0e4fa7a1bf1180ffdcec47329063ac2fe78889f772007cc7642eaf7c949244c3

Sharing

Copy URL Twitter E-mail

General

Target

0e4fa7a1bf1180ffdcec47329063ac2fe78889f772007cc7642eaf7c949244c3
Size

2.0MB
MD5

f20fe0b09ff040ed1ee70e2e2530fb11
SHA1

bc5f61025e14f70fad0d6834aff5edb052ef4d02
SHA256

0e4fa7a1bf1180ffdcec47329063ac2fe78889f772007cc7642eaf7c949244c3
SHA512

b4d480586e2d466a219339ccf94e3b58db619994bcf2baaea4fef29f7a1d8b3a9c6c3811b218ea531a211753396040822c3fef65078fea24a86a1fb6b7a52f7b
SSDEEP

24576:vbQ8Ev07+55O4atr0zAiX90z/F0jsFB3SQk:v8t07n4aB0zj0yjoB2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e4fa7a1bf1180ffdcec47329063ac2fe78889f772007cc7642eaf7c949244c3

Files

0e4fa7a1bf1180ffdcec47329063ac2fe78889f772007cc7642eaf7c949244c3
.exe windows:10 windows x64 arch:x64

888742b8dd20542042b35143c687bdb7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

vssagent.pdb

Imports

advapi32

OpenEventLogW
ReadEventLogW
CloseEventLog
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
ControlService
CloseServiceHandle
ConvertSidToStringSidW
OpenThreadToken
GetTokenInformation
DeregisterEventSource
RegDeleteTreeW
RegQueryValueExW
ReportEventW
RegisterEventSourceW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceEvent
OpenProcessToken

kernel32

GetSystemInfo
GlobalMemoryStatusEx
QueryDosDeviceW
CloseHandle
CreateFileW
GetVolumeNameForVolumeMountPointW
FindFirstVolumeW
FindNextVolumeW
GetDriveTypeW
GetVolumePathNameW
GetDiskFreeSpaceExW
GetVolumeInformationW
FindVolumeClose
CopyFileW
GetFullPathNameW
ExpandEnvironmentStringsW
FindFirstFileW
FindNextFileW
GetSystemTimeAsFileTime
WideCharToMultiByte
WriteFile
LoadLibraryExW
FindClose
LeaveCriticalSection
EnterCriticalSection
GetVersionExW
SetConsoleCtrlHandler
GetModuleHandleW
InitializeCriticalSection
SetFilePointer
ReadFile
DeleteCriticalSection
CreateMutexW
ReleaseMutex
GetStdHandle
GetConsoleMode
SetConsoleMode
FreeLibrary
GetProcAddress
lstrcmpiW
lstrcpynW
VirtualProtect
VirtualAlloc
GetCurrentProcess
SizeofResource
LoadResource
FindResourceExW
lstrcpyW
Sleep
HeapDestroy
ReleaseSRWLockShared
InitializeSRWLock
GetCurrentThread
GetSystemTime
TlsFree
TlsGetValue
TlsAlloc
OutputDebugStringW
TlsSetValue
lstrlenW
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
OutputDebugStringA
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetComputerNameExW
GetWindowsDirectoryW
GetModuleFileNameW
DeleteFileW
AcquireSRWLockShared
MultiByteToWideChar
LocalAlloc
GetTimeFormatW
GetThreadLocale
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFree
GetLastError
DeviceIoControl
GetNativeSystemInfo
VirtualQuery
IsWow64Process
FormatMessageW
GetCommandLineW
HeapSetInformation
GetTickCount

msvcrt

_unlock
memcpy
__dllonexit
_onexit
_lock
memcmp
_vsnprintf
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_commode
_fmode
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_wtoi
wcscpy_s
wcscat_s
malloc
__C_specific_handler
fflush
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
memcpy_s
iswalnum
qsort
free
realloc
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
_purecall
wcsncmp
_wcsicmp
wcschr
iswspace
_vsnwprintf
wprintf
__CxxFrameHandler3
memset
_CxxThrowException
__iob_func
_wcsnicmp
wcscmp

ole32

CoResumeClassObjects
CoRegisterClassObject
CoTaskMemRealloc
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CLSIDFromString
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoRevokeClassObject

user32

CharNextW
KillTimer
SetTimer
UnregisterDeviceNotification
RegisterDeviceNotificationW
PostMessageW
FindWindowW
DestroyWindow
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
RegisterClassW
DefWindowProcW
UnregisterClassW
LoadStringW
CharPrevW

oleaut32

VariantClear
VarUI4FromStr
GetErrorInfo
VariantChangeType
SysAllocString
SysStringLen
SysFreeString
RegisterTypeLi
LoadTypeLi

rpcrt4

RpcStringFreeW
UuidToStringW

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

shlwapi

PathFileExistsW

setupapi

SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiCreateDeviceInfoList
SetupDiOpenDeviceInterfaceW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces

vssapi

CreateVssBackupComponentsInternal

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

clusapi

OpenCluster
CloseCluster

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW

Sections

.text
Size: 327KB - Virtual size: 327KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

888742b8dd20542042b35143c687bdb7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

ole32

user32

oleaut32

rpcrt4

ntdll

shlwapi

setupapi

vssapi

version

clusapi

api-ms-win-security-lsalookup-l1-1-0

Sections

.text Size: 327KB - Virtual size: 327KB

.rdata Size: 160KB - Virtual size: 159KB

.data Size: 5KB - Virtual size: 140KB

.pdata Size: 10KB - Virtual size: 9KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 1.5MB - Virtual size: 1.5MB

.text
Size: 327KB - Virtual size: 327KB

.rdata
Size: 160KB - Virtual size: 159KB

.data
Size: 5KB - Virtual size: 140KB

.pdata
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 1.5MB - Virtual size: 1.5MB