijzWoK0zgtAsI5U2dTfAHowQW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
app.com

File Explorer

app.com

.exe 1.5MB

app.com

IMPHASH 1f89da72ad2cf6929f70a5df4780ced9
SHA256 ca066896a28840f4eccb9150adf86170d83337650d28b128cb584e7d8b178695
MD5 bd3231011448b2d6a335032d11c12cad
SHA1 b14bdeccca499668fac5049890bb7f3e5bef9537
SHA512 4fdf90883f5fde3aeb02b2ddc46c5e3cd421fe98697aca0d31b1aaea39598d2624c3339ab75a96997287c611a7d4dd8459b1c3341fe972cf049885d22c31f3de
SSDEEP 24576:U7fGyyeUW7jK9ijzqPoKQ+2L7uUgtAsjxy5U2dTfUpHkKBdsQM+WAM7W:OfFU2m9ijzWoK0zgtAsI5U2dTfAHowQW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

717820

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\317196\out\Release\PatchUp.pdb

kernel32

GlobalAlloc TerminateProcess SetEvent SystemTimeToTzSpecificLocalTime SetFilePointer SetPriorityClass DeviceIoControl SetCurrentDirectoryW GetUserDefaultUILanguage GetFileType OpenProcess SetUnhandledExceptionFilter GetLocalTime GetSystemTimeAsFileTime DeleteFileW GetSystemDirectoryW LocalAlloc ReadFile CreateFileW FileTimeToSystemTime GetModuleHandleA GetTimeZoneInformation CreateProcessW LocalFree GetPrivateProfileStringW GlobalFree CreateMutexW WaitForSingleObject CreateRemoteThread GetVersion GetTempPathW InterlockedCompareExchange Sleep GlobalLock DeleteAtom FindAtomW AddAtomW OpenThread GetAtomNameW GetFileSizeEx SetFilePointerEx LocalFileTimeToFileTime FormatMessageW GetModuleFileNameW lstrcmpiA lstrcmpA SetEnvironmentVariableA CompareStringW CompareStringA GlobalUnlock SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW InitializeCriticalSectionAndSpinCount FlushFileBuffers GetConsoleMode GetConsoleCP GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID QueryPerformanceCounter GetStartupInfoA SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetDateFormatA GetTimeFormatA HeapCreate GetModuleFileNameA GetStdHandle IsValidCodePage GetOEMCP GetACP TlsFree TlsSetValue TlsAlloc TlsGetValue LCMapStringW LCMapStringA GetCPInfo GetStringTypeW RtlUnwind GetStartupInfoW VirtualQuery IsDebuggerPresent UnhandledExceptionFilter ExitThread GetTempFileNameW GetShortPathNameW SystemTimeToFileTime GetSystemTime OpenMutexW GetCommandLineW GetLongPathNameW InterlockedIncrement LoadLibraryExW lstrcmpiW lstrcmpW MulDiv WritePrivateProfileStringW WriteFile GetPrivateProfileSectionW GetPrivateProfileSectionNamesW ProcessIdToSessionId CreateEventW ReleaseMutex InterlockedDecrement lstrlenW GetFileSize VirtualProtect CreateFileA ExitProcess GetSystemInfo GetVersionExW FreeConsole GetCurrentProcessId GetModuleHandleW WideCharToMultiByte SetLastError RaiseException MultiByteToWideChar GetTickCount DeleteCriticalSection CloseHandle CreateThread InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetCurrentThreadId FlushInstructionCache GetCurrentProcess FreeLibrary LoadLibraryW GetLastError FindResourceExW FindResourceW LoadResource LockResource TerminateThread lstrlenA InterlockedExchange VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy SizeofResource OutputDebugStringW GetProcAddress

user32

SetRectEmpty SetWindowLongW GetWindowLongW DefWindowProcW CallWindowProcW IsWindow PostThreadMessageW DestroyWindow PostMessageW GetMessageW TranslateMessage DispatchMessageW RegisterClassExW GetClassInfoExW LoadCursorW CreateWindowExW MonitorFromPoint GetMonitorInfoW AllowSetForegroundWindow GetForegroundWindow GetWindowThreadProcessId AttachThreadInput SetForegroundWindow SetActiveWindow SetFocus GetKeyboardState keybd_event GetWindowRect GetDesktopWindow LoadStringW UnregisterClassA FindWindowW MonitorFromRect SetWindowPos SendMessageW InvalidateRect UpdateWindow MessageBoxW GetActiveWindow ShowWindow GetClientRect GetParent IsDialogMessageW RegisterWindowMessageW MapWindowPoints MonitorFromWindow GetWindow IsWindowVisible CopyRect KillTimer SetTimer PostQuitMessage BringWindowToTop SwitchToThisWindow ReleaseDC GetDC ScreenToClient CharNextW PeekMessageW DestroyAcceleratorTable InvalidateRgn FillRect ReleaseCapture SetCapture MoveWindow ClientToScreen CreateAcceleratorTableW RedrawWindow GetSysColor GetClassNameW GetDlgItem GetFocus IsChild EndPaint BeginPaint SetWindowTextW GetWindowTextW GetWindowTextLengthW GetMessagePos PtInRect EnableWindow LoadImageW GetSystemMetrics SystemParametersInfoW GetCursorPos CreatePopupMenu DestroyMenu TrackPopupMenu InsertMenuItemW SendMessageTimeoutW GetClassLongW SetClassLongW GetWindowPlacement DrawTextW GetWindowDC SetScrollInfo GetScrollInfo SetScrollPos GetDlgCtrlID SetCursor HideCaret IsWindowEnabled InflateRect IsRectEmpty GetKeyState OffsetRect

gdi32

GetPixel GetObjectA CreateFontW SetTextColor SetBkColor SetViewportOrgEx GetTextMetricsW CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteObject BitBlt DeleteDC GetStockObject GetObjectW GetDeviceCaps GetTextExtentPoint32W

advapi32

RegCloseKey RegQueryValueExA GetUserNameW LookupAccountNameW GetSidSubAuthorityCount GetSidIdentifierAuthority IsValidSid RegDeleteValueW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW ChangeServiceConfigW CloseServiceHandle QueryServiceConfigW OpenServiceW OpenSCManagerW RegCreateKeyA GetSidSubAuthority RegCreateKeyExW RegSetValueExW OpenProcessToken RegQueryValueExW RegOpenKeyExW RegOpenKeyExA RegEnumKeyExA

shell32

SHGetDiskFreeSpaceExW CommandLineToArgvW ShellExecuteW Shell_NotifyIconW SHGetPathFromIDListW SHBrowseForFolderW ord680 SHGetSpecialFolderPathW SHGetFolderPathW ord165

ole32

RevokeDragDrop CoUninitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitialize OleInitialize OleUninitialize StringFromGUID2 OleLockRunning CreateStreamOnHGlobal CoGetClassObject CLSIDFromProgID CLSIDFromString

oleaut32

VarBstrCmp SafeArrayUnlock SysFreeString SysAllocString SysStringLen VariantInit VariantClear DispCallFunc VarUI4FromStr OleCreateFontIndirect LoadRegTypeLi LoadTypeLi SysAllocStringLen SafeArrayGetVartype SafeArrayCopy VariantCopy SafeArrayGetLBound SafeArrayGetUBound SafeArrayCreate SafeArrayDestroy SafeArrayLock

shlwapi

SHGetValueA SHSetValueA SHSetValueW SHDeleteValueW PathIsRelativeW StrCmpIW PathCompactPathW StrStrIW wnsprintfW ColorRGBToHLS ColorHLSToRGB PathStripPathW ord437 StrCmpNIW PathAppendW PathFindFileNameW PathIsDirectoryW PathFileExistsW PathRemoveFileSpecW PathCombineW SHGetValueW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipSaveImageToFile GdipAddPathArc GdipSetSmoothingMode GdipGetSmoothingMode GdipGetImageEncoders GdipCreatePath GdipGetImageEncodersSize GdipSetInterpolationMode GdipCreateSolidFill GdipAddPathLine GdipAddPathPie GdipGetPathWorldBoundsI GdipAddPathLine2 GdipCreatePen1 GdipFillPath GdipDeletePath GdipFillRectangleI GdipCloneBrush GdipAlloc GdipFree GdipDeleteBrush GdipCreateLineBrushFromRectI GdipDeletePen GdipDrawPath GdipDrawRectangle GdipDrawImagePointRectI GdipResetWorldTransform GdipRotateWorldTransform GdipTranslateWorldTransform GdipPrivateAddMemoryFont GdipDeletePrivateFontCollection GdipNewPrivateFontCollection GdipDrawLine GdipAddPathEllipseI GdipGetPathGradientPointCount GdipSetPathGradientSurroundColorsWithCount GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipCreateFromHWND GdipDrawString GdipGetFontHeight GdipFillRectangle GdipResetClip GdipSetClipRectI GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipSetTextRenderingHint GdipMeasureString GdipDeleteStringFormat GdipCreateStringFormat GdipDeleteFont GdipCreateFont GdipGetFontCollectionFamilyList GdipCloneFontFamily GdipDeleteFontFamily GdipSetLinePresetBlend GdipDrawLineI GdipCreatePen2 GdipDrawRectangleI GdipCreateLineBrushFromRect GdipAddPathRectangleI GdipGetPixelOffsetMode GdipSetPenWidth GdipDrawEllipseI GdipSetPenDashStyle GdipSetPenDashOffset GdipAddPathLineI GdipSetPixelOffsetMode GdipDrawImageRectI GdipGetImageGraphicsContext GdipGetImagePixelFormat GdipDisposeImage GdipCloneImage GdipCreateBitmapFromScan0 GdipDeleteGraphics GdipCreateFromHDC GdipClosePathFigure GdipBitmapSetPixel GdipBitmapGetPixel GdipDrawImageRectRectI GdipGetImageHeight GdipAddPathArcI GdipResetPath GdipSetPathGradientCenterPoint GdipSetPathGradientGammaCorrection GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipGetImageWidth

psapi

GetModuleFileNameExW

wininet

DeleteUrlCacheEntryW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

userenv

GetUserProfileDirectoryW

netapi32

Netbios

urlmon

URLDownloadToCacheFileW